AML Compliance Services for Regulated Businesses & Financial Services

Q: How does Czech AML law apply to our business?

Czech AML/CFT obligations primarily arise under Act No. 253/2008 Coll. Businesses that qualify as obliged entities under the Act must comply with the requirements applicable to their activities, including customer due diligence, record keeping and suspicious-transaction reporting. The Financial Analytical Office and, for entities within its sectoral remit, the Czech National Bank are relevant supervisory authorities.

AML/CFT compliance for regulated businesses

More than policies on paper.

Regulatory expectations around AML/CFT compliance have increased significantly across the European Union and international markets. Supervisory authorities now expect firms to demonstrate not only the existence of documented frameworks, but their effective operation in practice.

Regulators increasingly expect firms not only to maintain documented AML/CFT policies and procedures, but also to demonstrate effective implementation of customer due diligence controls, transaction monitoring systems, sanctions screening, governance arrangements, suspicious transaction reporting processes and ongoing risk management frameworks.

LEX ARTA provides AML/CFT advisory and outsourced compliance support covering AML audits, enterprise-wide risk assessments, AML/CFT programme design, outsourced MLRO support, Travel Rule compliance, AML/CFT training and remediation of regulatory findings. Our work combines practical legal, compliance and financial crime expertise gained through operational roles within regulated businesses, including MLRO, Compliance Officer and DPO functions.

What effective AML/CFT requires

An effective AML/CFT framework typically includes:

Customer Due Diligence (CDD)

Enhanced Due Diligence (EDD)

Risk Assessment

Transaction Monitoring

Sanctions Screening

PEP Controls

STR / SAR Reporting

Record Keeping

Staff Training

Independent Audit

MLRO Governance

Travel Rule (TFR)

For regulated businesses, AML/CFT compliance is not a one-time documentation exercise but an ongoing operational obligation.

Who needs AML/CFT compliance

AML/CFT obligations apply across a broad range
of regulated and higher-risk sectors.

Crypto-Asset Service Providers (CASPs)

CASP applicants must provide information on their AML/CFT internal controls, policies, procedures and money-laundering and terrorist-financing risk assessment as part of the MiCA authorisation file. Once authorised, CASPs must also comply with the applicable EU and national AML/CFT framework and Regulation (EU) 2023/1113.

Virtual Asset Service Providers (VASPs)

Crypto exchanges, OTC desks, custodial wallet providers and other VASPs are subject to AML/CFT obligations under FATF standards and national implementing legislation.

FinTech Companies

FinTech businesses offering payment, transfer, embedded finance, digital asset or regulated financial services frequently require AML/CFT frameworks appropriate to their risk profile.

Payment Institutions & EMIs

Payment service providers, payment institutions and electronic money institutions must maintain risk-based AML/CFT programmes and demonstrate ongoing compliance to supervisory authorities.

Investment Firms & Financial Intermediaries

Investment businesses, brokers, forex companies and other financial intermediaries are expected to implement effective AML/CFT controls aligned with applicable supervisory standards.

iGaming & Online Gaming

Gaming operators subject to AML/CFT obligations require risk assessments, AML programme design, player due diligence frameworks and ongoing regulatory compliance.

Core components of an AML/CFT programme

What an Effective AML/CFT Programme Should Cover.

AML Risk Assessment

Risk assessments form the foundation of an AML/CFT framework and help determine how compliance resources should be allocated across products, services, customers, delivery channels and geographic exposure.

Customer Due Diligence (CDD)

CDD procedures enable businesses to identify and verify customers, understand ownership structures and assess customer risk at onboarding and on an ongoing basis.

Enhanced Due Diligence (EDD)

EDD measures are applied where higher-risk relationships or activities are identified, including high-risk jurisdictions, complex ownership structures and politically exposed persons (PEPs).

Transaction Monitoring

Transaction monitoring controls assist businesses in identifying unusual, suspicious or potentially high-risk activity requiring review, escalation or reporting.

Sanctions Compliance

Sanctions screening and governance frameworks help businesses manage exposure to sanctions-related risks and comply with applicable EU and international sanctions regimes.

Suspicious Activity Reporting

AML/CFT programmes should include procedures for identifying, investigating and reporting suspicious activity to the relevant authorities where required.

