Skip to main content

Compliance Framework

Compliance Framework Document

Project / Organization:Project: ALAI Holding ASBilko — DropBalkan PaymentAccounting App Policy Number: POL-COMP-FW-001SaaS Version: 1.0 Date: 2026-02-23 Author: SecurityCompliance Architect Status: Draft Reviewers: DPO, Legal Counsel, CEO Classification: Confidential

Document History

Version Date Author Changes
0.1 2026-02-23 SecurityCompliance Architect Initial draft — DropRS/BA/HR payment app multi-jurisdictionthree-country compliance mapping

1. Applicable Regulations

Compliance Owner: SecurityCompliance Architect / DPO ([email protected])[email protected]) Company:Last Review: ALAI2026-02-23 Holding AS (org.nr 932 516 136), incorporated in Norway| Domain:Next Review: getdrop.no Business Model: PSD2 pass-through payment app — NEVER holds customer money; AISP reads bank balances, PISP initiates payments from user's bank account. Service: Remittance to 30+ countries + QR payments in Norway Users: All residents of Norway, 18+ years, with Norwegian BankID

Primary Jurisdiction: Norway

Drop is incorporated in Norway under Norwegian law. All primary regulatory obligations flow from Norwegian legislation and Finanstilsynet supervision.2026-08-23

Regulation Norwegian LawCountry RelevancePhase
PSD2GDPR — Regulation (PaymentEU) Services)2016/679 Betalingstjenesteloven (LOV-2018-11-23-85)HR CorePhase — legal basis for payment operations1
AML/CFTHvitvaskingsloven (LOV-2018-06-01-23) + Hvitvaskingsforskriften (FOR-2018-09-14-1324)Core — anti-money laundering obligations
GDPRPersonopplysningsloven (LOV-2018-06-15-38)Core — personal data protection
Financial EnterprisesFinansforetaksloven (LOV-2015-04-10-17)Licensing, governance, capital requirements
ICT SecurityIKT-forskriften (FOR-2003-05-21-630)ICT security for financial enterprises
Digital Operational ResilienceDORA (EU) 2022/2554Norway incorporation expected ~2026 H2
Currency RegistryValutaregisterloven (LOV-2003-06-06-39)Cross-border payment reporting to SSB
Consumer ProtectionFinansavtaleloven (LOV-2020-11-13-125)Payment terms, user rights, fee transparency
Electronic SignatureseIDAS / LOV-2001-06-15-81BankID as qualified electronic identification

Remittance Corridor Jurisdictions

Drop sends remittances to 30+ countries. Regulatory obligations in these corridors:

Destination RegionKey RegulationsDrop Obligations
EU/EEA (Eurozone, Croatia, etc.)GDPR (free data flow), EU AMLStandard KYC; no SCCs needed for data
SerbiaZZPL (Zakon o zaštiti podataka,podataka LOVo ličnosti (ZZPL, Sl. glasnik RS 87/2018) Standard KYC; SCC + TIA for data transfers
Bosnia & HerzegovinaZZLP (Zakon o zaštiti ličnih podataka, SG BiH 49/06)Standard KYC; SCC + TIA for data transfers
TurkeyTurkish Personal Data Protection Law (KVKK 6698/2016)FATF monitoring list — enhanced KYC
PakistanPakistan Personal Data Protection ActFATF monitoring — enhanced due diligence

Note: Drop's obligations in corridor jurisdictions are primarily fulfilled by the receiving payment institution. Drop's direct obligations are Norwegian-law based, supplemented by GDPR requirements for cross-border data transfers.

2. Licensing

Current Status

Drop is an MVP-stage application. No Finanstilsynet license has been obtained. Live transactions with real money are NOT permitted until a license is in place.

Licensing Pathway

Option A: Begrenset betalingsforetak (Limited Payment Institution)

Law: Betalingstjenesteloven § 2-10c

RequirementDetail
Monthly transaction volumeMax 6 million NOK/month (12-month average)
Capital requirementNone
Application timeline3-6 months
EEA passportingNO — Norway only
Fit & properDirectors and beneficial owners
AMLFull compliance required

Drop fit: Initial launch — allows ~3,000 remittances of 2,000 NOK average/month.

