Compliance training for employees of gambling companies A practical overview of obligations, risks and settings for companies

Mgr. Marek Hučík
Mgr. Marek Hučík
24.4.2026 | ARROWS law firm

Gambling operators face one of the strictest regulatory regimes in Europe. An integral part of this regulation is the obligation to train employees in compliance, AML, KYC, and responsible gambling. This article explains what needs to be ensured, what sanctions may apply for insufficient training, and how to avoid the most common mistakes.

The photograph shows a lawyer addressing the issue of mandatory employee training.

Summary

Compliance training for employees is mandatory for gambling operators in the Czech Republic and is based on Act No. 186/2016 Coll., on gambling, and in particular on Act No. 253/2008 Coll., on certain measures against the legalisation of proceeds of crime and the financing of terrorism (the “AML Act”).

Employees responsible for player registration, transaction monitoring and reporting suspicious transactions must understand KYC processes and have specific knowledge of risk identification.

Every employee in direct contact with players should know the principles of responsible gambling in order to recognise signs of problematic behaviour and be able to respond with empathy and with the player’s best interests in mind.

Insufficient or missing training may result in fines of up to CZK 50 million (in the event of a breach of the Gambling Act) or up to 10% of annual net turnover (in the event of a breach of the AML Act), loss of licence, and personal criminal liability of senior employees.

Legal basis for the obligation to train employees

A gambling operator is not merely a game provider – in legal terms, it becomes a so-called obliged entity under Act No. 253/2008 Coll., on certain measures against the legalisation of proceeds of crime and the financing of terrorism (the “AML Act”).

This classification means that you are subject to compliance obligations comparable to those of banks or insurance companies. Accordingly, the Ministry of Finance and the Financial Analytical Office (FAÚ) explicitly require that all key employees of your operation undergo regular AML and KYC training, with details on the content and frequency of training set out in implementing Decree No. 367/2008 Coll., on certain requirements for the system of internal principles.

The legal basis for training can also be found in Act No. 186/2016 Coll. If you need to set internal rules and training so that they stand up to an inspection, our specialisation in gambling and lotteries can also help., on gambling, which, in connection with the licensing of operators, assumes that the operator has effective internal control processes in place (cf., for example, Section 72(2)(d) of the Gambling Act) – and that these processes involve trained employees.

State supervision over compliance with these obligations is carried out by several authorities: the Ministry of Finance, the Czech Customs Administration, and the FAÚ. If an inspection finds that key staff do not have sufficient knowledge, this leads to serious sanctions.

In March 2026, the FAÚ issued a new Methodological Guideline No. 6 intended for obliged entities in the gambling sector, which specifically points out shortcomings in employee training and emphasises the need for high-quality, relevant and regularly repeated training. We also summarise the context of the practical impact of AML obligations in gambling (including training requirements) in the article Obligations of gambling operators in the area of AML and terrorist financing. This is therefore not merely a recommendation – it is a clear signal that the regulator is actively monitoring and enforcing this area.

Who must be trained and why

Not all of your employees need the same training. Gambling operators must differentiate by roles and responsibilities. The highest requirements apply to employees in the following functions:

Employees responsible for player registration and identification must have a thorough understanding of KYC (Know Your Customer) processes.

This means they must be able to distinguish between standard identity verification and the enhanced due diligence required by law. They must know which documents are acceptable, how a “liveness check” is performed in online identification, and how to work with politically exposed persons (PEPs) and sanctions lists.

An error in identification is not only a breach of the Gambling Act – it is a breach of the AML Act, which may lead to a fine of up to CZK 50,000,000 or up to 10% of total annual net turnover, whichever is higher.

Employees monitoring transactions and deciding on the reporting of suspicious transactions must be able to detect anomalies.

They must know what player behaviour signals possible money laundering – for example, when a player deposits a large amount without an apparent source of income, quickly transfers it into gameplay and then withdraws the winnings. In cases where the suspicion also translates into an internal investigation or there is a risk of sanctions against specific individuals, it is also appropriate to take into account aspects of criminal law under Czech legislation.

These employees must have a clear procedure for how and when to report their findings to the FAÚ, and they must understand that late or unreported suspicious transactions are not merely a mistake – they are a breach of the law with comparable sanctions. We discuss the technical and process requirements for identification and ongoing customer verification in an online environment in more detail in the text Verification of the identity of online gambling players: Legal requirements and technical solutions.

All employees in direct contact with players – whether casino floor staff, online support, or staff in gaming rooms – must be trained in the principles of responsible gambling.

They must recognise signs of a problem gambler, be able to respond with empathy, and have information about support services and self-exclusion tools offered by the operator.

