Serbian police used EU funds to purchase technology from a sanctioned russian company

Serbia’s Ministry of the Interior (MUP) continued to upgrade software and equipment from the Russian company Papilon, which has been under U.S. and European Union sanctions since 2023, according to an investigation by Radio Free Europe/Radio Liberty (RFE/RL).

The investigation also found that part of this equipment was financed by Serbia in 2023 using funds received from the European Union.

Because of this, Brussels may seek reimbursement from Belgrade, European Commission spokesperson Guillaume Mercier told RFE/RL.

“If it is established that an expenditure was not made in compliance with EU rules, including those related to sanctions, the EU will take appropriate measures to protect the EU budget, including recovery of funds where appropriate,” Mercier said.

Serbia’s Ministry of the Interior did not respond to RFE/RL’s questions regarding the purchase and use of this technology despite the sanctions.

What is known about cooperation between Papilon and the Serbian police?

For years, Serbia’s Ministry of the Interior has been upgrading equipment from the Russian IT company Papilon, used for identity verification based on fingerprints and palm prints, facial images, or iris scans, according to documents available on the public procurement portal.

According to data from the Russian business registry, Papilon is engaged in the development of biometric and forensic systems.

Since 2023, Papilon and four related companies have been on the U.S. list of entities found to be “engaged in activities that threaten the national security or foreign policy interests of the United States.”

The companies are also subject to EU sanctions, meaning they are on the list of entities facing the EU’s strictest trade restrictions.

The EU justification for the sanctions states that the companies are “military end users, part of the Russian military-industrial complex, or have commercial or other ties to, or otherwise support, Russia’s defense and security sector.”

RFE/RL’s investigation showed that some of the Russian company’s equipment was purchased using EU IPA funds—funds intended to implement reforms in EU candidate countries and prepare them for accession.

A 2024 report by Serbia’s Ministry of the Interior on activities related to EU-supported projects states that one million euros were allocated for procurement when, “in October 2023, the National Criminal Forensics Center switched to a new version of AFIS (AFIS Papilon 9).”

The National Criminal Forensics Center is part of the Police Directorate of Serbia’s Ministry of the Interior and conducts forensic examinations and provides material evidence for the criminal justice system.

In this way, the Center obtained a multifunctional automated system for identifying fingerprints, palm prints, faces, and irises, designed to manage large biometric databases.

When was Papilon placed under sanctions?

At the time IPA funds were used, the Russian company Papilon had already been listed for eight months—since February 27, 2023—on the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) Entity List.

This list includes foreign companies, organizations, and individuals determined by the U.S. government to be involved in activities that threaten U.S. national security or foreign policy interests.

The U.S. administration explained that five companies linked to Papilon were added to the list for supporting Russian operations in occupied Ukrainian territories, “including the use of biometric technology to suppress Ukrainian resistance and impose loyalty among the Ukrainian population in occupied territories.”

When asked how sanctioned equipment could be purchased using IPA funds, European Commission spokesperson Guillaume Mercier told RFE/RL that EU support for Serbia has been ongoing since 2011, when Papilon was not under sanctions.

Papilon and its affiliated companies have been on the EU sanctions list since December 18, 2023—two months after EU funds paid for the upgrade to a more advanced version of the AFIS Papilon system under an IPA project.

The aim of the support, Mercier explained, was to ensure that legislation, policies, standard operating procedures, and technological equipment for criminal investigations “are in line with relevant Prüm regulations and decisions.”

The Prüm regulations relate to EU cooperation enabling member states to automatically exchange DNA profiles, fingerprints, and vehicle registration data to combat terrorism and serious crime.

Their goal is the rapid identification of suspects and more effective cross-border police cooperation.

“Since 2011, before the above-mentioned companies (Papilon) were placed under sanctions, AFIS Papilon software has been provided through EU support to Serbian authorities. The system has been used and upgraded since then. Papilon AFIS products were assessed as compliant with standards at the time,” Mercier said.

He added that the EU “takes compliance with sanctions very seriously within the framework of overall cooperation with Serbia.”

“Especially in this sector, and through discussions with the Ministry of the Interior and the Serbian police within Chapter 24,” Mercier noted, adding that a request for reimbursement of EU funds is also possible.

Chapter 24 and Chapter 23 are two key chapters in EU accession negotiations related to the rule of law. Chapter 24 covers justice, freedom, and security. Without progress in these two chapters, no country can advance in the EU integration process.

