Information for VASPs

07.11.2024 08:25

With regard to the growing number of commercial companies with an international element within their property and organizational structure, established for the purpose of providing virtual asset services which often do not fulfill their legal obligations in the area of measures against money laundering and terrorist financing (hereinafter referred to as "AML/CFT") flawlessly, the Financial Analytical Office (hereinafter referred to as the "FAU") draws attention to the following:

Language of the procedure. According to Section 16 of the Act No. 500/2004 Coll. Code of Administrative Procedure: „Communication within the procedure shall be carried out and documents executed in the Czech language. Parties to the procedure may also communicate and file submissions in the Slovak language“. In other words, all submission towards the FAU must be in Czech (or Slovak) language (e.g. suspicious transaction report, designation of Contact Person, fulfillment of the information duty or Internal System of Rules).

Terminology. Virtual asset service provider (hereinafter referred to as the „VASP“) is according to Section 2 (1) l) of Act No. 253/2008 Coll., on Selected Measures against Legitimization of Proceeds of Crime and Financing of Terrorism (hereinafter referred to as the „AML Act“) one of the categories of so-called „obliged entity“. Section 4 (8) of the AML Act then refers to the VASP as a person who, as an object of his business activity, buys, sells, stores, manages, transfers or mediates the purchase or sale of a virtual asset (see the definition of the term in Section 4 (9) of the AML Act) for another, provides financial services related to the offer or the sale of a virtual asset, or provides other similar services related to a virtual asset.

Trade license. A person who intends to provide services related to a virtual asset as part of its business activity is required to have an trade authorization, specifically:
- Classification of trades: notifiable unqualified trades; Objects of business: Manufacture, trade and services not specified in Annexes 1 to 3 to the Trade Licensing Act 455/1991 Coll. (hereinafter referred to as “Trade Licensing Act”);
- Field of activity: the provision of services related to virtual assets (no. 81).
In case that the obliged entity carries out the activity in question without a trade license, it is subject to not just an administrative penalty (i.e. fine of up to CZK 500,000 for committing an offense in the sense of Section 62 (1) j) of the Trade Licensing Act), but possibly even criminal penalty (i.e. imprisonment or prohibition of activity for committing criminal offence of unauthorized business activity in the sense of Section 251 of Act No. 40/2009 Coll., Criminal Code (hereinafter referred to as „Criminal Code“)).

Designation of a Contact Person. In accordance with Provision 22 of the AML Act, the VASP is obliged to designate a specific employee or member of a statutory body to fulfill the reporting obligation pursuant to Section 18 of the AML Act and to ensure ongoing contact with the FAU (the so-called Contact Person). The VASP informs the FAU of the designation of Contact Person and any subsequent changes within 60 days from the day it became an obliged entity, or within 30 days from the day the changes occurred (the form is available on the FAU´s website: https://fau.gov.cz/kontaktni-osoby). If the VASP did not inform the FAU about the designation or change of the Contact Person, it would commit an offense in the sense of Section 46 (2) of the AML Act, for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: Contact person as specific employee or member of a statutory body of the VASP must be able to communicate with FAU in Czech (or Slovak) language.

Creation and regular update of the Risk Assessment. The VASP is obliged to create, no later than 60 days from the date on which it became an obliged entity, a written assessment of the risks of legalization of criminal proceeds and financing of terrorism (so-called Risk Assessment) for the types of provided business and business relationships, to the extent that it carries out monitored activities according to the AML Act (cf. Section 21a (2) of the AML Act), while continuously updating the assessment in question (cf. Section 21a (3) of the AML Act). If the VASP did not create a written Risk Assessment or did not regularly update it, it would commit an offense in the sense of Section 48 (4) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: The Risk Assessment must be created in Czech language.

Creation and regular update of the Internal System of Rules. The VASP is obliged to create (and regularly update) a written system of internal policies, procedures and control measures to fulfill the obligations set out in the AML Act no later than sixty 60 days from the date on which it became an obliged entity based on the Risk Assessment (the so-called Internal System of Rules). If the VASP did not create a written Internal System of Rules, it would commit an offense in the sense of Section 48 (2) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: The Internal System of Rules must be created in the Czech language.