This is not merely a nice-to-have – it is a regulatory obligation and part of the regulatory framework focused on player protection.

Senior employees and management must be familiar with the compliance system as a whole. They must understand the liability of the legal entity for employee failures.

They must know internal policies for reporting risks and be able to ensure that compliance is not just a paper obligation, but a real part of the company’s operating culture.

What compliance training must include

General AML and compliance training is not enough. Recently, the FAÚ and the Ministry of Finance have emphasised that training for the gambling sector must be specific, practical, and regularly updated.

Generic training along the lines of “what AML is and why we avoid it” is no longer enough. A gambling operator must train based on its own risk profile and the type of game it operates.

The basic module should cover the following areas:

Specific definitions of the KYC process in the gambling context, including the legal framework under the AML Act and the Gambling Act.

Employees must know how identity is verified specifically within their company (whether online or in person), which documents are accepted, and what to do if a player refuses to identify themselves (answer: without identification, they cannot play, regardless of how high the stake would be).

The Register of Excluded Persons (RVO) is a key tool. Employees must know that the RVO must be checked in real time at every player login, that a technical system failure is not an excuse, and that an error in the RVO check is one of the most frequently sanctioned failures in regulatory practice.

This is a critical player-protection control – a person in the RVO is often there because gambling bans have been imposed on them.

Detection and reporting of suspicious transactions (OPO) is essential. Employees must know the specific types of transactions that may indicate money laundering.

Not every unusual transaction is suspicious, but if multiple factors coincide (a large deposit, a rapid transfer into gameplay, withdrawing winnings without any apparent economic logic), the employee should respond.

They must know that an OPO must be reported without undue delay and understand how this is implemented in practice (a formal process, record-keeping, content review).

Responsible gambling and player care are key. In direct contact with players, staff should recognize signs that a player is behaving problematically: sitting for too long, placing unusually high bets, showing signs of mental distress.

Modern approaches include so-called reality-check notifications – a discreet signal to the player to realize how long they have been playing and how much they have wagered.

Employees must be able to present information about self-limiting tools in a non-confrontational way (time limits, betting limits, options for a complete gambling ban).

The company’s internal policies and procedures are essential for employees. Every employee should have clear access to the internal manual (SVZ – System of Internal Policies), which describes the procedures.

If an employee does not know how to respond to a suspicious situation, or is not sure whom to report it to, the training has failed.

Most common questions about the content of compliance training
  1. Do I have to train all employees the same way, or can I have different modules?
    No, you must differentiate. A maintenance worker who never comes into contact with players does not need the same training as a registration officer. But everyone should have at least a basic awareness of how compliance works. The FAÚ (Czech Financial Analytical Office) calls this role-based training and explicitly recommends it in Methodological Guideline No. 6.
  2. How often do I have to provide training?
    The AML Act and Implementing Decree No. 367/2008 Coll. require training at least once a year (Section 16(1) of Decree No. 367/2008 Coll.). However, that is the minimum. If there is a legislative change or an internal incident, you should train again. Many operators train more frequently, for example twice a year, to ensure better knowledge retention.
  3. Can I buy training from an external company, or do I have to prepare my own?
    You can purchase external training if it is suitable for the gambling sector and focuses on the specific risks of your business. But you must verify that the trainer understands the local legal framework in the Czech Republic and does not just give you generic “AML 101”.

Sanctions and practical risks for insufficient training

If an inspection by the FAÚ (Czech Financial Analytical Office) or the Ministry of Finance finds that your employees are not properly trained, you face several types of sanctions:

For a breach of the AML Act, a legal entity may be fined up to CZK 50,000,000, or up to 10% of the obliged entity’s total annual net turnover, whichever is higher.

For large operators, the fine can therefore rise above CZK 100 million, for example up to the mentioned CZK 130 million.

If it is found during an inspection that employees were not trained, the FAÚ will treat this as a systemic failure of risk management and therefore as a serious breach.

For a breach of the Gambling Act, a gambling operator may be fined up to CZK 50,000,000.

Insufficient employee training often leads to practical errors (incorrect identification, an unreported suspicious transaction), which then trigger precisely these fines.

The threat of revocation of the basic permit (licence) is real. In the worst cases, where it is found that the compliance system does not work at all and employees do not have even basic knowledge, the FAÚ and the Ministry of Finance have the authority to propose revocation of the basic permit to operate gambling. This is an existential threat.

Criminal liability of the legal entity and senior employees is serious. If it is proven that management intentionally neglected training or covertly knew about breaches and failed to respond, both the legal entity and specific individuals may be criminally prosecuted – managing directors, board members, heads of the compliance department – under Act No. 418/2011 Coll., on the criminal liability of legal entities and proceedings against them.

