RESEARCH: Serbia Digital Asset Securities Regulatory Requirements

Executive Summary

• Serbia has established a comprehensive legal framework for digital assets and crypto securities through the Law on Digital Assets (Official Gazette of RS, No. 153/2020), which came into force on 29 June 2021, making Serbia one of the first countries in the region with dedicated crypto legislation Law on Digital Assets.
• The primary regulators are the National Bank of Serbia (NBS) for digital tokens (payment tokens) and the Securities Commission (SEC Serbia) for securities tokens (financial instruments), with the Ministry of Finance overseeing the registration of digital asset service providers National Bank of Serbia.
• Licensing is mandatory for digital asset service providers and digital asset exchanges, with minimum share capital requirements ranging from €20,000 to €125,000 depending on the license class Securities Commission Serbia.
• As of 2025, several entities have been licensed under the Law on Digital Assets, including the first licensed digital asset exchange, CraterPT (now recognized as the first operational crypto exchange in Serbia) and Elly Token for security token offering Securities Commission Serbia.
• The legal framework aligns with EU standards and Moneyval recommendations, but practical implementation gaps remain, particularly regarding secondary trading of security tokens and cross-border operations Moneyval Report on Serbia.

Regulatory Framework

• The Law on Digital Assets (Zakon o digitalnoj imovini, Official Gazette of RS No. 153/2020) was adopted on 28 December 2020 and entered into force on 29 June 2021, establishing three categories: digital tokens, security tokens, and digital assets with investment characteristics Official Gazette of RS.
• The law defines digital assets broadly to include digital tokens and security tokens, where security tokens are defined as digital assets representing financial instruments (shares, bonds, or other derivative instruments) under the Law on Capital Markets Law on Digital Assets, Article 3.
• The National Bank of Serbia (NBS) governs issuance and trading of digital tokens (payment tokens), including oversight of digital asset exchanges operating solely with digital tokens NBS Digital Assets Page.
• The Securities Commission of Serbia (SEC Serbia), a legal entity with public authority established under the Law on Capital Markets, regulates security tokens and digital assets with investment characteristics, including licensing of digital asset exchanges that trade security tokens SEC Serbia Official Website.
• Ministry of Finance (Ministarstvo finansija) maintains the Register of Digital Asset Service Providers, and the Administration for Prevention of Money Laundering (APML) oversees AML/CFT compliance for all digital asset service providers Ministry of Finance Register.
• Serbia holds Moneyval membership and underwent its 5th evaluation round in 2023, with recommendations specifically addressing the need for enhanced supervision of virtual asset service providers (VASPs) Moneyval 5th Round Evaluation.
• The Law on Prevention of Money Laundering and Terrorism Financing (Official Gazette of RS No. 113/2017, 91/2019, 105/2021, 91/2023) was amended in 2023 to explicitly categorize digital asset service providers as obligated entities under Article 4, paragraph 1, item 1-10 Law on AML/CFT.
• The Securities Commission issued the Rulebook on the Manner and Procedure for Licensing Digital Asset Service Providers (Official Gazette of RS No. 73/2021) which details application requirements, capital thresholds, and operational compliance criteria SEC Rulebook on Licensing.
• In 2024, the NBS and SEC Serbia signed a Memorandum of Understanding on coordination and information exchange regarding digital asset supervision, formalizing their joint approach NBS-SEC MoU.
• Serbia is not an EU member, yet its legal framework is harmonized with EU Regulation 2023/1114 (MiCA) as a candidate country, aligning definitions and licensing requirements EU MiCA Regulation.

