Skip to main content

Compliance Framework

Compliance Framework Document

Project:Project / Organization: BilkoALAI Holding AS — BalkanDrop AccountingPayment SaaSApp Policy Number: POL-COMP-FW-001 Version: 1.0 Date: 2026-02-23 Author: ComplianceSecurity Architect Status: Draft Reviewers: DPO, Legal Counsel, CEO Classification: Confidential

Document History

Version Date Author Changes
0.1 2026-02-23 ComplianceSecurity Architect Initial draft — three-countryDrop payment app multi-jurisdiction compliance mapping RS/BA/HR

1. Applicable Regulations

Compliance Owner: ComplianceSecurity Architect / DPO ([email protected])[email protected]) External Auditor:Company: ToALAI beHolding engagedAS (Phaseorg.nr 2)932 516 136), incorporated in Norway Last Review:Domain: 2026-02-23 |getdrop.no NextBusiness Review:Model: 2026-08-23PSD2 pass-through payment app — NEVER holds customer money; AISP reads bank balances, PISP initiates payments from user's bank account. Service: Remittance to 30+ countries + QR payments in Norway Users: All residents of Norway, 18+ years, with Norwegian BankID

Primary Jurisdiction: Norway

Drop is incorporated in Norway under Norwegian law. All primary regulatory obligations flow from Norwegian legislation and Finanstilsynet supervision.

Regulation CountryNorwegian Law ApplicabilityRelevance
PSD2 (Payment Services)Betalingstjenesteloven (LOV-2018-11-23-85)Core — legal basis for payment operations
AML/CFTHvitvaskingsloven (LOV-2018-06-01-23) + Hvitvaskingsforskriften (FOR-2018-09-14-1324)Core — anti-money laundering obligations
GDPRPersonopplysningsloven (LOV-2018-06-15-38)Core — personal data protection
Financial EnterprisesFinansforetaksloven (LOV-2015-04-10-17)Licensing, governance, capital requirements
ICT SecurityIKT-forskriften (FOR-2003-05-21-630)ICT security for financial enterprises
Digital Operational ResilienceDORA (EU) 2022/2554Norway incorporation expected ~2026 H2
Currency RegistryValutaregisterloven (LOV-2003-06-06-39)Cross-border payment reporting to SSB
Consumer ProtectionFinansavtaleloven (LOV-2020-11-13-125)Payment terms, user rights, fee transparency
Electronic SignatureseIDAS / LOV-2001-06-15-81BankID as qualified electronic identification

Remittance Corridor Jurisdictions

Drop sends remittances to 30+ countries. Regulatory obligations in these corridors:

Destination RegionKey RegulationsDrop Obligations
EU/EEA (Eurozone, Croatia, etc.)GDPR (free data flow), EU AMLStandard KYC; no SCCs needed for data
SerbiaZZPL (Zakon o zaštiti podataka, LOV RS 87/2018)Standard KYC; SCC + TIA for data transfers
Bosnia & HerzegovinaZZLP (Zakon o zaštiti ličnih podataka, SG BiH 49/06)Standard KYC; SCC + TIA for data transfers
TurkeyTurkish Personal Data Protection Law (KVKK 6698/2016)FATF monitoring list — enhanced KYC
PakistanPakistan Personal Data Protection ActFATF monitoring — enhanced due diligence

Note: Drop's obligations in corridor jurisdictions are primarily fulfilled by the receiving payment institution. Drop's direct obligations are Norwegian-law based, supplemented by GDPR requirements for cross-border data transfers.

2. Licensing

Current Status

Drop is an MVP-stage application. No Finanstilsynet license has been obtained. Live transactions with real money are NOT permitted until a license is in place.

Licensing Pathway

Option A: Begrenset betalingsforetak (Limited Payment Institution)

Law: Betalingstjenesteloven § 2-10c

RequirementDetail
Monthly transaction volumeMax 6 million NOK/month (12-month average)
Capital requirementNone
Application timeline3-6 months
EEA passportingNO — Norway only
Fit & properDirectors and beneficial owners
AMLFull compliance required

Drop fit: Initial launch — allows ~3,000 remittances of 2,000 NOK average/month.

Option B: Ordinaert betalingsforetak (Full Payment Institution)

Law: Betalingstjenesteloven §§ 2-3 to 2-10

RequirementDetail
Initial capital125,000 EUR (~1.4M NOK) for remittance services
Application timeline6-12 months
EEA passportingYES — enables Sweden/Denmark
GovernanceBoard, compliance officer, internal audit
SafeguardingClient funds in segregated account or guarantee

Drop fit: Target license for Scandinavian scale.

Option C: Agent Model (recommended for Phase 1)

Law: Betalingstjenesteloven § 2-12

RequirementDetail
StructureDrop operates as agent of licensed payment institution
CapitalNone required from Drop
Timeline1-3 months
LiabilityPrincipal (licensed PSP) is responsible

Target partners: Licensed Norwegian PSPs or BaaS providers (Swan, Modulr, Banking Circle).

