Custodial wallet / SaaS in Czech Republic

VASP Activities (Virtual Assets Only): For services exclusively involving virtual assets (e.g., crypto-to-crypto exchange, crypto custody), the Czech Republic requires registration as a trade license (živnostenské oprávnění) under the Trade Licensing Act, specifically for "Provision of services related to virtual assets." This is generally considered a "free trade" (volná živnost).

Act No. 253/2008 Coll., on Certain Measures Against Legalisation of Proceeds of Crime and Financing of Terrorism (the "AML Act"): This is the primary national law transposing the EU AML directives. It was amended to include VASPs as obliged entities.

Act No. 455/1991 Coll., the Trade Licensing Act, was amended effective April 1, 2025, and further amendments will take effect July 1, 2025, affecting the regulatory framework for virtual asset service providers under Czech AML law.

Custodial Wallet Services: Providing services to safeguard private cryptographic keys on behalf of customers, to hold, store, and transfer virtual assets.

While the Fifth Anti-Money Laundering Directive (EU 2018/843) (5AMLD) initially brought virtual asset service providers under AML/CFT scope in Czechia, the framework has evolved with newer EU regulations (e.g., MiCA, Travel Rule, upcoming AMLR/AMLD legislation by 2025) now also being relevant and superseding aspects of previous directives.

The legal framework for money laundering harmonization in Czechia is now governed by Directive (EU) 2024/1640, which replaced the earlier Sixth Anti-Money Laundering Directive (EU 2018/1673).

Identification of the Customer:

Natural Persons: Full name, date and place of birth, permanent address, nationality.

Legal Entities: Company name, registered office address, identification number (IČO), and details of their statutory representatives.

Beneficial Owner (BO): For legal entities and trusts, VASPs must identify and verify the beneficial owner(s) – i.e., the natural person(s) who ultimately own or control the customer, or on whose behalf a transaction is being conducted. This typically involves identifying any natural person holding more than 25% of the shares or voting rights, or otherwise exercising control.

Verification of Identity:

Information must be verified using reliable, independent sources (e.g., valid government-issued identification documents for individuals like passports or ID cards; official company registration documents for legal entities).

For non-face-to-face relationships, enhanced verification measures are required.

Enhanced Due Diligence (EDD):

Customers or beneficial owners who are Politically Exposed Persons (PEPs).

Source of Funds/Wealth (When Applicable):

VASPs must continuously monitor the business relationship and transactions to ensure they are consistent with their knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Regular reviews of customer information and risk assessments must be conducted.

AML/CFT fines by the FAÚ for failures in compliance, which can apply to any "obliged entity," including crypto service providers. However, large, publicly detailed fines against prominent crypto platforms are not as common as in some other countries.

Entity Targeted: Alexander Vinnik (primary alleged operator of BTC-e/WEX), and associated individuals/entities involved in money laundering. Violation Type: Operating an unlicensed money transmission business, money laundering (estimated billions of dollars), and wire fraud using Bitcoin. Outcome: Disruption of a major global cryptocurrency-based money laundering operation. Seizure of significant assets. Conviction and ongoing prosecution of key individuals.

Entity Targeted: Various obliged entities, including (but not limited to) payment institutions, banks, and potentially smaller crypto service providers. Specific names and detailed violations for smaller crypto firms are not always publicly disclosed unless the fine is exceptionally large or the case is particularly egregious. Violation Type: Failure to comply with anti-money laundering and counter-terrorist financing (AML/CFT) obligations (e.g., insufficient customer due diligence, inadequate risk assessment, failure to report suspicious transactions). Penalty Amount: Varies significantly depending on the severity and scale of the violation. Fines can range from tens of thousands CZK to millions CZK. FAÚ annually publishes statistics on fines but not always specific details for each entity unless it's a high-profile case. Outcome: Improved AML compliance among obliged entities, deterrence of future violations.

Regulator Name: Financial Analytical Office (FAÚ) of the Ministry of Finance.