Compliance Framework

Compliance Framework Document

Project: BilkoDrop — BalkanFintech AccountingPayment SaaSApp (ALAI Holding AS) Version: 1.0 Date: 2026-02-23 Author: ALAI Compliance ArchitectTeam Status: Draft Reviewers: DPO, Legal Counsel, CEO Classification: Confidential

Document History

Version	Date	Author	Changes
0.1	2026-02-2312	Compliance ArchitectAgent (ALAI)	Initial draftgap —analysis RS/BA/HRand three-country complianceregulatory mapping
1.0	2026-02-23	Security Architect (ALAI)	Framework document

---

1. Applicable Regulations

Compliance Owner:Overall Compliance ArchitectReadiness ([email protected])MVP Last Review:stage, 2026-02-23 | Next Review:13): 2026-08-238/100 — Pre-production MVP. No live transactions.

10%

Regulation	CountryNorwegian Law	PhaseApplicability	Status
GDPRPSD2	Betalingstjenesteloven (LOV-2018-11-23-85)	Core — Regulationpayment (EU)services 2016/679regulation	HR	Phase 1ready
Zakon o zaštiti podataka o ličnosti (ZZPL, Sl. glasnik RS 87/2018)AML/KYC	RSHvitvaskingsloven (LOV-2018-06-01-23)	Core — anti-money laundering	5% ready
GDPR	Personopplysningsloven (LOV-2018-06-15-38)	Core — personal data protection	15% ready
ICT Security	IKT-forskriften / DORA (EU) 2022/2554	Required for financial enterprises	25% ready
Financial Enterprise	Finansforetaksloven (LOV-2015-04-10-17)	Licensing and governance	0% ready
Currency Registry	Valutaregisterloven (LOV-2004-12-17-109)	Cross-border payment reporting	0% ready
Consumer Protection	Finansavtaleloven (LOV-2020-12-18-146)	User rights	Partial

Source: legal/drop-regulatory-map-v2.md, legal/drop-gap-analysis-v2.md

Compliance Owner: Alem Bašić, CEO/CISO — ALAI Holding AS ([email protected]) External Auditor: TBD — requires appointment before license application Last Audit: 2026-02-12 (internal security audit) | Next Audit: TBD (prior to license application)

---

2. GDPR Compliance

Source: legal/personvernerklaering.md, legal/dpia-vurdering.md, legal/drop-regulatory-map-v2.md §4

2.1 Requirements Summary

Article	Requirement	Our Implementation	Status
Art. 5	Data minimization, purpose limitation	Only collect necessary fields; DPIA documents necessity	Partial
Art. 6	Lawful basis for processing	See §2.2	Partial
Art. 7	Consent — specific, informed, unambiguous	Consent management TBD	Not implemented
Art. 13/14	Privacy notice at collection	legal/personvernerklaering.md (draft, Norwegian)	Draft exists
Art. 17	Right to erasure	TBD — account deletion flow not built	Planned Phase 2
Art. 20	Right to data portability	TBD — data export feature planned	Planned Phase 2
Art. 25	Privacy by design and default	Pass-through model minimizes data held	Architectural
Art. 30	Records of processing activities	legal/behandlingsprotokoll.md — TBD	Not created
Art. 32	Appropriate security measures	See security-architecture.md	Partial
Art. 33	72-hour breach notification	See data-breach-response-plan.md	Documented
Art. 35	DPIA for high-risk processing	legal/dpia-vurdering.md	Draft exists
Art. 37	DPO designation	TBD — not yet appointed	Not done
Art. 44	Cross-border transfers	SCCs required — see §2.4	Planned

2.2 Lawful Basis Inventory

Processing Activity	Lawful Basis	Legal Basis Document	Retention
Account creation and management	Contract (Art. 6.1.b)	legal/brukervilkar.md (Terms)	Duration + 2 years
Payment initiation (PISP)	Contract (Art. 6.1.b)	legal/brukervilkar.md	5 years (Bokføringsloven)
Account info reading (AISP)	Consent (Art. 6.1.a)	Consent at onboarding	Until consent withdrawn
AML/KYC identity verification	Legal obligation (Art. 6.1.c)	Hvitvaskingsloven §§ 10-18	5 years (hvvl. §30)
Transaction monitoring	Legal obligation (Art. 6.1.c)	Hvitvaskingsloven §§ 24-25	5 years (hvvl. §30)
Fraud detection	Legitimate interest (Art. 6.1.f)	LIA documented in DPIA	2 years
Security logging	Legitimate interest (Art. 6.1.f)	IKT-sikkerhetspolicy	12-24 months
Marketing emails	Consent (Art. 6.1.a)	Consent record	Until consent withdrawn

