When the Czech National Bank (Česká národní banka, CNB) opens an AML audit (an on-site or remote examination of a virtual asset service provider's anti-money-laundering controls), the clock for a compliant response starts immediately. Czech Republic crypto law sits at the intersection of the national AML Act and the EU-wide requirements that flow from successive Anti-Money Laundering Directives – and, increasingly, the harmonising force of MiCA (the Markets in Crypto-Assets Regulation) as administered by ESMA and national competent authorities. A business that has not pre-positioned its KYC framework, transaction monitoring logs and Travel Rule records for regulatory inspection will find itself exposed well before the first examiner's question is asked.
Defending an AML audit in the Czech Republic is not simply a compliance exercise. It is a legal matter with cross-border consequences: the entity's EU passporting rights, its banking relationships and the regulator's willingness to permit continued operations all turn on how the response is handled. This page maps the regulatory regime, the audit process, the most common points of failure and how counsel can help a digital-asset business come through examination without lasting damage.
What is the Czech AML regime for virtual-asset businesses?
Czech virtual asset service providers are obliged persons under the Czech AML Act, which implements the EU Anti-Money Laundering Directives into national law. The CNB is the primary supervisory authority for VASPs operating under that regime. Under MiCA, the Czech Republic will additionally designate a national competent authority to issue CASP (Crypto-Asset Service Provider) authorisations and oversee compliance with the EU-level rulebook – reinforcing, rather than replacing, the existing AML obligations.
The practical consequence is layered. A VASP in the Czech Republic answers to the CNB on AML/CFT matters under domestic law and simultaneously tracks the ESMA guidelines that flow through MiCA. For an exchange or custodian that passports services into other EU member states, the home-state supervisor's assessment of AML adequacy carries weight far beyond Prague. A negative finding by the CNB can trigger notifications to host-state regulators and erode the passporting position that underpins the firm's pan-European operating model.
The FATF Recommendation 15 framework – which brought virtual assets into the formal AML perimeter – is the international baseline. The Travel Rule (the obligation to pass originator and beneficiary data with a transfer) applies to VASPs transmitting funds above the applicable threshold. Czech implementation mirrors the EU-level expectation: VASPs must collect, verify and transmit that data, and must be able to demonstrate to the CNB that their systems do so in practice.
What typically triggers a CNB AML audit of a crypto business?
CNB AML examinations of VASPs arise from several distinct triggers, each carrying different urgency and risk signals for the supervised entity. Understanding which trigger applies shapes the defensive strategy from day one.
Routine supervisory cycles are the baseline. The CNB periodically examines all obliged persons in its perimeter; a VASP that has been registered or authorised for a meaningful period should anticipate periodic review as a matter of course. These examinations are typically announced in advance, allowing time to prepare documentation – though the preparation window is shorter than most operators expect.
Targeted examinations arise from specific intelligence. A spike in suspicious transaction reports from the VASP itself (or a conspicuous absence of them), a complaint from a correspondent bank, an alert from a foreign financial intelligence unit or a press incident can all prompt the CNB to open a focused review. These examinations are often unannounced or arrive on very short notice. In our cross-border practice, we have seen targeted examinations escalate quickly from a document request to an on-site visit within days – leaving a business scrambling for records that should have been maintained and indexed in real time.
EU-coordination-driven reviews are an emerging category. Under the AML/CFT framework applicable to CASPs under MiCA, national competent authorities are expected to coordinate with ESMA and with peer supervisors. A concern raised in another member state about a group entity can generate a parallel CNB inquiry into the Czech subsidiary or branch.
The process above describes the standard path. Your facts – the entity structure, the user base, the banking counterparties – change the analysis materially. For a scoped assessment of your audit exposure, contact OBOLUS at info@oboluslaw.com.
What does the CNB examine during an AML audit of a VASP?
The CNB's examination focus for a VASP AML audit concentrates on seven core areas, all of which must be documented and defensible before the first request for information arrives.
First, the risk assessment and risk appetite framework: the regulator expects a written, dated, board-approved risk assessment that reflects the VASP's specific business model, customer base, geography and product mix. A generic template lifted from a compliance library will not satisfy the CNB. The assessment must demonstrate that senior management owns the risk picture, not merely that a document exists.
Second, the KYC framework – customer identification, verification and due diligence procedures. The CNB will test whether the firm's written policies match its actual onboarding practice. Discrepancies between what the policy says and what the transaction records show are the most frequently cited deficiency in VASP examinations across EU jurisdictions.
Third, transaction monitoring. Automated systems must be calibrated to the firm's risk profile; the CNB will ask how alert thresholds were set, who reviews alerts, how long review takes and what escalation occurs. A system that generates alerts that are never actioned is, in regulatory terms, worse than a simpler system properly operated.
