Bosnia and Herzegovina belongs to that class of markets where demand for a "crypto licence" is plentiful and the licence itself does not exist. That is why this page is a status-and-risks page, not a sales page: in one half of the country — Republika Srpska — a mandatory entry in the supervisor's record operates; in the other — the Federation — there is only a draft law; and at state level no virtual-asset law exists at all. A decision on such a market must be taken with both eyes open — the opportunity and the risk.
Our position is straightforward: instead of selling you the illusion of a "Bosnian licence", we show you what really exists (and what does not), what risks this direction carries, and how an application is structured so that it stays within the correct legal frame. This market publishes no official figures for fees, capital or deadlines — and that in itself is part of the risk.
Republika Srpska: a Record, Not a Licence
In Republika Srpska the legal basis for crypto services is Article 260b of the Law on the Securities Market, together with the Rulebook on the record of providers of services connected with virtual currencies (Sl. glasnik RS 4/23, 82/24 and 112/25 — amended as recently as 2025). Under this article, providers established in Republika Srpska — and foreign providers serving it through a branch — must be entered in the supervisor's record before they start providing services; an unentered provider must not operate. The law also states that neither the Republic, nor the Commission, nor any other public-sector body guarantees the value of virtual currencies or bears liability for losses.
The key word here is "record", not "licence": the Securities Commission does not issue licences or approvals — it keeps the record of these providers and is at the same time exclusively competent for their AML/CFT supervision. The service therefore boils down to two layers: entry in the record and anti-money-laundering obligations. There are no licensing requirements — no capital, no prudential standards, no own-funds classes — which naturally makes this a "light" model, and precisely why resellers market it under the name of a licence.
The Market Reality: Two Entries in Three Years
The real picture of the record as of 23 September 2026 is this: exactly two companies are entered — "Digital Asset Menagment" d.o.o. of Banja Luka (EPUVV-1/23) and "Crypto Trading Management Servis" d.o.o. of Istočno Novo Sarajevo (EPUVV-4/23), both enrolled in 2023. Two participants in three years means this market is practically untested: there is no reservoir of experience, no line of precedents and no demonstrated niche. The Commission feels this too — on 27 May 2026 it published a warning addressed to users of virtual-currency services. And one more time, plainly: the record does not release anyone from AML obligations — the state-level law recognises VASPs as accountable persons, and supervision exists even though no licensing regime does.
The Federation: a MiCA-Aligned Draft — Not Yet a Route
In the Federation of Bosnia and Herzegovina, in July 2026, the government prepared a draft Law on Virtual Assets — together with a new Law on the Capital Market — and the public consultation ran until 1 September 2026; the draft is aligned with MiCA's logic and provides for licensing. But no enacted law exists yet: on this half of the country's territory there is no route today — neither a record nor a licence. The draft's status must be re-verified in every single case before you plan anything: if it is adopted, the picture changes; if it is not, the Federation remains without a route.
The Risk Map: What to Know Before Someone Sells You a "Licence"
The first risk is terminological: what is sold in Bosnia as a "licence" is in reality the enrollment of a Republika Srpska entity in the Commission's record. The second is informational: fees, capital and processing deadlines are not officially published, so both budget and calendar are to be confirmed with the regulator, not read from a brochure. The third is precedential: three years, two entries — the regulatory practice is nearly empty, and every new application is essentially pioneering. The fourth is structural: the two halves of the country have two different realities, and adoption of the Federation's draft would redraw the whole picture. Against this map we see two healthy scenarios: either a calculated attempt in Republika Srpska with the risks clearly accepted, or the choice of an alternative jurisdiction — in both cases our role is structuring and documenting the risks.
The Georgian Layer: What Applies at Home Despite a Bosnian Record
A Bosnian record does not change what applies in Georgia. The organic law on the National Bank of Georgia (No 101044): Article 52-5(2) — a virtual asset service provider registers with the National Bank; Article 52-5(3) — providing services while unregistered is impermissible; Article 52-5(4) — a provider carries on only that activity and auxiliary activity; Article 39-1 — a virtual asset is not legal tender and payments in it are prohibited; Article 48 — supervision belongs to the National Bank.
The AML law (No 4690334): Article 3(1) makes VASPs accountable persons; Article 4 assigns AML supervision to the National Bank; Article 11(1) sets the crypto KYC trigger for an occasional transaction at USD 1 000 / EUR 1 000 / GEL 3 000; Article 17¹ imposes the Travel Rule, with the accompanying-information content set by a National Bank act (Article 52-5(1) of the organic law). A Bosnian record does not cancel this layer — for services directed at Georgia, registration with the National Bank remains mandatory.
Frequently Asked Questions
Does a crypto licence exist in Bosnia?
No. Republika Srpska operates a record entry with the Commission (Article 260b); the Federation has only a draft law. The licence the market sells under that name does not exist.
How many companies are in the record?
As of 23 September 2026 — exactly two, both entries from 2023: one from Banja Luka, one from Istočno Novo Sarajevo. Three years of history with two participants.
Is the attempt worth it?
That is a question of your risk profile. Our role is to tell you the truth: a light but untested model on one side, a non-existent licence on the other. If you decide — we structure the application correctly; if not — we review alternative jurisdictions.
Does a Bosnian record change Georgian requirements?
No. Services directed at Georgia still require registration with the National Bank under Article 52-5(2), and the KYC trigger (USD 1 000 / EUR 1 000 / GEL 3 000) and the Travel Rule remain part of the Georgian AML layer.
How We Help on Legal.ge
Legal.ge builds the Bosnian direction on risks, not promises: first we re-verify the current status — the Commission's record on secrs.gov.ba and the fate of the Federation's draft — because this picture moves; then, if you choose the direction, we set up the Republika Srpska legal entity and the record application under Article 260b with the AML/CFT layer accounted for; and if your risk profile does not allow it, we review alternative jurisdictions on our other pages. In parallel we build the Georgian ring — National Bank registration and AML compliance. Contact us — let us start the Bosnian direction from the real picture, without illusions.