Czech Republic -- Custody Regulations Regulatory Overview

The regulatory landscape for cryptocurrency and digital asset custody in the Czech Republic, like much of the EU, is currently in transition. While there isn't a specific, standalone law dedicated solely to crypto custody, existing Anti-Money Laundering (AML) and counter-terrorist financing (CTF) legislation applies, and the upcoming EU-wide Markets in Crypto-Assets (MiCA) Regulation will significantly overhaul the framework.

Here's a breakdown:

Current Czech Republic Regulations (Pre-MiCA)

The primary legislation currently impacting entities offering crypto custody services in the Czech Republic is the national AML/CTF framework.

1. Custodial License Requirements

• Regulator: The Financial Analytical Office (Finanční analytický úřad - FAU) is the primary AML/CTF supervisory authority.

• Requirement: Entities providing services related to virtual assets, which includes the custody or administration of virtual assets, are considered "obliged entities" under Czech AML law. They must be registered with the FAU.

• Legal Basis: Act No. 253/2008 Coll., on Selected Measures Against Legitimisation of Proceeds of Crime and Financing of Terrorism (AML Act).

  • Specifically, Section 2(1)(l) defines providers of services relating to virtual assets as obliged entities. Section 4 provides for the registration obligation.

• Requirements for Registration/Operation:

  • Establishment and implementation of internal AML/CTF policies and procedures.
  • Customer Due Diligence (CDD) measures.
  • Reporting suspicious transactions to the FAU.
  • Appointment of an AML officer.
  • Ensuring the fitness and probity of management.
  • Maintaining records.

  References:

  • Act No. 253/2008 Coll. (AML Act): While an official English translation by the government may not be readily available online, the Czech version can be found in the Collection of Laws (Sbírka zákonů). Reputable legal firms often provide summaries in English.
  • Financial Analytical Office (FAU) website: https://www.financnianalytickyurad.cz/ (Czech only, but provides official information for registration and compliance).

2. Segregation of Client Assets Rules

• Currently: There is no specific Czech law explicitly mandating the segregation of client crypto assets for virtual asset service providers (VASPs) under the current AML framework. However, general commercial law principles concerning fiduciary duties and preventing the misuse of client funds would strongly suggest, as best practice, that client assets should be held separately from the firm's operational assets. Misappropriation could lead to criminal charges.

3. Insurance/Bonding Requirements

• Currently: There are no specific Czech laws mandating insurance or bonding requirements for crypto custody providers.

4. Cold Storage Mandates

• Currently: There are no specific Czech laws mandating cold storage for crypto assets. However, robust security measures, including appropriate storage solutions (cold, warm, hot storage strategies), are generally expected as a matter of best practice and operational resilience for any financial service provider handling client assets, especially considering the inherent risks of digital assets.

5. Qualified Custodian Definitions

• Currently: Czech law does not define a "qualified custodian" specifically for crypto assets in the same way traditional financial regulations define custodians for securities or funds. The closest regulated entity is the "provider of services relating to virtual assets" registered with the FAU under the AML Act.

Pending Custody Legislation (MiCA)

The Markets in Crypto-Assets (MiCA) Regulation (EU) 2023/1114 is an EU-wide regulation that will directly apply in all member states, including the Czech Republic, creating a harmonized and comprehensive regulatory framework for crypto-assets and crypto-asset service providers (CASPs).

1. Implementation Timeline

• Stablecoins (Asset-Referenced Tokens and E-money Tokens): Rules applying to these assets and their service providers will apply from 30 June 2024.
• Other Crypto-Assets and CASPs (including Custodians): Rules for other crypto-assets and service providers will apply from 30 December 2024.

2. MiCA's Impact on Custody

MiCA introduces specific requirements for CASPs providing "custody and administration of crypto-assets on behalf of third parties."

• Custodial License Requirements:

  • CASPs, including custodians, will require a specific authorization (license) from a designated competent authority in an EU Member State. In the Czech Republic, the Czech National Bank (Česká národní banka - CNB) is expected to be the primary competent authority for MiCA licenses.
  • Requirements:
    • Establishment of robust governance arrangements, including internal control mechanisms, effective risk management, and systems to ensure data integrity and confidentiality.
    • Prudential requirements (sufficient own funds or professional indemnity insurance).
    • Suitability of management and shareholders.
    • Robust ICT and security arrangements.
    • Complaint handling procedures.

• Segregation of Client Assets Rules:

  • Explicit Mandate: MiCA explicitly mandates CASPs providing custody to segregate client crypto-assets from their own assets. They must record clients' crypto-assets in separate accounts or using other equivalent measures, ensuring clients' crypto-assets are clearly distinguishable from the CASP's own assets.
  • Protection: In the event of the CASP's insolvency, client crypto-assets must not be considered part of the CASP’s insolvency estate.

• Insurance/Bonding Requirements:

  • MiCA requires CASPs to hold either:
    • Own funds permanently at the disposal of the CASP that are at least the higher of:
      • EUR 50,000 to EUR 150,000 (depending on the services provided).
      • A quarter of the fixed overheads of the preceding year.
    • A professional indemnity insurance policy covering the territories in which the CASP offers services, for an amount equivalent to the required own funds.

• Cold Storage Mandates:

  • MiCA doesn't explicitly mandate "cold storage" as a specific technology, but it requires CASPs to implement robust security policies and procedures to ensure the protection and integrity of clients' crypto-assets.
  • This includes:
    • Procedures for the safekeeping of crypto-assets.
    • Safeguarding against unauthorized access to cryptographic keys.
    • Robust operational resilience, including backup and disaster recovery plans.
    • Best practice interpretation: Meeting these security requirements will almost certainly necessitate secure offline storage (cold storage) for a significant portion of client assets.

• Qualified Custodian Definitions:

  • MiCA defines "custody and administration of crypto-assets on behalf of third parties" as a specific crypto-asset service requiring authorization. Any entity authorized to provide this service under MiCA would effectively function as a "qualified custodian" in the EU, subject to the comprehensive set of rules outlined above.

  References:

  • Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114
  • Czech National Bank (ČNB) website: https://www.cnb.cz/en/ (Expected to be the competent authority for MiCA licenses in the Czech Republic).

Summary and Outlook

Currently, the Czech Republic's approach to crypto custody is primarily rooted in AML/CTF compliance, requiring registration with the FAU and adherence to anti-money laundering obligations. There are no specific national laws for asset segregation, insurance, or cold storage for crypto custody providers.

However, the impending implementation of MiCA will drastically change this. From late 2024, the Czech Republic will operate under a comprehensive EU framework that will:

• Require specific authorization for crypto custody providers.
• Mandate clear segregation of client assets.
• Introduce prudential requirements (own funds or insurance).
• Demand robust security measures that will likely necessitate advanced storage solutions.
• Effectively create a definition for a regulated "crypto custodian" within the EU.

Entities currently providing custody services or planning to do so in the Czech Republic should actively prepare for MiCA's requirements and engage with the Czech National Bank as the likely competent authority.

Disclaimer: This information is for general informational purposes only and does not constitute legal or financial advice. Regulations are complex and subject to change. It is essential to consult with legal professionals specializing in Czech and EU financial regulation for advice tailored to specific situations.