Serbian police used EU funds to buy technology from a sanctioned Russian company

Serbia's Ministry of Internal Affairs (MUP) continued to upgrade the software and equipment of the Russian company Papilon, which has been under US and European Union sanctions since 2023, according to a study by Radio Free Europe (RFE).

The research also showed that part of this equipment was financed by Serbia in 2023 with funds received from the European Union.

This is why Brussels may demand a refund from Belgrade, European Commission spokesman Guillaume Mercier told Radio Free Europe.

"If it is established that an expenditure has not been carried out in accordance with EU rules, including those related to sanctions, the EU will take appropriate measures to protect the EU budget, including the recovery of funds where appropriate," Mercier said.

Serbia's Interior Ministry did not respond to Radio Free Europe's questions about the purchase and use of this technology despite sanctions.

What is known about the cooperation between Papillon and the Serbian police?

The Serbian Interior Ministry has been upgrading devices from Russian IT company Papilon for years, which are used for identity verification based on fingerprints and palm prints, facial images or iris scans, according to documents available on the public procurement portal.

The Russian company Papilon, according to data from the Russian business register, is engaged in the development of biometric and forensic systems.

Since 2023, Papillon and four related companies have been on the US list of companies found to be “engaged in activities that threaten the national security or foreign policy interests of the United States.”

The companies are also subject to European Union sanctions, that is, on the list of companies subject to the EU's strictest trade restrictions.

The justification for the sanctions cited by the EU is that the companies in question are “military end-users, part of the Russian military-industrial complex, or have commercial or other links to, or otherwise support, the Russian defense and security sector.”

Radio Free Europe's investigation showed that some of this Russian company's equipment was purchased through EU IPA funds, funds that serve to implement reforms in EU candidate countries, preparing them for entry into the Union.

The 2024 report of the Serbian Ministry of Interior on activities related to the implementation of Union-supported projects states that one million euros were allocated for the procurement of equipment when “in October 2023, the National Center for Criminal Forensics switched to a new version of AFIS (AFIS Papillon 9)”.

The National Center for Criminal Forensics is part of the Police Directorate of the Ministry of Internal Affairs of Serbia, which conducts forensic examinations and provides material evidence for the needs of the criminal procedure system in Serbia.

In this way, he provided a multifunctional automatic system for identifying fingerprints, palms, faces and irises, designed to manage large biometric databases.

Since when has Papillon been under sanctions?

At the time the IPA funds were used, the Russian company Papilon had been on the Bureau of Industry and Security (BIS Entry List) of the US Department of Commerce for eight months, as of February 27, 2023.

This list is a list of foreign companies, organizations, and individuals that the US government has determined are involved in activities that threaten the national security or foreign policy interests of the US.

The US administration's explanation for the decision says that five companies linked to Papillon were placed on the list for supporting Russian operations in the occupied territories of Ukraine, "which include the use of biometric technology to suppress Ukrainian resistance and impose loyalty among the Ukrainian population in the occupied territories."

When asked how it happened that sanctioned equipment was being purchased with IPA funds, European Commission spokesman Guillaume Mercier told Radio Free Europe that support for Serbia has been continuous since 2011, when the Russian company Papillon was not on the sanctions list.

The Russian company and its affiliated companies have been on the EU sanctions list since December 18, 2023, two months after EU funds paid for the transition to a more advanced version of the Papilon AFIS System under the IPA project.

The aim of the support, as Mercier explains, was to ensure that, through legislation and policies, standard operating procedures and technological equipment for criminal investigations “are in line with the relevant Prüm regulations and decisions”.

The Prüm Regulations concern EU cooperation that enables member states to automatically exchange DNA profiles, fingerprints and vehicle registration numbers to combat terrorism and serious crime.

Its goal is the rapid identification of suspects and more efficient cross-border police cooperation.

“Since 2011, before the aforementioned companies (Papilon) were placed on the sanctions list, the Papillon AFIS software has been provided through EU support to the Serbian authorities. The system has been used and improved since then. Papillon AFIS products were assessed as compliant with the standards at the time,” says Guillaume Mercier.

He adds that the EU "takes the issue of sanctions compliance very seriously within the framework of overall cooperation with Serbia."

"Especially in this sector, and through discussions with the Ministry of Internal Affairs and the Serbian police within Chapter 24," Mercier emphasizes, adding that there may also be a request for the return of EU funds.

Chapter 24 and Chapter 23 are two key chapters in the EU accession negotiations related to the rule of law.

Chapter 24 covers justice, freedom and security. Without progress in these two chapters, no country can advance in the European integration process.

The European Union is financing more than 400 projects for the Serbian Ministry of Internal Affairs through accession funds, some of which have been completed and some are still ongoing, so the exact amount of funds allocated cannot be determined.

