Skip to main content

Regulatory Compliance

Regulatory Compliance

Overview

Drop Srbija operates within the Serbian regulatory framework for payment services, data protection, and anti-money laundering. This document outlines the key legal requirements and compliance obligations.

NBS (Narodna Banka Srbije) — Payment Institution Licensing

Licensing Path

Year 1 (Recommended): Operate as registered agent under Article 24 of the Law on Payment Services through partnership with a licensed Serbian bank.

Year 2: Pursue Payment Institution (PI) license directly from NBS once market validation is proven.

Payment Institution License Requirements

If pursuing own PI license:

Minimum Capital Requirement: EUR 125,000 (or RSD equivalent)

Required Documents for NBS Authorization:

  1. Business Plan (3-year projection)

    • Market analysis (Serbian remittance + domestic transfer market)
    • Revenue model (transaction fees, FX spreads)
    • Risk assessment (operational, financial, fraud, AML/CFT)
    • Financial projections (P&L, balance sheet, cash flow)

  2. AML/CFT Programme

    • Customer due diligence procedures
    • Transaction monitoring rules (thresholds, alerts)
    • Sanctions screening process
    • Suspicious transaction reporting protocol
    • USPNFT eUprava integration for STR filing

  3. IT Security and Business Continuity

    • System architecture diagram
    • Data protection measures (encryption, access control, audit logs)
    • Incident response plan
    • Disaster recovery and backup procedures
    • Penetration testing schedule

  4. Organizational Structure

    • Org chart with key personnel
    • CVs and credentials of directors and compliance officers
    • Proof of fit-and-proper assessment (criminal record check, financial solvency)
    • Compliance Officer appointment (AML/CFT specialist)
    • Data Protection Officer (DPO) appointment

  5. Proof of Share Capital

    • Bank statement showing EUR 125,000 deposited
    • Shareholder agreements
    • Proof of source of funds

Timeline: 9-14 months from application submission to license issuance (optimistic).

NBS Contact:

  • Email: [email protected]
  • Phone: +381 11 3027 100
  • Address: Nemanjina 17, 11000 Belgrade, Serbia

ZPNFTM (Zakon o sprečavanju pranja novca) — AML/CFT Framework

Law on Prevention of Money Laundering and Terrorist Financing

Official Gazette: 113/2017, 91/2019, 153/2020

Regulatory Authority: Administration for the Prevention of Money Laundering (APML)

Key Obligations

  1. Customer Due Diligence (CDD)

    • Verify identity using government-issued ID (JMBG validation)
    • Collect name, address, date of birth, national ID number
    • Verify beneficial ownership (for legal entities)
    • Enhanced due diligence for high-risk customers (PEPs, high-value transactions)

  2. Transaction Monitoring

    • Threshold: RSD 15,000 (~EUR 130) for identification requirement
    • High-value threshold: EUR 15,000 for enhanced monitoring
    • Pattern detection: Structuring, unusual activity, cross-border remittances

  3. Suspicious Transaction Reporting (STR)

    • Report to APML via USPNFT eUprava portal (https://euprava.gov.rs)
    • No de minimis threshold — any suspicious activity must be reported
    • Prohibition on tipping off the customer

  4. Record Retention

    • 5 years minimum for transaction data (Article 60)
    • 10 years for high-risk transactions
    • Must be readily accessible for APML audits

  5. Sanctions Screening

    • Check all customers and transactions against:
      • UN Consolidated List (https://www.un.org/securitycouncil/sanctions/list)
      • EU Restrictive Measures (https://sanctionsmap.eu/)
      • Serbian Government Sanctions (Official Gazette)
    • NOTE: There is NO "NBS SDN list" — Serbia does not maintain a separate sanctions list. Use UN + EU + Serbian government sources only.

  6. PEP Screening

    • Politically Exposed Persons (domestic and foreign)
    • Family members and close associates
    • Enhanced due diligence required

USPNFT eUprava Integration

Portal: https://euprava.gov.rs/usluge/uspnft
What it does: Electronic submission of Suspicious Transaction Reports (STRs) to APML

Drop Srbija Implementation:

  • Compliance Officer has eUprava account with STR permissions
  • STR submission within 3 business days of detection
  • System generates draft STR from aml_flags table entries
  • Manual review by Compliance Officer before submission

ZZPL (Zakon o zaštiti podataka o ličnosti) — Data Protection

Law on Personal Data Protection

Official Gazette: 87/2018

Regulatory Authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection)

Contact:

  • Email: [email protected]
  • Phone: +381 11 3408 900
  • Address: Bulevar kralja Aleksandra 15, 11000 Belgrade, Serbia

Key Principles

Serbia's ZZPL is modeled on GDPR but with some differences. Key provisions:

Data Protection Impact Assessment (DPIA)

Required for: Biometric KYC verification (facial recognition for JMBG validation)

Document: dpia-kyc-biometric.md

Key Findings:

  • High risk: Biometric data is special category (Article 17)
  • Mitigation: Encryption, access control, retention limits (delete after verification)
  • Legal basis: Legal obligation (AML/CFT) + contract performance
  • Approved by: ALAI Lexicon (awaiting Serbian DPO review)

Privacy Policy

Location: privacy-policy-sr.md

Publication Requirements:

  • Must be in Serbian (official version)
  • Published on Drop Srbija website before launch
  • In-app display during onboarding (user must accept before account creation)
  • Updated whenever processing activities change

Content Includes:

  • Data controller: Drop Srbija d.o.o. (legal entity TBD)
  • Legal bases for each processing activity
  • Data categories and retention periods
  • Third-party processors (AWS, SMS gateway)
  • User rights and how to exercise them
  • DPO contact details

Incident Reporting — NBS and Poverenik

Three-Track Notification System

Drop Srbija has three parallel incident notification obligations:

Track 1: NBS Initial Notification (Within 4 Hours)

Trigger: Significant operational or security incident affecting payment services

Examples:

  • Service outage >2 hours
  • Cyberattack or data breach
  • Fraudulent transaction pattern
  • NBS IPS integration failure
  • Critical system failure

Contact: [email protected], +381 11 3027 100

Format: Brief email alert with:

  • Incident type and time of detection
  • Preliminary impact assessment
  • Immediate actions taken
  • Estimated resolution time

Track 2: NBS Detailed Report (Within 72 Hours)

Follow-up to Track 1 with comprehensive analysis:

Required Content:

  • Root cause analysis
  • Full impact assessment (customers affected, transaction volume, financial loss)
  • Timeline of events
  • Preventive measures implemented
  • Lessons learned

Format: PDF document, 5-15 pages, Serbian language

Submission: Email to [email protected]

Track 3: Poverenik Data Breach Notification (Within 72 Hours)

Trigger: Personal data breach (unauthorized access, data exposure, data loss)

Examples:

  • Database leak
  • Phishing attack exposing customer data
  • Employee unauthorized access
  • Ransomware encryption of customer records

Contact: [email protected], +381 11 3408 900

Format: Breach notification form (available on Poverenik website)

Required Content:

  • Nature of breach (type of data, number of individuals affected)
  • Likely consequences
  • Measures taken to mitigate
  • DPO contact details

IMPORTANT: This is a separate notification from NBS reporting. Personal data breaches must be reported to BOTH NBS (if affecting payment services) AND Poverenik (for data protection compliance).

User Notification

Trigger: Data breach likely to result in high risk to user rights and freedoms

Timeline: Without undue delay (typically within 72 hours)

Method: SMS + in-app notification + email

Template: incident-notification-procedure.md contains user notification templates in Serbian.

Serbian Bank Partnership

Drop Srbija Year 1 strategy relies on partnership with a licensed Serbian bank to access NBS IPS as a registered agent.

Under the Law on Payment Services, payment institutions and banks can appoint registered agents to provide payment services on their behalf.

Requirements:

  • Agent must be registered with NBS
  • Principal (bank) remains responsible for agent's actions
  • Written agent agreement required
  • Agent must comply with all AML/CFT obligations

Bank Partnership Pitch

Target Banks: Raiffeisen Banka, Erste Bank, Banca Intesa, OTP Banka, Mobi Banka (digital-first)

Value Proposition:

  • Drop brings new digital-native customers to the bank
  • Increased IPS transaction volume
  • Revenue share on transaction fees
  • Co-branded offering (optional)

What Drop Needs:

  • IPS gateway API access
  • Registered agent status (Article 24)
  • Technical integration support
  • Bank account for settlement

Document: serbian-bank-partnership-pitch.md

Timeline: 6-7 months from first contact to launch (optimistic)

Sanctions Sources (CORRECTED)

Drop Srbija screens against three sources:

  1. UN Consolidated List

    • URL: https://www.un.org/securitycouncil/sanctions/list
    • Format: XML/PDF download
    • Update frequency: Weekly

  2. EU Restrictive Measures (Sanctions Map)

    • URL: https://sanctionsmap.eu/
    • Format: JSON API available
    • Update frequency: Daily

  3. Serbian Government Sanctions

    • Source: Official Gazette of the Republic of Serbia
    • Implementation: Serbia adopts UN sanctions, occasionally imposes additional measures
    • No centralized API — manual monitoring required

CRITICAL CORRECTION: There is NO "NBS SDN list." NBS does not maintain a separate sanctions list. Earlier references to "NBS SDN" were an error. Use only the three sources above.

Compliance Roles

Drop Srbija must appoint the following officers before launch:

Role Responsibility Qualifications
Data Protection Officer (DPO) ZZPL compliance, data subject requests, breach notification Legal/IT background, ZZPL expertise
AML/CFT Compliance Officer Transaction monitoring, STR filing, sanctions screening ACAMS certification or equivalent, Serbian language
Risk Officer Operational and financial risk management Can be CTO initially, fintech risk experience

Hiring Status: TBD — awaiting Drop Srbija d.o.o. incorporation

DISCLAIMER:

All documents are DRAFT status and require Serbian legal counsel review before use. Drop Srbija must engage a Serbian law firm specializing in fintech/payment services for:

  1. Validation of all legal and regulatory statements
  2. Review and finalization of all documents
  3. Entity structure and licensing strategy advice
  4. Drafting final agreements and regulatory submissions

Budget Estimate: EUR 5,000-10,000 for initial legal review.

Last Updated: 2026-04-16
Next Review: After Serbian legal counsel engagement

No comments to display

Back to top