3. PSD2 / Betalingstjenesteloven

Strong Customer Authentication (SCA)

Law: Betalingstjenesteloven §§ 4-28, 4-29; Delegated Regulation (EU) 2018/389

§ Art.
RequirementSection Status
GDPRTwo-factor — Regulation (EU) 2016/679authentication HR Directly applicable — EU member4-28 Phase 12: BankID (possession + knowledge)
ZakonDynamic o zaštiti podataka o ličnosti (ZZPL, Sl. glasnik RS 87/2018)linking RSArt. 5 (Del. Reg.) GDPR-alignedPhase —2: inamount force+ Novpayee 2018tied to BankID signing
90-day re-authenticationArt. 10 (Del. Reg.) Phase 2
ZakonLow-value o zaštiti ličnih podatakaexemption (ZZLP,<500 Sl. glasnik BiH 49/2006, 76/2011)NOK) BA State-level data protection lawPhase 3
Zakon o računovodstvu (Sl. glasnik RS 73/2019, 44/2021)RSAccounting law, double-entry, retentionPhase 2
Zakon o računovodstvu i reviziji FBiH (Sl. novine FBiH 83/2009, 56/2023)BA (FBiH)Accounting and audit lawPhase 3
Zakon o računovodstvu i reviziji RS BiH (Sl. glasnik RS BiH 96/2005)BA (RS)Accounting and audit lawPhase 3
Zakon o računovodstvu HR (NN 78/15, 120/16, 116/18)HRAccounting law, CFRS, retentionPhase 2
Zakon o PDV (Sl. glasnik RS 84/2004 et al.)RSVAT law, 20%/10%/0% ratesPhase 2
Zakon o PDV BiH (Sl. glasnik BiH 9/2005 et al.)BAVAT law, 17%/0% rates, UIOPhase 3
Zakon o porezu na dodanu vrijednost HR (NN 73/13 et al.)HRVAT law, 25%/13%/5%/0%, ePoreznaPhase 2
Zakon o elektronskom dokumentu (Sl. glasnik RS 51/2009)RSLegal validity of electronic recordsPhase 2
Opći porezni zakon HR (NN 115/16 et al.)HRGeneral tax law frameworkPhase 2
Pravilnik o kontnom okviru RS (2021)RSChart of accounts standardPhase 2
FBiH Pravilnik o kontnom okviru (2022)BA (FBiH)Chart of accounts standardPhase 3
RRiF Kontni plan HRHRStandard chart of accounts10-18 Phase 2

Current

2.state: SerbiaEmail + password only. SCA required for production launch.

Required implementation (RS)Phase —2):

Regulatory
    Compliance

  • BankID OIDC for initial login (Level 4 eID)
  • Transaction signing with BankID for all payment initiation
  • Dynamic linking: display amount + payee in BankID signing dialog
  • Session timeout and re-authentication after 5 minutes inactivity

    • 2.1Open Data Protection — Zakon o zaštiti podataka o ličnostiBanking (ZZPL)AISP/PISP)

    Full name:Law: ZakonBetalingstjenesteloven o§§ zaštiti4-40 podatakato o4-46

    ličnosti
    ServiceLawRequirement
    AISP (read bank balances)§ 4-41AISP license or agent arrangement; explicit user consent
    PISP (initiate payments)§ 4-44PISP license or agent arrangement; no storing bank credentials
    Dedicated interface§ 4-40Use banks' PSD2 APIs (Bits, Tink, or direct bank APIs)

    Consumer Information Requirements

    Citation:Law: Sl.Betalingstjenesteloven glasnikkapittel RS br. 87/2018 In force: November 21, 2018 Description: Serbia's GDPR-aligned personal data protection law. Mirrors GDPR structure3 and principles.4; Supervisory authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection) Website: https://www.poverenik.rsFinansavtaleloven

    Requirement ZZPL ArticleSection BilkoDocument
    Pre-contractual information§§ 3-1 to 3-8Framework agreement (rammeavtale)
    Per-transaction information§§ 3-22 to 3-26Transaction receipts
    Fee transparency before authorization§ 3-23Pre-auth disclosure screen
    Exchange rate disclosure§ 3-24FX rate + reference rate shown before confirmation
    Execution time (non-EEA)§ 4-15Max D+4 business days
    Complaint handling§ 3-60Klagebehandling procedure

    4. AML/KYC — Hvitvaskingsloven

    Customer Due Diligence (CDD)

