CMS Expert Guide to AML and CTF law and regulation in CEE

Overview of relevant laws and regulations

  • Act No. 253/2008 Coll., on certain measures against money laundering and financing of terrorism (the “AML Act”);
  • Decree No. 281/2008 Coll., on certain requirements for the system of internal policies, procedures and control measures against money laundering and terrorist financing (the “AML Decree”);
  • Act No. 40/2009 Coll., Criminal Code;
  • Act No. 69/2006 Coll., on carrying out of international sanctions (the “International Sanctions Act”),
  • The main legal act which provides for AML/CTF is the new Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, adopted on 6 December 2019 and which entered into force on 28 April 2020 (the “AML Law”);
  • The Law of Ukraine “On Combatting Terrorism”, adopted on 20 March 2003, as amended (the “CT Law”);
  • Penal Code of Ukraine, adopted on 5 April 2001, as amended (the “PCU”).

2. Are the 4th AML Directive and the 5th AML implemented in your jurisdiction?

Yes, the 4th AML Directive was implemented into Czech law via Act No. 368/2016 Coll. which amends (i) the AML Act; (ii) the International Sanctions Act; (iii) Act No. 304/2013 Coll., on public registers of legal entities and individual persons; and other acts. 

The 5th AML Directive is currently being implemented into two separate acts: (i) an amendment act which will amend the AML Act and Act No. 186/2016 Coll., on hazardous games; and (ii) a new act on the Ultimate Beneficial Owner Registry. 

According to the explanatory note to the AML Law and available information from public sources, the new AML Law was developed based on and adopted with the purpose of implementing the basic provisions of the 4th AML Directive and partially the provisions of the 5th AML Directive.

3. Which is the AML/CTF supervisory authority in your jurisdiction?

The Financial Analytics Office is the main AML/CTF supervisory authority. Other authorities authorised to monitor compliance with the key obligations under the AML Act in certain sectors include the Czech National Bank, the Ministry of Finance, and the Czech Inspection Authority. 

The State Service of Financial Monitoring of Ukraine (the “SSFMU”) is the main AML/CTF supervisory authority. 1 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Chapter V.

Other authorities that perform the functions of state regulation and supervision of subjects of primary financial monitoring include the National Bank of Ukraine, the Ministry of Finance of Ukraine, the Ministry of Justice of Ukraine, the National Securities and Stock Market Commission, the Ministry of Digital Transformation. 2 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 6(3).  

4. Who are the obliged/reporting entities in your jurisdiction? Are there any local derogations from the scope of the obliged entities as provided for in the 4th and 5th AML Directives? 

There are almost 40 categories of reporting entities under the AML Act, including banks, financial institutions, operator of hazardous games, persons active in the real estate industry and intermediaries in the field, notaries, attorneys etc. In the Czech Republic, the scope of reporting entities under the AML Directives is extended also to include persons authorised to conduct business at cultural sites or with items of cultural value, persons authorised to conduct business with used goods or intermediaries in the field, national administrators of registries of permits and persons providing services connected with virtual currencies. 

In Ukraine, the primary financial monitoring entities (obliged entities) are banks, financial institutions, payment services providers, insurance and reinsurance companies and intermediaries, accountants, legal advisors, tax advisors, persons providing the services on formation and management of legal entities, notaries, estate agents, providers of services related to virtual assets, etc. 3 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 6 (2).   

We understand that in Ukraine, the scope of the obliged entities is mainly the same as under such AML Directives.

The KYC requirements in the Czech Republic follow the requirements of the 4th and 5th AML Directives and include the following minimum information:

  • Individual persons: name, surname, birth certificate number, date of birth (if birth certificate number is not provided), place of birth, permanent or other residence, citizenship and if the person is the entrepreneur, also company name, place of business and the identification number;
  • Legal entities: company name, registered seat, identification number, identification data on persons who are members of the company’s statutory bodies which enable their identification;
  • Trust funds and other institutions without a legal personality: title, identification data of the administrator or of a person in a similar position. 

To facilitate the obligations of the reporting entities, the AML Act provides a general obligation on commercial companies, trust funds, associations, public legal entities, foundations, and institutes to disclose their UBOs to the court which keeps the relevant register, e.g. commercial companies will register at the court maintaining the commercial register. Please note that the UBO registry is not publicly accessible.

