Information for obliged Entities

VASP as obliged entity

With regard to the growing number of commercial companies with an international element within their property and organizational structure, established for the purpose of providing virtual asset services which often do not fulfill their legal obligations in the area of measures against money laundering and terrorist financing (hereinafter referred to as "AML/CFT") flawlessly, the Financial Analytical Office (hereinafter referred to as the "FAU") draws attention to the following:

  • Language of the procedure. According to Section 16 of the Act No. 500/2004 Coll. Code of Administrative Procedure: „Communication within the procedure shall be carried out and documents executed in the Czech language. Parties to the procedure may also communicate and file submissions in the Slovak language“. In other words, all submission towards the FAU must be in Czech (or Slovak) language (e.g. suspicious transaction report, designation of Contact Person, fulfillment of the information duty or Internal System of Rules). 

  • Terminology. Virtual asset service provider (hereinafter referred to as the „VASP“) is according to Section 2(1) b) 15. Of the Act No. 253/2008 Coll., on Selected Measures against Legitimization of Proceeds of Crime and Financing of Terrorism (hereinafter referred to as the „AML Act“) one of the categories of so-called „obliged entity“. VASP is included among financial institution.
    • Section 4(8) of the AML Act then refers to the definition of „Virtual Asset“.
    • Section 4(9) of the AML Act then refers to the definition of „Service related to a virtual asset“
    • Section 4(10) of the AML Act then refers to the definition of „VASP“ 
    • Section 4(11) of the AML Act then refers to the definition of „Non-hosted address“

  • The Czech national bank (CNB) license – CNB is a competent authority under the EU’s Markets in Crypto-Assets Regulation (MiCA) on the basis of the Act on the Digitalisation of the Financial Market. The CNB is authorised to receive applications during the February 2025 (once the legislative process has been completed and the relevant act comes into effect). More information here.

  • Designation of a Contact Person. In accordance with Provision 22 of the AML Act, the VASP is obliged to designate a specific employee or member of a statutory body to fulfill the reporting obligation pursuant to Section 18 of the AML Act and to ensure ongoing contact with the FAU (the so-called Contact Person). The VASP informs the FAU of the designation of Contact Person and any subsequent changes within 30 days from the day it became an obliged entity, or within 15 days from the day the changes occurred. With effect from 1. 2.2025 a decree No. 420/2024 Coll. of the Ministry of Finance is binding on the notification of the contact person to the FAU, which sets a prescribed format (xml) and structure (form). More information in Czech here. Furthermore, the notification of the contact person is required exclusively through the data box of the obliged person pursuant to Section 22 (2) of the AML of the Act. This is possible (from 1. 2. 2025) simply by clicking on the "Send" button in the interactive form and subsequent login to the data box of the obliged person whose contact person is notified. Interactive form is accessible from the home page of FAU´s website „Formulář pro oznámení kontaktní osoby“. This newly extended obligation must be fulfilled by all current obliged entities until 3 March 2025. Breaches of information duty in relation to the Contact Person is commitment of an offense in the sense of Section 46 (2) of the AML Act, for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000. 
    • Warning: Contact person as specific employee or member of a statutory body of the VASP must be able to communicate with FAU in Czech (or Slovak) language.

  • Creation and regular update of the Risk Assessment. The VASP is obliged to create, no later than 60 days from the date on which it became an obliged entity, a written assessment of the risks of legalization of criminal proceeds and financing of terrorism (so-called Risk Assessment) for the types of provided business and business relationships, to the extent that it carries out monitored activities according to the AML Act (cf. Section 21a (2) of the AML Act), while continuously updating the assessment in question (cf. Section 21a (3) of the AML Act). If the VASP did not create a written Risk Assessment or did not regularly update it, it would commit an offense in the sense of Section 48 (4) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
    • Warning: The Risk Assessment must be created in Czech language.

  • Creation and regular update of the Internal System of Rules. The VASP is obliged to create (and regularly update) a written system of internal policies, procedures and control measures to fulfill the obligations set out in the AML Act no later than sixty 60 days from the date on which it became an obliged entity based on the Risk Assessment (the so-called Internal System of Rules). If the VASP did not create a written Internal System of Rules, it would commit an offense in the sense of Section 48 (2) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000. 
    • Warning: The Internal System of Rules must be created in the Czech language.

  • Suspicious Transaction Report (STR). The system of AML/CFT measures is based on the principle of active participation of obliged entities, who, as part of their business activities, identify and mitigate AML/CFT risks and report to the FAU suspicious transactions (see the definition of the term in Section 6 of the AML Act). In other words, one of the most fundamental duties of the obliged entities (i.e. VASP) is the Suspicious Transaction Report according to Section 18 (1) of the AML Act (the form is available on the FAU´s website: https://fau.gov.cz/oznameni-o-podezrelem-obchodu). If the VASP failed to report to the FAU a suspicious transaction pursuant to Section 18 (1) of the AML Act, it would commit an offence in the sense of Section 46 (1) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 30,000,000. 
    • Warning: The STRs must be reported to the FAU without undue delay and in Czech language. There is a strict confidentiality relating to STR and activities taken by the FAU.

The VASP, as an obliged person, subsequently has a whole series of other obligations stemming from the AML Act, whether they are obligations related to the customer and his transactions (e.g. identification duty, customer due diligence) or general obligations (e.g. record keeping, employee training, etc.). 

In conclusion, the FAU notes that the failure to comply with the AML/CFT obligations could not just result in the administrative penalty (see the examples above), but considering the nature of misconduct might lead to possible criminal prosecution for the crime of legalization of proceeds of crime (cf. Section 216 and 217 of the Criminal Code).