Implementace a aktualizace Systému vnitřních zásad (AML) po legislativních novelách

Why is updating AML rules crucial right now? New legislation and growing threats

The key change is Act No. 107/2024 Coll., which amends Act No. 253/2008 Coll., on Certain Measures Against Money Laundering and Terrorist Financing (hereinafter the "AML Act"), effective from May 1, 2024. This amendment introduces specific new obligations that require an immediate review of existing internal processes and documentation.

At the same time, it is important to perceive the broader European context. A new European AML package is on the horizon, which includes the sixth AML directive (AMLD6) and the establishment of a new European supervisory authority, AMLA (Authority for Anti-Money Laundering). This development signals further tightening and harmonization of rules across the EU, for which it is necessary to prepare strategically.

Furthermore, the threat of sanctions is more real than ever. In 2023, the Financial Analytical Office (FAÚ) received a record 7,114 suspicious transaction reports and, as part of its activities, secured funds amounting to CZK 3.8 billion. The FAÚ actively imposes significant fines for non-compliance with even seemingly basic obligations, which can reach tens of millions of CZK and, in extreme cases, lead to a ban on activity.

Effective AML compliance is therefore not about a one-off acquisition of a document, but about establishing a continuous process of monitoring, updating, and training. This dynamic approach is the only reliable protection in an constantly changing regulatory environment.

System of Internal Principles (SIP): Your primary line of defense

The System of Internal Principles is a key internal document that, according to Section 21 of the AML Act, must be prepared in writing by a wide range of so-called obligated entities – from credit and financial institutions to the real estate sector and service providers for legal entities. This is not a mere formality in case of an inspection, but a practical manual that defines how your company and its employees proceed when fulfilling statutory obligations.

According to the law, the SIP must contain at least 

• A non-exhaustive list of typologies and signs of suspicious transactions,

• precise procedures for client identification and customer due diligence,

• rules for risk assessment and management (in connection with the Risk Assessment under Section 21a),

• the procedure from detecting a suspicious transaction to reporting it to the FAÚ,

• rules for storing data and documents,

• measures for postponing the execution of a client's order.

It is essential to realize that the SIP must be approved by the statutory body and continuously updated. Any legislative change, such as Amendment No. 107/2024 Coll., or a significant change in your business (e.g., the introduction of new services) automatically requires a review and adjustment of this document.

Having a SIP on paper is not enough. It must be functional and up-to-date. The Prague-based legal team at ARROWS specializes in drafting internal guidelines that are not only 100% in compliance with the law, but also clear and practically applicable for your employees. Contact us at consultation@arws.cz to get a tailored legal solution.

Indeed, the mere existence of a document does not guarantee compliance. Real protection lies in employees knowing, understanding, and following the procedures specified in the SIP. The FAÚ does not impose fines only for missing documentation, but also in cases where the obligated entity does not act in accordance with its own System of Internal Principles. This addresses the real problem – the risk arising from unimplemented rules, not just from a missing document.

Risk Assessment (§ 21a): Do you know your weaknesses before a FAÚ inspection?

According to Section 21a of the AML Act, the Risk Assessment is an integral and mandatory part of your System of Internal Principles. It is a strategic document in which your company identifies, assesses, and evaluates the specific risks of abuse for money laundering and terrorist financing to which it is exposed in the course of its activities.

For real estate agencies, the system of internal principles and risk assessment are prepared directly according to how the agency trades; this corresponds to tailored AML documentation under Czech legislation.

When assessing risks, you must take into account in particular the following factors:

• Client type: Is it a politically exposed person (PEP)? Do they come from a high-risk country? Do they have an opaque ownership structure?

• Product or service type: Does the product allow anonymity? Does it involve high volumes of cash or transactions with virtual assets?

• Distribution channels: Does the transaction take place remotely without face-to-face contact, which increases the risk of identity theft?

• Geographical risk: Does the transaction relate to countries on sanction lists or to high-risk third countries according to EU and FATF lists?

The goal is not to completely avoid all risks, but to manage them effectively. This so-called Risk-Based Approach means that clients and transactions with a higher risk profile must be subject to enhanced due diligence and stricter measures.

A properly conducted risk assessment is the foundation of an effective defense. Our Czech legal team will help you not only identify risks specific to your industry, but also set up legal consultations and procedures that will protect you from fines and unexpected inspections. Do not hesitate to contact our office – consultation@arws.cz.