    Law: Hvitvaskingsloven §§ 10-18

    RequirementSectionDrop Implementation
    LawfulIdentity basis for processingverification Art.§ 12 ContractBankID (Art.covers 12name st.+ 1fødselsnummer tač.+ 2) — accounting service deliveryDOB)
    DataElectronic minimizationverification Art.§ 5 st. 1 tač. 312(3) CollectBankID onlyis email,approved name,electronic tax ID (PIB/JMBG) — required for invoicingmethod
    DataSource subjectof rightsfunds (access,large erasure, portability)amounts) Art.§ 26-4115 Endpoints:Trigger GETabove /account/data, DELETE /account, GET /account/exportthresholds
    RegisterPurpose of processing activitiesrelationship Art.§ 5012(1)d InternalRegistration processing register — requiredquestionnaire
    SecurityOngoing of processingmonitoring Art.§ 5024 TLSTransaction 1.3monitoring + AES-256 + bcrypt + RBACsystem
    BreachRecord notification to Poverenikretention Art.§ 5630 Within5 72years hoursafter ofrelationship becoming aware
    Cross-border data transferArt. 64-65Railway EU West — within ZZPL scopeends

    Breach

    KYC notification contact:

    • Authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti
    • Address: Bulevar kralja Aleksandra 15, 11000 Belgrade
    • Email: [email protected]
    • Deadline: 72 hours from awareness (ZZPL Art. 56)

    2.2 Accounting Law — Zakon o računovodstvuTiers

    Full name: Zakon o računovodstvu Citation: Sl. glasnik RS br. 73/2019, 44/2021 Description: Defines accounting obligations for all legal entities in Serbia.

    Implementation of countries/individualsOFAC/UN/EU
    RequirementTier BilkoLimit RequirementsCorridor Risk
    Double-entry bookkeeping mandatoryBasic PrismaUp schemato enforces1,000 debitAccountIdNOK/transaction, +5,000 creditAccountIdNOK/monthBankID verification onlyLav (Low) — debit = credit validatedEU/EEA
    ChartStandard Up accounts:to Pravilnik10,000 oNOK/transaction, kontnom30,000 okviruNOK/monthBankID + address verificationMiddels (2021)Medium) — 10Serbia, class system (0-9)Serbian CoA seed data with standard 3-digit accountsBiH
    Financial statements required: Bilans stanja (Balance Sheet), Bilans uspeha (Income Statement)Enhanced ReportAbove generation10,000 moduleNOK/transactionFull EDD: source of funds + senior management approvalHøy (PhaseHigh) 2)— Pakistan, Turkey (FATF)
    Large entities: Izveštaj o novčanim tokovima (Cash Flow), Napomene (Notes)Blocked PhaseAny 2amount
    Sanctioned
    Filing institution: APR (Agencija za privredne registre)Blokkert — https://www.apr.gov.rs PDF export in Serbian format
    Annual filing deadline: June 30Filing reminders in app
    Document retention: 10 yearsSoft delete — financial records never hard deletedsanctioned

    2.3Transaction VATMonitoring Law — Zakon o PDVRules

    Full name:Law: ZakonHvitvaskingsloven o§§ porezu24, na25

    dodatu

    Transactions vrednostthat must trigger investigation:

    1. Citation:Structuring Sl.— glasnikmultiple RStransactions br.just 84/2004,below 86/2004,reporting 61/2005thresholds
      2. et
    2. Rapid al.movement — large in/out within same day
    3. Unusual corridors — sudden change in destination country
    4. Volume spikes — significantly above customer's historical pattern
    5. FATF jurisdiction — any transaction to FATF grey/black list countries
    6. PEP match — customer or recipient on PEP list

    Reporting: Suspicious Transaction Reports (consolidated)STR) Description:filed Serbia'swith VATEFE law.(Enheten for finansiell etterretning) via altinn.no. Tipping off the customer is prohibited (§ 28).

    AML Risk Classification — Corridor Risk

    RateCorridor DescriptionRisk Level ApplicationRationale
    20%EU/EEA (opšta stopa)countries StandardLav rate(Low) GeneralStrong goodsAML andframeworks, servicesFATF compliant
    10%Croatia (snižena stopa)HR) ReducedLav rate(Low) Food,EU medicines,member utilitiesstate
    0%Serbia (RS) ZeroMiddels rate(Medium) Exports,FATF internationalmember, transportnot EU; targeted remittance risk
    Bosnia & Herzegovina (BA)Middels (Medium)Enhanced monitoring; cash economy
    Turkey (TR)Høy (High)FATF grey list (monitoring); elevated corridor risk
    Pakistan (PK)Høy (High)FATF monitoring; common remittance corridor
    OFAC/UN sanctioned countriesBlokkertTransactions blocked entirely

    VAT registration threshold:Source: 8,000,000 RSD annual turnover Return frequency: Monthly (>50M RSD) or Quarterly (<50M RSD) Filing deadline: 15th of following month Portal: ePorezi — https:~//www.poreskauprava.gov.rs Penalties: 50,000 – 2,000,000 RSD for SEF non-compliance

    2.4 E-Invoice — SEF (Sistem e-Faktura)

    Platform: https://efaktura.gov.rs Mandatory since:

    • B2G (suppliers to government): May 2022
    • B2B (business-to-business): January 2023

    Format: UBL 2.1 XML Integration: API available — @bilko/country-rsALAI/products/Drop/legal/hvitvaskingsrutiner.md package (Phase 2) Penalties: 50,000 – 2,000,000 RSD for non-compliance

    2.5 Electronic Document Law

    Full name: Zakon o elektronskom dokumentu, elektronskoj identifikaciji i uslugama od poverenja u elektronskom poslovanju Citation: Sl. glasnik RS br. 94/2017 Description: Legal validity of electronic documents and digital signatures.