Option B: Ordinaert betalingsforetak (Full Payment Institution)

Law: Betalingstjenesteloven §§ 2-3 to 2-10

RequirementDetail
Initial capital125,000 EUR (~1.4M NOK) for remittance services
Application timeline6-12 months
EEA passportingYES — enables Sweden/Denmark
GovernanceBoard, compliance officer, internal audit
SafeguardingClient funds in segregated account or guarantee

Drop fit: Target license for Scandinavian scale.

Option C: Agent Model (recommended for Phase 1)

Law: Betalingstjenesteloven § 2-12

RequirementDetail
StructureDrop operates as agent of licensed payment institution
CapitalNone required from Drop
Timeline1-3 months
LiabilityPrincipal (licensed PSP) is responsible

Target partners: Licensed Norwegian PSPs or BaaS providers (Swan, Modulr, Banking Circle).

3. PSD2 / Betalingstjenesteloven

Strong Customer Authentication (SCA)

Law: Betalingstjenesteloven §§ 4-28, 4-29; Delegated Regulation (EU) 2018/389

10-18
RequirementSectionStatus
Two-factor authentication§ 4-28Phase 2: BankID (possession + knowledge)
Dynamic linkingArt. 5 (Del. Reg.)Phase 2: amount + payee tied to BankID signing
90-day re-authenticationArt. 10 (Del. Reg.)RS Phase 2
Low-valueZakon exemptiono zaštiti ličnih podataka BiH (<500ZZLP, NOK)Sl. glasnik BiH 49/2006) Art.BA Phase 3
Zakon o računovodstvu (Sl. glasnik RS 73/2019)RSPhase 2
Zakon o računovodstvu i reviziji FBiH (Sl. novine FBiH 83/2009)BA (FBiH)Phase 3
Zakon o računovodstvu i reviziji RS BiH (Sl. glasnik RS BiH 96/2005)BA (RS entity)Phase 3
Zakon o računovodstvu HR (NN 78/15, 120/16, 116/18)HRPhase 2
Zakon o PDV RS (Sl. glasnik RS 84/2004 et al.)RSPhase 2
Zakon o PDV BiH (Sl. glasnik BiH 9/2005 et al.)BAPhase 3
Zakon o porezu na dodanu vrijednost HR (NN 73/13 et al.)HRPhase 2
Zakon o elektronskom dokumentu RS (Sl. glasnik RS 51/2009)RSPhase 2
Opći porezni zakon HR (NN 115/16 et al.)HRPhase 2
Pravilnik o kontnom okviru RS (2021)RSPhase 2
FBiH Pravilnik o kontnom okviru (2022)BA (FBiH)Phase 3
RRiF Kontni plan HRHR Phase 2

Current

state:

2. Email + password only. SCA required for production launch.

Required implementationSerbia (PhaseRS) 2):

—
    Regulatory
  1. BankIDCompliance

OIDC

2.1 forData initialProtection login— Zakon o zaštiti podataka o ličnosti (Level 4 eID)
  • Transaction signing with BankID for all payment initiation
  • Dynamic linking: display amount + payee in BankID signing dialog
  • Session timeout and re-authentication after 5 minutes inactivity

    • Open Banking (AISP/PISP)ZZPL)

    Law:Full name: BetalingstjenestelovenZakon §§o 4-40zaštiti topodataka 4-46

    o ličnosti
    ServiceLawRequirement
    AISP (read bank balances)§ 4-41AISP license or agent arrangement; explicit user consent
    PISP (initiate payments)§ 4-44PISP license or agent arrangement; no storing bank credentials
    Dedicated interface§ 4-40Use banks' PSD2 APIs (Bits, Tink, or direct bank APIs)

    Consumer Information Requirements

    Law:Citation: BetalingstjenestelovenSl. kapittelglasnik 3RS andbr. 4;87/2018 FinansavtalelovenIn force: November 21, 2018 Description: Serbia's GDPR-aligned personal data protection law. Supervisory authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti Website: https://www.poverenik.rs