According to the AML Law, the legal requirements for KYC are the following:

  • identifying the customer (client) and verifying the customer’s identity on the basis of documents, data or information obtained from a reliable and independent source;
  • identifying the UBO of the customer or its absence, including, by clarifying the ownership structure and obtaining data allowing to establish the UBO, and taking measures to verify his/her identity;
  • clarifying the nature of future business relationships and the purpose of conducting a financial transaction;
  • regularly monitoring business relations and respective financial transactions of the customer (client) as to their compliance with the available information about the customer, its activities and respective risks (including, if necessary, about sources of funds for financial transactions);
  • ensuring the relevance of received documents, data and information about the customer. 4 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 1.  

The new AML Law provides new disclosure rules for UBOs in the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organization and requires that the information about such ultimate beneficiary owners is constantly updated. 5 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Final and Transitional Provisions.  A failure by the management/directors of an entity to submit (including on time) information and documents regarding the entity’s UBO to the state registrar is punishable with an administrative fine from UAH 17,000 (EUR 580) to UAH 51,000 (EUR 1,750). 6 Code of Administrative Offences of Ukraine, 7 December 1984, Art. 16611.  

6. Is there any legislation in your country allowing for online/digital onboarding of customers? What are the restrictions, if any?

Yes, the legislation in various sectors, such as the banking sector, allows for the digital onboarding of customers, provided that the requirements for customer identification and customer verification under the AML Act are observed.  

With the entry into force of the new AML Law on 28 April 2020, the implementation of identification and verification will not require the personal presence of customers. 7 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 1.  The National Bank of Ukraine is currently developing fundamental changes to the regulation on the remote identification and verification of customers.

7. What are the other main obligations of the reporting entities? Do the obligations of some of them go beyond those required by the 4th and 5th AML Directives in terms of internal safeguards, KYC duties, reporting obligations, etc.?

The main obligations of the reporting entities under the AML Act follow the 4th and 5th AML Directives. These include customer due diligence (CDD), the collection of information and documents and their storage, an assessment of the risk of money laundering and terrorist financing, and the disclosure of information on suspicious operations, transactions and customers. The Czech AML Act further specifies requirements for a system of internal principles, risk assessment, staff training and information obligation.

The main obligations of the reporting entities under AML Law are: (i) the due diligence of the customer; (ii) the collection and storage of information and documents, in particular, on the customer’s identification, verification of the UBO and the customer’s financial transactions; (iii) and assessment of the risk of money laundering and terrorism financing; (iv) notification of the competent state authorities of any suspicious operations and the threshold operations of customers. 8 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 8(2).  

We understand that the main obligations of the reporting entities under AML Law mainly follow these Directives, i.e., the AML Law does not contain any obligations going beyond those required by the AML Directives.

8. Is a National Risk Assessment adopted in your jurisdiction? If yes, what are the main identified risks?

Yes, the first round of the National Risk Assessment for Money Laundering and Terrorist Financing (the “NRA”) was finalised and approved on 9 January 2017 by the Government of the Czech Republic (the idea is to repeat the NRA regularly). 

The NRA report provides an assessment of the role of each public authority entrusted with the task of enforcing the AML and individual controlling mechanisms.

The NRA report provides a strategy and useful measures for monitoring and limiting the risks of money laundering and terrorist financing regarding the following bodies:

  • financial institutions;
  • mobile payment services providers;
  • insurers;
  • legal and advisory services;
  • service providers for companies and trust funds.

The main identified risks include: 

  • tax-related crimes followed by money laundering;
  • corruption followed by money laundering;
  • interference with public procurement followed by money laundering;
  • public aid crimes followed by money laundering;
  • terrorist financing; and
  • drug-related crimes followed by money laundering.

Yes, according to the AML Law, the National Risk Assessment on preventing and countering legalisation (laundering) of proceeds of crime and terrorism financing (the “NRA”) is carried out systematically, but at least once every three years. 9 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Art. 28(2).  

The second NRA report was provided in December 2019 by the SSFMU (the first in Ukraine was conducted in 2016). According to the results of the second NRA, 24 risks of money laundering and terrorism financing were identified in Ukraine (including 6 high-level risks, 16 medium risks and 2 low risks). The main identified high-level risks were:

  • risk of forgery of invoices in foreign economic activity (the risk of illegal financial outflows from the country);
  • manifestations of terrorism and separatism;
  • high cash turnover; 
  • low income among the population;
  • money laundering/ terrorism financing via remote services or using virtual currencies; and
  • inadequate detection and sanctioning of suspicious financial transactions by PEPs. 10 Report on the National Risk Assessment in the field of the prevention and counteraction of the legalization (laundering) of criminal proceeds and the financing of terrorism, 2019, pages 233-234.  