    Bilko-generated invoices and reports constitute valid electronic documents when:

    • Generated by certified accounting software
    • Stored immutably with audit trail
    • Exportable in PDF/XML format

    2.6 APR Filing

    3.5. BosniaGDPR &/ Herzegovina (BA) — Regulatory CompliancePersonopplysningsloven

    Complexity:

    3.1 Data Protection — Zakon o zaštiti ličnih podataka BiHProcessing

    Full name:Law: Zakon o zaštiti ličnih podataka Bosne i Hercegovine Citation: Sl. glasnik BiH br. 49/2006, 76/2011, 89/2011 Description: State-level personal data protection law. Pre-GDPR butArt. aligned6; in principles. Supervisory authority: Agencija za zaštitu ličnih podataka Bosne i HercegovinePersonopplysningsloven (AZLP) Website: https://www.azlp.ba

    The same state-level law applies across both FBiH and Republika Srpska.LOV-2018-06-15-38)

    §
    RequirementProcessing Activity ZZLPLegal ArticleBasis BilkoNorwegian ImplementationLaw Reference
    LawfulUser basis for processingArt. 4registration Contract performancePersonopplysningsloven § 5, GDPR Art. 6(1)(accounting service delivery) + legal obligation (tax records)b)
    DataKYC securityidentity measuresverification Art.Legal 14obligation TLSPersonopplysningsloven 1.3§ 6, GDPR Art. 6(1)(c) + AES-256Hvitvaskingsloven +§ bcrypt + RBAC12
    Cross-borderPayment transferprocessing Art.Contract 18performance RailwayPersonopplysningsloven EU§ West5, —GDPR outsideArt. BiH; SCCs mechanism6(1)(b)
    BreachTransaction notificationmonitoring to AZLP(AML) Legal obligationPersonopplysningsloven § 6, GDPR Art. 146(1)(c) + GDPRHvitvaskingsloven practice 72 hours24
    DataFødselsnummer subject rightsprocessing Art.Special 5-10legal basis SamePersonopplysningsloven endpoints§ as12 RS(requires specific legal basis)
    Error monitoring (Sentry)Legitimate interestGDPR Art. 6(1)(f)
    MarketingConsentGDPR Art. 6(1)(a)

    Breach

    Data notificationSubject contact:

    • Authority: Agencija za zaštitu ličnih podataka Bosne i Hercegovine (AZLP)
    • Address: Hamdije Čemerlića 2/VI, 71000 Sarajevo
    • Email: [email protected]
    • Deadline: 72 hours (following GDPR best practice)

    3.2 FBiH — Accounting LawRights

    Full name: Zakon o računovodstvu i reviziji Federacije Bosne i Hercegovine Citation: Sl. novine FBiH br. 83/2009, 56/2023 Description: Accounting and audit law for Federation of BiH.

    RequirementRight BilkoGDPR ArticleDrop Implementation
    Double-entry bookkeepingEnforced by schema
    Chart of accounts: FBiH Pravilnik (2022) — 10 class system (0-9)BiH CoA seed data
    Financial statements: Bilans stanja, Bilans uspehaReport generation module (Phase 3)
    Filing institution: Agency of Financial Information (FBiH)PDF export
    Annual filing deadline: March 31Filing reminders
    Document retention: 10 yearsImmutable storage

    3.3 Republika Srpska (BiH Entity) — Accounting Law

    Full name: Zakon o računovodstvu i reviziji Republike Srpske Citation: Sl. glasnik RS BiH br. 96/2005, 74/2016 Description: Accounting and audit law for Republika Srpska entity of BiH.