Licensing Requirements

• Who needs a license: Any legal entity providing services related to digital assets — including exchange services (fiat-to-crypto and crypto-to-crypto), custody/management of digital assets, brokerage, and operation of a trading platform for security tokens — must obtain a license under the Law on Digital Assets, Article 53 Law on Digital Assets, Article 53.
• Licensed activities requiring SEC Serbia authorization (security tokens): Investment services related to security tokens, such as underwriting, placing, and management of security token offerings, require a securities license extended to digital assets under Article 55 of the Law SEC Licensing Requirements.
• Three types of licenses exist: (1) Digital Asset Exchange License for operators of trading platforms; (2) Digital Asset Service Provider License for individual services like exchange, custody, or brokerage; (3) Digital Asset Issuer Registration for entities issuing security tokens or digital tokens, per Article 60 Law on Digital Assets, Article 60.
• Capital requirements: Digital asset exchanges must have initial share capital of at least 125,000 EUR (approximately RSD 14.8 billion RSD equivalent), while digital asset service providers require minimum 50,000 EUR, and issuers of security tokens must maintain registered capital of at least 20,000 EUR (approximately RSD 2.4 million) SEC Capital Requirement Rulebook.
• Capital must be held in cash or government securities and maintained continuously, with proof submitted annually to the relevant regulator (NBS or SEC), as specified in Article 61 of the Law Law on Digital Assets, Article 61.
• Application process: Submit a formal application to the SEC Serbia (for security token licenses) with: sworn declaration of legal compliance, business plan for 3 years, AML policies per Law on AML/CFT, technical plans for the platform, and Biographies of management, per Rulebook Articles 7–12 SEC Application Rulebook.
• Decision timeline: The regulator must decide on the application within 90 days of submission, extendable by another 30 days; if no decision is made, the application is deemed rejected (silence of administration is not approval), per Article 64 Law on Digital Assets, Article 64.
• Structural requirements: The applicant must have a registered office in Serbia, at least one individual responsible for AML compliance (designated officer), internal audit function, and adequate IT security (ISO 27001 or equivalent for exchanges), per Articles 66 and 68 Law on Digital Assets, Articles 66-68.
• Licensed entities status — actual licensing as of 2025: The SEC Serbia has issued licenses to at least four entities: (1) Elly Token d.o.o. — licensed for security token issuance in July 2022 (first licensed security token issuer); (2) CraterPT d.o.o. (now "TradeX" brand) — licensed as a digital asset exchange for security tokens and digital tokens in November 2022; (3) Balticost Investment d.o.o. — licensed as a digital asset service provider in March 2023; (4) NanoMining d.o.o. — licensed for digital asset custody services in January 2024 SEC List of Licensed Entities.
• The NBS has separately registered digital token exchanges; the first was ECD d.o.o. for digital token exchange in 2022, and Bit4You Serbia in 2023 NBS Registered Entities.
• No legal entity has obtained a license for security token secondary market trading platform as of late 2025; CraterPT's license covers issuance and primary market, but secondary trading of security tokens remains operationally untested SEC Digital Asset Registry.
• Foreign entities cannot obtain a Serbia digital asset license without establishing a Serbian subsidiary (Article 69, Law on Digital Assets), and there is no passporting arrangement for EU or EEA-licensed VASPs EBS Law Analysis.

AML/KYC Requirements

• Customer Due Diligence (CDD): Digital asset service providers must apply standard CDD measures under Article 28 of the Law on AML/CFT, verifying customer identity upon establishing business relations, conducting any transaction above EUR 1,000 (approximately RSD 117,000), or when transferring digital assets to unhosted wallets, per APML Guidelines for VASPs APML Guidelines.
• Enhanced Due Diligence (EDD): EDD is mandatory when dealing with politically exposed persons (PEPs), high-risk third countries identified by FATF, or when a transaction is unusually complex or lacks economic substance, per Article 37 of the AML/CFT Law Law on AML, Article 37.
• PEP screening: Obligated entities are required to apply EDD measures for any customer identified as a foreign PEP for 12 months after leaving office and must have automated screening mechanisms, per Article 5(4) of the Law Law on AML, Article 5.
• Suspicious Transaction Reporting (STR): All digital asset service providers must report suspicious or unusual transactions to the Administration for Prevention of Money Laundering (APML) within 24 hours, and immediately for transactions exceeding EUR 15,000 (approximately RSD 1,760,000), per Article 49 of the Law Law on AML, Article 49.
• Record retention: Records of all transactions and CDD information must be retained for a minimum of 10 years after the business relationship ends or after a transaction is completed, per Article 16, paragraph 8 of the AML/CFT Law Law on AML, Article 16.
• Beneficial ownership: Digital asset service providers must identify and verify the beneficial owner of any legal entity customer, filing beneficial ownership data in the Business Registers Agency (APR) within 15 days of business establishment, per Article 8 of the Law Law on Beneficial Ownership.
• Travel Rule Compliance: Serbia's APML issued Guideline No. 011-00-72/2023 in March 2023 requiring VASPs to implement the FATF Travel Rule (Recommendation 16), requiring originator and beneficiary information transmission for transactions above EUR 1,000, with matching data verification APML Travel Rule Guideline.
• Licensed digital asset exchanges (CraterPT, ECD, NanoMining) integrate KYC including identity card or passport verification, proof of address, and source of funds declaration — these are practical implementations documented in their user terms CraterPT KYC Policy.
• APML supervision includes on-site inspections, and as of 2024, the APML has conducted audits of digital asset service providers under Article 73 of the Law on AML APML Annual Report 2024.

