Bosnia and Herzegovina: A Three-Way Regulatory Split

Operating a crypto ATM in Bosnia and Herzegovina is technically possible — but only in one of the country's three administrative units, and only until the FATF delivers its next verdict in June 2026. The country has just one active operator running 5–6 machines for a population of 3.15 million. That's not an oversight. It reflects how genuinely complex this jurisdiction is.¹

Last updated: April 2026

Three Jurisdictions, Three Different Answers

BiH's fragmented governance structure means there is no single answer to the question "is this legal?" — it depends entirely on where you operate.

  • Republika Srpska is the only viable path. Since October 2022, RS formally recognizes virtual currencies under its amended Law on the Securities Market, with oversight assigned to the RS Securities Commission. Six VASP entities are currently registered, including active exchanges. A crypto ATM operator can register here, operate legally, and do so with reasonable regulatory clarity.²
  • Federation of BiH has no crypto framework whatsoever. The Federal Ministry of Finance has explicitly stated it does not regulate crypto exchanges or recognize cryptocurrencies as a means of payment. The consequence is not just uncertainty — the FBiH Tax Administration has physically seized a crypto ATM in Sarajevo, establishing an enforcement precedent in a regulatory vacuum.³ Operating here today carries unacceptable legal risk.
  • Brčko District adopted a new Securities Market Law in March 2026 that creates space for virtual asset regulation, but implementing regulations have not yet followed.⁴

At the state level, the February 2024 AML/CFT law (Official Gazette BiH 13/24) provides BiH-wide definitions of "virtual currency" and "VASP," designating crypto service providers as AML-obligated entities across all jurisdictions — but it created no licensing regime.⁵

Getting Registered in Republika Srpska

The RS path is a notification-and-approval process rather than a full license, but it provides the legal foundation to operate. The steps are sequential: incorporate a local d.o.o. (LLC) with minimum share capital of BAM 1,000 (~€511), then notify the RS Securities Commission within 30 days of incorporation with a full AML/CFT documentation package — business plan, beneficial ownership declarations, clean criminal records for directors, and details of the appointed AML officer. The Commission issues a certificate of registration after a fitness-and-propriety assessment. Processing fee: ~€500. Review period: 30–60 days.⁶

A physically present, locally appointed Money Laundering Reporting Officer is mandatory — not optional.⁷ An annual MLRO salary in BiH runs €23,800–35,300 gross.

Total setup costs for a 3-ATM pilot range from €75,000–150,000, covering company formation, equipment (landed cost ~€7,800–10,800 per machine from the EU), working capital, and first-year compliance personnel. Annual ongoing compliance costs run €15,000–35,000.⁸ Timeline from decision to first operational ATM: 3–5 months.⁹

AML and KYC: Strict, State-Wide, and Non-Negotiable

The 2024 AML law applies uniformly across all BiH jurisdictions and aligns with the EU's 4th and 5th Anti-Money Laundering Directives.¹⁰ For crypto ATM operators, the key thresholds are:

Customer Due Diligence applies to all transactions at or above KM 1,000 (~€510) — stricter than the general financial institution threshold and directly aligned with FATF's VASP guidance.¹¹ Since crypto ATMs are inherently non-face-to-face operations, enhanced due diligence capabilities should be built into every machine from day one.

Suspicious Activity Reports must be filed with the Financial Intelligence Department within 72 hours, with no minimum monetary threshold.¹² Cash transactions at or above KM 30,000 (~€15,300) require mandatory FIU reporting. Individual customer transactions should be structured to stay below this ceiling. All records must be retained for a minimum of 10 years.¹³

Banking: The Practical Bottleneck

Banking is the single largest operational obstacle. Many BiH banks are reluctant to serve crypto businesses, and international group banks — UniCredit, Raiffeisen, Intesa Sanpaolo — tend to be the most conservative due to group-level compliance obligations.¹⁴ That said, registered VASPs including DCX Exchange and Adriatic Crypto Exchange do maintain local bank accounts, demonstrating it is achievable.¹⁵


The key enabler is sequencing: secure RS VASP registration first, then approach banks with full compliance documentation in hand. The RS certificate of registration materially improves banking acceptance. Supplementing with an EU Electronic Money Institution for payment processing flexibility is worth considering.¹⁶

The June 2026 FATF Decision Changes Everything

BiH was placed under a FATF observation period in February 2025 following MONEYVAL's identification of significant deficiencies: no asset confiscation legislation, absent targeted financial sanctions laws, and weak non-financial sector supervision.²⁰ At the February 2026 FATF plenary, BiH narrowly avoided grey-listing — but the decision was deferred to June 2026.²¹


If grey-listed, banking relationships would deteriorate further, international transactions involving BiH entities would face enhanced scrutiny across the board, and the operating environment for crypto businesses would become materially harder to sustain.²² Critical legislation remains pending — the Law on Asset Confiscation and the Law on Targeted Financial Sanctions — and its passage depends on political dynamics that are genuinely difficult to predict in BiH's Dayton Agreement governance structure.²³

The upside: 10% flat corporate tax, VAT-exempt crypto transactions, EUR-pegged currency stability, and virtually no ATM competition.²⁴ The downside: three-way regulatory fragmentation, banking friction, a corruption perception score of 34/100, and a binary regulatory event arriving in a matter of months.²⁵

Sources and references:

1. Gofaizen Sherle & UPay, 2. Ainvest & Tacno & Blockspot, 3. Crypto News & Tacno, 4. Brčko District Official Gazette March 2026, 5. Official Gazette BiH 13/24 & FOL, 6. CMS & Gofaizen Sherle, 7. Sb-sb & ia-lawfirm, 8. COREDO & General Bytes Internal Cost Analysis, 9. COREDO & AdamSmith, 10. Advokat-prnjavorac & Manimama, 11. Advokat-prnjavorac, 12. Advokat-prnjavorac, 13. Nub, 14. Ainvest & The Banks, 15. Global Law Experts & COREDO, 16. Gofaizen Sherle, 17. Mvteo & Commercium, 18. Lloyds Bank Trade, 19. CRA BiH, 20. Sarajevo Times, 21. Sarajevo Times, 22. Sarajevo Times, 23. Sarajevo Times, 24. Mevconsultants & Gofaizen Sherle & AdamSmith, 25. Transparency International & Statbase & Ainvest.

Legal Disclaimer: This blog article by GENERAL BYTES is for informational purposes only and does not guarantee absolute accuracy due to the rapid and unpredictable changes in Bosnia and Herzegovina legislation. It does not constitute formal legal, financial, or investment advice.