    RequirementBilko Implementation
    Double-entry bookkeepingEnforced by schema
    Filing institution: Tax Administration of RS (BiH entity)PDF export
    Annual filing deadline: March 31Filing reminders
    Document retention: 11 yearsMaximum retention applied across entities

    3.4 VAT — Zakon o PDV BiH

    Full name: Zakon o porezu na dodanu vrijednost Bosne i Hercegovine Citation: Sl. glasnik BiH br. 9/2005, 35/2005, 100/2008 et al. Description: Unified VAT law administered at state level. No reduced rates. Administering authority: UIO — Uprava za indirektno oporezivanje (Indirect Taxation Authority) Portal: https://www.uino.gov.ba

    RateDescription
    17% (opća stopa)Standard rate — all goods and services
    0%Exports

    Registration threshold: 100,000 BAM annual turnover Return frequency: Monthly Filing deadline: Check UIO portal

    3.5 E-Invoice — CPF (Central Platform for Fiscalisation)

    Status: PENDING — technical specifications not yet published Law adopted: January 2026 (FBiH only) Expected availability: ~2027

    Bilko decision: Do NOT implement CPF integration until technical specs are published. Monitor UIO and FBiH government portals for updates. BiH is Phase 3 launch.

    3.6 Corporate Income Tax

    EntityCIT RateFiling Deadline
    FBiH10%March 31
    RS (BiH entity)10%March 31

    Bilko provides CIT calculation support — separate fields for FBiH vs RS entity in organization settings.

    4. Croatia (HR) — Regulatory Compliance

    Note: Croatia is an EU member state. GDPR applies directly without separate national transposition law.

    4.1 Data Protection — GDPR

    Applicable law: GDPR — Regulation (EU) 2016/679 (directly applicable) National implementing act: Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/2018) Supervisory authority: AZOP — Agencija za zaštitu osobnih podataka Website: https://azop.hr

    law)
    RequirementGDPR ArticleBilko Implementation
    Lawful basisArt. 6Contract (6.1.b) for service; legal obligation (6.1.c) for tax
    Data minimizationArt. 5(1)(c)Collect OIB (Croatian tax ID), name, email only
    Right to access Art. 15 GETProfile /api/v1/account/page + data export endpoint
    Right to rectificationArt. 16Profile edit
    Right to erasure Art. 17 DELETEAccount /api/v1/accountdeletion (PII— anonymized;30-day financialretention recordsfor retainedAML peroverride
    Right to restrictionArt. 18Manual processing by DPO
    Right to portability Art. 20 GETJSON /api/v1/account/export (JSON)
    SecurityRight ofto processingobject Art. 3221 TLSOpt-out 1.3for + AES-256 + bcrypt + RBACmarketing
    Breach notificationRight to AZOPwithdraw consent Art. 337(3) WithinConsent 72management hours
    DPIAArt. 35This document covers accounting data
    DPA with processorsArt. 28Required with Railway, Vercel, Cloudflare, SendGridUI

    BreachRetention notificationconflict: contact:

    • Authority: AZOP — Agencija za zaštitu osobnih podataka
    • Address: Selska cesta 136, 10000 Zagreb
    • Email: [email protected]
    • Portal: https://azop.hr/prijavapovrede
    • Deadline: 72 hours from awareness (GDPR Art. 33)
      • 17
    (erasure)

    4.2vs. AccountingHvitvaskingsloven Law§ 30 (5-year AML retention). AML retention takes precedence — Zakon o računovodstvu

    Full name: Zakon o računovodstvu Citation: NN 78/15, 120/16, 116/18, 42/20, 47/20 Description: Croatian accounting law, aligns with EU Accounting Directive.

    anonymizedafter
    RequirementBilko Implementation
    Double-entry bookkeepingEnforced by schema
    Chart of accounts: RRiF standard — 10 class system (0-9)HR CoA seeduser data
    Accountingaccount standards:close, CFRStransaction (forrecords SMEs)retained or5 IFRS (PIEs)CFRS-compliant reports
    Financial statements: Bilanca, Račun dobiti i gubitka, Izvještaj o novčanim tokovimaReport generation module (Phase 2)
    Filing via RGFI (Registar godišnjih financijskih izvještaja)FINA filing
    Filing institution: FINA — Financijska agencija — https://www.fina.hr
    Annual filing deadline: April 30Filing reminders
    Document retention: 11 yearsImmutable storage

    4.3 General Tax Law — Opći porezni zakon

    Full name: Opći porezni zakon Citation: NN 115/16, 106/18, 121/19, 32/20 et al. Description: Framework tax law governing all Croatian taxes, including penalties for VAT non-compliance.

    Relevant to Bilko: Defines document retention (11 years), electronic record acceptance, and obligations for digital accounting systems.years.

