A business becomes an obliged entity in Montenegro by doing something on a list, not by applying for anything. Estate agency and property transactions, crypto-asset services, gaming, and the regulated professions all sit inside the Prevention of Money Laundering and Terrorist Financing Act, and the obligations start with the activity rather than with a registration.
The first of those obligations catches foreign owners more often than any other, because it looks administrative and is not. Montenegro does not allow an obliged entity simply to designate a member of staff as its money laundering reporting officer. The person appointed must hold a personal licence issued by the Financial Intelligence Unit, obtained after training and a professional examination, valid for five years, and capable of being withdrawn for defined failures. The entity has sixty days.
Article numbers below are from the Zakon o sprečavanju pranja novca i finansiranja terorizma, published in "Službeni list Crne Gore" br. 110/2023, 065/2024, 024/2025, 041/2026 — a decision of the Constitutional Court of Montenegro — and 059/2026, read on 5 September 2026. General information about Montenegrin law, not advice on a particular business.
The sixty days, and the three days inside them
Article 69(1) requires the obliged entity, within 60 days of establishment or of commencing the activity, to appoint an AML/CFT compliance officer and at least one deputy, and — within three working days of the appointment — to notify the Financial Intelligence Unit.
The notification is specific. It must contain, for each person: name and surname; personal identification number; the number, expiry date and issuing state of their identity document; for a foreigner, the number and expiry date of the residence permit; job title and contact telephone. It must also contain the obliged entity's name, tax identification number and registered address.
Article 69(2) requires any change of officer or deputy to be notified within three days of the change, and Article 69(3) requires that notification to include an explanation of the reasons for the change. A quiet substitution is not available; the FIU is told why.
Article 69(9) requires all of these notifications to be submitted electronically and signed with a qualified electronic signature under the legislation governing electronic identification and electronic signature. For a foreign-owned entity whose director is abroad, that is a prerequisite with its own lead time.
The exemptions for a small business, and their limits
The Act does not impose the full structure on a two-person company.
Article 69(4): an obliged entity with six or fewer employees is not required to appoint a deputy.
Article 69(5): in an entity with six or fewer employees, the director may perform the compliance officer's functions, provided the director satisfies the Article 70 conditions. Article 69(6) requires the entity to notify the FIU of that arrangement with the same data.
Article 69(7) is the provision that surprises growing businesses. In a non-financial sector obliged entity with more than six employees, the director may still act as compliance officer — but only with the prior written consent of the Financial Intelligence Unit. Article 69(8) allows the entity to bring an administrative dispute against a refusal.
The threshold therefore does real work. A property or crypto business that crosses six employees cannot simply continue with the director wearing both hats; it needs either a separate licensed officer or the FIU's written agreement.
The four conditions, and the one that rules out outsourcing
Article 70(1) sets out what a person must satisfy to be appointed as officer or deputy:
| Condition | Article 70(1) |
|---|---|
| Completed the training and passed the professional examination | point 1 |
| Holds the licence to perform the functions | point 2 |
| Not finally convicted of a criminal offence carrying a prison sentence longer than six months | point 3 |
| Is in an employment relationship with the obliged entity | point 4 |
Point 4 removes the arrangement many foreign groups reach for first. The compliance officer cannot be an external consultant, an accountant retained by the hour, or a group compliance function sitting in another country. The person has to be employed by the Montenegrin obliged entity.
The Act then restricts how far one licensed person can be spread. Article 70(2) provides that a person appointed as officer or deputy at one financial sector obliged entity may not be appointed at another. Article 70(3) is more permissive outside finance: in justified circumstances a person appointed at one non-financial sector obliged entity may also be appointed at one additional non-financial obliged entity — one more, not several. Article 70(4) carves out the director performing the role under Article 69(5), who may hold it at several obliged entities where they are both the director and the only employee.
The licence itself
Article 71 builds the qualification. The training is delivered by an adult-education organiser licensed under the adult education legislation, under a programme established in accordance with that legislation with the prior consent of the FIU. The candidate then sits the professional examination before a commission formed by the head of the FIU, and the FIU issues a certificate of the passed examination on a prescribed form. Article 71(7) allocates the cost: where the candidate is already employed by the obliged entity, the entity bears the examination costs.
Article 72 is the provision that changes the planning.
The licence is issued by the Financial Intelligence Unit, to a person who: has residence or an approved stay in Montenegro; submits a certificate or other act of the competent authority proving good repute within the meaning of Article 40r; and has passed the professional examination.
It is issued for a period of five years and may be renewed. The renewal application is submitted to the FIU at the latest 30 days before the period expires. It is issued on a prescribed form whose authenticity can be verified — which is what allows an entity, or a counterparty, to check that an appointed officer's licence is real and current.
The residence requirement in Article 72(2) point 1 is worth reading alongside the employment requirement in Article 70(1) point 4. Together they mean the role is held by a person who is employed in Montenegro and lawfully resident there — not a visiting group officer.
How a licence is lost
Article 73 lists five grounds on which the licence ceases to be valid: at the holder's request; on expiry of the period for which it was issued; if the holder ceases to satisfy the repute condition under Article 40r; if the holder becomes permanently incapable of performing the functions or loses legal capacity; and in the case of negligent performance of the functions.
Article 74 then defines negligent performance objectively, which is unusual and worth quoting in substance. The officer or deputy is treated as performing negligently where, without justified reason, they:
- fail to submit data and information under Article 66 more than four times in a period of two years;
- submit them late under Article 66 more than six times in a period of two years; or
- fail to act, or act late, under Articles 93 and 95 more than twice in a period of two years.
