KYC.IO

Global Regulations and Requirements for KYC Onboarding
(powered by KYC-Chain)

National ID card name

Lična karta (Croatian: Osobna iskaznica, Serbian Cyrillic: Лична карта)

National ID Photo

back of national id photo back

Does the country have Esignature Laws?

Law on electronic signature in Bosnia and Herzegovina

E-sig law files

What year did the relevant AML laws and regulations become effective?

2014

Further details on AML regime

The new law on the prevention of money laundering and financing of terrorist activities became effective on 01 July 2014.

Who is the regulator for AML controls for Banking

State Investigation and Protection Agency (http://www.sipa.gov.ba/en) Financial Intelligence Department (“FID”).

Link to site

http://www.sipa.gov.ba/en

Other financial Services

N/A

Website of Regulator

N/A

Financial Sector regulator

N/A

Practical Guidance for AML

Yes

Practical guidance PDF's

Is there a requirement to verify the identity of customers retroactively?

Yes

Retroactive details

For customers who existed before the current AML legislation was introduced, companies are obliged to collect missing documentation and data.

Has the country been the subject of FATF mutal evaluation in the last 3 years?

Yes

PDF of FATF review

Are there minimum transaction thresholds (Y/N)

Yes

More details on minimum transaction thresholds.

Transactions less than approximately EUR15,339 are not reported to the Financial Reporting Organisation.

What are the requirements for customer identification information for individuals

a) determine the beneficial owner; b) obtain information on the purpose and nature of the business relationship or transaction; and c) perform continuous monitoring of business activities of the custome

Details to be Collected on Corporates

What are the high level requirements around beneficial ownership (identification and verification)?

Identity of the beneficial owner of the legal entity is verified through the original or verified copy of the excerpt from court register or other public register. If this is not possible the controller shall gather all relevant information from the original or verified documentation and business records submitted by the agent of the person authorised by the beneficial owner, or by obtaining a written statement from an agent or another person authorised by the beneficial owner.

What circumstances are enhanced customer due diligence measures required?

Enhanced customer due diligence, apart from usual identification requirements, include additional measures which are prescribed by the Law: a) when entering into a relationship with the bank or any other credit institution which is headquartered in a country which is not on the list of countries that apply internationally accepted standards for the prevention of money laundering and financing of terrorist activities. Additional data which are required for enhanced procedures are: data on date of issuing and period for which licence for performing financial services is valid, name and address of the authority that issued licence, description of the internal procedures for prevention of money laundering and financing of terrorist activities, description of the relevant legislation for prevention of money laundering which are applied in the country where the bank or credit institution is registered, a written statement that the bank or credit institution does not have business relationship with shell banks, a written statement that the bank or credit institution does not have established or that it is not entering into a business relationship with shall banks, a written statement that bank or credit institution is subject to administrative supervision in the country where it has headquarters, and that it is obliged to adjust its business with laws for preventing money laundering and financing of terrorist activities; b) when entering into a relationship with Politically Exposed Person (“PEP”). When the client and/or owner of the client that enters into a business relationship or executes a transaction, or when the client and/or owner of the client on whose behalf is entered into a business relationship or performed the transaction is a PEP, additional measures for identification of the client must be performed: gather information on source of income and assets which is or shall be subject to a business relationship or transaction for documentation that is presented by the client (when this information cannot be obtained in the prescribed manner, the client must provide written statements), persons liable for carrying out measures for money laundering detection and the prevention of money laundering shall obtain written approval from the top management before entering into a business relationship with the PEP, after entering into a business relationship with the PEP. Persons liable for carrying out measures for money laundering detection and the prevention of money laundering shall monitor transactions and other business activities of PEPs; c) in the event a client was not physically present when identification was performed. Persons liable for carrying out measures for money laundering detection and the prevention of money laundering shall gather additional documentation, information and data based on which identification can be checked. Additionally check or confirm submitted documentation, identification documents by the credit or financial institution, apply measures that the first payment in the business relationship is performed via an account opened in the name of the client in the other credit institution; and d) in any other cases, for new or existing clients, when due to the business relationship, specifics of the transaction, business profile of the client, or any other circumstances which are related to the client, when the risk of money laundering and financing of terrorist activities exists.

