Pursuant to Article 35, paragraph 1, subparagraph 1.1, and Article 65, paragraphs 1 and 2, of Law No.
03/L-209 on the Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No. 77/16 August 2010, Prishtina), as amended and supplemented by Law No. 05/L-150 on the Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No. 10/03 April 2017),
Article 8, paragraph 1, of Law No. 08/L-304 on Banks, Article 114 of Law No. 04/L-093 on Banks,
Microfinance Institutions and Non-Bank Financial Institutions (Official Gazette of the Republic of Kosovo, No. 11/11 May 2012, Prishtina), Article 34 of Law No. 08/L-295 on Crypto-Assets (Official Gazette of the Republic of Kosovo, No. 21/22 November 2024, Prishtina), Article 136 of the Law on Payment Services (Official Gazette of the Republic of Kosovo, No. 10/14 May 2026, Prishtina), Article 66, paragraph 2, of Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing (Official Gazette of the Republic of Kosovo, No. 18/15 June 2016, Prishtina), and Article 21 of Law No. 11/L-017 Amending and Supplementing Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing, the Board of the Central Bank of the Republic of Kosovo, at its meeting held on 27 October 2026, adopted the following:

REGULATION ON INFORMATION ACCOMPANYING TRANSFERS OF FUNDS AND CRYPTO-ASSETS

CHAPTER I GENERAL PROVISIONS

Article 1 Purpose

This Regulation establishes requirements concerning information on the payer and the payee accompanying transfers of funds, in any currency, and information on the originator and the beneficiary accompanying transfers of crypto-assets, for the purposes of preventing, detecting and investigating money laundering and terrorist financing, where at least one of the payment service providers or crypto-asset service providers involved in the transfer of funds or crypto-assets is licensed in Kosovo. This Regulation also establishes rules on internal policies, procedures and controls to ensure the implementation of AML/CFT measures where at least one of the payment service providers or crypto-asset service providers involved in the transfer of funds or crypto-assets is licensed in Kosovo.

Article 2 Scope

1. This Regulation applies to payment service providers and their branches licensed in Kosovo that send or receive transfers of funds in any currency. This Regulation also applies to transfers of crypto-assets, including those executed through crypto-ATMs, where the originator’s or

BANKA QENDRORE E REPUBLIKËS SË KOSOVËS
CENTRALNA BANKA REPUBLIKE KOSOVO
CENTRAL BANK OF THE REPUBLIC OF KOSOVO

beneficiary’s crypto-asset service provider, or an intermediary crypto-asset service provider, is licensed domestically.

2. This Regulation shall not apply to the services listed in Article 3, subparagraphs 1.1 to 1.13 and subparagraph 1.15, of the Law on Payment Services.

3. This Regulation shall not apply to transfers of funds or transfers of electronic money tokens carried out using a payment card, an electronic payment instrument, a mobile phone or any other prepaid or postpaid technological device with similar characteristics, provided that the following conditions are met:

3.1. the card, instrument or device is used exclusively to pay for goods and services;

3.2. the number of the card, instrument or device accompanies all transfers arising from the transaction.

4. Notwithstanding paragraph 3 of this Article, this Regulation shall apply where a payment card, an electronic payment instrument, a mobile phone or any other prepaid or postpaid technological device with similar characteristics is used to carry out a transfer of funds or electronic money tokens between natural persons acting as consumers for purposes other than their trade, business or profession.

5. This Regulation shall not apply to persons whose sole activity is converting paper documents into electronic data under a contract with a payment service provider, or to persons whose sole activity is providing payment service providers with messaging or other support systems for transmitting funds, or with clearing and settlement systems.

6. This Regulation shall not apply to transfers of funds where one of the following conditions is met:

6.1. the transfer involves the payer withdrawing cash from the payer’s own payment account;

6.2. the transfer constitutes a transfer of funds to a public authority as payment of taxes, fines or other levies domestically;

6.3. the payer and the payee are payment service providers acting on their own behalf;

6.4. the transfer is carried out through an exchange of cheque images.

7. This Regulation shall not apply to transfers of crypto-assets where one of the following conditions is met:

7.1. the originator and the beneficiary are crypto-asset service providers acting on their own behalf;

7.2. the transfer constitutes a person-to-person transfer of crypto-assets without the involvement of a crypto-asset service provider.