2.3 Controls Mapping

Control	Requirement	Status	Evidence
Privacy notice (Norwegian)	Art. 13/14	Draft	legal/personvernerklaering.md
DPIA	Art. 35	Draft	legal/dpia-vurdering.md
DPO contact	Art. 37	Not done	TBD — DPO appointment needed
Data breach response plan	Art. 33	Documented	docs/SECURITY-COMPLIANCE/data-breach-response-plan.md
Data processing agreements	Art. 28	Partial	legal/dpa-sumsub.md, dpa-swan.md, dpa-sentry.md
SCCs for non-EEA transfers	Art. 46	Planned	Required for remittance corridors
Register of processing activities	Art. 30	Not created	legal/behandlingsprotokoll.md to be completed

2.4 Data Subject Rights — Implementation

Right	Status	Target Implementation
Access (Subject Access Request)	Not built	GET /api/users/me/data-export — Phase 2
Rectification	Partial	PATCH /api/users/me — settings update exists
Erasure	Not built	Account deletion + anonymization — Phase 2
Portability	Not built	JSON export endpoint — Phase 2
Restriction of processing	Not built	Phase 2
ZakonObjection oto zaštiti ličnih podataka BiH (ZZLP, Sl. glasnik BiH 49/2006)processing	BANot built	Support flow — Phase 32

SLA target: 30 days per GDPR requirement.

2.5 Cross-Border Transfer Compliance

Drop remittance to 30+ countries triggers GDPR Chapter V requirements:

Transfer	Mechanism	Status
Drop → EEA countries (PLN, EUR)	Free flow — no restriction	Compliant
ZakonDrop o→ računovodstvu (Sl. glasnik RS 73/2019)UK	RSAdequacy decision	Compliant
Drop → Serbia (RSD)	SCCs + Transfer Impact Assessment	Planned
Drop → Bosnia-Herzegovina (BAM)	SCCs + TIA	Planned
Drop → Turkey (TRY)	SCCs + TIA	Planned
Drop → Pakistan (PKR)	SCCs + TIA + supplementary measures	Planned — high risk

Data minimized in transfer: Only sender name, recipient name/account, amount, currency, reference. Fødselsnummer NEVER transferred cross-border.

Source: legal/dpia-vurdering.md §7

---

3. PSD2 / SCA Compliance

Source: legal/drop-regulatory-map-v2.md §2, legal/drop-gap-analysis-v2.md §2

3.1 Strong Customer Authentication (SCA)

Current state: NOT compliant — email + password only (single factor). No BankID integration. Required: BankID integration for SCA (Phase 2, BLOCKING for live transactions).

SCA Requirement	Law	Status
Two of three factors (knowledge/possession/inherence)	Betalingstjenesteloven §§ 4-28, 4-29	NOT IMPLEMENTED
Dynamic linking (amount + payee bound to auth code)	Delegated Reg. (EU) 2018/389 Art. 5	NOT IMPLEMENTED
90-day re-authentication	Delegated Reg. Art. 10	NOT IMPLEMENTED
BankID integration (covers possession + knowledge)	Required for Norwegian residents	PLANNED Phase 2

3.2 Open Banking (AISP/PISP)

Requirement	Status
AISP license or agent arrangement	NOT OBTAINED
PISP license or agent arrangement	NOT OBTAINED
PSD2 API integration (Neonomics)	PLANNED Phase 2
No storing of bank credentials	Architectural (pass-through model)
PSU explicit consent before account access	PLANNED Phase 2

Licensing path: Agent model under licensed PSP (1-3 months) while preparing full license (6-12 months). See §4.