How should FI's deal with Politically exposed persons

Enhanced customer procedures are required for foreign and domestic PEPs and for every physical person who has or used to have an exposed public function, their close family members and close associates. PEPs include president of the state, premiers, ministers, deputies of ministers, assistants of ministers, representatives of the legislators, judges of the supreme court, constitutional court or other courts, members of the audit department and board of governors of the Central Bank, ambassadors and officers of the military forces and members of the management or supervisory boards of companies which are mainly owned by the state.

What enhanced due diligence must be performed for correspondent banking relationships?

Enhanced customer due diligence procedures are prescribed for banks and other financial institutions which have headquarters abroad. Apart from identification and monitoring procedures, the company is obliged to: a) gather information on whether a customer has license, and if yes, for which period the license is granted for providing banking services, name and headquarters of the authority which issued the license; description of the internal procedures which relate to identification and prevention of money laundering and financing of terrorist activities; description of the internal procedures for identification of the beneficial owner of the customer, which relate to reports on suspicious transactions to the relevant authorities; description of the internal procedures for keeping the reports, description of the internal controls and other procedures adopted by the bank for the detection and prevention of the money laundering or financing terrorist activities; b) obtain a description of the relevant legislation in the field of detection and prevention of money laundering and financing terrorist activities in the state where the bank or similar financial institution is established or registered; c) obtain a written statement that the bank or other similar financial institution does not have any business relations with shell banks; d) obtain a written statement that the bank or other similar financial institution does not have a legal relationship with shell banks; e) obtain a written statement that the bank or other similar financial institution is not under administrative supervision in the residence state and that, in accordance with legislation in the residence state, has an obligation to adjust its business activities to be in line with legislation which relates to the detection and prevention of money laundering and financing of terrorist activities; and f) ensure an employee of the controller shall not enter into business relationship with a foreign bank prior obtaining approval from his superior.

Are relationships with banks who might be considered a 'shell' and without substance permitted?

Yes

In what circumstances is additional due diligence required for non face-to-face transactions and/or relationships?

The following identification procedures are required for customers not physically present during the identification process: a) gather additional identification documents, data and information based on which the identity of the customer can be checked; b) perform additional checks of the identification documents submitted and obtain confirmation for those documents from another loan or financial institution; and c) apply measures by which the first payment is performed via an account opened in the name of the customer in another financial institution.

To whom are SAR's made? (suspicious activity reports)

State Investigation and Protection Agency

Link to website of SAR reporting

http://www.sipa.gov.ba/en

Other Suspicious or unusual transactions obligations.

There is an obligation to report any suspicious client or person.

Are there any de-minimis thresholds below which transactions do not need to be reported?

EUR15,339.

Are there any penalties for non compliance with reporting requirements e.g. tipping off?

AML legislation prescribes financial penalties for non compliance with reporting requirements for the legal entity, controllers, responsible persons in the legal entity and independent entrepreneurs.

Are there any requirements (legal or regulatory) to use automated Suspicious Transaction monitoring technology?

Is there a requirement to obtain authority to proceed with a current/ongoing transaction that is identified as suspicious?

A transaction which is identified as suspicious is temporarily suspended based on the warrant of the Financial Reporting Organisation up to a maximum of 5 days.

Does the local legislation allow transactions to be monitored outside the jurisdiction?

Local legislation allows the Financial Reporting Organisation to request documentation and information from other authorities which are responsible for prevention of money laundering.

Is there a legal requirement for a bank’s external auditor/other external organisation to report on the bank’s AML systems and controls?

Yes.

If an external report on the bank’s AML systems and controls is required: a) how frequently must the report be provided?

once a year;

To whom should the report on AML systems be submitted?

the Banking Agency

Is an AML system part of the financial statement audit?

no.