Article 3 Definitions

1. All terms and expressions used in this Regulation shall have the same meaning as the terms defined in Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing, Law No. 11/L-017 Amending and Supplementing Law No. 05/L-096 on AML/CFT, and Law No. 10/L-026 on Payment Services, and/or the following definitions for the purposes of this Regulation:

1.1. Terrorist financing – has the meaning defined in the applicable AML/CFT legislation;

1.2. Money laundering – has the meaning defined in the applicable AML/CFT legislation;

1.3. CBK – the Central Bank of the Republic of Kosovo;

1.4. FIU-K – the Financial Intelligence Unit of Kosovo;

1.5. Law on AML/CFT – means Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing, as amended and supplemented by Law No. 11/L-017;

1.6. Payer – means a person who holds a payment account and authorises a transfer of funds from that payment account or, where there is no payment account, gives a transfer of funds order;

1.7. Payee or beneficiary – means a person who is the intended recipient of a transfer of funds or crypto-assets;

1.8. Payment service provider (PSP) – means any financial institution licensed, registered or authorised under the applicable laws and regulations to provide funds transfer services;

1.9. Intermediary payment service provider – means a PSP that is neither the payer’s nor the payee’s PSP and that receives and transmits a transfer of funds on behalf of the payer’s or the payee’s PSP or another intermediary PSP;

1.10. Payment account – means an account held in the name of one or more payment service users which is used for executing payment transactions;

1.11. Funds – means banknotes and coins, cash or electronic money;

1.12. Transfer of funds – means any transaction carried out at least partly by electronic means on behalf of a payer through a PSP, with a view to making funds available to a payee, irrespective of whether the payer and the payee are the same person and irrespective of whether the payer’s and the payee’s PSP are one and the same, including:

1.12.1. a credit transfer;

1.12.2. a direct debit;

1.12.3. money remittance;

1.12.4. a transfer carried out using a payment card, an electronic payment instrument, a mobile phone or another prepaid or postpaid electronic device with similar characteristics;

1.13. Transfer of crypto-assets – means any transaction intended to move crypto-assets from one distributed ledger address, crypto-asset account or other device allowing the storage of crypto-assets to another, carried out by at least one crypto-asset service provider acting on behalf of an originator or a beneficiary, irrespective of whether the originator and the beneficiary are the same person and irrespective of whether the originator’s and the beneficiary’s crypto-asset service provider is the same;

1.14. Batch file transfer of funds – means a bundle of several individual transfers of funds grouped together for transmission;

1.15. Unique transaction identifier – means a combination of letters, numbers or symbols determined by the PSP in accordance with the protocols of the payment and settlement systems or messaging systems used for the transfer of funds, which allows the transaction to be traced back to the payer and the payee;

1.16. Person-to-person transfer of crypto-assets – means a transfer of crypto-assets without the involvement of any crypto-asset service provider;

1.17. Crypto-asset – has the meaning defined in the Law on Crypto-Assets;

1.18. Crypto-asset service provider – has the meaning defined in Article 2, paragraph 1.54, of the Law on AML/CFT;

1.19. Intermediary crypto-asset service provider – means a crypto-asset service provider that is neither the originator’s nor the beneficiary’s crypto-asset service provider and that receives and transmits a transfer of crypto-assets of the originator or beneficiary, or of another intermediary crypto-asset service provider;

1.20. Crypto-ATM – means physical or online electronic terminals enabling a crypto-asset service provider to carry out, in particular, transfer services for crypto-assets;

1.21. Distributed ledger technology (DLT) address – means an alphanumeric code identifying an address on a network using distributed ledger technology (DLT) or similar technology to which crypto-assets can be sent or from which they can be received;

1.22. Crypto-asset account – means an account held by a crypto-asset service provider in the name of one or more natural or legal persons that can be used to carry out transfers of crypto-assets;

1.23. Self-hosted address – means a DLT address that is not linked to:

1.23.1. a crypto-asset service provider;

1.23.2. an entity established abroad providing services similar to those of crypto-asset service providers;

1.24. Originator – means a person who holds a crypto-asset account with a crypto-asset service provider, a distributed ledger technology address or a device allowing the storage of crypto-assets, and authorises a transfer of crypto-assets from that account, distributed ledger technology address or device, or, where there is no such account, distributed ledger technology address or device, a person who orders or initiates a transfer of crypto-assets;

1.25. DLT (Distributed Ledger Technology) – has the meaning defined in the Law on Crypto-Assets;

1.26. Legal entity identifier or “LEI” – means a unique alphanumeric reference code based on the ISO 17442 standard assigned to a legal entity;

1.27. SEPA – means the Single Euro Payments Area;

1.28. Legal person identifier – means a unique code based on the ISO 17442 standard assigned to a legal person;

1.29. Money remittance – means a payment service where funds are received from a payer, without any payment account being opened in the name of the payer or the payee, for the sole purpose of transferring a corresponding amount to a recipient or another payment service provider acting on behalf of the payee, and/or where such funds are received on behalf of and made available to the payee;

1.30. Electronic money token – means a type of crypto-asset that purports to maintain a stable value by reference to the value of one official currency.