 Risks associated with insufficient risk assessment

Changes in practice: What did the latest amendment to the AML Act (Act No. 107/2024 Coll.) bring?

The amendment to the AML Act effective from May 1, 2024 brought several fundamental changes that have a direct impact on the daily practice of obligated entities. Here is an overview of the most important ones:

• Expansion of the scope of obligated entities: AML obligations now also apply to other entities, such as insolvency administrators or traders in precious metals and stones for transactions exceeding the EUR 10,000 limit.

• Virtual assets are considered cash: Payment with a virtual asset (e.g. cryptocurrency) is now considered a cash payment for the purposes of the AML Act. This means that even entrepreneurs who do not normally fall under obligated entities become them if they accept a payment in cryptocurrency worth EUR 10,000 or more.

• New obligations for virtual asset service providers: These entities are now obliged to send their System of Internal Principles and risk assessment directly to the Financial Analytical Office.

• Change in the FAÚ's procedure when inspecting SIP: The FAÚ is moving to a risk-based approach and will no longer preventively assess every submitted SIP. Inspections will be more targeted, and the impact of finding deficiencies will be all the harsher.

Every change in the law and subsequent adjustment of the System of Internal Principles carries another key obligation – training employees according to Section 23 of the AML Act. Merely updating the document without informing the team is insufficient and can in itself be a reason for a sanction.

Changes in the law require not only document adjustments, but also informing your teams. ARROWS provides professional training for employees or management, including a certificate, which will ensure that your people know and comply with the current rules. For an immediate solution to your situation, write to us at consultation@arws.cz.

Client identification and customer due diligence: Who are you letting into your business?

The foundation of any functional AML system is a thorough knowledge of the client (KYC process – Know Your Customer). This process stands on two pillars:

1. Client identification (Sections 7, 8 of the AML Act): Obtaining and verifying basic data about the client and the person acting on their behalf, typically in their physical presence and on the basis of a valid identity document.

2. Customer due diligence (Section 9 of the AML Act): A deeper review, which is always carried out when establishing a business relationship or for transactions over EUR 15,000. It includes determining the purpose of the transaction, the source of funds, and, above all, identifying and verifying the identity of the beneficial owner.

The obligation to work with the Register of Beneficial Owners (RBO) is crucial. It is not enough to just look at the register. According to Section 9(2)(b) of the AML Act and the Act on the Register of Beneficial Owners, you must actively verify whether the registered data corresponds to reality. If you find a discrepancy, you are obliged to report this fact to the competent court.

Negligence in this area does not pay off. If you do not perform proper identification or due diligence, the law in Section 15 obliges you to refuse the transaction. Otherwise, you risk a fine of up to CZK 10,000,000.

Risks of insufficient client identification and customer due diligence

The international element and AML: Are you ready for global business?

Doing business with an international reach brings specific and increased AML risks. It is absolutely essential to thoroughly verify whether your client, their beneficial owner, or transaction partners do not come from a high-risk third country according to the lists compiled by the European Union and the international organization FATF.

Likewise, it is a key obligation of every company to actively check whether the client, their beneficial owner, or even the bank through which the transaction is to take place, are subject to international sanctions. Trading with a person on a sanction list is obligatorily considered suspicious by law and requires immediate notification to the FAÚ.

Thanks to our ARROWS International network, built over ten years, we handle cases with an international element practically every day. We thus provide our clients with not only local expertise but also global reach for safe and legal international transactions.

ARROWS: Your partner for safe and transparent business

We are not just suppliers of legal documents. We are partners who understand your business and actively protect it from regulatory risks. Our extensive experience from long-term cooperation with a portfolio of more than 150 joint-stock companies, 250 LLCs, and 51 municipalities and regions allows us to provide fast and high-quality services tailored to your needs.

Our expertise in the field of AML is closely linked to advice in the area of corporate compliance and ESG, where we help companies set up robust and ethical management processes. You can find more about this service on our website.

At ARROWS, we pride ourselves on building relationships. We actively connect our clients if we see interesting business or investment synergies, and we are happy to listen to your business ideas as well.

Do not wait for a FAÚ inspection. Properly set AML rules are an investment in the security and good reputation of your company.