3.3 Consumer Protection (PSD2)

Requirement	Status	Document
Framework agreement	Draft	legal/brukervilkar.md
Fee transparency pre-authorization	Partial	Fee shown post-submission in API
Transaction receipts	Not built	Phase 2
ZakonExecution otime računovodstvu i reviziji FBiH (Sl. novine FBiH 83/2009)disclosure	BANot (FBiH)	Phase 3
Zakon o računovodstvu i reviziji RS BiH (Sl. glasnik RS BiH 96/2005)	BA (RS entity)	Phase 3
Zakon o računovodstvu HR (NN 78/15, 120/16, 116/18)	HR	Phase 2
Zakon o PDV RS (Sl. glasnik RS 84/2004 et al.)	RS	Phase 2
Zakon o PDV BiH (Sl. glasnik BiH 9/2005 et al.)	BA	Phase 3
Zakon o porezu na dodanu vrijednost HR (NN 73/13 et al.)	HR	Phase 2
Zakon o elektronskom dokumentu RS (Sl. glasnik RS 51/2009)	RS	Phase 2
Opći porezni zakon HR (NN 115/16 et al.)	HR	Phase 2
Pravilnik o kontnom okviru RS (2021)	RS	Phase 2
FBiH Pravilnik o kontnom okviru (2022)	BA (FBiH)	Phase 3
RRiF Kontni plan HR	HRbuilt	Phase 2

---

2.4. SerbiaFinanstilsynet (RS) — Regulatory ComplianceLicensing

2.1 Data Protection — Zakon o zaštiti podataka o ličnosti (ZZPL)

Source: legal/drop-regulatory-map-v2.md §1, legal/konsesjonssoknad-forberedelse.md

4.1 License Options

Option	Timeline	Capital	Scope
Agent model (under existing licensee)	1-3 months	None from Drop	Fastest to market
Begrenset betalingsforetak	3-6 months	None (simplified)	Max 6M NOK/month volume
Ordinaert betalingsforetak	6-12 months	125,000 EUR	Full name:EEA passporting

Recommended path: ZakonAgent omodel zaštitifirst podataka→ oBegrenset ličnostibetalingsforetak Citation:for Sl.initial glasniklaunch RS→ br.Ordinaert 87/2018for InScandinavian force:expansion.

November

4.2 21,Licensing 2018 Description: Serbia's GDPR-aligned personal data protection law. Supervisory authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti Website: https://www.poverenik.rs

Readiness

name,PIB/JMBGonly

Requirement	ZZPL ArticleStatus	Bilko ImplementationGap
LawfulBusiness basisplan forwith processing3-year projections	Art. 12Draft	Contract (Art. 12 st. 1 tač. 2) — accounting servicePartial
DataAML minimizationpolicy and procedures	Art. 5 st. 1 tač. 3Draft	Email,legal/hvitvaskingsrutiner.md
Fit where& legallyproper documentation	Not done	Board/management CVs + police certs needed
Compliance officer designated	Not done	Appointment required
DataClient subjectfund rightssafeguarding	Art.N/A 26-41(pass-through)	GETN/A /account/data,— DELETEDrop /account,never GETholds /account/exportfunds
ProcessingIT registersecurity policy	Art. 50Draft	Internal processing register requiredlegal/ikt-sikkerhetspolicy.md
SecurityIncident ofhandling processingplan	Art. 50Draft	TLS 1.3, AES-256, bcrypt, RBAClegal/hendelseshaandtering.md
BreachOutsourcing notification to Poverenikpolicy	Art. 56Draft	Within 72 hours of awarenesslegal/utkontraktering-policy.md

---

5. AML/KYC Compliance

Breach notification:Source: [email protected]legal/hvitvaskingsrutiner.md, | Bulevar kralja Aleksandra 15, 11000 Belgradelegal/risikovurdering-hvitvasking.md

2.25.1 AccountingAML LawProgram — Zakon o računovodstvuStatus

Full name: Zakon o računovodstvu Citation: Sl. glasnik RS br. 73/2019, 44/2021

Implementationenforces debitAccountId + creditAccountIdCoA seed data Sheet) +—harddeletefinancial

Requirement	BilkoStatus	Document
Double-entryEnterprise-wide bookkeepingrisk assessment	SchemaDraft	legal/risikovurdering-hvitvasking.md
ChartAML ofpolicy accounts:and Pravilnik o kontnom okviru (2021) — 10 class (0-9)procedures	SerbianDraft	legal/hvitvaskingsrutiner.md
BilansAML stanjaCompliance Officer appointed	NOT DONE	Appointment required
KYC procedures (BalanceCDD)	Mock only	Real KYC via BankID + BilansSumsub uspeha— (IncomePhase Statement)2
Transaction monitoring system	NOT IMPLEMENTED	Phase 2
PEP screening	NOT IMPLEMENTED	Phase 2 reports(ComplyAdvantage / Refinitiv)
Filing:Sanctions APR (https://www.apr.gov.rs), deadline June 30screening	PDFNOT exportIMPLEMENTED	Phase reminders2
DocumentSTR retention:reporting 10to yearsEFE (Altinn)	SoftNOT deleteIMPLEMENTED	Phase never2
Staff dataAML training	NOT DONE	Required
5-year record retention	NOT IMPLEMENTED	Phase 2