CHAPTER II OBLIGATIONS OF PAYMENT SERVICE PROVIDERS

SUBCHAPTER I OBLIGATIONS OF THE PAYER’S PAYMENT SERVICE PROVIDER

Article 4 Information accompanying transfers of funds

1. The payer’s payment service provider shall ensure that transfers of funds are accompanied by the following information on the payer:

1.1. the payer’s name;

1.2. the payer’s payment account number;

1.3. the payer’s address, including the country name, official personal identification document number and customer identification number or date and place of birth;

1.4. subject to the existence of the necessary field in the relevant payment message format, and where provided by the payer to their payment service provider, the payer’s current LEI or, in its absence, any available equivalent official identifier.

2. The payer’s payment service provider shall ensure that transfers of funds are accompanied by the following information on the payee:

2.1. the payee’s name;

2.2. the payee’s payment account number;

2.3. subject to the existence of the necessary field in the relevant payment message format, and where provided by the payer to their payment service provider, the payee’s current LEI or, in its absence, any available equivalent official identifier.

3. By way of derogation from subparagraph 1.2 of paragraph 1 and subparagraph 2.2 of paragraph 2 of this Article, where a transfer is not made to or from a payment account, the payer’s payment service provider shall ensure that the transfer of funds is accompanied by a unique transaction identifier.

4. Before transferring funds, the payer’s payment service provider shall verify the accuracy of the information referred to in paragraph 1 of this Article and, where applicable, paragraph 3 of this Article, on the basis of documents, data or information obtained from a reliable and independent source.

5. The verification referred to in paragraph 4 of this Article shall be deemed to have taken place where one of the following applies:

5.1. The payer’s identity has been verified in accordance with the customer due diligence provisions laid down in the applicable AML/CFT legislation, and the information obtained through that verification has been retained in accordance with Article 64 of the Law on AML/CFT.

5.2. The provisions of paragraph 1.4 of Article 19 of the Law on AML/CFT apply to the payer.

6. Without prejudice to the derogations provided for in Articles 5 and 6 of this Regulation, the payer’s payment service provider shall not execute any transfer of funds before ensuring full compliance with this Article.

Article 5 Domestic transfers of funds

1. By way of derogation from paragraphs 1 and 2 of Article 4 of this Regulation, where all payment service providers involved in the payment chain operate in Kosovo, transfers of funds shall be accompanied by at least the payment account numbers of both the payer and the payee or, where paragraph 3 of Article 4 of this Regulation applies, the unique transaction identifier.

2. Notwithstanding paragraph 1 of this Article, the payer’s payment service provider shall, within three working days of receiving a request for information from the payee’s payment service provider or an intermediary payment service provider, make available the following:

2.1. for transfers of funds exceeding EUR 1,000, whether carried out in a single transaction or in several transactions that appear to be linked, the information on the payer or the payee in accordance with Article 4 of this Regulation;

2.2. for transfers of funds not exceeding EUR 1,000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1,000, at least:

2.2.1. the names of the payer and the payee;

2.2.2. the payment account numbers of the payer and the payee or, where paragraph 3 of Article 4 applies, the unique transaction identifier.

    3. By way of derogation from paragraph 4 of Article 4 of this Regulation, for the transfers of funds referred to in paragraph 2.2 of this Article, the payer’s payment service provider need not verify the information on the payer unless the payer’s payment service provider:

3.1. has received the funds to be transferred in cash or anonymous electronic money; or

3.2. has reasonable grounds to suspect money laundering or terrorist financing.

Article 6 Transfers of funds abroad

1. For batch file transfers of funds from a single payer where the payees’ payment service providers are abroad, paragraph 1 of Article 4 shall not apply to the individual transfers of funds bundled together, provided that the batch file contains the information referred to in paragraphs 1, 2 and 3 of Article 4 of this Regulation, that this information has been verified in accordance with paragraphs 4 and 5 of Article 4 of this Regulation, and that the individual transfers carry the payer’s payment account number or, where paragraph 3 of Article 4 of this Regulation applies, the unique transaction identifier.

2. By way of derogation from paragraph 1 of Article 4 and, where applicable, without prejudice to the information required under the CBK Regulation Establishing Requirements for Credit Transfers and Direct Debits in Euro, funds not exceeding EUR 1,000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1,000 shall be accompanied by at least:

2.1. the names of the payer and the payee;

2.2. the payment account numbers of the payer and the payee or, where paragraph 3 of Article 4 of this Regulation applies, the unique transaction identifier.

3. By way of derogation from paragraph 4 of Article 4 of this Regulation, the payer’s payment service provider need not verify the information on the payer referred to in this paragraph unless the payer’s payment service provider:

3.1. has received the funds to be transferred in cash or anonymous electronic money; or

3.2. has reasonable grounds to suspect money laundering or terrorist financing.