MLRO Governance

Effective AML/CFT programmes require clear governance structures, defined responsibilities and appropriate oversight by the MLRO and senior management.

Staff Training

Employees should receive regular AML/CFT training appropriate to their role, responsibilities and exposure to financial crime risks.

Independent Review & Audit

Periodic independent testing and review help assess the effectiveness of AML/CFT controls, identify weaknesses and support continuous improvement.

Our AML/CFT compliance services

AML/CFT support across the compliance lifecycle.

Practical, proportionate support across every stage of the AML/CFT compliance lifecycle.

AML/CFT Enterprise-Wide Risk Assessment

Understand the business-wide risk profile before calibrating controls.

Business-wide assessment of customer, geographic, product, service, channel and transaction risks, including inherent risk, the control environment and residual risk.

Risk Assessment →

AML Policies & Procedures

Build or update the operating framework.

Risk-based governance documents and operational procedures aligned with the applicable regulatory perimeter, business model and control environment.

AML Policies & Procedures →

AML Regulatory Gap Analysis

Identify the distance between current state and required state.

Structured mapping of applicable requirements to existing documents, controls and evidence, with risk-rated findings and a practical remediation roadmap.

Gap Analysis →

AML Audit & Compliance Review

Independently test design, implementation and operating effectiveness.

Independent full-programme or targeted review of AML/CFT controls, governance, evidence and operating effectiveness, subject to the agreed assurance scope.

AML Audit →

AML Remediation & Regulatory Readiness

Turn identified deficiencies into implemented corrective action and evidence.

Corrective-action planning, control and documentation changes, ownership, implementation evidence and preparation for supervisory follow-up.

Remediation →

Outsourced MLRO & AML Support

Add senior AML capacity, structured oversight or a formal mandate where permitted.

Project-based framework and function build, expert support, operational capacity, fractional oversight and designated AML Officer or MLRO services where legally and operationally appropriate.

Outsourced MLRO & AML Support →

Travel Rule & TFR Compliance

Embed transfer-information requirements into crypto-asset workflows.

TFR gap assessments, policies, procedures, counterparty and self-hosted-address controls, governance and implementation readiness.

Travel Rule →

AML/CFT Training

Build role-specific understanding of financial-crime risk and escalation duties.

Training for compliance teams, management, onboarding and operational staff, tailored to the relevant business model and regulatory context.

AML Training →

CASPs and VASPs

AML/CFT compliance for crypto-asset businesses.

Crypto-asset service providers operate under a combined framework that includes MiCA authorisation and governance requirements, the applicable EU and national AML/CFT regime, Regulation (EU) 2023/1113 and relevant FATF standards.

LEX ARTA assists CASPs and VASPs with both licensing-stage and operational compliance requirements — from initial AML/CFT programme design and regulatory gap assessment through to ongoing MLRO support, Travel Rule implementation and remediation of regulatory findings.

Key AML/CFT areas for crypto businesses

Customer onboarding controls

Blockchain risk management

Travel Rule / TFR compliance

Transaction monitoring

Unhosted wallet controls

Sanctions screening

Suspicious transaction reporting

AML governance and MLRO oversight

MiCA and CASP AML/CFT Requirements

CASP applicants must demonstrate adequate AML/CFT internal controls, policies, procedures and risk assessment within the MiCA authorisation process. Authorised CASPs must maintain those arrangements together with the AML/CFT and transfer-information obligations that apply to their activities.

Travel Rule & TFR Compliance

The Transfer of Funds Regulation (Reg. (EU) 2023/1113) introduces originator and beneficiary information requirements for crypto-asset transfers. For CASPs and VASPs, Travel Rule compliance should be embedded into customer onboarding, transfer workflows, transaction monitoring, sanctions screening and escalation procedures — not treated as a standalone documentation exercise.

Regulatory framework

AML/CFT regulation in the Czech Republic and EU.

Czech Republic

zákon č. 253/2008 Sb.

In the Czech Republic, AML/CFT obligations primarily arise under Act No. 253/2008 Coll. (the Czech AML Act). Businesses qualifying as obliged entities (povinné osoby) must implement risk-based AML/CFT programmes, conduct CDD, maintain records and report suspicious transactions to the Financial Analytical Office (FAÚ).

