Czech Republic AML Obligations for Auditors: Act 253/2008 Guide

Auditors in the Czech Republic are "obliged persons" under the country's anti-money laundering law, Act No. 253/2008 Coll. This guide walks through what the Czech Chamber of Auditors (Komora auditorů České republiky, KA ČR) says that means in practice, using its methodological guide for auditors on internal controls and on managing money laundering and terrorist financing risk. It is written for finance professionals who want to understand how the Czech regime works. If you are building wider skills, our guide to customer due diligence in accountancy practices covers the basics that apply in every country.

A note on scope before we start. This post covers statutory auditors and audit firms only. We did not confirm how the Act applies to accountants and bookkeepers in the Czech Republic, so we do not describe their obligations here. Please read the "What we could not confirm" section at the end.

Who is covered and who supervises

According to the KA ČR guide, auditors are obliged persons under section 2(1)(e) of the Act, and "auditor" covers both individual statutory auditors and audit firms. The Financial Analytical Office (Finanční analytický úřad, FAÚ) is the Czech financial intelligence unit and publishes methodical instructions to help obliged entities comply. The FAÚ page we read lists instructions on international sanctions, beneficial owner determination, politically exposed persons and the national PEP list, and customer due diligence for credit and financial institutions, but those instructions are published in Czech and we have not read them.

The KA ČR guide itself says it is not a binding professional regulation. It is guidance that explains how the Chamber reads the Act, so auditors should treat the Act and FAÚ instructions as the authority.

When identification and due diligence are required

The guide states that identification is required when the subject value of a transaction exceeds EUR 1,000, when a business relationship starts, and when a transaction is suspicious. It stresses that the test is the value of the subject matter of the transaction, not the auditor's fee.

Customer due diligence must be carried out at specified points. The guide lists, among others, the start of a business relationship, an occasional transaction reaching EUR 15,000, dealings with a politically exposed person or a person from a high-risk third country, and any suspicion. The steps it describes include understanding the purpose and nature of the relationship, identifying and verifying the beneficial owner, checking sanctions and PEP status, ongoing monitoring, and reviewing the source of funds.

How identification works

The guide says the first identification of a natural person requires physical presence and verification against an identity document. For a legal entity, the auditor verifies a document of existence from a reliable source and also identifies the person acting for the entity. It describes alternatives, including electronic identification, identification mediated by a notary or government point, taking over another institution's identification, remote identification and qualified electronic signatures. Each has conditions, and none may be used where there are doubts.

Simplified and enhanced due diligence

Simplified due diligence is allowed only for justified lower-risk cases. Enhanced due diligence applies to higher-risk cases, and the guide says PEPs require senior management approval. It also states that PEP status continues for at least 12 months after the person leaves the function (section 54(8) of the Act). Our guide to politically exposed persons explains the wider concept.

Beneficial owners

The guide defines a beneficial owner as the natural person who ultimately owns or controls the entity, and uses a 25% threshold for ownership, voting rights, profit entitlement or decisive influence. Where the client must be recorded in the Czech beneficial ownership register, the auditor must check the register and at least one other source. The guide notes that simply confirming the register entry is unlikely to be seen as sufficient. If an auditor reasonably finds a discrepancy, the guide says they must notify the client and allow a response, and if the client does not resolve it without undue delay, report it to the competent court. FAÚ may instruct the auditor not to notify the client where that could jeopardise an investigation. For background on ownership chains, see our guide to ultimate beneficial ownership.

When you must refuse

The guide says the auditor must refuse the transaction or relationship if the client refuses identification or does not cooperate, if the authority to act cannot be shown, if identification or due diligence cannot be completed, if there are doubts about the information or documents provided, or if the source of funds of a PEP is unknown.

Reporting suspicious transactions

For auditors, the guide describes a route that runs through the Chamber. The report goes to KA ČR without undue delay, or immediately where there is a risk of delay, and must be made by the designated contact person. Reports can be sent by registered letter or through the Czech data box (datová schránka), and must include specified content such as the auditor's details, the parties, a description of the transaction and the red flags. According to the guide, KA ČR checks the report and forwards it to FAÚ within 7 calendar days of the suspicious transaction being identified. A suspicious transaction must also be reported if the auditor refuses the engagement, and the guide says a report is not a breach of confidentiality.

Confidentiality and tipping off

The guide explains that the confidentiality duty in section 38 covers reports, investigations and FAÚ information requests. It binds the auditor, staff and anyone working for the firm, and continues after the relationship ends. It lists exceptions, including warning a client away from illegal activity and certain disclosures to supervisory bodies, and notes that legal privilege exceptions do not apply where a client seeks advice to legalise proceeds of crime or finance terrorism.

Record keeping

The guide states that identification and due diligence records and transaction records must be kept for 10 years from the end of the occasional transaction or business relationship. Records of staff training must be kept for at least 5 years. Where someone acts through a representative, the original or a certified copy of the power of attorney must be kept.

Internal controls, contact person and training

Auditors must adopt appropriate strategies, procedures and communication to manage the risks they identify, which the guide calls the "system of internal principles" (section 21). Written documentation is recommended but not required. The elements it lists include compliance checks, staff screening, an independent function where the size of the firm justifies it, and an anonymous internal reporting channel under whistleblower law. Risk assessment should take account of the KA ČR sector assessment, national and supranational assessments, and the factors in Annex 2 of the Act. Our firm-wide AML risk assessment approach shows how a firm can structure this kind of assessment.

The guide also says an auditor must appoint a contact person and notify FAÚ through the data box within 30 days of the rule taking effect, or within 15 days of any change in the contact person's details, and that a member of the statutory body must be formally designated to ensure compliance (section 22a). Staff who may encounter suspicious transactions must be trained at least once every 12 calendar months and before they take up the role. The training covers typologies and red flags, due diligence requirements and reporting procedures.

Our suggestions for a Czech audit firm

The following are our own suggestions, not requirements from the Act or the guide. Keep a short checklist at engagement acceptance that records the transaction value test, the client's beneficial owner and the sources you checked. Calendar the annual training so it falls inside every 12-month window. Store the contact person's details somewhere that a change triggers the 15-day notification. If you want structured learning on these topics, see our CPD courses.

Frequently asked questions

Do auditors report directly to FAÚ?

According to the KA ČR guide, the report goes to the Chamber, which forwards it to FAÚ within 7 calendar days of the transaction being identified as suspicious.

How long must records be kept?

The guide says 10 years from the end of the occasional transaction or business relationship, and at least 5 years for training records.

Is the KA ČR guide legally binding?

No. The guide describes itself as not a binding professional regulation, so check the Act and FAÚ instructions for the binding rules.

What we could not confirm

We read the Chamber's guide, which refers to rules effective 30 December 2024, and a FAÚ page listing its methodical instructions. We did not read the text of Act No. 253/2008 itself, the FAÚ instructions, or the guide's section on offences, so we state no penalty amounts. We did not confirm whether the guide has been updated since the version we read, nor how the Act applies to accountants and bookkeepers. Always check the current Act and FAÚ materials before relying on this post. This post is general information, not legal advice.