An inspection should be able to reconstruct what actually happened. A current form or claim that software assessed everything is insufficient. Evidence must connect information available at the time, the applicable rule and the customer decision.
Supervision covers more than documents
Section 35 defines FAÚ supervision and sector-specific authorities. The CNB matters for financial institutions and professional chambers for specified professions; these are not interchangeable recipients. Supervision follows risk analysis and the duties of the specific category.
Section 9(3) expressly requires justification of due diligence scope and evidence of performance, or of simplified-measure or exemption conditions. “We know the customer” without supporting information is not adequate reasoning.
Build a demonstrable customer file
Retain identification data, verification method, time and performer. For companies include the representative and authority, beneficial-owner sources and structure. Add purpose, funds review, risk assessment and resulting measures as applicable.
Distinguish declarations from verification. Where sources conflict, record the discrepancy, further questions and conclusion. A software alert with no recorded response does not demonstrate resolution.
Connect procedures to practice
Keep historical internal-rule and risk-assessment versions, approvals where required, relevant staff training and role allocations. Contact-person submission proves that particular duty, not all customer measures.
As a practical test, ask an authorised employee to retrieve evidence for a completed case without the original caseworker’s help. If only today’s customer profile can be opened, the historical trail is probably insufficient.
Provide truthful cooperation and corrections
For Section 24 requests, verify the authority, scope, deadline and secure delivery. Follow profession-specific statutory channels. Do not invent retrospective identification or training. Mark missing records honestly and describe actual evidence and remediation.
Date new measures accurately. Section 35(13) may lead to a remediation requirement; demonstrate its completion rather than merely promising it.
For a remediation measure under section 35(13), notify FAÚ of completion without undue delay, no later than ten days after the specified deadline expires. Record completion and notification dates; this notification period does not postpone the remediation itself.
Practical steps
- Identify applicable supervision and duties.
- Index customer, internal and submission evidence.
- Test reconstruction of a historical case.
- Provide truthful documents and record specific remediation.
Illustrative scenario
A practice records why it requested a loan agreement: the amount did not fit the customer’s profile. It retains the agreement, query and assessment of the associated payment.
When the situation differs
After inspection is announced, staff backdate “verified in person” entries despite never meeting the customer.
What to document
- File index and historical procedure versions.
- Scope reasoning and discrepancy resolution.
- Authority requests, responses and remediation evidence.
Common pitfalls
- Keeping only a final score without inputs.
- Presenting new remediation as historical compliance.
Frequently asked questions
Must I always collect the maximum number of documents?
No. Demonstrate proportionality and actual performance of necessary measures; accumulating unrelated data does not prove quality.
Is a software export evidence?
It may form part of the evidence. It must be complete, readable and connected to actual measures and sources.
Put this guidance into practice
Choose a record for the step you are working on. Adapt it to your profession and actual case.
Complete client information online
Where to go next
- Who is responsible for AML in a company? — Assign management, contact-person, staff and supplier roles without leaving a gap before a transaction.
- Risk assessment and internal policies: what your business needs — Applicability, written form and exceptions for risk assessment and internal policies.
Sources and legal references
- Zákon č. 253/2008 Sb. — aktuální znění e-Sbírky ↗
§ 9 odst. 3, § 16, § 21–24, § 35 · accessed 2026-10-04
Editorial work and source checks are not independent legal approval of your particular process. Compare the conditions and exceptions with your own circumstances.