    4.4 VAT Law — Zakon o porezu na dodanu vrijednost

    Full name: Zakon o porezu na dodanu vrijednost Citation: NN 73/13, 148/13, 143/14 et al. Description: Croatian VAT law implementing EU VAT Directive. Portal: ePorezna — https://www.porezna-uprava.hr

    RateDescriptionApplication
    25% (opća stopa)Standard rateGeneral goods and services
    13% (srednja stopa)Intermediate rateCertain foods, water supply, accommodation, newspapers
    5% (snižena stopa)Reduced rateBooks, baby food, prescription medicines
    0%Zero rateExports, intra-EU supply

    Registration threshold: 60,000 EUR annual turnover Return frequency: Monthly Filing deadline: Last day of following month

    4.5 E-Invoice — HR-FISK / eRačun

    Platform: https://hr-fisk.fina.hr Operator: FINA — Financijska agencija Status: Mandatory since January 1, 2026 (all B2B, B2G, B2C) Format: UBL 2.1 XML with HR-CIUS (Croatian Implementation User Specification) Protocol: AS4 (Peppol-compatible) Certificate: FINA qualified certificate required

    Integration: @bilko/country-hr package (Phase 2) — FINA API integration required Penalties: Up to 500,000 EUR for non-compliance (severe) Archive requirement: 11 years

    4.6 FINA Reporting

    4.7 HNB (Hrvatska narodna banka)

    For organizations with foreign currency transactions, HNB reporting may apply. Bilko supports EUR (Croatia's official currency since January 2024), with historical HRK support for data migration.

    5. Cross-Country Compliance Matrix

    RequirementSerbia (RS)Bosnia & Herzegovina (BA)Croatia (HR)
    Data protection lawZZPL (GDPR-aligned, 2018)ZZLP BiH (state-level, 2006)GDPR (directly applicable)
    Supervisory authorityPoverenikAZLPAZOP
    Breach notification deadline72 hours72 hours (best practice)72 hours (GDPR Art. 33)
    Double-entry bookkeeping✅ Mandatory✅ Mandatory✅ Mandatory
    Standard VAT rate20%17%25%
    Reduced VAT rate10%None13% and 5%
    VAT return frequencyMonthly/QuarterlyMonthlyMonthly
    VAT filing deadline15th of next monthTBD (UIO)Last day of next month
    E-invoice platformSEF (mandatory since Jan 2023)CPF (pending ~2027)HR-FISK (mandatory since Jan 2026)
    E-invoice formatUBL 2.1 XMLTBDUBL 2.1 XML (HR-CIUS)
    Annual report filingAPR — June 30Agency of Financial Info / Tax Admin RS — March 31FINA RGFI — April 30
    Chart of accountsPravilnik (2021)FBiH Pravilnik (2022)RRiF standard
    Document retention10 years10 years (FBiH) / 11 years (RS entity)11 years
    CurrencyRSDBAMEUR
    Corporate income tax15%10% (both entities)18% (10% if revenue <1M EUR)

    Bilko retention policy: Apply maximum retention across all markets — 11 years for all financial records. Financial data is never hard-deleted.

    6. Data Classification Scheme

    Level Label Examples ControlsEncryption Required
    L1 Public Exchange rates, fee schedule, privacygetdrop.no policycontent NoneNo
    L2 Internal AggregatedSystem analytics,logs, non-PIIperformance logsmetrics, error traces AccessNo control(TLS)
    L3 Confidential UserNames, email, name,phone, organizationtransaction data,history, invoicebank amountsbalances EncryptionTLS + accessAES-256 controlat + audit logrest
    L4 Restricted Tax IDsFødselsnummer (PIB/JMBG/OIB/JIB)national ID), bankKYC accountdocuments, numbers,BankID TOTP secretssub EncryptionTLS + RBACAES-256-GCM +field MFAencryption +(separate audit + 10-year retentionkey)

    Tax ID handling:

    • Serbia: PIB (Poreski identifikacioni broj) — 9 digits; JMBG (Jedinstveni matični broj građana) — 13 digits
    • BiH: JIB (Jedinstveni identifikacioni broj) — 13 digits
    • Croatia: OIB (Osobni identifikacijski broj) — 11 digits

    All tax IDs treated as L4 Restricted data. Stored with access logging. Never included in JWT payloads or logs.

    7.

    Data Subject Rights Implementation

    Inventory
    RightData Category EndpointClassification SLARetention NotesLegal Basis
    Access (Art. 15 GDPR / ZZPL Art. 26 / ZZLP Art. 8)Name GETL3 /api/v1/account/dataConfidential 30Life daysof account + 5 years (AML) Returns user + org + invoices + expensesContract
    Rectification (Art. 16)Email PATCHL3 /api/v1/account/profileConfidential ImmediateLife of account Email, nameContract
    ErasurePhone (Art. 17)number DELETEL3 /api/v1/ConfidentialLife of account 30 daysPII anonymized; financial records retained per lawContract
    Portability (Art. 20)Fødselsnummer GETL4 /api/v1/account/exportRestricted 305 daysyears (AML) JSONLegal exportobligation
    RestrictionBankID (Art. 18)sub [email protected]L4 Restricted 305 daysyears (AML) ManualLegal processobligation
    ObjectionKYC (Art. 21)documents [email protected]L4 Restricted 305 years (AML)Legal obligation
    Transaction recordsL3 Confidential5 years (AML) + accountingLegal obligation
    Bank account balancesL3 ConfidentialSession only — not persistedContract
    IP addresses / logsL2 Internal90 days NotLegitimate applicable for contract processinginterest

    DPIA

    Erasure exception: Financial records (invoices, expenses, transactions) are retained for the legally required period (10-11 years depending on country) even after user account erasure. Only PII (email, name, password hash) is anonymized.