    Requirement SectionZZPL Article DocumentBilko Implementation
    Pre-contractualLawful informationbasis for processing §§Art. 3-1 to 3-812 Framework agreementContract (rammeavtale)Art. 12 st. 1 tač. 2) — accounting service
    Per-transactionData informationminimization §§Art. 3-225 tost. 3-261 tač. 3 TransactionEmail, receiptsname, PIB/JMBG only where legally required
    FeeData transparencysubject before authorizationrights §Art. 3-2326-41 Pre-authGET disclosure/account/data, screenDELETE /account, GET /account/export
    ExchangeProcessing rate disclosureregister §Art. 3-2450 FXInternal rateprocessing +register reference rate shown before confirmationrequired
    ExecutionSecurity timeof (non-EEA)processing §Art. 4-1550 MaxTLS D+41.3, businessAES-256, daysbcrypt, RBAC
    ComplaintBreach handlingnotification to Poverenik §Art. 3-6056 KlagebehandlingWithin procedure72 hours of awareness

    Breach notification: [email protected] | Bulevar kralja Aleksandra 15, 11000 Belgrade

    2.2 Accounting Law — Zakon o računovodstvu

    Full name: Zakon o računovodstvu Citation: Sl. glasnik RS br. 73/2019, 44/2021

    RequirementBilko Implementation
    Double-entry bookkeepingSchema enforces debitAccountId + creditAccountId
    Chart of accounts: Pravilnik o kontnom okviru (2021) — 10 class (0-9)Serbian CoA seed data
    Bilans stanja (Balance Sheet) + Bilans uspeha (Income Statement)Phase 2 reports
    Filing: APR (https://www.apr.gov.rs), deadline June 30PDF export + reminders
    Document retention: 10 yearsSoft delete — never hard delete financial data

    2.3 VAT — Zakon o PDV

    Citation: Sl. glasnik RS br. 84/2004 (consolidated)

    RateDescription
    20% (opšta stopa)Standard — general goods and services
    10% (snižena stopa)Reduced — food, medicines, utilities
    0%Exports, international transport

    VAT threshold: 8,000,000 RSD | Return: Monthly (>50M RSD) or Quarterly | Deadline: 15th of next month

    2.4 E-Invoice — SEF (Sistem e-Faktura)

    Platform: https://efaktura.gov.rs | Mandatory: B2B since January 2023 Format: UBL 2.1 XML | Penalties: 50,000–2,000,000 RSD for non-compliance Integration: @bilko/country-rs package (Phase 2)

    2.5 APR Filing

    Serbian entities file annual financial reports with APR (Agencija za privredne registre). Deadline: June 30. Bilko generates APR-compatible PDF/XML exports.

    3. Bosnia & Herzegovina (BA) — Regulatory Compliance

    Complexity: BiH has two entities (FBiH and Republika Srpska). VAT unified at state level via UIO. Direct taxes separate per entity.

    3.1 Data Protection — Zakon o zaštiti ličnih podataka BiH (ZZLP)

    Full name: Zakon o zaštiti ličnih podataka Bosne i Hercegovine Citation: Sl. glasnik BiH br. 49/2006, 76/2011, 89/2011 Supervisory authority: AZLP — Agencija za zaštitu ličnih podataka Bosne i Hercegovine Website: https://www.azlp.ba

    RequirementZZLP ArticleBilko Implementation
    Lawful basisArt. 4Contract + legal obligation
    Security measuresArt. 14TLS 1.3, AES-256, bcrypt, RBAC
    Cross-border transferArt. 18Railway EU West — SCCs mechanism
    Breach notification to AZLPArt. 14 + GDPR practice72 hours

    Breach notification: [email protected] | Hamdije Čemerlića 2/VI, 71000 Sarajevo

    3.2 FBiH — Accounting Law

    Full name: Zakon o računovodstvu i reviziji Federacije Bosne i Hercegovine Citation: Sl. novine FBiH br. 83/2009, 56/2023

    RequirementBilko Implementation
    Double-entry bookkeepingSchema enforced
    Chart of accounts: FBiH Pravilnik (2022)BiH CoA seed data
    Filing: Agency of Financial Information (FBiH), deadline March 31PDF export
    Document retention: 10 yearsImmutable storage