Suspicious Transaction Report (STR). The system of AML/CFT measures is based on the principle of active participation of obliged entities, who, as part of their business activities, identify and mitigate AML/CFT risks and report to the FAU suspicious transactions (see the definition of the term in Section 6 of the AML Act). In other words, one of the most fundamental duties of the obliged entities (i.e. VASP) is the Suspicious Transaction Report according to Section 18 (1) of the AML Act (the form is available on the FAU´s website: https://fau.gov.cz/oznameni-o-podezrelem-obchodu). If the VASP failed to report to the FAU a suspicious transaction pursuant to Section 18 (1) of the AML Act, it would commit an offence in the sense of Section 46 (1) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 30,000,000.
- Warning: The STRs must be reported to the FAU without undue delay and in Czech language. There is a strict confidentiality relating to STR and activities taken by the FAU.

The VASP, as an obliged person, subsequently has a whole series of other obligations stemming from the AML Act, whether they are obligations related to the customer and his transactions (e.g. identification duty, customer due diligence) or general obligations (e.g. record keeping, employee training, etc.).

In conclusion, the FAU notes that the failure to comply with the AML/CFT obligations could not just result in the administrative penalty (see the examples above), but considering the nature of misconduct might lead to possible criminal prosecution for the crime of legalization of proceeds of crime (cf. Section 216 and 217 of the Criminal Code).

Finally, please be aware that FAU does not maintain any kind or register of VASPs.

New legal framework

NEW AML/CFT REGULATORY FRAMEWORK FOR VASPs

From 30 December 2024 there is significant change in relation to the persons providing services related to virtual assets (hereinafter „VASPs“) who belong to one of the categories of obliged entities according to the Act No. 253/2008 on Selected Measures against Legitimisation of Proceeds of Crime and Financing of Terrorism (hereinafter „AML Act“). VASPs, as obliged entities newly stipulated by Section 2(1) b) 15. of AML Act, are classified as financial institution. It is based on the following legislation of the European Union:

Markets in Crypto-Assets Regulation (MiCA): REGULATION (EU) 2023/1114 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937
Regulation TFR: REGULATION (EU) 2023/1113 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (recast)
Directive MiFiD: Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) – consolidated text.

Under the new rules, each VASP has to hold a license resulting from a fee-based procedure.

In case that entity intends to provide services relating to a virtual assets under the MiCA regulation, it is obliged to apply for a licence from the Czech National Bank under that regulation. The Czech National Bank will be also national competent authority with supervisory powers. More information here. Detailed information about licencing process you can find on the Czech National Bank websites.

To perform business activities relating to a virtual assets, which are not covered by the MiCA regulation (i.e. crypto-assets that are unique and not fungible with other crypto-assets), the entity must obtain an authorisation from FAÚ as result of the permit procedure newly stipulated in the AML Act.

Entities providing crypto-asset services in accordance with national applicable laws before 30 December 2024 may continue to do so until 31 July 2025 or until they are granted or refused a MiCA authorisation. The same rule is applicable for FAÚ´s permission.

From 30 December 2024 all VASPs in the Czech Republic are binded by the Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (https://eur-lex.europa.eu/eli/reg/2023/1113/oj).

VASP as obliged entity

Language of the procedure. According to Section 16 of the Act No. 500/2004 Coll. Code of Administrative Procedure: „Communication within the procedure shall be carried out and documents executed in the Czech language. Parties to the procedure may also communicate and file submissions in the Slovak language“. In other words, all submission towards the FAU must be in Czech (or Slovak) language (e.g. suspicious transaction report, designation of Contact Person, fulfillment of the information duty or Internal System of Rules).

Terminology. Virtual asset service provider (hereinafter referred to as the „VASP“) is according to Section 2(1) b) 15. Of the Act No. 253/2008 Coll., on Selected Measures against Legitimization of Proceeds of Crime and Financing of Terrorism (hereinafter referred to as the „AML Act“) one of the categories of so-called „obliged entity“. VASP is included among financial institution.
- Section 4(8) of the AML Act then refers to the definition of „Virtual Asset“.
- Section 4(9) of the AML Act then refers to the definition of „Service related to a virtual asset“
- Section 4(10) of the AML Act then refers to the definition of „VASP“
- Section 4(11) of the AML Act then refers to the definition of „Non-hosted address“

The Czech national bank (CNB) license – CNB is a competent authority under the EU’s Markets in Crypto-Assets Regulation (MiCA) on the basis of the Act on the Digitalisation of the Financial Market. The CNB is authorised to receive applications during the February 2025 (once the legislative process has been completed and the relevant act comes into effect). More information here.

Designation of a Contact Person. In accordance with Provision 22 of the AML Act, the VASP is obliged to designate a specific employee or member of a statutory body to fulfill the reporting obligation pursuant to Section 18 of the AML Act and to ensure ongoing contact with the FAU (the so-called Contact Person). The VASP informs the FAU of the designation of Contact Person and any subsequent changes within 30 days from the day it became an obliged entity, or within 15 days from the day the changes occurred. With effect from 1. 2.2025 a decree No. 420/2024 Coll. of the Ministry of Finance is binding on the notification of the contact person to the FAU, which sets a prescribed format (xml) and structure (form). More information in Czech here. Furthermore, the notification of the contact person is required exclusively through the data box of the obliged person pursuant to Section 22 (2) of the AML of the Act. This is possible (from 1. 2. 2025) simply by clicking on the "Send" button in the interactive form and subsequent login to the data box of the obliged person whose contact person is notified. Interactive form is accessible from the home page of FAU´s website „Formulář pro oznámení kontaktní osoby“. This newly extended obligation must be fulfilled by all current obliged entities until 3 March 2025. Breaches of information duty in relation to the Contact Person is commitment of an offense in the sense of Section 46 (2) of the AML Act, for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: Contact person as specific employee or member of a statutory body of the VASP must be able to communicate with FAU in Czech (or Slovak) language.

Creation and regular update of the Risk Assessment. The VASP is obliged to create, no later than 60 days from the date on which it became an obliged entity, a written assessment of the risks of legalization of criminal proceeds and financing of terrorism (so-called Risk Assessment) for the types of provided business and business relationships, to the extent that it carries out monitored activities according to the AML Act (cf. Section 21a (2) of the AML Act), while continuously updating the assessment in question (cf. Section 21a (3) of the AML Act). If the VASP did not create a written Risk Assessment or did not regularly update it, it would commit an offense in the sense of Section 48 (4) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: The Risk Assessment must be created in Czech language.

Creation and regular update of the Internal System of Rules. The VASP is obliged to create (and regularly update) a written system of internal policies, procedures and control measures to fulfill the obligations set out in the AML Act no later than sixty 60 days from the date on which it became an obliged entity based on the Risk Assessment (the so-called Internal System of Rules). If the VASP did not create a written Internal System of Rules, it would commit an offense in the sense of Section 48 (2) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 1,000,000.
- Warning: The Internal System of Rules must be created in the Czech language.

Suspicious Transaction Report (STR). The system of AML/CFT measures is based on the principle of active participation of obliged entities, who, as part of their business activities, identify and mitigate AML/CFT risks and report to the FAU suspicious transactions (see the definition of the term in Section 6 of the AML Act). In other words, one of the most fundamental duties of the obliged entities (i.e. VASP) is the Suspicious Transaction Report according to Section 18 (1) of the AML Act (the form is available on the FAU´s website: https://fau.gov.cz/oznameni-o-podezrelem-obchodu). If the VASP failed to report to the FAU a suspicious transaction pursuant to Section 18 (1) of the AML Act, it would commit an offence in the sense of Section 46 (1) of the AML Act for which could be imposed administrative penalty in the form of a fine up to CZK 30,000,000.
- Warning: The STRs must be reported to the FAU without undue delay and in Czech language. There is a strict confidentiality relating to STR and activities taken by the FAU.