Bosnia & Herzegovina: technology regulation at a glance

Framework: State-level AML/CFT Law (February 2024) defining VASPs; Republika Srpska Securities Market Law (amended 2022) recognizing virtual assets; RS Securities Commission as primary licensing authority

Bosnia & Herzegovina's crypto regulatory framework is fragmented across its two entities. At the state level, an AML/CFT Law enacted in February 2024 defines virtual currencies and designates VASPs as obligated entities for KYC/AML compliance. Formal licensing for crypto service providers exists only in Republika Srpska, while the Federation of Bosnia and Herzegovina lacks entity-level licensing pending a proposed FinTech Bill. The country is not an EU member and is outside MiCA's scope, positioning itself as a lower-cost alternative for crypto businesses in proximity to the EU.

Framework: No dedicated AI law or national AI strategy; AI-adjacent provisions exist under the Personal Data Protection Law (Official Gazette, 28 Feb 2025, in application from 4 Oct 2025, GDPR-aligned); Federation BiH Development Strategy 2021-2027 names AI a priority; governance engagement driven primarily by UNDP and EU accession obligations

Bosnia and Herzegovina has no dedicated AI legislation and no formally adopted national AI strategy at the Council of Ministers (state) level as of May 2026. AI is addressed indirectly via the new GDPR-aligned Personal Data Protection Law, which includes automated decision-making restrictions, and through sub-state entity development strategies that list AI as an economic priority. Governance progress is largely externally driven by EU accession pressure and UN-supported initiatives, with institutional fragmentation and weak digital capacity acting as systemic barriers.

Framework: Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25, 28 February 2025), supervised by the Agency for Personal Data Protection (Agencija za zaštitu ličnih/osobnih podataka, AZLP)

Bosnia and Herzegovina enacted a new, comprehensive Law on Personal Data Protection in early 2025, replacing the outdated 2006 legislation and aligning the country's data-protection regime with EU Regulation 2016/679 (GDPR) and Directive 2016/680. The law was published in the Official Gazette on 28 February 2025, entered into force on 8 March 2025, and became fully applicable on 4 October 2025 after a 210-day transition period. The reform reflects BiH's EU accession obligations and mirrors GDPR structure, principles, rights, and enforcement mechanisms.

Framework: Republika Srpska: Law on Electronic Money (Official Gazette RS No. 1/24, in force July 2024), supervised by Banking Agency of RS (ABRS). Federation of BiH: no equivalent e-money or payment services law; Banking Agency of FBiH (FBA) supervises banks only. State-level payment infrastructure operated by Central Bank of Bosnia and Herzegovina (CBBH).

Bosnia and Herzegovina has an asymmetric fintech regulatory landscape split along entity lines. Republika Srpska enacted a dedicated Law on Electronic Money in January 2024 (effective July 2024), creating a functioning EMI licensing regime under the ABRS. The Federation of Bosnia and Herzegovina has not yet enacted equivalent payment services or e-money legislation, leaving a significant regulatory gap. The state-level CBBH operates interbank clearing and RTGS infrastructure and is pursuing SEPA accession, with a TIPS-based instant-payment rail expected to go live in mid-2026.

Framework: Law on Foreigners of Bosnia and Herzegovina (2015, as amended); Rulebook on Entry and Stay of Aliens; administered by the Service for Foreigners' Affairs (SPS) under the Ministry of Security

Bosnia and Herzegovina has no dedicated digital nomad or remote-work visa category. Foreign remote workers can legally remain up to 90 days under visa-free arrangements or a short-stay visa; for longer stays the principal pathway is registering a legal entity (d.o.o.) in BiH, which entitles the founder to apply for a temporary residence permit without a separate work permit. Property ownership also provides a basis for temporary residence, but BiH has no formal golden-visa or citizenship-by-investment programme.

Framework: Communications Regulatory Agency (CRA); Law on Personal Data Protection (2025); self-regulatory Press Council, no dedicated online safety or platform-liability law

Bosnia and Herzegovina has no comprehensive online safety or platform-liability regime. The Communications Regulatory Agency (CRA) regulates broadcasting and telecommunications but has limited reach over online content moderation. A stakeholder agreement on co-regulatory principles was reached in May 2026 under Council of Europe facilitation, but no legislation has been enacted; the field remains characterised by a legislative vacuum and political deadlock over jurisdictional competences.

Framework: Fragmented sectoral rules: new Law on Personal Data Protection (Official Gazette BiH, February 2025); Criminal Code cybercrime provisions; no dedicated national cybersecurity law, no national CERT, no national cybersecurity strategy

Bosnia & Herzegovina has no comprehensive cybersecurity law and remains, as of mid-2026, the only country in South-East Europe without a formalised national CERT or cybersecurity strategy. Cybersecurity obligations are scattered across a new GDPR-aligned data protection law (applicable from October 2025), Criminal Code provisions criminalising attacks on information systems, and an entity-level CERT in Republika Srpska. EU accession pressure is driving calls for NIS2-aligned legislation, but no such bill has been formally tabled at state level.

Framework: Law on the Policy of Foreign Direct Investment in Bosnia and Herzegovina (1998, state-level); Company Law of the Federation of BiH; Law on Business Companies of Republika Srpska; administered by FIPA (state), cantonal/municipal courts (FBiH), and APIF (RS)

Bosnia and Herzegovina permits 100% foreign ownership in most sectors, with a 49% cap only in defence/arms and media. However, the country's fragmented governance, two entities (Federation of BiH with 10 cantons, and Republika Srpska) plus Brčko District, means registration procedures, minimum capital rules, and costs differ significantly by jurisdiction, adding meaningful complexity. The US State Department's 2024 Investment Climate Statement flags an overly complex and non-harmonised registration framework that is vulnerable to corruption, though formal timelines are short once documents are prepared.