Reputational and commercial damage can be worse than the fine. If partners and investors find out that your compliance system is failing and employees are not trained, it may lead to disruption of business relationships, termination of contracts, or loss of trust from banks and service providers.

Most common questions about sanctions and risks
  1. Will I lose my licence if I have just a few employees without training?
    It will not happen automatically, but it depends on the severity and type of error. If it is found that a key employee (for example, the head of the compliance department) was not trained and this caused a breach in reporting a suspicious transaction, that is serious. If it was an incorrect entry in attendance records, that is less serious. The key is how it looks from the regulator’s perspective: is it an isolated mistake, or systemic neglect?
  2. What if I hide behind the training if there is a mistake in the future?
    You cannot. The absence of training documentation is like an admission that you did not intend to train. If there are issues in court proceedings, the absence of training records will be used against you. Conversely, if you have an evidentiary chain of training, it strengthens your defence.
  3. How much does proper compliance training cost?
    The price varies depending on the scale of the operation and whether the training is external vs. internal. Basic external training ranges from a few thousand to tens of thousands of Czech crowns. Preparing your own programme may cost even more. But as regulators themselves say: the cost of training is always lower than the cost of a fine.

Practical solution: how to set up an effective training programme

You do not have time to get lost in this on your own. There are several proven approaches:

The first step is a status audit. Review how many employees you have, what their roles are, and whether you have any documentation of their training at all.

If you cannot see the papers or emails proving the training, you have a problem. Many operators find that training took place “informally” or is only remembered when an inspection happens.

The second step is choosing the method. You can buy off-the-shelf online training from a gambling specialist, or prepare your own programme with the help of a specialist lawyer.

It is often combined with a webinar or workshop where a lawyer explains the specifics of your situation.

The third step is planning. Set a calendar—for example, May and November each year. All relevant employees are required to undergo training.

Create a simple list with the employee’s position, training date, course title, and a signature or email confirmation of attendance. That is your evidence.

The fourth step is internal communication. Management should emphasize to everyone that compliance is not just a formality.

If employees see that management ignores compliance, they will ignore it too. Compliance should be part of the internal culture.

Table of practical issues and solutions

Possible issues

How ARROWS can help (office@arws.cz)

Training documentation is missing; during an inspection, the regulator believes you trained too little or not at all

ARROWS attorneys can help you create a documentation trail and set up training record-keeping procedures that will withstand regulatory scrutiny in the Czech Republic.

Employees are not trained in gambling-specific procedures; only a generic “AML course” was purchased

ARROWS will provide you with a legal opinion on what specific training you need under Czech legislation, and can arrange tailored training for you or help you identify a suitable external trainer.

During an inspection by the FAU (the Czech Financial Analytical Office), it becomes apparent that senior employees themselves do not understand their compliance obligations

ARROWS will organize a workshop or expert training for management focused on leadership roles and their responsibilities.

You receive a report that an employee breached compliance rules (e.g., incorrect player identification)

ARROWS will provide legal advice on how to respond internally, document and remedy the situation, and how to communicate with regulators.

You are concerned about current legislative changes (e.g., the new FAU methodological guideline No. 6 of March 2026)

ARROWS attorneys monitor legislation and will inform you about new requirements and recommend updating your training program.
Most common questions on practical implementation
  1. An employee says they have already completed the training. How do I verify that it’s true?
    Ask for a certificate, a confirmation email, or access to the online portal where the training took place. If the employee does not know where, when, and what they studied, the training effectively did not take place. The regulator will consider it the same.
  2. What is the ideal content of a certificate?
    At a minimum: the employee’s name, type of training, date, duration (in hours), the trainer’s or provider’s name, and a signature or official stamp. For online courses, a screenshot of the certificate and the login details for the course are sufficient. Without this information, the certificate is not adequate evidence.
  3. What if an employee just “clicks through” the training in a single day?
    The training should last long enough for the employee to have time to learn. Very short “training” (e.g., 15 minutes) is not considered substantive by the regulator. A standard duration is 2–4 hours, depending on the content. If the training was only 30 minutes, the regulator will view it critically.
  4. Do I have to train new employees as well?
    Yes—before their first working day in a role that involves compliance. A new employee in player registration must be trained immediately, not after three months. The period before their first independent contact with a player is critical.
  5. What if an employee tries to say, “I can’t recognize compliance, that’s on you”?
    That will not fly. If an employee has anything to do with identification, monitoring, or direct contact with a player, they must understand compliance. If they refuse to be trained, it is a disciplinary matter and may be grounds for termination of employment. The regulator would criticize you for hiring the wrong person or failing to train them properly.
  6. What if the law changes or the FAU issues a new guideline—do I have to train again?
    If there is a material change in the legal framework (for example, the new FAU methodological guideline No. 6 in March 2026), refresher training is recommended so employees know the new rules. It is not always formally mandatory by law, but in practice and from a regulatory perspective it is expected. If you do not respond to legislative developments and employees work under old rules, you will bear responsibility during an inspection. ARROWS attorneys monitor legislation and can alert you to the need for updates.

