Crypto Lawyer, Web3 & Tokenization, Serbia Guide (NCR lawyers Overview & GLE Recommendations)

If you plan to issue, trade or provide services related to tokens and cryptocurrencies in Serbia, you almost certainly need a licence and a structured compliance programme under the country’s Law on Digital Assets. Serbia enacted this dedicated statute, with oversight divided between the National Bank of Serbia (NBS) and the Securities Commission, creating one of the more developed crypto-regulatory frameworks in Southeast Europe. At NCR lawyers, we regularly advise Web3 founders, exchanges and institutional token issuers through every stage of this process, and in this guide I set out the practical roadmap that any crypto lawyer, Web3 project or tokenization venture needs to follow.

Quick Compliance Snapshot, Who Needs a Crypto Licence in Serbia?

Any entity providing virtual-currency services or digital-token services to the public in Serbia must obtain a licence before commencing operations. The Law on Digital Assets defines the triggering activities broadly, so the question is not whether your project is “big enough” but whether it falls within any of the regulated service categories.

In my experience, the fastest way to determine your licensing obligation is to work through a three-step decision flow:

1. Do you hold, store or manage crypto assets on behalf of clients? If yes, you are providing custodial services and need a licence.
2. Do you operate a platform where users can buy, sell or exchange virtual currencies or digital tokens? If yes, you are operating an exchange and need a licence.
3. Do you offer tokens to the public, whether through an ICO, IEO or other sale mechanism? If yes, you will need to prepare a white paper and may require Securities Commission approval, depending on the token classification.

Even a single “yes” answer triggers a regulatory obligation. Answering “no” to all three does not automatically exempt you, ancillary services such as advisory, portfolio management or transfer services for digital assets can also require authorisation.

Licensing Types: NBS vs Securities Commission

The regulatory split in Serbia turns on the nature of the digital asset involved. The NBS licenses and supervises providers of services related to virtual currencies, assets like Bitcoin and Ether that function primarily as a medium of exchange or store of value. The Securities Commission, by contrast, oversees digital tokens that exhibit characteristics of financial instruments, essentially security-like tokens that grant profit-sharing rights, voting rights or represent a claim on an underlying asset. Understanding which regulator governs your activity is the first critical decision any crypto lawyer advising on tokenization in Serbia must make.

Typical Timeline and Documentation Required

A licence application to the NBS typically requires submission of the applicant’s corporate documents, proof of minimum capital, an AML/KYC programme, an IT security assessment and a business plan. For token issuers subject to Securities Commission oversight, a regulated white paper (or “leaflet” for smaller offerings) must also be prepared and approved before any public marketing begins. From my practice, a well-prepared applicant should budget three to six months from initial submission to licence grant, though complex structures or incomplete documentation can extend this timeline significantly.

Token Types and Legal Classification Under Serbia’s Digital Assets Law

Serbia’s Law on Digital Assets draws a clear line between two categories of digital asset, and the legal classification of your token determines which rules, and which regulator, apply.

Token Classification Decision Tree

When I advise clients on how to test whether a token is a security under Serbian law, the analysis follows a structured path:

• Does the token grant the holder a right to share in profits or revenue? If yes, it is likely a digital token subject to Securities Commission oversight.
• Does the token represent an ownership stake or voting right in an entity? If yes, it will almost certainly be classified as a financial instrument.
• Is the token purchased primarily as an investment with the expectation of returns driven by the efforts of others? If yes, the securities characterisation applies regardless of the label the issuer attaches.
• Does the token function solely as a medium of exchange without any investment-return expectation? If yes, it is more likely a virtual currency regulated by the NBS.

Misclassification is one of the most common, and most costly, errors I see in Serbia’s crypto market. An incorrect classification can result in operating without the required licence, which exposes the entity to enforcement action, fines and potential criminal liability.

Licensing Obligations, Supervisory Bodies and the Application Process

Serbia requires all virtual-currency service providers and digital-token service providers to obtain a licence before commencing operations. The process is rigorous and designed to ensure that only entities with adequate capital, governance and compliance infrastructure enter the market.

The step-by-step application process generally follows this sequence:

1. Legal entity formation. The applicant must be incorporated in Serbia (or have an authorised branch) and meet minimum share capital requirements specified by the NBS or the Securities Commission, depending on the service type.
2. Internal compliance build-out. Before submitting an application, the entity must develop and document its AML/KYC programme, IT security policies, business continuity plan and internal governance framework.
3. Application submission. The complete dossier, including corporate documents, proof of capital, compliance manuals, business plan and (for token issuers) a draft white paper, is submitted to the relevant regulator.
4. Regulatory review. The NBS or Securities Commission reviews the application, may request supplementary information and conducts a fit-and-proper assessment of key personnel.
5. Licence grant and ongoing obligations. Once approved, the entity is entered into the relevant register and must comply with continuous reporting, audit and supervisory requirements.

The Securities Commission has published implementing bylaws that specify the detailed content requirements for white papers and rules on advertising token offerings. These bylaws are essential reading for any issuer and should be reviewed carefully with a crypto lawyer experienced in tokenization and Serbia’s digital assets law.

Ancillary Registrations and Record-Keeping

Beyond the primary licence, the NBS requires licensed entities to submit Records of Virtual Currency Holders and to maintain detailed transaction records. These reporting obligations are separate from AML suspicious-activity reporting and serve the NBS’s broader supervisory and statistical functions. Failure to maintain and submit these records can result in regulatory sanctions even where the entity is otherwise compliant.

AML/KYC, Sanctions Screening and CFT, A Practical Checklist for Crypto Businesses in Serbia

Anti-money laundering and know-your-customer obligations are the most operationally demanding aspect of running a crypto business in Serbia. Every licensed virtual-currency and digital-token service provider is classified as an obliged entity under Serbia’s AML framework, which aligns closely with the EU’s Anti-Money Laundering Directives.

From what I am seeing in practice, regulators are paying particular attention to the robustness of AML/KYC crypto compliance in Serbia. I recommend building your programme around the following five-point operational checklist:

1. Adopt written AML/CFT policies and procedures. These must cover customer due diligence (CDD), enhanced due diligence (EDD) for high-risk clients, politically exposed person (PEP) screening and sanctions list checks.
2. Implement robust onboarding processes. Verify the identity of every customer before enabling transactions. For corporate clients, identify the ultimate beneficial owner. Collect and verify source-of-funds information for transactions above prescribed thresholds.
3. Deploy ongoing transaction monitoring. Use automated systems to flag unusual patterns, large single transactions, rapid sequences of transfers, structuring behaviour and transactions with high-risk jurisdictions.
4. File suspicious activity reports (SARs). When monitoring detects activity that raises suspicion of money laundering or terrorist financing, file a SAR with Serbia’s Administration for the Prevention of Money Laundering (APML) without delay and without tipping off the customer.
5. Conduct periodic internal audits. Regularly test the effectiveness of your AML programme through independent internal or external audits and update policies to reflect regulatory changes and emerging typologies.

Data protection rules, including Serbia’s Law on Personal Data Protection, which is modelled on the EU’s GDPR, also apply to the personal information collected during KYC. Entities must ensure lawful processing, data minimisation and secure storage of customer identification records.

Tax Treatment, Accounting and Reporting for Crypto Tokens in Serbia

The tax treatment of crypto assets in Serbia is an area where specific guidance remains limited, and in my view this creates both uncertainty and opportunity for well-advised market participants. Current practice, based on general tax principles and informal regulatory commentary, operates as follows:

• Corporate income tax. Gains from the sale or exchange of digital assets by a Serbian legal entity are generally subject to corporate income tax at the standard rate. The timing and valuation of gains can be complex, particularly for token-to-token exchanges.
• Capital gains tax (individuals). Individual taxpayers who realise gains from crypto transactions may be subject to capital gains tax. The tax base is calculated as the difference between the sale price and the acquisition cost.
• VAT. The VAT treatment of crypto services in Serbia has not been fully clarified. In EU member states, the exchange of virtual currencies for fiat is generally VAT-exempt following EU case law, but Serbia has not issued an equivalent ruling. I advise clients to seek a binding tax opinion before structuring large-scale token operations.
• Withholding tax. Cross-border payments to non-resident service providers (including crypto-related advisory or technology services) may trigger withholding tax obligations, potentially reduced by applicable double tax treaties.

Given the evolving nature of this area, my advice to clients is always to engage a specialist tax advisor early in the structuring phase, ideally alongside their crypto lawyer, to ensure that Web3 and tokenization structures are optimised from both a regulatory and a fiscal perspective.

Structuring Token Offerings, ICOs, NFTs and IP Protection in Serbia

The structuring of a token sale or ICO in Serbia depends on the classification of the token and the scale of the offering. The Law on Digital Assets and its implementing bylaws establish two principal paths:

• Regulated white paper route. For public offerings of digital tokens, the issuer must prepare a white paper that meets content requirements specified in the Securities Commission’s bylaws. This document must disclose the issuer’s identity, the rights attached to the token, risk factors, use-of-proceeds information and technical details of the project. The white paper must be filed with the Securities Commission and, for certain token types, approved before marketing begins.
• Private placement / exemptions. Smaller offerings or those directed exclusively to qualified investors may benefit from lighter-touch requirements, including the use of a simplified “leaflet” instead of a full white paper. However, the exact scope of available exemptions depends on the token classification and the number of offerees.

For ICO legal structuring in Serbia, I recommend including the following contract clauses as a minimum:

• Clear terms of sale defining the rights, restrictions and risks of the token
• Transfer-of-rights provisions specifying what (if anything) transfers alongside the token
• Warranties and representations from the issuer regarding regulatory compliance
• Escrow arrangements for raised funds, with conditions for release and refund
• Governing law and dispute resolution clause (Serbian courts or international arbitration)

NFT IP Protection and Copyright Steps

NFTs raise distinct intellectual property issues under Serbian law. Purchasing an NFT does not, by itself, transfer copyright in the underlying work. To protect NFT creators and buyers, I advise that the minting agreement explicitly address whether copyright is licensed or assigned, the scope of permitted use and any revenue-sharing arrangements. Registering the underlying work with Serbia’s Intellectual Property Office provides additional evidentiary protection in disputes. For NFT copyright in Serbia, clear contractual documentation is the single most effective protective measure.

Cross-Border Operations and MiCA, What EU Regulation Means for Serbia-Based Crypto Projects

Serbia is not an EU member state, which means the EU’s Markets in Crypto-Assets Regulation (MiCA) does not apply directly within Serbian territory. However, any Serbia-based provider that offers services to customers located in EU member states may trigger MiCA obligations in those jurisdictions. The regulation establishes comprehensive licensing, governance and consumer-protection requirements for crypto-asset service providers (CASPs) operating within the EU’s single market.

In my view, the practical impact of MiCA on Serbia is threefold. First, Serbia-based providers targeting EU customers should assess whether they need to obtain authorisation under MiCA or establish an EU-based entity. Second, stablecoin issuers face particularly stringent requirements under MiCA’s Title III and Title IV provisions, which may limit cross-border crypto trading from Serbia into the EU without a compliant structure. Third, voluntary alignment with MiCA standards, even for purely domestic Serbian operations, can strengthen investor confidence and facilitate future EU expansion. Serbia’s EU accession process may eventually lead to harmonisation, and early compliance is a strategic advantage.

Risk Management, Governance and Smart Contract Legal Considerations

Beyond licensing and AML, robust governance is essential for any crypto project operating in Serbia. From what I am seeing in practice, the projects that attract institutional investment and survive regulatory scrutiny are those that treat governance as a core function rather than an afterthought.

I recommend implementing the following risk-mitigation measures:

• Smart contract audits. Commission independent code audits before deploying any smart contract that handles user funds or governs token issuance. Document the audit findings and remediation steps.
• DAO governance frameworks. If the project operates through a decentralised autonomous organisation, establish a legal wrapper (such as a Serbian limited liability company or a foreign foundation) that provides legal personality for contracting, liability and regulatory purposes.
• Escrow and fund-custody controls. Use escrow arrangements for raised funds, with clear release conditions, multi-signature controls and segregation from the entity’s operational accounts.
• Insurance. Explore professional indemnity and cyber-risk insurance policies to cover operational failures, hacking incidents and third-party claims.
• Dispute resolution. Specify in advance whether disputes will be resolved through Serbian courts or international arbitration. For cross-border projects, institutional arbitration (such as ICC or VIAC) offers neutrality and enforceability advantages.

Why Choose GLE for Serbia Corporate Crypto Work

The Global Law Experts network connects clients with vetted local counsel across more than 100 jurisdictions, ensuring that Web3 projects receive advice grounded in domestic regulatory knowledge rather than generic international commentary. For Serbia corporate and crypto work, the network provides access to practitioners with direct experience navigating the Law on Digital Assets, NBS licensing procedures and Securities Commission filings.

Services available through GLE’s Serbia corporate crypto practice include:

• Crypto licence application and regulatory liaison (NBS and Securities Commission)
• AML/KYC programme design, documentation and audit support
• Token classification analysis and structuring
• White paper preparation and Securities Commission filings
• Tokenization structuring for real-world assets
• NFT IP protection, copyright registration and licensing agreements
• Tax advisory coordination for token issuance and cross-border operations
• MiCA readiness assessment for Serbia-based providers targeting EU markets

Regulatory Obligations by Entity Type, Comparison Table

The following table summarises the core obligations for the three most common entity types operating in Serbia’s crypto market:

Conclusion

Serbia’s Law on Digital Assets provides a structured, and increasingly mature, framework for crypto, Web3 and tokenization ventures, but it demands careful navigation. From licence applications and token classification through AML/KYC implementation, tax structuring and cross-border MiCA considerations, the compliance pathway involves multiple regulators, detailed documentation and ongoing supervisory obligations. The cost of getting it wrong, licence revocations, fines, criminal exposure, far outweighs the investment in getting it right from the outset. As a crypto lawyer working across Web3 and tokenization matters in Serbia, my consistent advice to founders, corporates and investors is the same: engage experienced local counsel early, build compliance into your project’s DNA and treat the regulatory framework as a competitive advantage rather than an obstacle.

Sources

1. National Bank of Serbia, Digital Assets Guidance and Regulations
2. Securities Commission of the Republic of Serbia, Law on Digital Assets / Bylaws
3. Serbian Government, Law on Digital Assets Effective as of Today
4. EUR-Lex, General Data Protection Regulation (GDPR)
5. European Commission, eIDAS / EUDI Regulation