On 31 July 2026, at its 195th session, Montenegro's Capital Market Commission entered Artenx d.o.o. Podgorica into the Register of crypto-asset service providers. According to the Commission's own announcement, it is the first company in that register.
That single fact tells you two things. The regime is real and operating — not a draft, not a consultation paper. And it is early enough that almost nobody providing crypto services into Montenegro has worked out whether it applies to them.
This is what the law actually says, read from the text rather than from summaries.
Where the obligation comes from
It is not a dedicated crypto statute. Montenegro put crypto-asset services inside the anti-money-laundering law — the Zakon o sprječavanju pranja novca i finansiranja terorizma — by an amending law published in "Službeni list CG" br. 024/25 on 12 March 2025, which changed or added 52 articles.
Two structural provisions follow from that choice:
- Article 131(1)(3) makes the Komisija za tržište kapitala Crne Gore — the Capital Market Commission — the supervisory authority that keeps the register.
- Article 145c gave that authority nine months from the law's entry into force to establish the register.
So the sequence is: law in March 2025, register established within nine months, first entrant July 2026. If you looked at Montenegro eighteen months ago and concluded "unregulated", that conclusion has expired.
Who has to be in it
Article 40a is the operative provision, and it has two limbs that catch different people.
The first limb covers a legal person, a company, an entrepreneur, or a natural person carrying on a business with a seat in Montenegro, or with residence or approved permanent residence in Montenegro, who intends to provide crypto-asset services in Montenegro. They must be entered in the register before beginning to provide those services. Not during. Not after the first client.
The second limb is the one people miss. A crypto-asset service provider from an EU member state — one not on the high-risk third-country list, which has been authorised by its home supervisor or is registered in its home regulator's register — who wishes to provide those services in Montenegro must also be entered in this register before starting.
Read that again if you run a licensed EU firm. Your home authorisation does not carry you into Montenegro on its own. Montenegro is not in the EU, so there is no passport here; the register entry is a separate, prior step.
The ten services that trigger it
The law defines crypto-asset services as a closed list. If what you do appears here, you are in scope:
| # | Service |
|---|---|
| 1 | custody and administration of crypto-assets on behalf of clients |
| 2 | operation of a crypto-asset trading platform |
| 3 | exchange of crypto-assets for fiat currency |
| 4 | exchange of crypto-assets for other crypto-assets |
| 5 | execution of orders for crypto-assets on behalf of clients |
| 6 | placing of crypto-assets |
| 7 | reception and transmission of orders for crypto-assets on behalf of clients |
| 8 | advice on crypto-assets |
| 9 | crypto-asset portfolio management |
| 10 | crypto-asset transfer services on behalf of clients |
Anyone who has read MiCA will recognise the shape of that list, which is not a coincidence and matters for what comes next.
Item 8 is the sleeper. A firm that holds no client assets, runs no platform and touches no keys — that simply advises on crypto-assets — is inside the definition. Advisory businesses tend to assume registers are for exchanges and custodians. The text does not say that.
Item 1 is defined broadly too: custody and administration covers holding or controlling, on a client's behalf, crypto-assets or the means of access to them, where appropriate in the form of private cryptographic keys. If you hold keys for someone else, you are not outside the perimeter because you never called yourself a custodian.
What the application file has to contain
Article 40b sets out what goes to the Commission with the application. For a Montenegro-based applicant:
- identification data — name, address, seat, registration or tax identification number for companies; name, personal number, address and municipality of residence for entrepreneurs and natural persons carrying on a business;
- proof of appointment of the AML compliance officer under Article 69;
- a criminal-record certificate or equivalent act proving repute, in the sense of Article 40r, for the director, the members, the members of the management and governance bodies, and the beneficial owner;
- a statement by the responsible person that they are aware of the obligations under the law;
- data on all directors, as prescribed by Article 117(1)(3);
- a business plan setting out the crypto-asset services the applicant intends to provide, including how it will market them.
Two practical observations for foreign founders, because this is where the file usually stalls.
The repute certificates are asymmetric. Where the relevant people are Montenegrin citizens, the supervisory authority obtains the certificate ex officio. Where any of them is not a Montenegrin citizen, the applicant supplies it. For a foreign-owned structure that means collecting criminal-record certificates from every relevant jurisdiction — for directors, members, governing bodies and the beneficial owner — and each of those will need its own apostille and translation. Start that early; it is the longest lead item in the file and it does not shorten because you are in a hurry.
The business plan is not a formality. The law asks for the services you intend to provide and how you will market them. That is a document a regulator reads, and it fixes the perimeter you are registering for.
Providers under the second limb of Article 40a — the EU-based ones — file their own prescribed list.