Supervised by FAÚ and ČNB

European Union

EU AML Regulation (AMLR) & AMLA

The EU AML Package — including Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and the Anti-Money Laundering Authority — strengthens the common EU AML/CFT framework. Crypto-asset service providers are obliged entities under the framework. AMLA will begin direct supervision of selected high-risk cross-border financial-sector obliged entities in 2028, while national competent authorities remain central to supervision of other entities.

AMLD6 · AMLR 2024/1624 · AMLA · TFR 2023/1113

International Standards

FATF Recommendations

FATF Recommendations set the global AML/CFT standard, including Recommendation 15 (virtual assets and VASPs) and Recommendation 16 (Travel Rule). LEX ARTA aligns compliance programmes to FATF standards and jurisdiction-specific implementing rules for cross-border structures and international licensing projects.

FATF R.15 · FATF R.16 · FATF Guidance on Virtual Assets

Why LEX ARTA

Why LEX ARTA for AML/CFT Compliance.

Practitioner-led AML/CFT support connects regulatory requirements with governance, controls and evidence that can work in day-to-day operations.

Senior-Led AML ExpertiseLegal and compliance practitioners focus on material risk, governance and regulatory expectations rather than template-only delivery.

Regulated-Business ContextFinTech, payments, crypto and other regulated models are assessed against their actual products, customers, transaction flows and jurisdictions.

Framework to OperationsPolicies, risk assessments, controls, training and oversight are connected so the AML framework can be implemented and evidenced.

Cross-Border CoordinationJurisdiction-specific professional input can be coordinated where local rules, filings or regulated roles require it.

Common questions

Frequently asked questions.

Do I need an AML/CFT programme as a crypto business?

Whether a crypto business is subject to AML/CFT obligations depends on its activities, legal status and jurisdiction. In the EU, crypto-asset service providers within the applicable regulatory perimeter are obliged entities under the AML/CFT framework, and Czech entities within scope are subject to Act No. 253/2008 Coll. FATF standards also influence national AML/CFT regimes. The exact control, governance and reporting requirements should be mapped to the business model and jurisdiction.

What is an AML audit and why do regulated businesses need one?

An AML audit is an independent review of the AML/CFT programme, which may assess policies, governance, due diligence, transaction monitoring, sanctions controls and implementation evidence. The need, scope and frequency of independent testing depend on the applicable legal and supervisory framework. An audit can identify deficiencies and support remediation before external scrutiny.

What does outsourced MLRO support actually cover?

The MLRO or equivalent AML compliance role typically has defined responsibilities for AML/CFT governance, escalation, suspicious-transaction decision-making, reporting and interaction with competent authorities. The precise statutory responsibilities and whether the role may be outsourced depend on applicable law and supervisory expectations. LEX ARTA provides supporting or designated services only where the mandate is legally and operationally appropriate.

What is the Travel Rule and does it apply to my business?

The Travel Rule, implemented in the EU through Regulation (EU) 2023/1113, requires originator and beneficiary information to accompany in-scope crypto-asset transfers where a crypto-asset service provider is involved. The Regulation applies regardless of transfer amount. For a transfer exceeding €1,000 to or from a self-hosted address, the crypto-asset service provider must also verify whether that address is owned or controlled by its client. LEX ARTA supports TFR gap assessments, policy design and implementation readiness.

How does Czech AML law apply to our business?

If your business operates in the Czech Republic and qualifies as a povinná osoba (obliged entity) under zákon č. 253/2008 Sb., you are required to maintain a documented, risk-based AML/CFT programme — covering CDD, transaction monitoring, STR filing to the Financial Analytical Office (FAÚ) and regular review. In practice, many businesses underestimate the operational depth the Czech AML framework requires. LEX ARTA supports businesses in building and maintaining compliant programmes under both Czech and EU requirements.

Can you remediate an existing AML/CFT programme that has regulatory gaps?

Yes. Much of LEX ARTA's work is reviewing and remediating existing programmes — identifying gaps against current requirements and making them defensible under regulatory scrutiny, rather than starting from scratch. We provide gap analyses, updated policies and procedures, and implementation support.

AML/CFT Compliance Services for Regulated Businesses & Financial Services