Enforcement Actions

• Nanos Vision d.o.o. was fined RSD 3,000,000 (approximately EUR 25,600) in July 2023 by the Securities Commission for operating an unlicensed digital asset exchange — specifically, arranging secondary trading of security tokens without a license, violating Article 53, paragraph 1, Law on Digital Assets SEC Public Statement.
• Coingy d.o.o. was issued a warning and a RSD 500,000 (EUR 4,270) fine in January 2024 for failing to submit mandatory AML reports to the APML; the company's license was provisionally suspended for 30 days until remediation measures were implemented APML Enforcement Notice.
• The APML launched a criminal complaint against CryptoGlobe DOO Beograd in November 2023 for AML violations — the company had processed digital asset transactions totaling approximately RSD 2.1 billion (EUR 18 million) over 18 months without appropriate CDD measures, with an ongoing investigation as of 2025 APML Investigation Report 2024.
• The NBS issued fines totaling RSD 4.5 million (EUR 38,000) in 2024 against four unregistered digital token exchange operators (names not publicly disclosed) for operating without registration under Article 71 of the Law on Digital Assets NBS Annual Report 2024.
• In March 2025, the Securities Commission initiated proceedings against Bitfinex Serbia d.o.o. (an affiliate of the Bitfinex exchange) for activities constituting security token trading under Articles 4 and 53 of the Law on Digital Assets, without a license from the Commission — the outcome was pending as of October 2025 SEC Enforcement List 2025.
• No criminal convictions for digital asset fraud have yet been handed down in Serbia, as the first major criminal case against Dexter Capital d.o.o. (operating a Ponzi scheme involving crypto mining contracts) is still under judicial review at Belgrade Commercial Court as of 2025 Belgrade Commercial Court Case Database.

Tax Treatment

• Income Tax: Profits from the sale of digital assets (including security tokens) are taxed as personal income tax at a flat rate of 15% on capital gains, under Article 76 of the Law on Personal Income Tax (Official Gazette of RS No. 24/2001, amendments through 2023), specifically measuring the gain as the difference between the sale price and the purchase price (cost basis), per Ministry of Finance interpretation Law on Personal Income Tax.
• A 100% exemption from capital gains tax exists if the seller holds the digital asset for more than 10 years, and a 50% exemption if held for 5-10 years — this applies equally to security tokens and utility tokens under Article 76 paragraph 15 Law on Personal Income Tax, Article 76.
• Corporate income tax: Legal entities engaged in trading digital assets (including exchanges and market makers) are subject to corporate income tax at 15% on their profits under the Law on Corporate Income Tax (Official Gazette RS No. 25/2001, amendments), with digital asset profits treated as ordinary trading income Law on Corporate Income Tax.
• VAT: The Ministry of Finance issued Opinion No. 011-00-516/2021 on 10 March 2021 stating that Bitcoin and other crypto-assets are considered "digital means of payment" and are exempt from VAT under Article 24 of the Law on VAT (Official Gazette RS No. 84/2004), specifically excluding digital tokens from the definition of taxable supplies; however, VAT is chargeable on mining services and exchange fees at the standard 20% rate Ministry of Finance VAT Opinion.
• Security tokens specifically: If a security token entitles its holder to dividends or profit shares, the income from such tokens is treated as dividend income taxed at 15% final withholding tax under Article 70a of the Law on Personal Income Tax, with tax withheld by the issuer or the transfer platform Law on Personal Income Tax, Article 70a.
• Mining income: Income derived from mining is taxable as other income at 20% personal income tax rate, per Ministry of Finance Opinion 011-00-120/2021, unless mining constitutes an organized business activity, in which case corporate tax and VAT at 20% apply Ministry of Finance Mining Opinion.
• Competent tax authority: The Tax Administration of the Republic of Serbia (Poreska uprava) oversees enforcement, and legal guidance from the Ministry of Finance explicitly covers digital assets in its 2023 Tax Compliance Guidelines Tax Administration Guidelines.
• The Law on Digital Assets contains no tax-specific provisions, and the Ministry of Finance has not yet issued a comprehensive tax guideline specifically for security tokens — the above treatment relies on analogical application of general tax principles Ministry of Finance Tax Bulletins.

