Your Essential CNB Compliance Checklist

Understanding the Czech Financial Market: Why the CNB is Different

This model contrasts sharply with the dual-regulator system in the United Kingdom, where the Prudential Regulation Authority (PRA) handles prudential supervision for systemic institutions, while the Financial Conduct Authority (FCA) oversees conduct for all firms. It is also fundamentally different from the multi-agency system in the United States, where entities like the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) have distinct and sometimes overlapping jurisdictions.

The CNB’s core mandate is to maintain the stability and integrity of the entire financial system. This objective drives a supervisory philosophy that is proactive and holistic. A compliance failure in one area, such as a late report, is not viewed as an isolated administrative error. Instead, the CNB sees it as a potential symptom of a wider weakness in your internal control systems, which can trigger broader and more intrusive scrutiny of all your licensed activities.

This interconnected approach creates a unique risk environment. A minor issue in one domain can quickly contaminate your firm's entire relationship with its sole regulator. It is therefore essential that your compliance functions are not siloed. Your reporting, prudential management, and internal governance teams must operate as a perfectly integrated unit, because that is how the CNB will view your firm. For immediate assistance in structuring your compliance framework, write to us at consultation@arws.cz.

Your Core Obligations: A Practical Compliance Checklist

For any foreign entity holding a CNB license, compliance rests on three fundamental pillars: continuous regulatory reporting, adherence to strict prudential rules, and the maintenance of a robust internal governance framework. Mastering these areas is essential for avoiding penalties and ensuring smooth business operations in the Czech Republic.

Pillar I: Continuous Regulatory Reporting (Výkaznictví)

The cornerstone of CNB supervision is the requirement for regular and detailed reporting, known in Czech as Výkaznictví. This is not a simple annual filing. It involves the ongoing submission of comprehensive financial and operational data, often on a monthly or quarterly basis, giving the CNB a continuous overview of your firm's health and activities.

All regulatory submissions must be made through the SDAT (sběr dat výkaznictví), the CNB's mandatory electronic portal. Correctly navigating this system is a primary compliance task. Failure to use the SDAT portal properly, or submitting inaccurate or late reports, is considered an immediate compliance breach and will attract regulatory attention.

Furthermore, for reporting transactions under the EU's Markets in Financial Instruments Regulation (MiFIR), which is fully implemented in Czech law, your entity must obtain and use a Legal Entity Identifier (LEI). Reporting obligations commence immediately upon receiving your license, though it is possible to request a temporary deferral if your entity is not yet fully operational.

Pillar II: Adhering to Prudential Rules and Capital Adequacy

A central principle of CNB regulation is Capital Adequacy. This is the legal obligation for your firm to hold sufficient capital reserves to cover the risks inherent in your business activities. This is not just a financial metric; it is a key indicator of your firm's stability and resilience, and the CNB monitors it closely.

A key component of this requirement is the Capital Conservation Buffer. This is a mandatory buffer set at a fixed rate of 2.5% of your total risk exposure amount and must be composed of the highest quality capital (Common Equity Tier 1). For certain institutions like banks, the CNB also sets a Minimum Requirement for Capital and Eligible Liabilities (MREL), which is tailored to each firm's specific risk profile.

While the broader prudential framework is harmonized at the EU level through regulations like the Investment Firm Regulation and Directive (IFR/IFD), national regulators like the CNB retain significant discretion. The CNB can, and does, set specific national capital buffers to address what it perceives as local or systemic risks. It is therefore critical not to assume that compliance with rules in another EU member state is sufficient for the Czech market.

Pillar III: Building a Resilient Internal Governance Framework

The CNB mandates that all license holders establish and maintain a comprehensive governance and risk management system that is proportionate to the scale and complexity of their business. This is not a "check-the-box" exercise; it is a fundamental requirement for holding a license. Your internal framework is your first line of defense against operational, financial, and compliance risks.

Key components of a compliant governance system include:

• A Clear Organizational Structure: Well-defined lines of responsibility and accountability.
• Effective Internal Controls: Robust processes to safeguard assets, ensure reliable financial reporting, and comply with laws and regulations.
• Independent Risk Management: A dedicated risk management function with the authority to monitor all significant risks and report its findings directly to the firm's control body (e.g., a supervisory board), bypassing management if necessary.

Crucially, all members of your management board and key function holders must continuously meet the CNB's strict "fit and proper" standard. This involves a deep and ongoing examination of both professional competence (including relevant experience) and personal integrity (including a clean criminal and regulatory record). Any changes in management must be promptly reported and approved.