SUBCHAPTER II OBLIGATIONS OF THE PAYEE’S PAYMENT SERVICE PROVIDER

Article 7 Detection of missing information on the payer or the payee

1. The payee’s payment service provider shall implement effective procedures to detect whether the fields relating to information on the payer and the payee in the messaging or payment and settlement system used to carry out the transfer of funds have been completed using characters or inputs admissible under that system’s conventions.

2. The payee’s payment service provider shall implement effective procedures, including, where appropriate, monitoring after or during transfers of funds, to detect whether the following information on the payer or the payee is missing:

2.1. for transfers of funds where the payer’s payment service provider is located domestically, the information referred to in Article 5 of this Regulation;

2.2. for transfers of funds where the payer’s payment service provider is abroad, the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 of Article 4 of this Regulation and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation;

2.3. for batch file transfers of funds where the payer’s payment service provider is located abroad, the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 of Article 4 of this Regulation and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation.

3. For transfers of funds exceeding EUR 1,000, whether carried out in a single transaction or in several transactions that appear to be linked, the payee’s payment service provider shall, before crediting the payee’s payment account or making the funds available to the payee, verify the accuracy of the information on the payee referred to in paragraph 2 of this Article on the basis of documents, data or information obtained from a reliable and independent source and, where regulated by domestic legislation, without prejudice to the requirements concerning execution time and the transaction’s value date.

4. For transfers of funds not exceeding EUR 1,000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1,000, the payee’s payment service provider need not verify the accuracy of the information on the payee unless it:

4.1. effects the payment of funds in cash or anonymous electronic money; or

4.2. has reasonable grounds to suspect money laundering or terrorist financing.

5. The verification referred to in paragraphs 3 and 4 of this Article shall be deemed to have taken place where one of the following applies:

5.1. The payee’s identity has been verified in accordance with the customer due diligence provisions laid down in the applicable AML/CFT legislation, and the information obtained through that verification has been retained in accordance with Article 64 of the Law on AML/CFT.

5.2. The provisions of paragraph 1.4 of Article 19 of the Law on AML/CFT apply to payees.

Article 8 Transfers of funds with missing or incomplete information on the payer or the payee

1. The payee’s payment service provider shall implement effective risk-based procedures, including procedures based on a risk-sensitive approach, to determine whether to execute, reject or suspend a transfer of funds lacking the complete required information on the payer and the payee, and to take appropriate follow-up action.

1.1. Where the payee’s payment service provider becomes aware, upon receiving a transfer of funds, that the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation, paragraph 1 of Article 5 of this Regulation, and Article 6 of this Regulation is missing or incomplete, or has not been completed using characters or inputs admissible under the conventions of the messaging or payment and settlement system referred to in paragraph 1 of Article 7 of this Regulation, the payee’s payment service provider shall, on a risk-sensitive basis:

1.1.1. reject the transfer of funds; or

1.1.2. request the required information on the payer and the payee before or after crediting the payee’s payment account or making the funds available to the payee.

2. Where a payment service provider repeatedly fails to provide the required information on the payer or the payee, the payee’s payment service provider shall:

2.1. take steps, which may initially include issuing warnings and setting deadlines, before proceeding to rejection, restriction or termination in accordance with subparagraph 2.2 of this Article if the required information has still not been provided; or

2.2. directly reject any future transfers of funds from that payment service provider, or restrict or terminate its business relationship with that payment service provider.

3. Pursuant to the preceding paragraph, the payee’s payment service provider shall report that failure and the steps taken to the CBK and FIU-K.

Article 9 Assessment and reporting by the payee’s payment service provider

The payee’s payment service provider shall take missing or incomplete information on the payer or the payee into account as a factor when assessing whether a transfer of funds, or any related transaction, is suspicious and whether it should be reported to FIU-K in accordance with the applicable AML/CFT legislation.

SUBCHAPTER III OBLIGATIONS OF INTERMEDIARY PAYMENT SERVICE PROVIDERS

Article 10 Retention of information on the payer and the payee accompanying the transfer

Intermediary payment service providers shall ensure that all information received on the payer and the payee accompanying a transfer of funds is retained with the transfer.

Article 11 Detection of missing information on the payer or the payee

1. The intermediary payment service provider shall implement effective procedures to detect whether the fields relating to information on the payer and the payee in the messaging or payment and settlement system used to carry out the transfer of funds have been completed using characters or inputs admissible under that system’s conventions.

2. The intermediary payment service provider shall implement effective procedures, including, where appropriate, monitoring after or during transfers of funds, to detect whether the following information on the payer or the payee is missing:

2.1. for transfers of funds where the payer’s and the payee’s payment service providers are located domestically, the information referred to in Article 5 of this Regulation;

2.2. for transfers of funds where the payer’s or the payee’s payment service provider is established abroad, the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation;

2.3. for batch file transfers of funds where the payer’s payment service provider is located abroad, the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation.