What are the requirements for the content of this external report on a bank’s AML systems and controls? Does it require: a) sample testing of KYC files? b) sample testing of SAR reports? c) examination of risk assessments?

Yes

Data Protection Laws And Personal Data

Yes

Data Protection for Corporate Data

N/A

Data protection for "sensitive Data" and additional protections.

Do any restrictions on the transfer of credit reports exist?

Personal data that are processed may be taken out of Bosnia and Herzegovina to another country or be given to an international organization that implements adequate safeguards for personal data. Adequacy of safeguards is estimated on the basis of specific circumstances in which the transfer of personal data is conducted, in which particularly the following shall be taken into account: a) types of personal data; b) the purpose and period of processing; c) the country in which data is transferred; d) statutory rules in force in the country in which data are transferred; and e) professional rules and security measures that must be respected in that country. Personal data that are processed may be taken out of Bosnia and Herzegovina to another country that does not provide adequate safeguards when: a) the disclosure of personal data is provided by special law or an international treaty binding for Bosnia and Herzegovina; b) the prior consent was obtained from the person whose data are transferred and the person was informed on the potential consequences of the data transfer; c) the disclosure of personal data is necessary to fulfil the contract between the data subject and the controller or the fulfilment of pre-contractual obligations undertaken at the request of the person whose data are processed; d) the disclosure of personal data is necessary to save the life of the person to whom the data pertains or when it is in his/her vital interests; e) the personal data are transferred from the files or records which are, in accordance with the law or other regulations, available to the public; f) the transfer of personal data is necessary for the public interest reasons; and g) the transfer of personal data is necessary for concluding or fulfilling a contract between the controller with a third party when the contract is in the interest of the person whose data are processed. Exceptionally, the Agency for data protection may approve the transfer of data from Bosnia and Herzegovina to another country which does not provide an appropriate level of protection as defined, when a controller in another country provides adequate safeguards for the protection of privacy and fundamental rights and freedoms of individuals or provision of similar rights arises from the provisions of a special agreement.

Regulator Acronym

FID

Year of last FATF mutual evaluation

2009, 2015

Field 67

additional identification documentsadditional checksfirst payment in another financial institution

National ID card details

Compulsory at 16 and is to be carried at all times after turning 18.

Compulsory?

National ID source

https://en.wikipedia.org/wiki/Bosnia_and_Herzegovina_identity_card

Passport Photo

practical Guidance yes / no

Is there a risk based approach

Legal Requirement

Yes

Regulator allows for monitoring transactions outside jurisdiction

Requirement to proceed

Yes

requirement to use automated suspicious transaction tools

Who are SARS made to?

SIPA

shell banks

Yes

EDD for correspondent banking

Yes

Minimum transactions

EUR 15,339

Min transaction USD

16722

Personal Data protection

Personal Data Protection Act

http://dzlp.mk/sites/default/files/Dokumenti/EU%20zakoni%20zzlp/BiH.pdf

If the AML laws and/or regulations became effective in the last 2 years, what were the requirements of the previous AML regime?

Previous law on the prevention of money laundering and financing of terrorist activities defined measures and responsibilities of the Financial intelligence department of the State Investigation and Protection Agency, persons liable under this Law, other state authorities and legal entities with public authorisations for detection and prevention and investigation of money laundering and financing of terrorist activities. It also prescribed measures and responsibilities of the Financial intelligence department for international cooperation for the prevention of money laundering and financing terrorist activities.

Non financial sector (e.g. casinos, high value goods etc.)

N/A

Does the country have a risk based approach?

YES

Where copies of identification documentation are provided, what are the requirements around independent verification or authentication?

Copies of identification documents must be verified.

Is there case law, other constitutional law or any other laws or regulations that may impact upon the transfer of information to this jurisdiction?

List of case law, constitutional law or any other laws or regulations that may impact upon the transfer of information.