Fourth, Travel Rule compliance. The CNB examines whether the VASP collects, screens and transmits originator and beneficiary data on qualifying transfers. The Travel Rule interoperability problem – what to do when the counterparty VASP cannot receive structured data – must be addressed in policy and evidenced in practice.
Fifth, suspicious activity reporting. The volume, timing and quality of reports submitted to the Financial Intelligence Unit (FAU) are reviewed. Both under-reporting and reflexive over-reporting attract scrutiny.
Sixth, training records. AML/CFT training must be documented for all relevant staff, including senior management and the board. Frequency and content are assessed against the firm's risk profile.
Seventh, the MLRO (Money Laundering Reporting Officer) function: the qualifications, seniority, resourcing and independence of the designated officer. The CNB expects the MLRO to have genuine authority and direct board access, not to be a junior compliance team member with a title.
How should a VASP structure its AML audit defence response to the CNB?
A structured audit defence begins before the examination opens, not after. The moment a VASP receives a CNB notice – whether a scheduled letter or an unannounced on-site visit – legal counsel and the MLRO should align on a response protocol within hours.
The first priority is a rapid internal audit against the seven examination areas described above. This is not the moment to discover that transaction monitoring logs are incomplete, that KYC records for certain customer cohorts are missing or that the Travel Rule system has not been correctly logging counterparty VASP data. Counsel should identify gaps before the regulator does and begin remediation – with a documented timeline – before the substantive response is filed.
The written response to CNB requests must be precise, complete and consistent across documents. Regulators examine whether the firm's answers to different questions are internally coherent. An answer that contradicts a document produced in the same package is a red flag that can escalate a routine examination into an enforcement inquiry.
Witness preparation is material where the CNB requests interviews with senior management or the MLRO. The regulator assesses not only what is said but whether the person being interviewed understands the business and the controls at a level of genuine competence. A senior officer who cannot explain how transaction monitoring thresholds were set – or who defers entirely to external consultants – projects an absence of governance ownership that tends to attract further scrutiny.
In a recent AML examination defence matter, an exchange operating under Czech registration faced a targeted CNB inquiry following alerts from its correspondent bank. We conducted a three-week internal review, identified gaps in the Travel Rule implementation and the suspicious activity reporting chain, and prepared a remediation plan with documented delivery milestones. The written response to the CNB presented the gap analysis, the remediation steps already taken and the timeline for remaining items. The examination closed without an enforcement recommendation. The key was demonstrating that management understood the deficiencies, had taken ownership and had already begun correcting them – rather than waiting for the regulator to prescribe the fix.
How do cross-border factors complicate AML audit defence for a Czech-registered VASP?
For a VASP that uses its Czech registration as an EU entry point, the cross-border dimension of an AML audit is often more consequential than the domestic examination itself. A finding that the firm's AML/CFT controls are deficient at the home-state level will be reported to host-state regulators across any EU member states where the firm passports. A service suspension or licence restriction imposed by the CNB will therefore cascade into multiple operating markets simultaneously.
Banking risk is the second major cross-border exposure. Correspondent banks monitoring a VASP's account will typically receive industry-standard CDD updates from the firm annually or following a material change. A CNB examination – particularly one that becomes public through the regulator's published supervisory outcomes – can trigger an enhanced due diligence review by the bank. In our practice, we have seen banks exit VASP relationships within weeks of a regulatory action, even where the firm had maintained accounts for years. Preserving banking access during an examination requires proactive communication, not silence.
Tax interaction is a third dimension. Where the CNB examination reveals unreported or misclassified transactions – staking rewards, exchange spreads, custody fees – a referral to the tax authority is possible. Counsel should assess, in parallel with the AML defence, whether any transaction classification issues carry tax implications that warrant proactive disclosure under the relevant Czech and EU tax regimes.
Entities that have structured their EU operations across multiple entities – a Czech VASP subsidiary, a holding company in another member state, a non-EU parent – face the additional question of whether the CNB inquiry will prompt enquiries directed at related entities in other jurisdictions. Coordinating the response across the group, through allied counsel in each relevant jurisdiction, is essential to preventing inconsistent statements from reaching different regulators.
If a prior application stalled or a bank account was closed in connection with a regulatory review, a second read of the structure can surface the cause and the route back. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
What are the most common mistakes VASPs make during a CNB AML audit?
Across the AML examinations we have supported in multiple EU jurisdictions, a consistent set of errors recurs. Avoiding them is as important as having strong underlying controls.
Over-production of documents without a coherent narrative is the most frequent. VASPs sometimes respond to a CNB request by sending every compliance document in existence, without a clear index or explanation of how the documents relate to the request. A regulator reviewing a disorganized document package draws an inference about the quality of the underlying compliance culture. The response should be curated, indexed and accompanied by a short explanatory letter that frames what is being provided and why.
