On August 29, 2025, the Central Bank of the Republic of Kosovo (BQK) approved the Regulation on the licensing of crypto-asset service providers (OSHKA) offering crypto-asset exchange services, establishing a clear legal and supervisory framework for this developing sector. The Regulation was adopted pursuant to Law No. 08/L-295 “On Crypto-Assets” and aims to ensure new standards of transparency, professionalism, and consumer protection in the digital assets market.
The Regulation stipulates that no operator may provide crypto-asset exchange services without first obtaining a license from the BQK. This license is mandatory both for services involving the exchange of crypto-assets for money and for those related to the exchange of crypto-assets with one another. The license is granted for an indefinite period and is non-transferable and non-tradable.
As part of the licensing application, each operator must submit the company’s founding documents, the business plan, the governance structure, a description of the procedures for handling customer complaints, the commercial policies, and the risk management policies. A specific requirement is the minimum capital, which has been set at 125,000 euros. In addition to this capital, there must also be an additional fund for initial expenses to cover establishment, operational, and administrative costs, which may not be less than 20% of the minimum capital. The requirement for an additional fund applies only to initial licensing applications.
The review procedure is clearly defined where once the complete application file has been submitted, the BQK is obliged to issue a decision within 60 (sixty) working days. The decision may either approve or reject the application, but in both cases the communication must be reasoned and documented. In the event of approval, the BQK, within 5 (five) working days from the granting of the license, informs the Financial Intelligence Unit (NJIF-K) as well as other competent authorities, depending on the type of license.
An important part of the Regulation is devoted to the obligations of licensed operators. They are required to keep client funds segregated from their own assets, to ensure that information regarding fees and pricing is published clearly, and to inform clients of the risks associated with crypto-asset trading. Operators are also obliged to comply with the law on the prevention of money laundering and terrorist financing, including the identification of clients for every transaction exceeding 1,000 (one thousand) Euros.
The Regulation grants crypto-asset service providers (OSHKA) the right to access payment account services in an objective, non-discriminatory, and proportionate manner, enabling them to provide services without obstacles. If a bank refuses access, it must provide a written justification within five working days and immediately make the decision available to the BQK.
OSHKA may not undertake a range of actions without the prior approval of the CBK. These include: changing the company name; amendments to the founding act or statute; increasing or reducing the share capital; changes in major shareholders; the appointment or reappointment of members of the governing bodies; the opening or relocation of offices within the country; as well as the distribution of dividends.
OSHKA must notify the BQK within 30 days of certain changes, such as modifications in the shareholder structure below the 10% threshold, the resignation of members of the governing bodies, the closure of offices, or organizational changes not reflected in the statute. In the case of operational risk events such as theft or fraud resulting in financial losses exceeding 1,000 (one thousand) euros, serious data damage or operational interruptions, compromise of confidential information that could endanger financial stability, or repeated breaches by management, the notification must be made without delay.
OSHKA are required to maintain sound governance, with a clear organizational structure, effective risk management, and strong internal controls. Members of the governing bodies must possess a good reputation and dedicate sufficient time to their responsibilities. Major shareholders must also demonstrate a good reputation, otherwise, the BQK may impose measures, including sanctions and the suspension of voting rights, in order to prevent unsound management.
According to this Regulation, OSHKA must draft and adopt business continuity policies (including IT and incident recovery), systems for safeguarding the availability, integrity, and confidentiality of data, as well as the implementation of AML obligations. OSHKA are required to maintain records of services, activities, orders, and transactions, make them available to clients upon request, and retain them for a period of 5 (five) years, and up to 7 (seven) years when required by the authority. They must also establish and maintain policies and procedures to identify, prevent, manage, and disclose conflicts of interest between the operator itself, its shareholders, related parties, governing bodies, employees, and clients, as well as between clients whose interests may conflict with one another.
During the licensing application with the BQK, an application fee must be paid in the amount determined by the BQK which is non-refundable in the event of rejection. After licensing, OSHKA are also subject to other fees according to the BQK’s applicable fee schedule.
Institutions subject to licensing are required, within 90 days from the entry into force of the Regulation, to undertake all necessary actions for applying and complying with its requirements.
Violations of the Regulation are subject to corrective measures and administrative sanctions in accordance with Article 67 of Law No. 03/L-209 “On the Central Bank of the Republic of Kosovo”, as amended, and Chapter VII of Law No. 08/L-295 “On Crypto-Assets”. The Regulation shall enter into force 90 days after its approval by the BQK Board.
By Majlinda Karaj, Associate, Lalaj & Partners