    8. Third-PartyA Data Processors

    Protection Impact Assessment (DPIA) has been conducted. Document: data-protection-impact-assessment.md

    DPIA trigger: Processing of fødselsnummer at scale, BankID integration, cross-border transfers to Serbia/BiH.

    Cross-Border Data Transfers

    ProcessorDestination ServiceTransfer Mechanism Data SharedRegionDPA RequiredSafeguards
    RailwayEU/EEA (AWS Frankfurt, Cloudflare EU) PostgreSQLFree hostingflow (EEA to EEA) AllStandard accountingGDPR dataEU West (Frankfurt/Paris)Yes — sign before launchprotections
    VercelCroatia (HR) FrontendFree flow (EEA → EU)Standard GDPR protections
    Serbia (RS)No adequacy decisionSCCs (Standard Contractual Clauses) + Transfer Impact Assessment (TIA)
    Bosnia & Herzegovina (BA)No adequacy decisionSCCs + Transfer Impact Assessment (TIA)
    USA (AWS, Sentry, BetterStack)No adequacy decisionSCCs + DPA signed

    Note: Serbia and Bosnia & Herzegovina do not have EU adequacy decisions. All data transfers involving these countries require SCCs and a documented TIA before data flows.

    6. ICT Security — IKT-forskriften / DORA

    IKT-forskriften (FOR-2003-05-21-630)

    Currently applicable to financial enterprises in Norway.

    RequirementSectionsStatus
    ICT security policy§§ 5-6Document: ikt-sikkerhetspolicy.md — Draft
    Incident handling§ 8Document: hendelseshaandtering.md — Draft
    Business continuity§ 9Document: beredskapsplan.md — Draft
    Outsourcing policy§ 10Document: utkontraktering-policy.md — Draft
    Access control§ 5Implemented: RBAC, session revocation, JWT
    Encryption§ 6Implemented: TLS 1.3, AES-256, bcrypt(12)

    DORA (EU) 2022/2554

    DORA is expected to be incorporated into Norwegian law approximately 2026 H2 (via EEA Agreement).

    DORA RequirementArticleDrop Plan
    ICT risk management frameworkArt. 6Mapped to IKT-forskriften currently
    ICT incident classificationArt. 18Breach response plan covers this
    Major incident reportingArt. 19Finanstilsynet + Datatilsynet within 72h
    Digital operational resilience testingArt. 24-25Annual pentest planned (Phase 3)
    ICT third-party risk managementArt. 28-44Outsourcing policy + DPAs
    Encryption standardsArt. 9(4)(d)AES-256-GCM, TLS 1.3

    7. Valutaregisterloven

    Law: Valutaregisterloven (LOV-2003-06-06-39)

    All cross-border payment service providers must report transactions to Statistisk sentralbyrå (SSB) and Norges Bank.

    RequirementThresholdReporting Recipient
    Cross-border transactionsAll (> 0 NOK)SSB via Valutaregisteret
    Aggregate statisticsMonthlyNorges Bank
    FormatXML via SSB APIValutaregisteret

    Implementation: Phase 2 — automated reporting pipeline to Valutaregisteret for all completed remittances.

    8. Compliance Gap Summary

    Overall compliance readiness: 8/100 (MVP stage — expected)

    AreaReadinessGap
    Licensing (Finanstilsynet)0%No license — no live transactions permitted
    PSD2 / SCA10%BankID not implemented; SCA not in place
    AML/KYC5%Mock KYC only; no real identity verification
    GDPR15%Privacy notice + DPIA drafted; no DPO appointed
    ICT Security25%Security hardened (post 2026-02-13); pentest pending
    Valutaregisterloven0%No SSB reporting pipeline
    Consumer Protection20%Terms drafted; no formal complaints process

    Phase 2 completion target: 60% (licensing + BankID + real KYC + GDPR implementation) Phase 3 completion target: 85% (pentest + Valutaregisteret + full GDPR + DPO)

    9. Compliance Monitoring Plan

    Monthly Checks

    •  npm audit — dependency vulnerability check
    •  Review Sentry errors for security-relevant issues
    •  BetterStack uptime + alert review
    •  Transaction volume check against license threshold (after licensing)

    Quarterly Checks

    •  KYC data retention audit (5-year AML retention compliance)
    •  GDPR data subject rights fulfillment review
    •  JWT_SECRET rotation (quarterly per key management policy)
    •  Review of AML transaction monitoring rules effectiveness
    •  Security exceptions review