    3.3 Republika Srpska (BA Entity)

    Citation: Sl. glasnik RS BiH br. 96/2005, 74/2016 Filing: Tax Administration of RS (BiH entity), March 31 Retention: 11 years — maximum applied across BA entities

    3.4 VAT — Zakon o PDV BiH

    Citation: Sl. glasnik BiH br. 9/2005 (consolidated) Authority: UIO — Uprava za indirektno oporezivanje | https://www.uino.gov.ba

    RateDescription
    17% (opća stopa)Standard — all goods and services
    0%Exports

    Threshold: 100,000 BAM | Return: Monthly | No reduced rates

    3.5 E-Invoice — CPF (Central Platform for Fiscalisation)

    Status: PENDING — technical specifications not published Law adopted: January 2026 (FBiH only) Expected: ~2027

    Bilko decision: DO NOT implement CPF until specs published. BiH is Phase 3 launch.

    3.6 Corporate Income Tax

    EntityRateDeadline
    FBiH10%March 31
    RS (BiH entity)10%March 31

    4. AML/KYCCroatia (HR) — HvitvaskingslovenRegulatory Compliance

    Note: Croatia is EU member state. GDPR applies directly.

    Customer4.1 DueData DiligenceProtection (CDD)— GDPR

    Law:Applicable: HvitvaskingslovenGDPR §§Regulation 10-18(EU) 2016/679 (directly applicable) National implementing act: Zakon o provedbi Opće uredbe (NN 42/2018) Supervisory authority: AZOP — Agencija za zaštitu osobnih podataka | https://azop.hr

    Requirement SectionGDPR Article DropBilko Implementation
    IdentityLawful verificationbasis §Art. 126 BankIDContract (covers6.1.b) namefor +service; fødselsnummerlegal +obligation DOB)(6.1.c) for tax
    ElectronicData verificationminimization §Art. 12(3)5(1)(c) BankIDOIB, isname, approved electronic method
    Source of funds (large amounts)§ 15Trigger above thresholds
    Purpose of relationship§ 12(1)dRegistration questionnaire
    Ongoing monitoring§ 24Transaction monitoring system
    Record retention§ 305 years after relationship ends

    KYC Tiers

    TierLimitRequirementsCorridor Risk
    BasicUp to 1,000 NOK/transaction, 5,000 NOK/monthBankID verificationemail only Lav (Low) — EU/EEA
    StandardUp to 10,000 NOK/transaction, 30,000 NOK/monthBankID + address verificationMiddels (Medium) — Serbia, BiH
    EnhancedAbove 10,000 NOK/transactionFull EDD: source of funds + senior management approvalHøy (High) — Pakistan, Turkey (FATF)
    BlockedAny amountSanctioned countries/individualsBlokkert — OFAC/UN/EU sanctioned

    Transaction Monitoring Rules

    Law: Hvitvaskingsloven §§ 24, 25

    Transactions that must trigger investigation:

    1. Structuring — multiple transactions just below reporting thresholds
    2. Rapid movement — large in/out within same day
    3. Unusual corridors — sudden change in destination country
    4. Volume spikes — significantly above customer's historical pattern
    5. FATF jurisdiction — any transaction to FATF grey/black list countries
    6. PEP match — customer or recipient on PEP list

    Reporting: Suspicious Transaction Reports (STR) filed with EFE (Enheten for finansiell etterretning) via altinn.no. Tipping off the customer is prohibited (§ 28).

    AML Risk Classification — Corridor Risk

    CorridorRisk LevelRationale
    EU/EEA countriesLav (Low)Strong AML frameworks, FATF compliant
    Croatia (HR)Lav (Low)EU member state
    Serbia (RS)Middels (Medium)FATF member, not EU; targeted remittance risk
    Bosnia & Herzegovina (BA)Middels (Medium)Enhanced monitoring; cash economy
    Turkey (TR)Høy (High)FATF grey list (monitoring); elevated corridor risk
    Pakistan (PK)Høy (High)FATF monitoring; common remittance corridor
    OFAC/UN sanctioned countriesBlokkertTransactions blocked entirely

    Source: ~/ALAI/products/Drop/legal/hvitvaskingsrutiner.md

    5. GDPR / Personopplysningsloven

    Law: GDPR Art. 6; Personopplysningsloven (LOV-2018-06-15-38)

    Processing ActivityLegal BasisNorwegian Law Reference
    User registrationContract performancePersonopplysningsloven § 5, GDPR Art. 6(1)(b)
    KYC identity verificationLegal obligationPersonopplysningsloven § 6, GDPR Art. 6(1)(c) + Hvitvaskingsloven § 12
    Payment processingContract performancePersonopplysningsloven § 5, GDPR Art. 6(1)(b)
    Transaction monitoring (AML)Legal obligationPersonopplysningsloven § 6, GDPR Art. 6(1)(c) + Hvitvaskingsloven § 24
    Fødselsnummer processingSpecial legal basisPersonopplysningsloven § 12 (requires specific legal basis)
    Error monitoring (Sentry)Legitimate interestGDPR Art. 6(1)(f)
    MarketingConsentGDPR Art. 6(1)(a)

    Data Subject Rights

    RightGDPR ArticleDrop Implementation
    Right to access Art. 15 ProfileGET page + /api/v1/account/data export endpoint
    Right to rectificationArt. 16Profile edit
    Right to erasure Art. 17 AccountDELETE deletion — 30-day retention for AML override
    Right to restrictionArt. 18Manual processing by DPO/api/v1/account
    Right to portability Art. 20 JSONGET /api/v1/account/export
    RightSecurity toof objectprocessing Art. 2132 Opt-outTLS for1.3, marketingAES-256, bcrypt, RBAC
    RightBreach notification to withdraw consentAZOP Art. 7(3)33 ConsentWithin management72 UIhours
    DPA with processorsArt. 28Railway, Vercel, Cloudflare, SendGrid

    RetentionBreach conflict:notification: [email protected] | https://azop.hr/prijavapovrede | Selska cesta 136, 10000 Zagreb

    4.2 Accounting Law — Zakon o računovodstvu HR

    Citation: NN 78/15, 120/16, 116/18, 42/20

    RequirementBilko Implementation
    Double-entry bookkeepingSchema enforced
    Chart of accounts: RRiF standardHR CoA seed data
    Accounting standards: CFRS (SMEs) or IFRS (PIEs)CFRS-compliant reports
    Bilanca + Račun dobiti i gubitkaReport generation Phase 2
    Filing: FINA RGFI (https://www.fina.hr), deadline April 30FINA-compatible export
    Document retention: 11 yearsImmutable storage

    4.3 General Tax Law — Opći porezni zakon HR

    Citation: NN 115/16, 106/18, 121/19, 32/20 Document retention 11 years, electronic record acceptance, digital accounting system obligations.

    4.4 VAT — Zakon o PDV HR

    Citation: NN 73/13 et al. | Portal: ePorezna — https://www.porezna-uprava.hr

    RateDescription
    25% (opća stopa)Standard — general goods and services
    13% (srednja stopa)Intermediate — foods, water, accommodation
    5% (snižena stopa)Reduced — books, baby food, medicines
    0%Exports, intra-EU supply

    Threshold: 60,000 EUR | Return: Monthly | Deadline: Last day of next month

    4.5 E-Invoice — HR-FISK / eRačun

    Platform: https://hr-fisk.fina.hr | Operator: FINA — Financijska agencija Mandatory since: January 1, 2026 (all B2B, B2G, B2C) Format: UBL 2.1 XML with HR-CIUS | Protocol: AS4 (Peppol-compatible) Certificate: FINA qualified certificate required Penalties: Up to EUR 500,000 for non-compliance Archive: 11 years

    Integration: @bilko/country-hr — FINA certificate + API (Phase 2)

    4.6 Corporate Income Tax — Croatia

    • Standard rate: 18% | Reduced: 10% (revenue <1M EUR) | Deadline: April 30

    5. Cross-Country Compliance Matrix

    § AML
    RequirementSerbia (RS)Bosnia & Herzegovina (BA)Croatia (HR)
    Data protection lawZZPL (GDPR-aligned, 2018)ZZLP BiH (2006)GDPR (directly applicable)
    Supervisory authorityPoverenikAZLPAZOP
    Breach notification deadline72 hours (ZZPL Art. 56)72 hours (best practice)72 hours (GDPR Art. 1733)
    VAT standard rate20%17%25%
    VAT reduced rate10%None13% / 5%
    E-invoice platformSEF (erasure)mandatory vs.Jan Hvitvaskingsloven2023) CPF (pending ~2027)HR-FISK (mandatory Jan 2026)
    E-invoice formatUBL 2.1 XMLTBDUBL 2.1 XML (HR-CIUS)
    Annual report filingAPR — June 30Agency Fin. Info / Tax Admin — March 31FINA RGFI — April 30
    Chart of accountsPravilnik (5-year2021) FBiH retention).Pravilnik AML(2022)RRiF standard
    Document retention10 years10 (FBiH) / 11 (RS entity)11 years
    CurrencyRSDBAMEUR
    CIT rate15%10%18% (10% <1M EUR)

    Bilko retention takespolicy: precedenceApply maximum across all markets — user11 datayears anonymizedfor afterall accountfinancial close,records. transactionNever recordshard retained 5 years.delete.

    6. Data Classification

     Scheme
    Level Label Examples Encryption RequiredControls
    L1 Public Exchange rates, fee schedule, getdrop.noprivacy contentpolicy NoNone
    L2 Internal SystemAggregated logs,analytics, performancenon-PII metrics, error traceslogs NoAccess (TLS)control
    L3 Confidential Names,Email, email,name, phone,organization transactiondata, history,invoice bank balancesamounts TLSEncryption + AES-256access atcontrol rest+ audit
    L4 Restricted FødselsnummerPIB/JMBG/OIB/JIB (nationaltax ID)IDs), KYCIBAN, documents,TOTP BankIDsecrets, subpassword hashes TLSEncryption + AES-256-GCMRBAC field+ encryptionMFA (separate+ key)audit + 11-year retention

    Tax ID types by country:

    • Serbia: PIB (9 digits), JMBG (13 digits)
    • BiH: JIB (13 digits)
    • Croatia: OIB (11 digits)

    7. Data Inventory

    Subject Rights Implementation
    Data CategoryRight ClassificationEndpoint RetentionSLA Legal BasisException
    NameAccess (GDPR Art. 15 / ZZPL Art. 26) L3GET Confidential/api/v1/account/data Life30 of account + 5 years (AML)days Contract—
    EmailRectification (Art. 16) L3PATCH Confidential/api/v1/account/profile Life of accountImmediate Contract—
    PhoneErasure number(Art. 17) L3DELETE ConfidentialLife of /api/v1/account Contract30 daysFinancial records retained per law
    FødselsnummerPortability (Art. 20) L4GET Restricted/api/v1/account/export 530 years (AML)days Legal obligation—
    BankIDRestriction sub(Art. 18) L4 Restricted[email protected] 5 years (AML)Legal obligation
    KYC documentsL4 Restricted5 years (AML)Legal obligation
    Transaction recordsL3 Confidential5 years (AML) + accountingLegal obligation
    Bank account balancesL3 ConfidentialSession only — not persistedContract
    IP addresses / logsL2 Internal9030 days Legitimate interest

    DPIA

    A Data Protection Impact Assessment (DPIA) has been conducted. Document: data-protection-impact-assessment.md

    DPIA trigger: Processing of fødselsnummer at scale, BankID integration, cross-border transfers to Serbia/BiH.

    Cross-Border Data Transfers

    DestinationTransfer MechanismSafeguards
    EU/EEA (AWS Frankfurt, Cloudflare EU)Free flow (EEA to EEA)Standard GDPR protections
    Croatia (HR)Free flow (EEA → EU)Standard GDPR protections
    Serbia (RS)No adequacy decisionSCCs (Standard Contractual Clauses) + Transfer Impact Assessment (TIA)
    Bosnia & Herzegovina (BA)No adequacy decisionSCCs + Transfer Impact Assessment (TIA)
    USA (AWS, Sentry, BetterStack)No adequacy decisionSCCs + DPA signedManual

    Note:Erasure exception: SerbiaInvoices, andexpenses, Bosniatransactions &retained Herzegovina10-11 doyears not(accounting havelaw). EUOnly adequacyPII decisions.(email, Allname, datapassword transfershash) involving these countries require SCCs and a documented TIA before data flows.anonymized.