Failing to remediate before responding is the second major error. Some firms respond to the CNB's initial request with documents that already evidence the problem the regulator is investigating. Where a gap is identified internally before the formal response, the remediation should be underway – or complete – before the response is filed, and the response should acknowledge the gap and describe the fix. Regulators across the EU respond more favorably to a firm that identifies its own deficiency and corrects it than to one that defends a position that the examination subsequently dismantles.
A common assumption is that AML compliance is purely a back-office function and that senior management does not need to be deeply involved in the examination. This is wrong. The CNB, in line with the supervisory expectations flowing from the EU AML Directives and from the MiCA governance requirements for CASPs, holds senior management and the board personally accountable for the adequacy of AML controls. Examination responses that treat the MLRO as the sole responsible party, without visible board-level engagement, tend to generate additional inquiries about governance.
Finally, underestimating the Travel Rule as an examination priority. The Travel Rule is a live enforcement focus for supervisors across the EU, including the CNB. VASPs that have not implemented a technical solution for counterparty data exchange, or that have implemented one but cannot demonstrate it is functioning correctly, face disproportionate scrutiny on this point. The interoperability challenge – dealing with counterparty VASPs that cannot receive or send Travel Rule data in a compatible format – is not a defence; it is a risk that the VASP's policy must address explicitly.
Which operator profile faces the highest AML audit risk in the Czech Republic?
Audit risk is not uniform across VASP types. The profile of the business, its customer base and its transaction flows determine where the CNB examination focus will concentrate.
A retail exchange with high transaction volumes, anonymous or pseudonymous customer cohorts and significant cross-border flow faces the highest inherent risk rating. The CNB will scrutinize the KYC framework at onboarding, the transaction monitoring calibration for layering typologies and the completeness of Travel Rule data. The primary risk in an examination of this profile is a finding of systematic KYC deficiency – which can lead to a business suspension order while remediation is assessed.
A custody provider serving institutional clients carries a lower volume risk but faces targeted scrutiny on the quality of its enhanced due diligence for higher-risk institutional counterparties, its chain-of-custody documentation for client assets and its controls over internal access to wallet infrastructure. An examination finding in the custody space tends to focus on governance and segregation rather than transaction volume.
A token issuance platform operating under Czech registration with EU-wide distribution faces examination of its whitepaper disclosures, its investor-classification and KYC process at the point of subscription, and whether its AML risk assessment has kept pace with the evolution of its token's secondary market. MiCA's whitepaper regime adds a disclosure-compliance dimension that interacts with the AML examination.
For all profiles: a Czech-registered entity that serves users in multiple EU member states through passporting is a higher supervisory priority than a purely domestic operation, because the CNB's examination outcome affects the entire passporting structure. Counsel should factor the passporting exposure into the risk assessment well before any examination opens.
Related at OBOLUS
- AML & Travel Rule compliance for digital-asset businesses – full-scope AML program design, MLRO support and regulatory engagement across EU and global regimes.
- Travel Rule compliance in Kazakhstan – AIFC – Travel Rule implementation under the AFSA regime, with cross-border interoperability analysis.
- CASP authorisation under MiCA for established operators – MiCA transition strategy for exchanges, custodians and other CASPs seeking EU passporting.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP to collect, verify and transmit originator and beneficiary information alongside a virtual asset transfer above the applicable threshold. Under FATF Recommendation 15 and its EU implementation, the originating VASP must pass the data to the beneficiary VASP before or simultaneously with the transfer. VASPs must also screen incoming Travel Rule data against sanctions lists and maintain records demonstrating that the obligation was met for each qualifying transfer.
Who must act as MLRO for a crypto firm?
The MLRO (Money Laundering Reporting Officer) must be an individual of sufficient seniority, competence and independence to discharge the function effectively. Czech and EU AML expectations require the MLRO to have direct board access, adequate resourcing and genuine authority to escalate suspicious activity reports without interference. For a VASP of meaningful size, the MLRO is typically a dedicated senior compliance officer – not a shared function with the CFO or a junior team member holding the title as a formality. The CNB will assess the MLRO's practical authority, not just the designation on paper.
How do regulators audit crypto AML programs?
Regulators including the CNB examine AML programs through a combination of document review, system walk-throughs and management interviews. They assess the written policies against actual practice – using transaction records, alert logs and training registers as evidence of how the program operates in reality. Particular scrutiny falls on transaction monitoring calibration, Travel Rule implementation, suspicious activity reporting rates and the governance role of senior management. A gap between written policy and operational practice is the most common finding and the most serious in terms of the supervisory response it attracts.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance obligations that govern their operations. Digital assets are the entirety of our practice. We map the licence stack across operating, custody and payment layers before a client commits – and we stand beside businesses when the regulator comes knocking. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialist in VASP AML examination defence and MiCA transition compliance across EU jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.