Article 12 Transfers of funds with missing information on the payer or the payee

1. The intermediary payment service provider shall establish effective risk-based procedures to determine whether to execute, reject or suspend a transfer of funds lacking the required information on the payer and the payee, and to take appropriate follow-up measures.

2. Where the intermediary payment service provider becomes aware, upon receiving a transfer of funds, that the information referred to in subparagraphs 1.1, 1.2 and 1.3 of paragraph 1 and subparagraphs 2.1 and 2.2 of paragraph 2 of Article 4 of this Regulation, paragraph 1 of Article 5 of this Regulation, or Article 6 of this Regulation is missing or incomplete, or has not been completed using characters or inputs admissible under the conventions of the messaging or payment and settlement system referred to in paragraph 1 of Article 7 of this Regulation, the intermediary payment service provider shall, on a risk-sensitive basis:

2.1. reject the transfer;

2.2. request information on the payer and the payee before or after transmitting the transfer of funds.

3. Where a payment service provider repeatedly fails to provide the required information on the payer or the payee, the intermediary payment service provider shall:

3.1. take steps, which may initially include issuing warnings and setting deadlines, before proceeding to rejection, restriction or termination in accordance with subparagraph 3.2 of this Article if the required information has still not been provided; or

3.2. directly reject any future transfers of funds from that payment service provider, or restrict or terminate its business relationship with that payment service provider.

3.3. Pursuant to the preceding paragraph, the intermediary payment service provider shall report that failure and the steps taken to the CBK and FIU-K.

Article 13 Assessment and reporting by intermediary payment service providers

The intermediary payment service provider shall take missing or incomplete information on the payer or the payee into account as a factor when assessing whether a transfer of funds, or any related transaction, is suspicious and whether it should be reported to FIU-K in accordance with the applicable AML/CFT legislation.

CHAPTER III OBLIGATIONS OF CRYPTO-ASSET SERVICE PROVIDERS

SUBCHAPTER I OBLIGATIONS OF THE ORIGINATOR’S CRYPTO-ASSET SERVICE PROVIDER

Article 14 Information accompanying transfers of crypto-assets

1. The originator’s crypto-asset service provider shall ensure that transfers of crypto-assets are accompanied by the following information on the originator:

1.1. the originator’s name;

1.2. the originator’s distributed ledger address where a transfer of crypto-assets is registered on a

network using DLT or similar technology, and the originator’s crypto-asset account number where such an account exists and is used to process the transaction;

1.3. the originator’s crypto-asset account number where a transfer of crypto-assets is not registered on a network using DLT or similar technology;

1.4. the originator’s address, including the country name, official personal identification document number and customer identification number or, alternatively, the originator’s date and place of birth;

1.5. subject to the existence of the necessary field in the relevant message format, and where provided by the originator to their crypto-asset service provider, the originator’s current LEI or, in its absence, any other available equivalent official identifier.

2. The originator’s crypto-asset service provider shall ensure that transfers of crypto-assets are accompanied by the following information on the beneficiary:

2.1. the beneficiary’s name;

2.2. the beneficiary’s distributed ledger address where a transfer of crypto-assets is registered on a network using DLT or similar technology, and the beneficiary’s crypto-asset account number where such an account exists and is used to process the transaction;

2.3. the beneficiary’s crypto-asset account number where a transfer of crypto-assets is not registered on a network using DLT or similar technology;

2.4. subject to the existence of the necessary field in the relevant message format, and where provided by the originator to their crypto-asset service provider, the beneficiary’s current LEI or, in its absence, any other available equivalent official identifier.

3. By way of derogation from subparagraph 1.3 of paragraph 1 and subparagraph 2.3 of paragraph 2 of this Article, where a transfer of crypto-assets is not registered on a network using DLT or similar technology and is not made to or from a crypto-asset account, the originator’s crypto-asset service provider shall ensure that the transfer of crypto-assets is accompanied by a unique transaction identifier.

4. The information referred to in paragraphs 1 and 2 of this Article shall be submitted before, simultaneously or concurrently with the transfer of crypto-assets, securely and in accordance with the provisions of the Law on Personal Data Protection.

5. The information referred to in paragraphs 1 and 2 of this Article need not be attached directly to, or included in, the transfer of crypto-assets.

6. For a transfer of crypto-assets to a self-hosted address, the originator’s crypto-asset service provider shall obtain and retain the information specified in paragraphs 1 and 2 of this Article and shall ensure that the transfer of crypto-assets is individually identifiable.

7. Without prejudice to the specific risk mitigation measures laid down in the applicable AML/CFT legislation, for a transfer exceeding EUR 1,000 to a self-hosted address, the originator’s crypto-asset service provider shall take adequate measures to assess whether that address is owned or controlled by the originator.

8. Before transferring crypto-assets, the crypto-asset service provider shall verify the accuracy of the information referred to in paragraph 1 of this Article on the basis of documents, data or information obtained from a reliable and independent source.

9. The verification referred to in paragraph 8 of this Article shall be deemed to have taken place where one of the following applies:

9.1. The originator’s identity has been verified in accordance with the customer due diligence provisions laid down in the applicable AML/CFT legislation, and the information obtained through that verification has been retained in accordance with Article 64 of the Law on AML/CFT and Law No. 11/L-017 Amending and Supplementing Law No. 05/L-096 on AML/CFT.

9.2. The provisions of paragraph 1.4 of Article 19 of the Law on AML/CFT apply to the originator.

10. The originator’s crypto-asset service provider shall not allow any transfer of crypto-assets to be initiated or executed before ensuring full compliance with this Article.

Article 15 Batch file transfers of crypto-assets

For batch file transfers of crypto-assets from a single originator, paragraph 1 of Article 14 of this Regulation shall not apply to the individual transfers bundled together therein, provided that the batch file transfer contains the information referred to in paragraphs 1, 2 and 3 of Article 14 of this Regulation, that this information has been verified in accordance with paragraphs 8 and 9 of Article 14 of this Regulation, and that the individual transfers contain the distributed ledger address where paragraph 2.2 of Article 14 applies, the originator’s crypto-asset account number where paragraph 2.3 of Article 14 of this Regulation applies, or the unique transaction identifier where paragraph 3 of Article 14 of this Regulation applies.

SUBCHAPTER II OBLIGATIONS OF THE BENEFICIARY’S CRYPTO-ASSET SERVICE PROVIDER

Article 16 Detection of missing information on the originator or the beneficiary

1. The beneficiary’s crypto-asset service provider shall implement effective procedures, including, where appropriate, monitoring after or during transfers, to detect whether the information on the originator and the beneficiary specified in paragraphs 1 and 2 of Article 14 of this Regulation is included in, or follows, the transfer or batch file transfer of crypto-assets.

2. For a transfer of crypto-assets from a self-hosted address, the beneficiary’s crypto-asset service provider shall obtain and retain the information referred to in paragraphs 1 and 2 of Article 14 of this Regulation and shall ensure that the transfer of crypto-assets can be individually identified.

3. Without prejudice to the specific risk mitigation measures laid down in the applicable AML/CFT legislation, for a transfer exceeding EUR 1,000 from a self-hosted address, the beneficiary’s crypto-asset service provider shall take adequate measures to assess whether that address is owned or controlled by the beneficiary.

4. Before making the crypto-assets available to the beneficiary, the beneficiary’s crypto-asset service provider shall verify the accuracy of the information on the beneficiary referred to in paragraph 2 of Article 14 on the basis of documents, data or information obtained from a reliable and independent source.

5. The verification referred to in paragraphs 2, 3 and 4 of this Article shall be deemed to have taken place where one of the following applies:

5.1. The beneficiary’s identity has been verified in accordance with the customer due diligence provisions laid down in the applicable AML/CFT legislation, and the information obtained through that verification has been retained in accordance with Article 64 of the Law on AML/CFT.

5.2. The provisions of paragraph 1.4 of Article 19 of the Law on AML/CFT.

Article 17 Transfers of crypto-assets with missing information on the originator or the beneficiary

1. The beneficiary’s crypto-asset service provider shall implement effective risk-based procedures, including the risk-based procedures laid down in the applicable AML/CFT legislation concerning customer due diligence measures, to determine whether to execute, reject, return or suspend a transfer of crypto-assets lacking the complete required information on the originator and the beneficiary, and to take appropriate follow-up action.

2. Where the beneficiary’s crypto-asset service provider becomes aware that the information referred to in paragraphs 1 and 2 of Article 14 of this Regulation, or Article 15 of this Regulation, is missing or incomplete, that crypto-asset service provider shall, on a risk-sensitive basis and without undue delay:

2.1. reject the transfer or return the transferred crypto-assets to the originator’s crypto-asset account; or

2.2. request the required information on the originator and the beneficiary before making the crypto-assets available to the beneficiary.

3. Where a crypto-asset service provider repeatedly fails to provide the required information on the originator or the beneficiary, the beneficiary’s crypto-asset service provider shall:

3.1. take steps, which may initially include issuing warnings and setting deadlines, before proceeding to rejection, restriction or termination in accordance with subparagraph 3.2 of this Article if the required information has still not been provided; or

3.2. directly reject any future transfers of crypto-assets from that crypto-asset service provider, or restrict or terminate its business relationship with that crypto-asset service provider.

4. Pursuant to the preceding paragraph, the beneficiary’s crypto-asset service provider shall report that failure and the steps taken to the CBK and FIU-K.

Article 18 Assessment and reporting by the beneficiary’s crypto-asset service provider

The beneficiary’s crypto-asset service provider shall take missing or incomplete information on the originator or the beneficiary into account as a factor when assessing whether a transfer of crypto-assets, or any related transaction, is suspicious and whether it should be reported to FIU-K in accordance with the applicable AML/CFT legislation.

SUBCHAPTER III OBLIGATIONS OF INTERMEDIARY CRYPTO-ASSET SERVICE PROVIDERS

Article 19 Retention of information on the originator and the beneficiary accompanying the transfer

Intermediary crypto-asset service providers shall ensure that all information received on the originator and the beneficiary accompanying a transfer of crypto-assets is transmitted with the transfer, and that records of this information are retained and made available at the request of competent authorities.

Article 20 Detection of missing information on the originator or the beneficiary

The intermediary crypto-asset service provider shall implement effective procedures, including, where appropriate, monitoring after or during transfers, to detect whether the information on the originator or the beneficiary specified in subparagraphs 1.1, 1.2 and 1.3 of Article 14 and subparagraphs 2.1, 2.2 and 2.3 of Article 14 of this Regulation has been submitted before, simultaneously or concurrently with the transfer or batch file transfer of crypto-assets, including where the transfer is made from or to a self-hosted address.

Article 21 Transfers of crypto-assets with missing information on the originator or the beneficiary

1. The intermediary crypto-asset service provider shall implement effective risk-based procedures, including the risk-based procedures laid down in the applicable AML/CFT legislation concerning customer due diligence measures, to determine whether to execute, reject, return or suspend a transfer of crypto-assets lacking the complete required information on the originator and the beneficiary, and to take appropriate follow-up action.

2. Where the intermediary crypto-asset service provider becomes aware that the information referred to in paragraphs 1.1, 1.2 and 1.3 of Article 14 of this Regulation and subparagraphs 2.1, 2.2 and 2.3 of Article 14 of this Regulation, or paragraph 1 of Article 15 of this Regulation, is missing or incomplete, that intermediary crypto-asset service provider shall, on a risk-sensitive basis and without undue delay:

2.1. reject the transfer or return the crypto-assets; or

2.2. request the required information on the originator and the beneficiary before carrying out the transfer of crypto-assets.

3. Where a crypto-asset service provider repeatedly fails to provide the required information on the originator or the beneficiary, the beneficiary’s intermediary crypto-asset service provider shall:

3.1. take steps, which may initially include issuing warnings and setting deadlines, before proceeding to rejection, restriction or termination in accordance with subparagraph 3.2 of this Article if the required information has still not been provided; or

3.2. directly reject any future transfers of crypto-assets from that crypto-asset service provider, or restrict or terminate its business relationship with that crypto-asset service provider.

4. Pursuant to the preceding paragraph, the beneficiary’s crypto-asset service provider shall report that failure and the steps taken to the CBK and FIU-K.

Article 22 Assessment and reporting by intermediary crypto-asset service providers

The intermediary crypto-asset service provider shall take missing or incomplete information on the originator or the beneficiary into account as a factor when assessing whether a transfer of crypto-assets, or any related transaction, is suspicious and whether it should be reported to FIU-K in accordance with the applicable AML/CFT legislation.

CHAPTER IV COMMON MEASURES APPLICABLE TO PAYMENT SERVICE PROVIDERS AND CRYPTO-ASSET SERVICE PROVIDERS

Article 23 Internal policies, procedures and controls to ensure the implementation of preventive measures

Payment service providers and crypto-asset service providers shall have internal policies, procedures and controls to ensure the implementation of AML/CFT measures under the applicable legislation or the CBK Regulation on AML/CFT when carrying out transfers of funds and crypto-assets under this Regulation.

CHAPTER V INFORMATION, DATA PROTECTION AND RECORD RETENTION

Article 24 Data protection

1. The processing of personal data under this Regulation shall be subject to the provisions of the Law on Personal Data Protection.

2. Personal data shall be processed by payment service providers and crypto-asset service providers under this Regulation solely for the purposes of preventing money laundering and terrorist financing and shall not be further processed in a manner incompatible with those purposes. Processing personal data under this Regulation for commercial purposes is strictly prohibited.

3. Payment service providers and crypto-asset service providers shall provide new customers with the information required under the Law on Personal Data Protection before establishing a business relationship or carrying out an occasional transaction. This information shall be provided in a concise, transparent, intelligible and easily accessible form in accordance with the Law on Personal Data Protection and shall, in particular, include a general notice concerning the legal obligations of payment service providers and crypto-asset service providers under this Regulation when processing personal data for the purposes of preventing money laundering and terrorist financing.

