Kosovo

Art. 5 lists six lawful bases for processing (consent, contract, legal obligation, vital interests, public task and legitimate interests) and Art. 6 sets consent conditions. Arts. 11-21 cover transparent information, access, rectification, erasure, restriction, portability, objection and automated decision-making.

Art. 33 requires the controller to notify the Information and Privacy Agency not later than 72 hours after becoming aware of a breach where feasible, with reasons for any delay, unless the breach is unlikely to risk individuals' rights and freedoms.

Art. 20 requires records to be kept for at least five years: identification documents and account files from the end of the business relationship, transaction records from execution or attempted execution, records tied to a suspicious-activity report from its submission, and wire transfer information. The FIU may extend the period by written order in special cases (Art. 20).

Art. 19 applies due diligence on establishing a business relationship, on occasional cash transactions of EUR 10,000 or more (single or linked), on doubts about identification data and on suspicion of money laundering or terrorist financing. Art. 22 requires enhanced measures for high-risk customers; Art. 19 also bars carrying out a transaction if due diligence cannot be completed. The CBK's 2024 regulation (Arts. 9-10) repeats and extends these duties for financial institutions.

Art. 4(1) prohibits issuing, trading, distributing or holding in custody crypto-assets, or providing related services, without a licence or authorisation. Art. 5 lists the licence categories (agents, trading platforms, crypto ATMs, token issuers) and Art. 6 the authorisations (token launches, advisory services); the CBK grants them under Art. 14 after consulting the FIU.