Those are counted events over a rolling two-year window, established by the FIU on the report of the competent supervisory authority under Article 131. They are not a judgment about the quality of the compliance programme; they are a tally.
Article 75 puts the consequence on the entity as well as the individual. The FIU issues a decision on cessation of the licence, against which an administrative dispute may be brought, and notifies the obliged entity without delay. The entity must then appoint another compliance officer or deputy within 15 days of the decision.
Fifteen days is not enough time to train and license a replacement. It is enough time to appoint someone who is already licensed — which is the practical argument for the deputy that Article 69(4) makes optional below seven employees.
What the officer actually has to do
Article 76(1) lists twelve functions. They include establishing, operating and developing the AML/CFT system; ensuring correct and timely submission of data to the FIU and cooperating with the inspection authority; preparing and regularly updating the risk analysis in accordance with the guidelines under Article 12(5); monitoring the implementation of policies, controls and procedures; initiating and participating in the drafting of operational procedures and the entity's internal acts; monitoring and coordinating the entity's compliance with the Act; cooperating on the information technology used; giving the management body initiatives and proposals; applying Article 16 when new products, services or distribution channels are introduced; preparing training programmes; and preparing an AML report once a year, more often as needed and whenever the competent supervisory authority requires it.
Article 76(2) attaches a deadline to that report: the entity must deliver it to the supervisory authority within three days of receiving the request. A report that exists only as a plan will not survive a three-day request.
Article 76(3) fixes the reporting line: the compliance officer and deputy are directly answerable to the management body of the obliged entity. Article 76(4) goes further for large or medium legal persons in the financial sector, where the officer must be functionally and organisationally separated from the entity's other organisational parts, with size determined under the accounting legislation.
Article 77(1) turns that into obligations on the employer. The entity must provide the officer with: conditions for efficient performance; functional connection with the other organisational parts enabling fast and timely work; adequate material conditions; spatial and technical conditions ensuring an appropriate degree of protection for the confidential data held; information-technology support enabling continuous and reliable monitoring; regular professional development; and a replacement during absence from work. Article 77(2) requires the management body to give assistance and support, and to report to the officer facts of significance for preventing and detecting money laundering.
The obligations that sit on the entity rather than the person
Four more requirements recur annually and are commonly missed.
Article 78 requires regular professional training for all employees who participate in the entity's AML/CFT work, covering the Act and secondary rules, the entity's internal acts, professional literature, the indicator lists under Articles 82 and 83, and the rules on international restrictive measures, personal data protection and data secrecy. Article 78(3) fixes the timing: the entity must prepare that year's training programme by the end of the first quarter of the current year.
Article 79 requires the entity to establish and implement rules on client handling, reporting, record keeping, internal control, risk assessment, risk management and communication, and rules ensuring adequate exchange of information between employees. Article 79(3) extends the duty outward: the entity must order and control the application of those rules in its business units and majority-owned companies seated in other states.
Article 80 requires regular internal control and audit of the implementation of AML policies, controls and procedures, proportionate to the risk established in the risk analysis. Where the legislation governing the entity's activity requires an independent internal audit, that audit must cover the regular assessment of the adequacy, reliability and efficiency of the AML risk management system — and Article 80(3) requires the entity to organise such an audit even where the sectoral law does not, whenever the entity assesses it necessary given the scale and nature of its business.
Articles 81 to 83 deal with indicators. Article 81 requires the entity to use the indicator lists when determining grounds for suspicion. Article 82 places the general list with the Ministry, prepared on technical foundations from the FIU. Article 83 requires the obliged entity to produce its own list, reflecting the complexity and size of its transactions, unusual methods of execution, the value or connectedness of transactions lacking economic or lawful purpose, and inconsistency with the client's usual or expected business — and Article 83(2) requires that list to be in the entity's documentation.
One appointment sits above all of this. Under Article 11(2), where an obliged entity has a collegiate management body, it must appoint one member of that body as responsible for the implementation of the Act — a board-level responsibility distinct from the compliance officer's role.
What the failures cost
Article 137a sets a fine of €5,000 to €40,000 for a legal person, and the listed breaches map directly onto the obligations above: failing to appoint the compliance officer and at least one deputy within the 60 days of Article 69(1); failing to deliver the notifications required by Article 69; failing to deliver the annual report to the supervisory authority within three days of its request under Article 76(2); failing to prepare the training programme by the end of the first quarter under Article 78(3); and failing to produce the entity's own indicator list under Article 83(1).
None of those is a failure to detect money laundering. They are failures to have the structure the Act requires, and they are established from documents.
The sequence for a new obliged entity
Working backwards from the sixty days makes the order clear. The licence is the long pole: it requires training, an examination before an FIU commission, residence or approved stay in Montenegro, and evidence of repute — so identifying the person, and starting their training, is the first step rather than a later one. The employment condition in Article 70(1) point 4 means that person has to be on the payroll, which for a foreign owner may mean a hire rather than a designation.
Then the mechanical items: the qualified electronic signature needed for the Article 69(9) notification; the deputy, optional below seven employees but the only realistic answer to the fifteen-day replacement rule in Article 75; the FIU's prior written consent if a non-financial entity above six employees wants the director to hold the role; the internal act regulating the officer's manner of work under Article 77(4); the entity's own indicator list under Article 83; and the training programme, dated by the end of the first quarter.
If your business has become, or is about to become, an obliged entity in Montenegro, our fintech and crypto work covers the appointment and the internal acts, and corporate law covers the board-level responsibility that sits alongside them.