    6.8. ICTThird-Party SecurityData — IKT-forskriften / DORAProcessors

    IKT-forskriften (FOR-2003-05-21-630)

    Currently applicable to financial enterprises in Norway.

    — Draft— Draft
    RequirementProcessor SectionsService RegionDPA Status
    ICT security policyRailway §§PostgreSQL 5-6hosting Document:EU ikt-sikkerhetspolicy.mdWest (Frankfurt/Paris)Required — Draftsign before launch
    Incident handlingVercel §Frontend 8hosting Document:EU hendelseshaandtering.mdedge Required
    Business continuityCloudflare §CDN, 9WAF, R2 storage Document:EU beredskapsplan.mdregion Required
    Outsourcing policySendGrid §Transactional 10email Document: utkontraktering-policy.md — Draft
    Access controlEU § 5Implemented: RBAC, session revocation, JWT
    Encryption§ 6Implemented: TLS 1.3, AES-256, bcrypt(12)Required

    9. Compliance Roadmap

    DORAPhase 1 — Pre-Launch (EU)GDPR 2022/2554baseline)

    •  Privacy policy published
    •  Terms of Service published
    •  User consent mechanism at registration
    •  Data deletion + anonymization workflow
    •  Data export endpoint
    •  DPAs signed: Railway, Vercel, Cloudflare, SendGrid
    •  Railway EU West region confirmed
    •  Breach notification process ready

    Phase 2 — Serbia Launch + Croatia Launch

    DORASerbia:

    is

    Croatia:

    •  Legal review (Zakon o računovodstvu + GDPR)
    •  Croatian CoA seed data (RRiF)
    •  VAT at 25% / 13% / 5%
    •  FINA certificate for HR-FISK
    •  HR-FISK API integration (mandatory)
    •  FINA RGFI report export

    Phase 3 — BiH Launch

    10. Risk Assessment

    Plan coverswithinpentestpolicyTLS
    DORA RequirementRisk ArticleLikelihood DropImpact Mitigation
    ICTGDPR/ZZPL riskbreach management frameworkfine Art.Low 6(if compliant) MappedHigh to(GDPR IKT-forskriften€20M currently/ ZZPL RSD 2M)Full implementation before first customer
    ICTSEF incidentnon-compliance classification(RS) Art. 18Medium BreachHigh response(RSD plan2M) Phase this2 SEF integration
    MajorHR-FISK incidentnon-compliance reporting(HR) Art.High 19(if not integrated) FinanstilsynetCritical +(EUR Datatilsynet500K) Phase 72h2 mandatory
    DigitalFinancial operationaldata resilience testingloss Art. 24-25Low AnnualCritical 30-day plannedRailway (Phasebackups, 3)immutable audit
    ICTTax third-partycalculation risk managementerror Art. 28-44Low OutsourcingHigh Configurable +rates, DPAsNUMERIC precision, Zod
    EncryptionBiH standardsCPF delay Art. 9(4)(d)Medium AES-256-GCM,Low Phase 1.3 planned, not blocking RS/HR

    Law: Valutaregisterloven (LOV-2003-06-06-39)

    All cross-border payment service providers must report transactions to Statistisk sentralbyrå (SSB) and Norges Bank.

    RequirementThresholdReporting Recipient
    Cross-border transactionsAll (> 0 NOK)SSB via Valutaregisteret
    Aggregate statisticsMonthlyNorges Bank
    FormatXML via SSB APIValutaregisteret

    Implementation: Phase 2 — automated reporting pipeline to Valutaregisteret for all completed remittances.

