Risk assessment and internal policies: what your business needs

Three questions before downloading a template

Determine when and for which actual activities you became obliged under Section 2. Separate implementing procedures under Section 21(1), identifying and assessing risk under Section 21a(1), and the specific written-form duty. Another profession’s document does not answer these questions. Assess multiple activities both together and individually.

Section 21(2) links written policies to Section 2(1)(a)–(d) and (h): credit and specified financial institutions, relevant gambling operators and real-estate activities, and specified company or trust services. Office or company-formation providers cannot automatically use the external-accountant regime. Section 21a(2) governs written assessment in this branch.

Exceptions have specific conditions

Section 21(3) permits an exception for Section 2(1)(b)–(d) and (h) categories where no employees or other persons work on the AML activity. Low turnover or director count alone does not decide it. External workers may matter. Reassess when staffing changes.

Paragraph 4 addresses persons in categories (b)–(d) and (h) working only for one other obliged entity, following that entity’s policies that adequately cover their activity. It is not an exception for every business with one customer. Professional chambers have their own methodology and risk duties; members still implement appropriate procedures.

Adopt and actually use the document

In the mandatory written branch, policies and assessment are prepared within 60 days of becoming obliged. The statutory body approves them and they are kept current. Submission to FAÚ or the Czech National Bank is a separate Section 21 branch, not automatic for every written policy. Evidence must reflect actual services, channels, clients and responsibilities.

Changed services can change the applicable branch

An external accountant adding company-formation or office services must assess the new activity separately under Section 2. They cannot automatically preserve the previous written-form conclusion. Similarly assess hiring, external cover and changed exception conditions. Retain the change date and reasons for the revised conclusion. The duty follows the actual service and statutory conditions, rather than the trade name or commercial package.

For an exception, also determine review triggers. Staffing or a link to one other obliged entity may change without renaming the business. Record the conditions met and who monitors their continuation. Separately arrange procedures required even without the specific written-form duty. A form exception does not exempt identification, due diligence, retention or reporting where the Act requires them.