2.35.2 VATTransaction —Monitoring Zakon o PDV

Citation: Sl. glasnik RS br. 84/2004Thresholds (consolidated)

Planned) goodsmedicines,

RateRule	DescriptionThreshold	Action
20%Single (opšta stopa)transaction	Standard> —NOK general50,000	Manual and servicesreview
10%Daily (snižena stopa)cumulative	Reduced> —NOK food,100,000	Manual utilitiesreview
0%Monthly cumulative	Exports,> internationalNOK transport500,000	EDD assessment
High-risk corridor transactions	> 5/week same corridor	Manual review
Structuring detection	Multiple just-under-threshold	Automatic flag

VAT threshold:Source: 8,000,000legal/hvitvaskingsrutiner.md RSD | Return: Monthly (>50M RSD) or Quarterly | Deadline: 15th of next month§5.2

2.45.3 E-InvoiceCorridor —Risk SEF (Sistem e-Faktura)Classification

Platform: https://efaktura.gov.rs | Mandatory: B2B since January 2023 Format: UBL 2.1 XML | Penalties: 50,000–2,000,000 RSD for non-compliance Integration: @bilko/country-rs package (Phase 2)

2.5 APR Filing

Serbian entities file annual financial reports with APR (Agencija za privredne registre). Deadline: June 30. Bilko generates APR-compatible PDF/XML exports.

---

3. Bosnia & Herzegovina (BA) — Regulatory Compliance

Complexity: BiH has two entities (FBiH and Republika Srpska). VAT unified at state level via UIO. Direct taxes separate per entity.

3.1 Data Protection — Zakon o zaštiti ličnih podataka BiH (ZZLP)

Full name: Zakon o zaštiti ličnih podataka Bosne i Hercegovine Citation: Sl. glasnik BiH br. 49/2006, 76/2011, 89/2011 Supervisory authority: AZLP — Agencija za zaštitu ličnih podataka Bosne i Hercegovine Website: https://www.azlp.ba

RequirementRisk Level	ZZLP ArticleCorridors	Bilko ImplementationActions
Lawful basisLow	Art.EU/EEA 4(PLN, EUR), UK	ContractStandard + legal obligationCDD
Security measuresMedium	Art.Serbia 14(RSD), Bosnia (BAM), Turkey (TRY)	TLSStandard 1.3,CDD AES-256,+ bcrypt,lower RBACthresholds
Cross-border transferHigh	Art.Pakistan 18(PKR)	RailwayMandatory EUEDD, Westsource —of SCCsfunds mechanismrequired
Breach notification to AZLPBlocked	Art.FATF 14blacklist +/ GDPREU practicehigh-risk / UN sanctions	72System-level hoursblock

Breach notification: [email protected] | Hamdije Čemerlića 2/VI, 71000 Sarajevo

3.2 FBiH — Accounting Law

Full name: Zakon o računovodstvu i reviziji Federacije Bosne i Hercegovine Citation: Sl. novine FBiH br. 83/2009, 56/2023

Requirement	Bilko Implementation
Double-entry bookkeeping	Schema enforced
Chart of accounts: FBiH Pravilnik (2022)	BiH CoA seed data
Filing: Agency of Financial Information (FBiH), deadline March 31	PDF export
Document retention: 10 years	Immutable storage

3.3 Republika Srpska (BA Entity)

Citation: Sl. glasnik RS BiH br. 96/2005, 74/2016 Filing: Tax Administration of RS (BiH entity), March 31 Retention: 11 years — maximum applied across BA entities

3.4 VAT — Zakon o PDV BiH

Citation: Sl. glasnik BiH br. 9/2005 (consolidated) Authority: UIO — Uprava za indirektno oporezivanje | https://www.uino.gov.ba

Rate	Description
17% (opća stopa)	Standard — all goods and services
0%	Exports

Threshold: 100,000 BAM | Return: Monthly | No reduced rates

3.5 E-Invoice — CPF (Central Platform for Fiscalisation)

Status: PENDING — technical specifications not published Law adopted: January 2026 (FBiH only) Expected: ~2027

Bilko decision: DO NOT implement CPF until specs published. BiH is Phase 3 launch.