    8. Compliance Gap Summary

    Overall compliance readiness: 8/100 (MVP stage — expected)

    AreaReadinessGap
    Licensing (Finanstilsynet)0%No license — no live transactions permitted
    PSD2 / SCA10%BankID not implemented; SCA not in place
    AML/KYC5%Mock KYC only; no real identity verification
    GDPR15%Privacy notice + DPIA drafted; no DPO appointed
    ICT Security25%Security hardened (post 2026-02-13); pentest pending
    Valutaregisterloven0%No SSB reporting pipeline
    Consumer Protection20%Terms drafted; no formal complaints process

    Phase 2 completion target: 60% (licensing + BankID + real KYC + GDPR implementation) Phase 3 completion target: 85% (pentest + Valutaregisteret + full GDPR + DPO)

    9. Compliance Monitoring Plan

    Monthly Checks

    Quarterly Checks

    •  KYC data retention audit (5-year AML retention compliance)
    •  GDPR data subject rights fulfillment review
    •  JWT_SECRET rotation (quarterly per key management policy)
    •  Review of AML transaction monitoring rules effectiveness
    •  Security exceptions review

    Annual Checks

    •  External security penetration test (required before Phase 3 launch)
    •  AML risk assessment review (Hvitvaskingsloven § 6)
    •  DPIA review (GDPR Art. 35 — when processing changes materially)
    •  All encryption keys rotation audit
    •  Regulatory change review — Finanstilsynet circulars
    •  DPAs review (AWS, Cloudflare, Sentry, BetterStack, Sumsub, BankID Norge AS)

    10. Third-Party Compliance

    All third-party processors of personal data require a signed Data Processing Agreement (DPA).

    VendorRoleDPA StatusData Transferred
    AWS (Frankfurt, Ireland)Infrastructure + hostingRequiredAll data
    Cloudflare (EU edge)CDN, WAF, DDoSRequiredRequest metadata, IPs
    SentryError monitoringRequiredError data, stack traces
    BetterStackUptime + logsRequiredLog data
    SumsubKYC verification (Phase 2)RequiredName, photo ID, fødselsnummer
    BankID Norge ASeID authentication (Phase 2)RequiredName, fødselsnummer, DOB
    Marqeta / LithicCard issuance (Phase 3)RequiredPayment data (PCI-DSS)

    DPA requirement source: GDPR Art. 28; Personopplysningsloven § 5

    11. Document Register

    Plan:
  • Bilko
    • Compliance:../../products/Bilko/docs/security/COMPLIANCE.md
  • Serbia
  • BiH
  • Croatia
    • Regulatory:../../products/Bilko/docs/regulatory/HR/README.md
    DocumentFileStatusOwner
    Privacy noticepersonvernerklaering.mdDraftDPO
    DPIAdpia-vurdering.mdDraftDPO
    Terms of servicebrukervilkar.mdDraftLegal
    AML procedureshvitvaskingsrutiner.mdDraftCompliance
    AML risk assessmentrisikovurdering-hvitvasking.mdDraftCompliance
    ICT security policyikt-sikkerhetspolicy.mdDraftSecurity
    Incident handlinghendelseshaandtering.mdDraftSecurity
    Business continuityberedskapsplan.mdDraftOperations
    Outsourcing policyutkontraktering-policy.mdDraftLegal
    Internal controlinternkontroll.mdDraftCompliance
    Suitability assessmentegnethetsvurdering.mdDraftLegal
    Complaint handlingklagebehandling.mdDraftOperations
    Licensing preparationkonsesjonssoknad-forberedelse.mdDraftLegal
    Gap analysisdrop-gap-analysis-v2.mdCompleteCompliance
    Regulatory mapdrop-regulatory-map-v2.mdCompleteLegal
    Security architecturesecurity-architecture.mdDraftSecurity
    Encryption policydata-encryption-policy.mdDraftSecurity
    Key management policykey-management-policy.mdDraftSecurity
    Breach responseResponse plan data-breach-response-plan.md DraftSecurity
    SecurityRegulatory: testing../../products/Bilko/docs/regulatory/RS/README.md policysecurity-testing-policy.Regulatory: ../../products/Bilko/docs/regulatory/BA/README.md DraftSecurity

    Approval

    Role Name Date Signature
    Author SecurityCompliance Architect 2026-02-23
    DPO
    Legal Counsel
    CEO
    Back to top