Finally, the CNB requires a genuine physical presence in the Czech Republic. A "letterbox company" with no real substance or local management is unacceptable and can be grounds for license revocation. This must be complemented by secure IT systems that are fully compliant with the EU's General Data Protection Regulation (GDPR).

Special Focus: Navigating Anti-Money Laundering (AML) Requirements

For all financial institutions, compliance with Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) regulations is a top priority for the CNB. While the CNB supervises its license holders in this area, the primary AML/CFT authority in the Czech Republic is the Financial Analytical Office (FAU). The two bodies cooperate closely, and you must be prepared to engage with both.

Your core obligations are defined by the Czech AML Act (No. 253/2008 Coll.) and include several key duties:

• Customer Due Diligence (CDD): You must implement procedures to identify and verify the identity of all your clients, including their beneficial owners.
• Risk Assessment: You are required to develop and apply a risk-based approach, classifying clients and transactions according to their potential money laundering risk.
• Suspicious Transaction Reporting: You have a legal duty to report any suspicious activity directly to the FAU.
• Employee Training: You must provide regular, documented AML training to all relevant employees at least once per year.

The foundation of your AML framework is a critical internal document known as the System vnitřních zásad (SVZ), or System of Internal Principles. This is your company's internal AML "constitution," detailing your specific procedures for client onboarding, risk assessment, transaction monitoring, and reporting. This document must be tailored to your specific business risks and kept constantly updated.

A unique emphasis of the Czech regulatory approach is the principle of "rekonstruovatelnost" (reconstructibility). It is not enough to simply have an AML policy in place. During an inspection, which can occur years after a transaction, you must be able to produce clear documentation that reconstructs and defends the logic behind your compliance decisions. This transforms compliance from a simple administrative task into the creation of a legally defensible narrative, elevating the need for expert legal advice on designing a resilient and justifiable risk management framework.

The High Cost of Non-Compliance: Understanding CNB Sanctions

The CNB has a wide array of enforcement tools at its disposal, and it does not hesitate to use them to maintain market stability and protect consumers. The consequences of non-compliance are severe and can threaten the very existence of your business in the Czech Republic.

The spectrum of sanctions includes:

• Admonition (Warning): The mildest form, used for minor offenses as a formal warning.
• Corrective Measures: Legally binding orders requiring you to remedy identified deficiencies within a specific timeframe.
• Financial Penalties: The most common sanction. Fines can range into the millions of Czech crowns. For example, failing to perform client identification can result in a fine of up to CZK 10,000,000, while systemic breaches of AML rules can lead to penalties as high as CZK 130,000,000 for financial institutions. Recent enforcement actions, such as the CZK 9.5 million fine imposed on Fio banka for AML failings, demonstrate the regulator's seriousness.
• Restriction or Revocation of License: In the most serious cases, the CNB can suspend certain business activities or completely revoke your license to operate, effectively ending your business in the country.

These sanctions are not private matters. The CNB is legally required to publish its final administrative decisions, meaning any penalty imposed will become public knowledge, causing significant and lasting reputational damage with clients, partners, and your home-country regulators. As an international law firm operating from Prague, European Union, we have extensive experience representing clients in these sensitive matters.

Your Partner for Secure Operations in Prague: How ARROWS Can Help

Navigating the CNB's complex regulatory environment requires deep local expertise and a proactive approach. A compliance strategy that works in another country cannot simply be transferred to the Czech Republic. ARROWS, a law firm based in Prague, European Union, combines deep knowledge of local regulations with a nuanced understanding of the challenges international businesses face.

Our firm supports over 150 joint-stock companies and 250 limited liability companies, and through our ARROWS International network, we operate in 90 countries worldwide. We offer a comprehensive suite of services designed to protect your business, prevent penalties, and ensure your operations are built on a secure legal foundation.

Our legal services include:

• Preparation of internal company policies, including robust, defensible AML Systems of Internal Principles (SVZ).
• Drafting all legally required documentation for reporting and notifications to the CNB.
• Legal consultations to prepare your management and staff for CNB inspections and prevent penalties.
• Representation in all proceedings before the CNB and the Financial Analytical Office.
• Professional training for your employees and management on their specific regulatory duties, complete with certificates.

What’s the next step?

Proactive compliance is the most effective way to protect your investment and reputation in the Czech market. Do not wait for a regulatory issue to arise. To ensure your operations in the Czech Republic are built on a secure legal foundation, contact our team of experts for a preliminary compliance review. Write to us at consultation@arws.cz.