Article 40e answers it: when services count as provided in Montenegro
Both limbs of Article 40a turn on providing crypto-asset services in Montenegro, and the statute does not leave that phrase to argument. Article 40e defines it, and the definition is broad: services are treated as provided in Montenegro if any one of the following applies to the provider.
| Trigger | What it catches |
|---|---|
| Seat, residence, or a place of business in Montenegro from which services are provided | the obvious case |
| Providing services, advertising, or directing a marketing campaign — regardless of the manner of advertising — at persons with a seat in Montenegro or resident there | targeting, not presence |
| Offering crypto-assets in Montenegro through one or more automated systems | app or platform availability |
| Distributing services through one or more distribution channels intended for persons with a seat in Montenegro or resident there | channel design |
| A postal address or telephone number in Montenegro, or a ".me" domain extension on the website | infrastructure signals |
Read the last row twice. A .me domain on your website is, on the face of the provision, sufficient on its own — and .me is sold worldwide as a vanity extension to businesses with no Montenegrin connection whatsoever. Anyone using it for a crypto-asset service should look at this article rather than assume the domain is decorative.
The middle rows matter more commercially. The test is not where your servers or your staff are. It is who you are aiming at. Advertising or a marketing campaign directed at Montenegrin residents brings you inside, expressly "regardless of the manner of advertising", and so does designing a distribution channel for them.
That also explains a detail in the application file: Article 40b requires a business plan stating the services and how they will be marketed. Marketing is not a commercial footnote in this framework; it is one of the statutory triggers for being in it.
Correction, and how it happened. An earlier version of this article said the statute contained no definition of "providing services in Montenegro" and declined to offer a bright line. That was wrong: Article 40e was there all along, and the reading that produced the error had followed Articles 40a and 40b without checking the articles between them. The inference offered instead — that the marketing-plan requirement implied marketing was relevant to scope — turned out to point the right way, but an inference was never needed. The article now states the rule.
The register is public, and that cuts both ways
The last paragraph of Article 40a is short and consequential: everyone has the right of access to the register data on the name of the provider and the crypto-asset services that provider supplies. The financial intelligence unit and the supervisory authorities get direct electronic access to the whole thing.
For anyone doing counterparty diligence, that is a free tool: if a firm tells you it is registered in Montenegro, you can check the name and the services it is registered for.
For anyone registering, it is a disclosure decision. Your entry states publicly which of the ten services you are in. Registering for a narrow scope you do not actually operate within is a problem; registering for everything you might one day do is a different problem.
What I am not going to tell you
Three deliberate gaps, because a confident wrong answer here is worse than an acknowledged one.
I found no penalty provision keyed to Article 40a in the consolidated text I read. That does not mean providing services without registration is consequence-free — supervisory and general AML sanctions exist, and the Commission is the supervisor — but I am not going to quote figures at you for an offence I could not tie to the article.
Registration is not a licence. The current regime is entry in a register on the conditions above, not a prudential authorisation with capital requirements. Anyone selling you a "Montenegro crypto licence" is using a word the current framework does not use.
The picture is still moving. The Commission has had a rulebook in public consultation, and Montenegro is aligning with MiCA through the EU accession process. What that means for firms that register now — whether entries convert, and on what terms — is exactly the question to keep under review rather than to settle from an article. Check the position on the day you file.
Why the timing matters commercially
There is a narrow window here that has nothing to do with law and everything to do with sequence.
A register that has one entrant is a register where being early is visible. It is also a register whose practice is being formed right now — the first files through a new process shape what the authority expects the second and third to look like.
And there is a harder edge. Article 40a says registration must happen before services begin. A firm already serving Montenegrin clients, or an EU firm that has been treating Montenegro as an incidental market, is not in a "we should get round to this" position. It is in a position where the obligation has already crystallised and the file has not been made.
The arithmetic
The costs here are not the registration file. They are the two things sitting on either side of it.
On one side: the lead time on repute certificates for a foreign-owned structure — every director, every governing body member, the beneficial owner, each from their own jurisdiction, each apostilled and translated. That is measured in weeks and it does not compress.
On the other: operating inside the definition without an entry, in a market where the supervisor is the Capital Market Commission and the register is public. I will not put a number on that because I could not verify one, and that is precisely the point at which people stop reading and start asking.
Against both, the cheap step is establishing whether the ten-service list catches what you actually do — which is a reading exercise on your own business description, done once, before anything else in this article becomes your problem.
What to send, and when
If you are considering the Montenegrin market, or already have users there, send a description of the service you provide — in operational terms rather than marketing terms — plus where your entity is incorporated and whether it holds any EU authorisation. That is enough to say which limb of Article 40a applies to you and what the file will need.
RoNa Legal advises foreign clients on Montenegrin law; representation before Montenegrin authorities and courts is conducted together with advocates entered in the register of the Bar Association of Montenegro. See our fintech and crypto practice or reach us through contact. Related: company formation in Montenegro, AML and KYC harmonisation for Montenegrin companies, and — for the separate question of paying for property in crypto — buying real estate with crypto.