Summary

Compliance training for employees at a company operating in the gambling sector is not an administrative formality. It is a legal obligation arising from Czech and European law, and regulators actively check it.

Insufficient or missing training can cost you tens of millions of Czech crowns in fines, loss of your licence, and criminal liability for management.

At the same time, a proper approach to training is your best defense: if you have documented that employees were trained well and regularly, your risk during an inspection is significantly reduced.

Training should be specific to the gambling sector, role-based (not everyone needs the same thing), and repeated at least once a year.

It should cover KYC, AML, suspicious transaction reporting, responsible gambling, and your company’s internal policies. You should keep detailed records of who studied what, when, and for how long.

If you are not sure how to set this up correctly, or you want your training program to fit your specific operations and regulatory profile, ARROWS attorneys at our Prague-based law firm can help.

They specialize in compliance in the gambling sector, understand regulators’ practice, and can propose a tailored solution for you.

Their goal is to ensure that your training procedures are not only lawful, but also genuinely effective and defensible during an inspection. You do not have to handle it alone—contact them at office@arws.cz.

Most common questions on compliance training for gambling
  1. Is compliance training really mandatory, or only recommended?
    It is an obligation set directly by Act No. 253/2008 Coll. (the AML Act) and Act No. 186/2016 Coll. (the Gambling Act), and further specified in Decree No. 367/2008 Coll. The Financial Analytical Office (FAÚ) actively checks compliance. The absence of training is a breach that leads to fines.
  2. How do you document that the training took place?
    You must have a record containing: the employee’s name, position, training date, duration in hours, course content, the trainer’s name and signature, or a certificate from the institution that provided the training. Without this documentation, the regulator will not believe that the training took place at all. ARROWS attorneys in Prague can help you set up a proper record-keeping system—contact office@arws.cz.
  3. What is the difference between external training and in-house training?
    External training saves you preparation time, but you must verify that the trainer understands the gambling sector and the Czech legal framework. In-house training may be cheaper in the long run, but it requires someone with the expertise to prepare it. Many operators combine both: they purchase a framework and then adapt it internally. If you are unsure, ARROWS attorneys focus on this area and can help you choose the right approach.
  4. What if I train an employee, but they do not remember the information?
    The employee may complete the training, but their knowledge will be verified: during an inspection, the regulator questions trained employees. If they do not know how to proceed, the regulator will conclude that the training was of poor quality or that the employee did not demonstrate sufficient knowledge. That is why it is important for the training to be interactive and for knowledge to be tested afterwards or verified in practice. ARROWS, a Prague-based law firm, can help design a high-quality programme and verification mechanisms, available at office@arws.cz.
  5. Do I have to train an employee who will only work for a few months?
    Yes, every employee who will be in a role related to gambling must undergo training—whether for three months or for a year. The regulator does not make exceptions based on the length of employment. Moreover, shorter employment does not mean a shorter training obligation—it is the same as for anyone else.
  6. What if the law changes or the FAÚ issues new guidance—do I have to train again?
    If there is a material change in the legal framework (for example, a new FAÚ Methodological Guideline No. 6 in March 2026), refresher training is recommended so that employees know the new rules. It is not always formally mandatory by law, but in practice and from a regulatory perspective it is expected. If you do not respond to legislative developments and employees work under old rules, you will bear responsibility during an inspection. ARROWS attorneys monitor legislation and can alert you to the need for updates—just email office@arws.cz.

Notice: The information contained in this article is of a general informational nature only and is intended to provide basic guidance on the topic under the legal framework as of 2026. Although we take maximum care to ensure accuracy, legal regulations and their interpretation evolve over time. We are ARROWS, a Prague-based law firm, an entity registered with the Czech Bar Association (our supervisory authority), and for maximum client security we maintain professional liability insurance with a limit of CZK 400,000,000. To verify the current wording of regulations and their application to your specific situation, it is necessary to contact ARROWS directly (office@arws.cz). We accept no liability for any damages arising from the independent use of information from this article without prior individual legal consultation.

Read also: