AML Compliance pro B2B

Why is your bank suddenly asking? Understanding the world of AML and the role of the FAÚ

These steps are not a sign of curiosity or arbitrariness on the part of the bank. They are a direct consequence of a strict legal framework that obliges banks to actively prevent the abuse of the financial system.

An Invisible Legal Framework

The cornerstone under Czech legislation is Act No. 253/2008 Coll., on Certain Measures Against the Localization of Proceeds of Crime and Financing of Terrorism, commonly known as the AML Act. 

This Act defines so-called obliged entities, which are on the front line of the fight against financial crime. Although many companies do not realize it, this category goes far beyond just banks.

Your company can also become an obliged entity. This includes, for example, real estate agencies, auditors, tax advisors, accountants, but also any entrepreneur who conducts a cash transaction worth over EUR 10,000.

This broad definition means that the obligations arising from the AML Act may apply to you without you fully realizing it.

The aim of the Act is to prevent two key threats: the laundering of proceeds of crime (money laundering) and the financing of terrorism. 

In practice, this means that banks and other obliged entities must actively investigate where their clients' money comes from and where it is going, to ensure that the financial system is not being abused to hide the origin of proceeds of crime or to support terrorist activities.

The Guardian of Finance: The Financial Analytical Office (FAÚ)

The key player in this system is the Financial Analytical Office (FAÚ). It is not a passive authority, but a highly specialized financial intelligence unit of the Czech Republic with extensive powers.

Its main task is to receive and analyze suspicious transaction reports from obliged entities, such as banks.

The FAÚ has the authority to conduct its own investigations, request information from tax authorities or the police, and, in the event of serious suspicion, order the freezing of funds. The power and importance of this office is evidenced by the fact that it has managed to secure assets worth over CZK 21 billion. For companies, this means only one thing: the FAÚ is an institution whose activities cannot be taken lightly.

Banks thus find themselves in an unenviable position. On one hand, their goal is to provide clients with quality services; on the other hand, the law obliges them to check these clients and report suspicious activities. 

The Czech legal team at ARROWS encounters the consequences of this Act daily and can help clients communicate effectively with their bank to prevent misunderstandings and unnecessary complications.

Under the Microscope: Which transactions trigger warning signals and lead to an audit?

In order for companies to effectively prevent problems, they must understand what exactly constitutes risky behavior in the eyes of the bank and regulators. It is not a random process; banks use a combination of legal obligations and sophisticated technologies to identify potentially dangerous transactions.

Two Stages of Verification: Identification and Customer Due Diligence

The AML Act distinguishes between two basic stages of client verification, which are important to understand separately:

1. Client Identification (Section 8 of the AML Act): This is the basic step that typically takes place when establishing a business relationship or for transactions over EUR 1,000. The bank verifies
   who you are – i.e., your identity and the identity of the acting persons and ultimate beneficial owners of the company based on official documents.

2. Customer Due Diligence (Section 9 of the AML Act): This is a deeper and ongoing process. Here, the bank is interested in what you do. It determines the purpose and nature of your business, the source of your funds and wealth, and reviews your ownership and management structure. This review takes place not only at the beginning, but throughout the duration of the business relationship.

Modern banking relies on advanced monitoring systems. These systems use so-called detection scenarios and algorithms that automatically evaluate transactions and compare them with the client's expected behavior. 

If a transaction deviates from the norm, the system generates an alert, which is then reviewed by a specialized bank employee.

This means that even an unintentional deviation from your normal transaction behavior can trigger a review process. Your transaction history thus creates a kind of digital footprint or risk profile. Any sudden change – whether in volume, frequency, geographical direction of payments, or the involvement of new, unknown counterparties – is immediately visible and requires explanation.

Practical "Red Flags": Risky Behavior

The Financial Analytical Office and international institutions have defined a number of typical behavioral patterns that are considered highly risky. Here are some of the most common "red flags" that can lead to increased scrutiny:

• Unnecessarily complex transaction chains: A company starts sending money through several different accounts in different countries without any obvious economic reason, trying to obscure their origin and the ultimate recipient.

• Use of offshore destinations: Regular transactions with companies based in countries that are on the EU or FATF list of high-risk third countries, or are generally known as tax havens.

• Structuring transactions (so-called "smurfing"): A larger sum of money is intentionally split into many smaller payments so that individual transactions fall below the thresholds that require increased bank attention.

• Transactions with virtual assets (cryptocurrencies): Incoming payments from the sale of cryptocurrencies where their origin and the legality of acquisition are not clearly documented. Virtual assets are under intense regulatory scrutiny today.

• Non-standard cash operations: Frequent and high cash deposits or withdrawals that do not match the company's normal business profile.

• BEC (Business Email Compromise) fraud: A company falls victim to a scam where, based on a fake email, it changes its supplier's payment details and sends money to the fraudsters' account. Even though the company is a victim, the transaction is suspicious to the bank and will be investigated.

Even legitimate business steps, such as creating a complex international holding structure, can pose a risk from an AML perspective. The burden of proof to explain the logic and legality of such a structure always lies with the client. 

The Prague-based law firm ARROWS specializes in preparing documentation that can explain even the most complex corporate structures and transactions to banks in a clear and transparent manner, thereby preventing unnecessary suspicion.

When an Account is Blocked: Real Impacts and Financial Risks for Your Company

Every entrepreneur's greatest fear is losing control over corporate finances. A blocked account, even if temporary, can have fatal consequences for a company's operations. It is crucial to understand how this process works and how devastating the impacts of poorly set up AML compliance can be.

The Legal Mechanism of "Freezing" an Account

If a bank evaluates a transaction or client behavior as highly risky and suspects that the securing of proceeds of crime could be frustrated, it activates the mechanism under Section 20 of the Act on Certain Measures Against the Localization of Proceeds of Crime and Financing of Terrorism (AML Act), known as the postponement of the execution of a client's instruction.

The process is as follows:

1. Based on its suspicion, the bank immediately files a suspicious transaction report with the Financial Analytical Office (FAÚ).

2. At the same time, the bank can unilaterally postpone the execution of the client's instruction (e.g., an outgoing payment) or block all operations on the account for up to 24 hours.

3. The FAÚ has 24 hours to evaluate the situation. If it finds the suspicion to be justified, it may decide to extend the postponement for up to 72 hours from the moment the report was received.

4. If the FAÚ files a criminal complaint within this period, the block can be extended by another 3 business days.

The key and most dangerous aspect for a company is that no standard remedy (appeal) is admissible against the FAÚ's decision to postpone the execution of an instruction. The company thus finds itself in a situation where it cannot pay wages, supplier invoices, or other obligations, and is completely dependent on the outcome of an investigation that it cannot directly influence.

How serious the consequences of neglecting AML obligations can be is shown by the recent case of Fio banka, which was fined CZK 9.5 million by the Czech National Bank (ČNB). The reasons that led to this high penalty are a valuable lesson and an overview of the most common mistakes for any company:

• Establishing a relationship with a sanctioned person: The bank failed to screen clients against international sanction lists.

• Insufficient review of the ownership structure: The bank failed to properly verify and document who the ultimate beneficial owners of its clients were, and did not take into account the risk level of their countries of origin.

• Errors in transaction monitoring: The bank's transaction monitoring system was inadequate, particularly in the area of cash operations and updating client risk profiles.

• Inadequate employee training: Some employees were not properly and regularly trained in AML, which is a direct violation of the law.

The fine imposed represents only the visible part of the whole problem. The actual costs for a company that gets into trouble with AML are much higher and include operational paralysis, loss of business opportunities, massive reputational damage, and huge internal costs for remediation and communication with authorities.

The following table summarizes the most common risks and shows specifically how the law firm ARROWS can help resolve them.

Steps to Safety: How to Set Up AML Compliance and Protect Your Business

Transitioning from reactive problem-solving to proactive protection is key to a company's long-term stability. Building a robust internal AML program is not just about fulfilling a legal obligation, but about creating a shield that protects the finances, reputation, and very existence of the business. This process stands on three basic pillars.

Risk Assessment (Section 21a of the AML Act)

It all starts with an honest assessment of your own risks. AML compliance is not a one-size-fits-all template that can simply be copied. Every company must develop its own, tailored written risk assessment that takes into account its specific situation.

It must analyze the risk factors associated with the types of clients it does business with, the products and services it offers, and the geographic areas in which it operates.

ARROWS helps clients develop a detailed risk assessment that is not only compliant with the law but also serves as a strategic document for managing the entire AML agenda. This document is absolutely crucial, as the setup of all other control mechanisms depends on it.

System of Internal Policies (SIP) (Section 21 of the AML Act)

Based on the risk assessment, the company must develop and apply in practice a System of Internal Policies (SIP). This is an internal "constitution" for the fight against money laundering. This written document must describe in detail the specific procedures the company uses for:

• Client identification and due diligence.

• Risk assessment and management.

• Retention of data and documents.

• Procedure upon detecting a suspicious transaction and reporting it to the FAÚ.

• Employee training and division of responsibilities.

The preparation of a high-quality and functional System of Internal Policies is one of the key services provided by ARROWS to protect clients and their statutory bodies from personal and corporate liability.

Regular Employee Training (Section 23 of the AML Act)

Even the best system is useless if employees do not know about it or do not understand it. The law therefore imposes an obligation to ensure, at least once a year, verifiable training for all employees who may encounter suspicious transactions in their work.

The content of the training must include the typology of suspicious transactions, internal procedures according to the SIP, and the correct procedure upon detecting a risk. Records of the training must be kept for at least 5 years.

ARROWS offers tailored professional training for both employees and top management, concluding with a certificate that serves as necessary proof of compliance with this legal obligation during any audit by the authorities.

In addition to these three pillars, the law also requires the designation of specific responsible persons. The company must appoint a member of the statutory body responsible for fulfilling AML obligations (Section 22a) and designate a contact person to ensure contact with the FAÚ (Section 22). This clearly shows that AML compliance is a responsibility at the highest level of management.

An important principle on which regulators place immense emphasis is so-called "reconstructibility". It is not enough just to do the right things; you must be able to prove at any time, even after several years, that you did them and how.

All legal services of ARROWS, from the preparation of documentation to representation before authorities, are built on the principle that every step must be carefully documented and defensible.

AML in International Transactions and New EU Regulations

In an interconnected world, international trade is the key to growth for many Czech companies. However, global opportunities also bring global risks, especially in the area of AML. Furthermore, regulations are constantly evolving, and what was sufficient yesterday may not be enough tomorrow.

The risk of money laundering is not the same in all countries. The European Union and the international FATF group regularly publish lists of so-called high-risk third countries. 

Any transaction or business partner associated with these jurisdictions automatically triggers the obligation to perform enhanced customer due diligence. This means deeper scrutiny, more detailed documentation, and an overall more cautious approach.

For Czech companies that export, import, or have international ownership structures, knowledge of these risks and correct procedures is absolutely essential. 

Thanks to our ARROWS International network, built over ten years, we handle cases with an international element daily and help clients safely navigate differing legal and regulatory requirements around the world.

The Future is Here: The New EU AML Package

The European Union recently approved an extensive package of new regulations that will fundamentally change the rules of the game across Europe. This package signals the end of an era when knowledge of only the Czech AML Act was sufficient for international business. Companies must prepare for stricter and more uniform rules.

Key changes include:

• Establishment of the AMLA (Authority for Anti-Money Laundering): A new pan-European supervisory body is being established in Frankfurt am Main. AMLA will have the power to directly supervise the riskiest financial institutions and coordinate the work of national authorities, such as the FAÚ. This will lead to the harmonization and tightening of supervision across the EU.

• Uniform AMLR (Anti-Money Laundering Regulation): The new regulation will be directly applicable in all member states and will unify many rules that were previously fragmented in national laws. It will also expand the scope of obliged entities to include, for example, crypto-asset service providers, luxury goods traders, or professional football clubs.

• New AMLD6 Directive (6th Anti-Money Laundering Directive): The sixth AML directive will further strengthen the powers of national financial intelligence units (FAÚ) and improve access to information in beneficial ownership and bank account registers.

The new rules have a set transitional period, for example, for the implementation of AMLD6 by 2027. However, smart companies will not wait until the last minute. Proactive adaptation to the new European reality is a strategic necessity. 

ARROWS provides strategic advice that helps companies create a plan for a smooth transition to the new rules and turn a regulatory threat into a managed and manageable project.

Basic AML compliance is a necessity, but truly resilient companies think one step ahead. They are not just about ticking off obligations, but about strategic risk management that protects their long-term interests. This is where the value of partnering with a law firm that has deep experience with corporate clients and understands complex business contexts is fully realized.

Our experience from long-term cooperation with more than 150 joint-stock companies and 250 limited liability companies allows us to see around the corner and address not only current problems but also future challenges.

Strategic Risks and Their Solutions with ARROWS

This table focuses on more complex, strategic issues encountered especially by medium and large companies with international operations.

At ARROWS, we also like to listen to interesting business ideas. We understand that law and business are interconnected, and our role is to help clients not only with protection but also with growth.

Do not wait for a problem. ARROWS is your partner for safe business.

The world of financial regulation is becoming increasingly complex and relentless. Ignoring AML rules is no longer possible and can lead to fatal consequences for any company, regardless of its size or industry. 

As this article shows, proactive and professionally managed AML compliance is not an unnecessary expense, but a key investment in the stability, reputation, and future growth of your business.

Waiting for the bank to contact you with unpleasant questions or for an audit from the Financial Analytical Office to knock on your door is a strategy that does not pay off. The risk of blocked accounts, fines in the millions, and damage to your good name is too high.

The Prague-based law firm ARROWS is here to help you prevent these risks. Our strength lies in a combination of:

• Deep experience: We provide long-term care for more than 150 joint-stock companies, 250 LLCs, and 51 municipalities and regions. We understand their needs and challenges.

• Comprehensive services: We provide a full spectrum of legal assistance – from drafting internal guidelines and preparing contracts, to professional training with certificates, to representation before courts and administrative bodies.

• International reach: Thanks to the ARROWS International network, we are ready to address your global challenges and ensure that your business is safe even beyond the borders of the Czech Republic.

• Speed and quality: We pride ourselves on rapid response and the top quality of our services, because we know that in business, time is key.

If you are dealing with any of the issues mentioned in this article, preparing for international expansion, or simply want to be sure that your company is 100% protected in the area of AML, do not hesitate to contact us.

Contact us today to arrange a non-binding consultation. Our team of experts is ready to discuss your situation and propose a solution tailored to your business.