3.6 Corporate Income Tax

Entity	Rate	Deadline
FBiH	10%	March 31
RS (BiH entity)	10%	March 31

---

4. Croatia (HR) — Regulatory Compliance

Note: Croatia is EU member state. GDPR applies directly.

4.1 Data Protection — GDPR

Applicable: GDPR Regulation (EU) 2016/679 (directly applicable) National implementing act: Zakon o provedbi Opće uredbe (NN 42/2018) Supervisory authority: AZOP — Agencija za zaštitu osobnih podataka | https://azop.hr

Requirement	GDPR Article	Bilko Implementation
Lawful basis	Art. 6	Contract (6.1.b) for service; legal obligation (6.1.c) for tax
Data minimization	Art. 5(1)(c)	OIB, name, email only
Right to access	Art. 15	GET /api/v1/account/data
Right to erasure	Art. 17	DELETE /api/v1/account
Right to portability	Art. 20	GET /api/v1/account/export
Security of processing	Art. 32	TLS 1.3, AES-256, bcrypt, RBAC
Breach notification to AZOP	Art. 33	Within 72 hours
DPA with processors	Art. 28	Railway, Vercel, Cloudflare, SendGrid

Breach notification: [email protected] | https://azop.hr/prijavapovrede | Selska cesta 136, 10000 Zagreb

4.2 Accounting Law — Zakon o računovodstvu HR

Citation: NN 78/15, 120/16, 116/18, 42/20

Requirement	Bilko Implementation
Double-entry bookkeeping	Schema enforced
Chart of accounts: RRiF standard	HR CoA seed data
Accounting standards: CFRS (SMEs) or IFRS (PIEs)	CFRS-compliant reports
Bilanca + Račun dobiti i gubitka	Report generation Phase 2
Filing: FINA RGFI (https://www.fina.hr), deadline April 30	FINA-compatible export
Document retention: 11 years	Immutable storage

4.3 General Tax Law — Opći porezni zakon HR

Citation: NN 115/16, 106/18, 121/19, 32/20 Document retention 11 years, electronic record acceptance, digital accounting system obligations.

4.4 VAT — Zakon o PDV HR

Citation: NN 73/13 et al. | Portal: ePorezna — https://www.porezna-uprava.hr

Rate	Description
25% (opća stopa)	Standard — general goods and services
13% (srednja stopa)	Intermediate — foods, water, accommodation
5% (snižena stopa)	Reduced — books, baby food, medicines
0%	Exports, intra-EU supply

Threshold: 60,000 EUR | Return: Monthly | Deadline: Last day of next month

4.5 E-Invoice — HR-FISK / eRačun

Platform: https://hr-fisk.fina.hr | Operator: FINA — Financijska agencija Mandatory since: January 1, 2026 (all B2B, B2G, B2C) Format: UBL 2.1 XML with HR-CIUS | Protocol: AS4 (Peppol-compatible) Certificate: FINA qualified certificate required Penalties: Up to EUR 500,000 for non-compliance Archive: 11 years

Integration: @bilko/country-hr — FINA certificate + API (Phase 2)

4.6 Corporate Income Tax — Croatia

• Standard rate: 18% | Reduced: 10% (revenue <1M EUR) | Deadline: April 30

---

5. Cross-Country Compliance Matrix

Requirement	Serbia (RS)	Bosnia & Herzegovina (BA)	Croatia (HR)
Data protection law	ZZPL (GDPR-aligned, 2018)	ZZLP BiH (2006)	GDPR (directly applicable)
Supervisory authority	Poverenik	AZLP	AZOP
Breach notification deadline	72 hours (ZZPL Art. 56)	72 hours (best practice)	72 hours (GDPR Art. 33)
VAT standard rate	20%	17%	25%
VAT reduced rate	10%	None	13% / 5%
E-invoice platform	SEF (mandatory Jan 2023)	CPF (pending ~2027)	HR-FISK (mandatory Jan 2026)
E-invoice format	UBL 2.1 XML	TBD	UBL 2.1 XML (HR-CIUS)
Annual report filing	APR — June 30	Agency Fin. Info / Tax Admin — March 31	FINA RGFI — April 30
Chart of accounts	Pravilnik (2021)	FBiH Pravilnik (2022)	RRiF standard
Document retention	10 years	10 (FBiH) / 11 (RS entity)	11 years
Currency	RSD	BAM	EUR
CIT rate	15%	10%	18% (10% <1M EUR)

Bilko retention policy: Apply maximum across all markets — 11 years for all financial records. Never hard delete.

