Serbia

Sets protection measures for ICT systems and duties for operators of systems of special importance, including 24-hour notification of significant incidents (Art. 13). The NBS is the competent supervisory authority for essential ICT operators in banking and financial markets it supervises.

Sets minimum ICT management, business continuity and disaster recovery standards for banks, insurers, financial lessors, voluntary pension fund managers, payment and e-money institutions and, for its payment services, the public postal operator. It applies from 1 January 2026 (Section 65) and contains the incident reporting scheme to the NBS (Sections 41-49).

Governs outsourcing of information-system activities, including cloud services, by banks, insurers, lessors, pension fund managers, payment and e-money institutions. It requires NBS notification before contracts and sub-outsourcing (Sections 20 and 25) and an exit strategy (Section 17), and applies from 1 March 2024 (Section 39).

NBS decision on licence applications from virtual currency service providers: required documents, fit-and-proper tests for managers and owners, AML/CFT screening, a 60-day decision period for licences and 30 days for consents. It applies from 29 June 2021.

Regulates investment firms, market operators, public offers and admission to trading, issuer disclosure, market abuse, clearing and settlement and the Securities Commission's powers. The Commission is the competent authority for most chapters; the NBS shares the CSD chapter and retail client protection.

Regulates issuance of and services in digital assets. The NBS supervises virtual currencies and the Securities Commission digital tokens (Art. 10); a licence is needed before providing any digital asset service (Art. 4(1)), and minimum capital is EUR 20,000, 50,000 or 125,000 depending on the services provided (Art. 54).

Large public-interest entities with more than 500 employees must publish a non-financial report covering environment, social and employee matters, human rights and anti-corruption (Arts. 37-38).

Sets out the AML/CFT duties of obliged entities: risk analysis, compliance officer and internal controls (Art. 5), customer due diligence (Art. 8) and reporting to the APML (Art. 47). Digital asset service providers are covered and must pass on transfer data (Arts. 15a-15c).

Governs electronic documents, electronic identification and trust services. A qualified electronic signature has the same legal effect as a handwritten signature (Art. 50), and qualified providers are entered in a register kept by the ministry responsible for information society (Art. 28).

Governs insurance and reinsurance business, brokerage and agency and their supervision by the NBS. Insurers need an NBS operating licence (Arts. 42-45) and minimum core capital is set by class (Art. 27).

Covers payment services, electronic money and payment systems and their supervision. Payment institutions and electronic money institutions need an NBS licence (Arts. 2 and 10), and Art. 3(7) lets the NBS exempt a provider from parts of the Law for a set period to test a new or improved service.

Regulates reporting of wrongdoing and protection of whistleblowers. Employers with more than 10 employees must adopt internal whistleblowing rules (Art. 16), act on reports within 15 days (Art. 15) and avoid retaliation (Art. 21).

Governs the establishment, operation, organisation, supervision and resolution of banks. Art. 15 and Art. 18 set a preliminary founding permit and an operating licence from the NBS, and Arts. 28-35a require risk management, including money laundering and terrorist financing risk (Art. 29 item 8, Art. 35a).

Main employment statute. It requires a written employment contract before work starts (Art. 32), sets full-time work at 40 hours a week (Art. 51) and caps overtime at eight hours a week (Art. 53).

Founding law of the central bank. The NBS lists the consolidated English text with amendments in 2004, 2010, 2012, 2015, 2018 and 2025.