Cooperation between the Ministry of Interior and Papillon without EU support

In addition to improving the AFIS system with the help of EU funds, the Serbian police have been investing in software and equipment from this Russian manufacturer for years, also from budget funds.

Equipment and software from Russian manufacturer Papilon, worth more than 1.4 million euros, were purchased over the past four years, according to data from the public procurement portal.

"Papillon AFIS can be used to process and store biometric data of citizens for various state needs, such as criminal records, border and immigration systems, but also general population registration, such as ID cards and passports," Filip Milošević, a researcher at the Belgrade-based SHARE Foundation, a non-profit organization that deals with freedom of expression on the Internet, data privacy and digital security, told Radio Free Europe.

In Serbia, the criminal AFIS system is also used in police and forensic investigations for the identification of suspects, convicted persons and latent traces from crime scenes.

In addition to the system itself, processing software, and databases for storing fingerprints and other biometric data, the Serbian police also use various devices manufactured by Papilon.

Fingerprint and palm scanners are in use, as well as workstations - computers with accompanying equipment on which the aforementioned system is installed, as can be seen in the procurement documentation of the Ministry of Interior.

During December 2022, the Ministry of Interior also carried out a “biometric data migration”, which involves the relocation and analysis of photographs (full face and profile) of all persons registered in the AFIS Papilon databases.

"This system should be upgraded to include automatic fingerprint encoding and automatic facial image encoding," is one of the points in the instructions for bidders on how to upgrade the Papilon AFIS system to a more advanced version.

Filip Milosevic from the SHARE Foundation states that “the Ministry of Interior probably wants to improve the current system for biometric data of citizens with a module that would enable the transfer of this data to other systems,” such as intelligent video surveillance and other software for collecting large data sets.

"This opens up the possibility for advanced data cross-referencing," Milosevic notes.

"Once this type of data migration is done to another system, practically this means that these software and systems can automatically identify, in real time, citizens by first and last name in any footage from surveillance cameras or mobile devices during protests, for example," warns Milosevic.

Who are the technology providers?

The work for the migration of biometric data for 2022, worth more than 30 thousand euros, was awarded to the company MRG export-import at the end of 2022, according to data on the public procurement portal.

As RFE/RL previously reported, Serbia's Interior Ministry, through the company MRG, has extended the license for the procurement of the controversial Cellebrite tool until mid-2026, after international organizations reported on its suspected misuse in Serbia.

Cellebrite tools were used to forcibly unlock the phones of journalists and activists in Serbia during 2024 and 2025, after which data was downloaded from their phones.

In some cases, “spyware” was installed that downloaded images, messages, and various digital traces in real time. This was analyzed in detail by the international organization Amnesty International.

Radio Free Europe's questions regarding the procurement of equipment from Russian manufacturer Papilon have not been answered by the time of publication of this article.

During 2025, framework agreements for servicing the equipment were awarded to a company from Çaçak – GMM ENGINEERING 032, according to the Public Procurement Administration.

According to data from the Business Registers Agency, the company was registered in September 2024, just six months before the Serbian Ministry of Interior awarded it procurement contracts worth more than 255 thousand euros.

These are also the only three procurements in which this company has participated.

The company GMM ENGINEERING 032 did not respond to Radio Free Europe's questions about how it entered this business.

Papillon and connections to the Russian state apparatus

Papilon Joint Stock Company and a number of related companies are registered in Russia in the city of Miass on the eastern slope of the Southern Urals in the Chelyabinsk region, that is, on the border of Europe and Asia.

Russian business registry data shows that the companies were registered in 2002 and Pavel Zaitsev is listed as a director.

They are registered for "activities and consultancy work in the field of computer technologies".

"We create multimodal biometric systems that enable the identification of a person based on any of the following: fingerprints, face, eyes. We ensure seamless integration of our forensic systems into the national biometric systems of other countries," they state on the website.

According to the same source, their technology is used in 43 countries and the company has close cooperation with police forces in Russia, Turkey, India, Uzbekistan, Kazakhstan and Tajikistan.

Radio Free Europe was unable to independently confirm this information.

One of the projects they particularly highlight on their website is their long-standing collaboration with the Russian Ministry of Internal Affairs.

As they state, “Papilon operates the Papillon-9 AFIS system for the Russian Ministry of Defense, maintaining a comprehensive national biometric database.”

They add that this project includes up to 155 million digital records, each of which contains ten fingerprints of citizens, and that they have workstations in over a thousand regional centers in Russia.

Papilon did not respond to Radio Free Europe's questions regarding cooperation with the Serbian Ministry of Internal Affairs.