9. What are the main CTF measures in your country?

The AML Act prescribes a number of key obligations that must be respected to the maximum extent by all reporting persons and all individuals and legal entities: 

  • client identification and control obligation;
  • information obligation;
  • reporting obligation;
  • obligation to postpone client’s instruction;
  • preventive measures obligation;
  • obligations related to transfers of funds;
  • reporting obligation regarding cross-border transfers;

Measures adopted in response to a breach of these obligations will depend on the nature of the breach, e.g. an assessment of whether the nature of the breach amounts to civil or criminal liability.

The main measures provided under the AML Law include the freezing of funds (i.e. prohibition on the transfer, conversion and allocation of funds) and suspension of financial operations. If assets allegedly connected with the terrorism financing are detected, the primary financial monitoring entity is obliged to immediately freeze the funds and notify the SSFMU and the Security Service of Ukraine, or to suspend the respective financial operations and notify the SSFMU. 11 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Chapter IV.  

Further, the PCU provides for criminal liability for terrorism financing. In particular, according to the PCU, any individuals who commit terrorism financing, will be punished with imprisonment from 3 to 12 years with possible additional sanctions such as a fine and confiscation of property with a prohibition from performing certain activities or occupying certain positions for up to three years. 12 Penal Code of Ukraine, 5 April 2001, Article 2585.

In addition, the AML law provides a wide range of sanctions, including fines, for obliged/reporting entities for violating the money laundering and terrorism financing legislation related to the monitoring procedures. 13 Law of Ukraine “On Preventing and Counteracting to Legalization (Laundering) of the Proceeds of Crime, Terrorism Financing, and Financing Proliferation of Weapons of Mass Destruction”, No. 361-IX, 6 December 2019, Article 32.  

10. What are the criminal and/or regulatory and/or other risks for corporate bodies/directors/employees under your national law if failing to comply with AML/CTF legislation? Is there regular enforcement of the AML/CTF legislation in your country?

Money laundering and terrorist financing are criminalised under the Czech Criminal Code as standalone crimes. The legalisation of the proceeds of crime is subject to imprisonment up to ten years. Terrorist financing is subject to imprisonment up to 15 years. Further sanctions, such as forfeiture of property etc., can be imposed.

Czech law recognises corporate criminal liability, therefore companies may also be criminally liable for money laundering and terrorist financing. There is a wide range of sanctions which can be imposed on legal entities, e.g. dissolution of the company, forfeiture of property, monetary penalty, and publishing the judgment. 

The AML Act provides a range of sanctions for non-compliance with the key obligations and sets out individual fines and penalties depending on the type of infringement, the type of infringer (an individual or entity or type of entity, banks, insurers, etc.).

In Ukraine, liability for money laundering and terrorism financing is provided by the PCU, the Code of Administrative Offences of Ukraine, adopted on 7 December 1984, as amended (the “CAOU”).

Where a corporate body is involved in money laundering/terrorism financing, its management/directors or employees do not bear criminal liability for such crimes merely because they hold the respective corporate positions. Instead, such management/directors or employees may only bear criminal liability if they personally took part in money laundering/terrorism financing activities (please also see our comments to Question 9 above). In addition, money laundering/terrorism financing committed in the name and on behalf of a legal entity may expose such entity to criminal sanctions (i.e. fine, confiscation and liquidation) under the PCU. 14 Penal Code of Ukraine, 5 April 2001, Articles 963, 967-969.  

According to the CAOU, if the money laundering and terrorism financing related legislation is breached (e.g., a failure to provide/late submission/submission of unreliable information related to the analysis of financial transactions), the management/directors of an entity will be punished with a fine from UAH 1,700 (EUR 60) to UAH 3,400 (EUR 115). 15 Code of Administrative Offences of Ukraine, 7 December 1984, Art. 1669.  

The number of notifications regarding money laundering and terrorism financing increases every year. However the effectiveness of law enforcement authorities in investigating and prosecuting money laundering/terrorism financing charges is relatively low overall.

Picture of Tomas Matejovsky
Tomáš Matĕjovský
Partner
Prague
Lukas Valusek
Lukas Valusek
Senior Associate
Prague
Olexander Martinenko
Olekhov, Ihor
Ihor Olekhov
Partner
Kyiv (CMS CMNO)