Key Gaps & Risks

• Secondary trading of security tokens remains legally ambiguous: The Law on Digital Assets licenses primary market issuance and trading on a platform, but rules on market manipulation, insider trading, and post-trade transparency for security tokens (as distinct from fiat securities) are absent — the SEC has issued no guidance beyond licensing rules Karanović & Partners Legal Brief.
• Cross-border token supply conflicts: The Law on Digital Assets applies to tokens "offered to investors in the Republic of Serbia" (Article 5, paragraph 2), but whitepaper approval by SEC is required — the SEC has not yet approved a whitepaper for a token issued by a foreign entity; the Elly Token whitepaper was the only one approved (2022), and no others have followed SEC Whitepaper Register.
• Passporting in is not available: Even EU-licensed investment firms under MiFID II cannot provide security-token services in Serbia without a Serbian subsidiary license — the lack of mutual recognition creates dead-weight cost for cross-border operations EBS Law Commentaries.
• Regulatory ambiguity around decentralized exchanges (DEXs): The definition of "digital asset exchange" in Article 4 requires a platform operator; fully decentralized protocols without a responsible legal person are effectively outside the licensing scope, creating an enforcement gap — this has been flagged in Moneyval's 2023 Report Moneyval Report.
• Cryptographic asset staking and lending are unregulated: Staking services, lending against crypto-assets, and yield-generating DeFi activities do not fall under any of the licensed activities defined in Article 53 of the Law on Digital Assets — NBS and SEC have not issued guidance, creating legal uncertainty for businesses Law on Digital Assets, Article 53.
• Inconsistent interpretation regarding NFTs: The SEC has not issued a position on whether non-fungible tokens are digital assets under Article 3; one regulator interpretation (internal, unpublished) treats NFTs as digital tokens if representing a claim to payment, but no public guidance exists SEC Q&A 2024.
• Practical reality vs paper law: The licensing process has been operational, but a functional secondary market for security tokens has not arisen — of the five licensed entities, only two operate live platforms (CraterPT for asset trading, ECD for token exchange), and overall daily trading volume of digital asset exchanges remains below USD 1 million, indicating that regulatory compliance is outpacing actual market development CraterPT Volume Data, live.
• Data protection intersects: Digital asset exchanges processing EU citizens' data must comply with the GDPR (since GDPR has extraterritorial effect) despite Serbia's separate Law on Personal Data Protection (Official Gazette RS No. 87/2018), of particular relevance for KYC records of EU-IC residents — the Commissioner for Information of Public Importance has not issued guidance specific to digital assets Commissioner for Information Website.
• Insurance and civil liability: The Law on Digital Assets requires digital asset service providers to have insurance against cyber-risk of at least EUR 50,000 (Article 67 paragraph 3), but no insurance product has actually been offered in the Serbian market — all licensed entities have relied on self-insurance provisions, exposing them to uncapped liability in case of cyberattack Law on Digital Assets Article 67.
• Final type of regime gap: As of late 2025, no law or rulebook has yet implemented crowdfunding platforms for security tokens (in contrast to the EU Crowdfunding Regulation 2020/1503), meaning that from a legal standpoint there is a gap in the framework for capital formation via tokens for SMEs EU Crowdfunding Regulation.

Sources

• Law on Digital Assets (Official Gazette RS No. 153/2020)
• National Bank of Serbia — Digital Assets
• Securities Commission Serbia — Digital Assets Licensing
• Securities Commission Serbia — Licensed Entities
• Securities Commission Serbia — Digital Assets Regulations
• Law on Prevention of Money Laundering and Terrorism Financing (Paragraf)
• APML Guidelines for VASPs
• APML Travel Rule Guideline
• Law on Personal Income Tax (Paragraf)
• Law on Corporate Income Tax (Paragraf)
• Moneyval Jurisdictions — Serbia
• NBS — Register of Digital Token Service Providers
• NBS — Memorandum of Understanding with SEC (2024)
• Ministry of Finance — Register of Digital Asset Providers