I believe it is server-side as well.
I'm sure that the XML could contain information about what an NPC is (haven't found yet) and where it is in the map.
Hao district, at the left of Zaiwei, has a few vendor NPCs.
It had all the generic ones, except the bank which didn't worked.
It was just there, without any interactions programmed.
But I highly doubt that they would put such information in the XML files.
I can see a few reasons to do not do that:
- Easily update the items
- Prevent that people buy discontinued items (like the Hao district currency, those boxes that were removed)
- Prevent that people buy items you aren't supposed to buy (like buying an Aransu 3 weapon)
- Make it easier for them to rip your money, by increasing/changing the costs
Even if it was in the XML files, I'm sure it would trigger plenty of red flags if you bought an item you aren't meant to, leading to a permanent ban.
Recommended read:
BLADE & SOUL USER AGREEMENT (THE "AGREEMENT")
https://us.ncsoft.com/en/legal/user-agreements/blade-and-soul-user-agreement.php
BLADE & SOUL RULES OF CONDUCT
https://us.ncsoft.com/en/legal/user-agreements/blade-and-soul-rules-of-conduct.php
Or look for the equivalent for your region.