The European Union is financing more than 400 projects for Serbia’s Ministry of the Interior through accession funds, some completed and others ongoing, making it impossible to determine the exact amount allocated.

Cooperation without EU support

In addition to upgrading the AFIS system with EU funds, Serbian police have for years invested budget funds in software and equipment from the Russian manufacturer.

Equipment and software from Papilon worth more than €1.4 million have been purchased over the past four years, according to public procurement data.

“Papilon AFIS can be used to process and store citizens’ biometric data for various state purposes, such as criminal records, border and immigration systems, as well as general population registration, including ID cards and passports,” Filip Milošević, a researcher at the Belgrade-based SHARE Foundation, told RFE/RL.

In Serbia, the criminal AFIS system is also used in police and forensic investigations to identify suspects, convicted persons, and latent fingerprints from crime scenes.

In addition to the system itself, processing software, and databases for storing fingerprints and other biometric data, Serbian police also use various devices manufactured by Papilon.

Fingerprint and palm scanners are in use, as well as workstations—computers with accompanying equipment on which the system is installed—according to Interior Ministry procurement documentation.

In December 2022, the Ministry of the Interior also conducted a “biometric data migration,” involving the transfer and analysis of photographs (full-face and profile) of all persons registered in AFIS Papilon databases.

“This system needs to be upgraded to include automatic fingerprint encoding and automatic facial image encoding,” states one of the requirements in the tender guidelines for upgrading AFIS Papilon to a more advanced version.

Milošević says the Interior Ministry “likely wants to upgrade the existing biometric data system with a module that would enable the transfer of these data into other systems,” such as intelligent video surveillance and other large-scale data collection software.

“This opens the possibility for advanced data cross-referencing,” he noted.

“Once this type of data migration is carried out into another system, it practically means that these software systems can automatically identify citizens by name and surname, in real time, in any footage from surveillance cameras or mobile devices during protests, for example,” Milošević warned.

Who are the technology providers?

The biometric data migration project in 2022, worth more than €30,000, was awarded to the company MRG export-import at the end of that year, according to public procurement data.

As previously reported by RFE/RL, Serbia’s Ministry of the Interior, through MRG, extended the license for the controversial Cellebrite tool until mid-2026, after international organizations reported suspected misuse in Serbia.

Cellebrite tools were used to forcibly unlock the phones of journalists and activists in Serbia during 2024 and 2025, after which data were extracted from their devices.

In some cases, spyware was installed that downloaded images, messages, and various digital traces in real time. This was analyzed in detail by Amnesty International.

Questions sent by RFE/RL to the Serbian Interior Ministry regarding the procurement of equipment from Papilon had not been answered at the time of publication.

In 2025, framework agreements for servicing the equipment were awarded to a company from Čačak—GMM ENGINEERING 032—according to the Public Procurement Administration.

According to data from the Business Registers Agency, the company was registered in September 2024, only six months before the Interior Ministry awarded it procurement contracts worth more than €255,000.

These are also the only three procurements in which the company has participated.

GMM ENGINEERING 032 did not respond to RFE/RL’s questions about how it entered this line of business.

Papilon and ties to the Russian state apparatus

Papilon Joint-Stock Company and several affiliated companies are registered in Russia in the city of Miass, on the eastern slopes of the Southern Urals in the Chelyabinsk region, on the border between Europe and Asia.

Russian business registry data show the companies were registered in 2002, with Pavel Zaitsev listed as director.

They are registered for “activities and consulting work in the field of computer technologies.”

“We create multimodal biometric systems that enable identification of a person based on any of the following: fingerprints, face, eyes. We ensure seamless integration of our forensic systems into national biometric systems of other countries,” the company states on its website.

According to the same source, its technology is used in 43 countries, and the company cooperates closely with police forces in Russia, Turkey, India, Uzbekistan, Kazakhstan, and Tajikistan.

RFE/RL was unable to independently verify this information.

One project highlighted on the company’s website is its long-term cooperation with Russia’s Ministry of the Interior.

As stated, “Papilon operates the AFIS Papilon-9 system for the Russian Ministry of Defense, maintaining a comprehensive national biometric database.”

They add that the project includes up to 155 million digital records, each containing ten fingerprints, and that they have workstations in more than 1,000 regional centers across Russia.

Papilon did not respond to RFE/RL’s questions regarding cooperation with Serbia’s Ministry of the Interior.