    Annual Checks

    •  External security penetration test (required before Phase 3 launch)
    •  AML risk assessment review (Hvitvaskingsloven § 6)
    •  DPIA review (GDPR Art. 35 — when processing changes materially)
    •  All encryption keys rotation audit
    •  Regulatory change review — Finanstilsynet circulars
    •  DPAs review (AWS, Cloudflare, Sentry, BetterStack, Sumsub, BankID Norge AS)

    10. Third-Party Compliance

    All third-party processors of personal data require a signed Data Processing Agreement (DPA).

    metadata,
    VendorRoleDPA StatusData Transferred
    AWS (Frankfurt, Ireland)Infrastructure + hosting None (static only)Required GlobalAll (EU edge for EU users)Yesdata
    Cloudflare (EU edge) CDN, WAF, R2 storageDDoS IP addresses, file attachmentsRequired EURequest region YesIPs
    SendGridSentry TransactionalError emailmonitoring Email addresses, invoice PDFsRequired EUError regiondata, stack traces
    BetterStack YesUptime + logsRequiredLog data
    SumsubKYC verification (Phase 2)RequiredName, photo ID, fødselsnummer
    BankID Norge ASeID authentication (Phase 2)RequiredName, fødselsnummer, DOB
    Marqeta / LithicCard issuance (Phase 3)RequiredPayment data (PCI-DSS)

    DPA status:requirement source: AllGDPR DPAsArt. must28; bePersonopplysningsloven signed§ before first paying customer. Railway EU West region must be explicitly configured to ensure EU data residency.5

    9.11. ComplianceDocument Roadmap

    Phase 1 — Pre-Launch (GDPR baseline)

    •  Privacy policy published (HR GDPR applicable immediately; RS/BA when launched)
    •  Terms of Service published
    •  User consent mechanism at registration
    •  Data deletion workflow implemented and tested
    •  Data export endpoint implemented
    •  DPAs signed with Railway, Vercel, Cloudflare, SendGrid
    •  Railway EU West region confirmed
    •  Breach notification process documented

    Phase 2 — Serbia Launch (3-6 months)

    Phase 2 — Croatia Launch (concurrent or shortly after)

    Phase 3 — BiH Launch (12-18 months)

    •  Legal review by BiH lawyer (FBiH + RS entity distinction)
    •  BiH CoA seed data (FBiH Pravilnik 2022)
    •  VAT calculation at 17% (UIO)
    •  Monitor CPF technical specs publication (~2027)
    •  FBiH vs RS entity distinction in org settings
    •  AZLP breach notification process confirmed

    10. Risk AssessmentRegister

    3planned,notSerbia/Croatia
    RiskDocument LikelihoodFile ImpactStatus MitigationOwner
    GDPR/ZZPLPrivacy data breach finenotice Low (if compliant)personvernerklaering.md High (GDPR up to €20M / ZZPL up to RSD 2M)Draft Full GDPR/ZZPL implementation before first customerDPO
    SEF non-compliance (Serbia)DPIA Medium (if not integrated)dpia-vurdering.md High (RSD 2M fine)Draft Phase 2 SEF integration before Serbia B2B launchDPO
    HR-FISKTerms non-complianceof (Croatia)service High (if not integrated)brukervilkar.md Critical (EUR 500K fine)Draft Phase 2 HR-FISK integration — mandatoryLegal
    FinancialAML data lossprocedures Lowhvitvaskingsrutiner.md CriticalDraft 30-day Railway backups, immutable audit trailCompliance
    TaxAML calculationrisk error (VAT)assessment Lowrisikovurdering-hvitvasking.md High (penalties + reputational)Draft Configurable tax rates per country, Zod validationCompliance
    BiHICT CPFsecurity delaypolicy Mediumikt-sikkerhetspolicy.md Low (launch delayed)Draft PhaseSecurity
    Incident blockinghandling hendelseshaandtering.mdDraftSecurity
    Business continuityberedskapsplan.mdDraftOperations
    Outsourcing policyutkontraktering-policy.mdDraftLegal
    Internal controlinternkontroll.mdDraftCompliance
    Suitability assessmentegnethetsvurdering.mdDraftLegal
    Complaint handlingklagebehandling.mdDraftOperations
    Licensing preparationkonsesjonssoknad-forberedelse.mdDraftLegal
    Gap analysisdrop-gap-analysis-v2.mdCompleteCompliance
    Regulatory mapdrop-regulatory-map-v2.mdCompleteLegal
    Security architecturesecurity-architecture.mdDraftSecurity
    Encryption policydata-encryption-policy.mdDraftSecurity
    Key management policykey-management-policy.mdDraftSecurity
    Breach response plandata-breach-response-plan.mdDraftSecurity
    Security testing policysecurity-testing-policy.mdDraftSecurity

    Approval

    Role Name Date Signature
    Author ComplianceSecurity Architect 2026-02-23
    DPO
    Legal Counsel
    CEO
    Back to top