4. Payment service providers and crypto-asset service providers shall always ensure that the transmission of any personal data concerning the parties involved in transfers of funds and cryptoassets is carried out in accordance with the Law on Personal Data Protection.

Article 25 Record retention

1. Information on the payer and the payee, or on the originator and the beneficiary, shall not be retained for longer than strictly necessary. The payer’s and the payee’s payment service providers shall retain records of the information referred to in Articles 4 to 7 of this Regulation, and the originator’s and the beneficiary’s crypto-asset service providers shall retain records of the information referred to in Articles 14 to 16, for a period of five years.

2. Without prejudice to the following paragraph, after expiry of the retention period referred to in paragraph 1 of this Article, payment service providers and crypto-asset service providers shall ensure that personal data are deleted, unless otherwise provided by law.

3. FIU-K may permit or require further retention for a maximum period of five years after carrying out a thorough assessment of the necessity and proportionality of such further retention, and where it considers this necessary for preventing, detecting or investigating money laundering or terrorist financing.

Article 26 Cooperation with other authorities

The exchange of information between the CBK and other domestic and foreign authorities with powers to prevent and combat money laundering and terrorist financing shall be subject to the applicable AML/CFT legislation.

CHAPTER VI ADMINISTRATIVE PENALTIES AND REMEDIAL MEASURES

Article 27 Administrative penalties and measures

1. Breaches of the provisions of this Regulation shall be subject to remedial and punitive measures as provided in Chapter V of the Law on AML/CFT, the Law on the Central Bank and the relevant legislation governing financial institutions.

2. The CBK shall supervise financial institutions’ compliance with their obligations under the applicable AML/CFT legislation, the Regulation on AML/CFT and this Regulation.

3. The competent authorities (the CBK and FIU-K) may coordinate their actions to impose administrative measures and sanctions, in accordance with the applicable legislation, in any of the following ways:

3.1. directly;

3.2. in cooperation with each other;

3.3. under their responsibility, by delegating these powers to other authorities;

3.4. by submitting an application to the competent judicial authorities.

Article 28 Specific provisions

1. The administrative penalties and measures laid down in the Law on AML/CFT shall apply in the event of the following breaches of this Regulation:

1.1. repeated or systematic failure by a payment service provider to ensure that a transfer of funds is accompanied by the required information on the payer or the payee, in breach of Article 4, 5 or 6 of this Regulation, or by a crypto-asset service provider to ensure that a transfer of crypto-assets is accompanied by the required information on the originator and the beneficiary, in breach of Article 14 or 15 of this Regulation;

1.2. repeated, systematic or serious failure by a payment service provider or crypto-asset service provider to retain records, in breach of Article 25 of this Regulation;

1.3. failure by a payment service provider to implement effective risk-based procedures, in breach of Article 8 or 12, or by a crypto-asset service provider to implement effective risk-based procedures, in breach of Article 17 of this Regulation;

1.4. serious failure by an intermediary payment service provider to comply with the requirements of Article 11 or 12, or by an intermediary crypto-asset service provider to comply with the requirements of Article 19, 20 or 21 of this Regulation.

Article 29 Reporting of breaches

1. Through its mechanisms, the CBK shall provide secure channels to encourage the reporting of breaches of this Regulation. These mechanisms shall include, at a minimum:

1.1. specific procedures for receiving reports of breaches and following them up;

1.2. appropriate protection for employees of payment service providers and crypto-asset service providers who report breaches committed within their institution;

1.3. protection of personal data relating both to the person reporting breaches and to the natural person suspected of being responsible for a breach, in accordance with the principles laid down in the Law on Personal Data Protection;

1.4. clear rules ensuring that confidentiality is guaranteed in all cases concerning the person reporting breaches committed within the obliged entity, unless disclosure is required by national law in the context of further investigations or subsequent judicial proceedings.

2. Payment service providers and crypto-asset service providers shall, in cooperation with the competent authorities, establish appropriate internal procedures for their employees to report breaches internally through a secure, independent, specific and anonymous channel, proportionate to the nature and size of the payment service provider or crypto-asset service provider.

CHAPTER VII FINAL PROVISIONS

Article 30 Applicability

The provisions of this Regulation establishing obligations for crypto-asset service providers shall apply in accordance with the provisions of the Regulation on the Licensing of Crypto-Asset Service Providers.

Article 31 Repeal

Upon the entry into force of this Regulation, the Regulation on Information Accompanying Transfers of Funds adopted by the Board of the Central Bank on 26 June 2024 shall be repealed.

Article 32 Entry into force

This Regulation shall enter into force upon the entry into force of Law No. 11/L-017 Amending and Supplementing Law No. 05/L-096 on the Prevention of Money Laundering and Combating Terrorist Financing.

Dr. Sc. Bashkim Nurboja
Chairman of the Board of the Central Bank of the Republic of Kosovo