---

6. Data Classification Scheme

fee

Level	Label	Description	Examples	Controls
L1	Public	ExchangePublic-facing rates,content	Landing schedule,page, privacy policymarketing	None
L2	Internal	AggregatedInternal, analytics,low sensitivity	Internal wikis, non-PII logsanalytics	Access control
L3	Confidential	Email,Sensitive personal or business data	User PII (name, organizationemail, data,phone), invoicetransaction amountsdata	Encryption + access control + auditlogging
L4	Restricted	PIB/JMBG/OIB/JIBHighest (taxsensitivity, IDs),regulatory IBAN, TOTP secrets, password hashesimplications	EncryptionFødselsnummer, +AML RBACreports, JWT secrets	Field-level encryption + MFA + strict access + audit + 11-yearHSM retentionkeys

Tax ID types by country:

• Serbia: PIB (9 digits), JMBG (13 digits)
• BiH: JIB (13 digits)
• Croatia: OIB (11 digits)

---

7. DataConsent SubjectManagement

Rights

7.1 Implementation

Consent Types Required

RightConsent Type	EndpointPurpose	SLA	Exception
Access (GDPR Art. 15 / ZZPL Art. 26)	GET /api/v1/account/data	30 days	—
Rectification (Art. 16)	PATCH /api/v1/account/profile	Immediate	—
Erasure (Art. 17)	DELETE /api/v1/account	30 days	Financial records retained per law
Portability (Art. 20)	GET /api/v1/account/export	30 days	—
Restriction (Art. 18)	[email protected]	30 days	Manual

Erasure exception: Invoices, expenses, transactions retained 10-11 years (accounting law). Only PII (email, name, password hash) anonymized.

---

8. Third-Party Data Processors

sign

Processor	Service	Region	DPA Status
RailwayOpen Banking (AISP)	PostgreSQLReading hostingbank account balances	EUPlanned WestPhase (Frankfurt/Paris)2 — PSD2 explicit consent required
Marketing emails	RequiredEmail —campaigns	Not implemented
Analytics	Product improvement	Not implemented
Cookie consent	Website cookies	Not implemented

7.2 PSD2 Open Banking Consent Requirements

Per Betalingstjenesteloven §§ 4-41 to 4-46:

• Explicit user consent before any AISP access to bank accounts
• Consent scoped per bank account
• Re-consent required every 90 days for AISP
• Consent revocable at any time (immediate effect)
• Consent stored with timestamp, IP, and scope in user_consents table (planned)

---

8. Audit Schedule & Methodology

Audit Type	Frequency	Scope	Owner	Last Done	Status
Internal security review	Quarterly	Application + infrastructure	Security team	2026-02-12	Completed
Penetration test	Annual	Full scope	External firm (TBD)	Not done	Planned pre-launch
VercelAML/compliance review	Frontend hostingAnnual	EUAll edgeAML procedures	RequiredAML Compliance Officer	Not done	Planned Phase 2
CloudflareGDPR compliance review	CDN, WAF, R2 storageAnnual	EUAll regionprocessing activities	RequiredDPO	Not done	Planned Phase 2
SendGridVulnerability assessment	Transactional emailQuarterly	EUExternal attack surface	RequiredSecurity team	2026-02-12	Completed
Business continuity drill	Annual	DR/BCP scenarios	Operations	Not done	Planned Phase 2

---

9. Compliance Roadmap

Training

Phase 1 — Pre-Launch (GDPR baseline)

•  Privacy policy published
•  Terms of Service published
•  User consent mechanism at registration
•  Data deletion + anonymization workflow
•  Data export endpoint
•  DPAs signed: Railway, Vercel, Cloudflare, SendGrid
•  Railway EU West region confirmed
•  Breach notification process ready

Phase 2 — Serbia Launch + Croatia Launch

Serbia:

•  Legal review (accounting law + ZZPL)
•  Serbian CoA seed data (Pravilnik 2021)
•  VAT at 20% / 10%
•  SEF XML export + API integration
•  APR report export (Bilans stanja, Bilans uspeha)

Croatia:

•  Legal review (Zakon o računovodstvu + GDPR)
•  Croatian CoA seed data (RRiF)
•  VAT at 25% / 13% / 5%
•  FINA certificate for HR-FISK
•  HR-FISK API integration (mandatory)
•  FINA RGFI report export

Phase 3 — BiH Launch

•  Legal review (FBiH + RS entity distinction)
•  BiH CoA seed data (FBiH Pravilnik 2022)
•  VAT at 17% (UIO)
•  Monitor CPF specs (~2027)
•  FBiH vs RS entity org settings

---

10. Risk AssessmentRequirements

RiskTraining	LikelihoodAudience	ImpactFrequency	MitigationStatus
GDPR/ZZPLAML breachfundamentals fine(hvvl.)	LowAll (if compliant)staff	HighAnnual (GDPR+ €20M / ZZPL RSD 2M)onboarding	FullNot implementationdone before— first customerrequired
SEFGDPR non-compliance (RS)fundamentals	MediumAll staff handling personal data	High (RSD 2M)Annual	PhaseNot 2 SEF integrationdone
HR-FISKSecure non-compliancecoding (HR)OWASP)	High (if not integrated)Engineering	Critical (EUR 500K)Annual	PhaseNot 2 mandatorydone
FinancialIncident dataresponse losstabletop	LowEngineering + Management	CriticalQuarterly	30-dayNot Railway backups, immutable auditdone
TaxPEP/sanctions calculationscreening errorprocedures	LowCompliance + customer-facing	HighAnnual	ConfigurableNot rates, NUMERIC precision, Zod
BiH CPF delay	Medium	Low	Phase 3 planned, not blocking RS/HRdone

Source: legal/hvitvaskingsrutiner.md §10

---

Related10. DocumentsThird-Party Compliance Requirements

10.1 Critical Vendor Register

Vendor	Service	Tier	Certifications	DPA Signed	Status
BankID Norge AS	SCA / Identity	Critical	eIDAS Level High	Required	Planned
Sumsub	KYC/AML	Critical	SOC 2, ISO 27001	Yes — legal/dpa-sumsub.md	Signed
Swan	Banking / payment rails	Critical	PCI-DSS, SOC 2	Yes — legal/dpa-swan.md	Signed
Neonomics	PSD2 AISP/PISP	Critical	PSD2 license (EU)	Required	Planned
AWS	Infrastructure	Critical	SOC 2 Type II, ISO 27001, PCI-DSS	AWS DPA	Standard
Sentry	Error monitoring	High	SOC 2	Yes — legal/dpa-sentry.md	Signed

10.2 Outsourcing Policy

Source: legal/utkontraktering-policy.md

All material outsourcing relationships must:

• SecurityHave Architecture:a security-architecture.mdwritten contract with DPA if processing personal data
• DPIA:Include data-protection-impact-assessment.mdright to audit clause
• BreachInclude Responsesub-processor Plan:approval data-breach-response-plan.mdrequirements
• BilkoHave Compliance:an ../../products/Bilko/docs/security/COMPLIANCE.mdexit strategy documented
• SerbiaBe Regulatory:notified ../../products/Bilko/docs/regulatory/RS/README.md
to
• BiHFinanstilsynet Regulatory:if ../../products/Bilko/docs/regulatory/BA/README.md
material
• Croatia(Finansforetaksloven Regulatory:§ ../../products/Bilko/docs/regulatory/HR/README.md13-7)

---

11. Compliance Monitoring

Current state: Manual tracking only. No automated compliance dashboard.

Target metrics (Phase 2):

Metric	Target	Alert Threshold
Open Critical compliance issues	0	> 0
KYC approval backlog	< 24h	> 48h
AML flagged transactions unreviewed	0 after 24h	> 0 after 48h
Data subject requests overdue	0	> 25 days
License application milestones	On schedule	Any delay
Vendor certifications expired	0	> 0
AML training completion	100%	< 100%

---

Approval

Role	Name	Date	Signature
Author	ALAI Compliance ArchitectTeam	2026-02-23
DPO	TBD — appointment required
CISO	TBD — appointment required
Legal Counsel	TBD — engagement required
CEO	Alem Bašić