Crypto license in Czech Republic

Ongoing maintenance of your crypto license

Acquisition of a crypto-license is only the beginning. In order for the company to continue to be able to work without risks, it must constantly fulfill regulatory requirements and support the proper level of compliance with legislation.

Regulatory reporting

Licensed providers of services related to crypto-assets (CASP) in the Czech Republic are obliged to regularly report to the Czech National Bank (CNB).

Depending on the activity of the company, these can be:

• Annual financial reporting (in some cases — with a mandatory audit).
• Quarterly or semi-annual reports on operational activity.
• Special reports upon request of the regulator, for example regarding the number of clients, total volume of transactions or other indicators necessary for monitoring at the EU level.

About any extraordinary events — cyberattacks, data leaks, serious technical failures or security incidents — it is also necessary to report without delays.

The company must keep full accounting of all operations and actions of clients. As a rule, these records must be stored for at least 10 years.

To not miss any deadline, it is worth keeping a compliance calendar with the indication of all deadlines for submitting reporting, conducting audits, fulfilling AML-procedures and tax obligations. Overdue or untruthful reports can lead to fines or other sanctions, therefore this direction requires constant attention.

Fulfillment of AML/KYC requirements

Compliance with rules of the fight against money laundering (AML) and procedures of customer identification (KYC) does not end after acquiring the license — it is an ongoing process.

The company must regularly:

• Check new clients.
• Update information about current users.
• Verify clients against sanctions lists.
• Track suspicious operations.

If a transaction or behavior of a client causes suspicion — for example, due to unusual activity or large transfers from jurisdictions of increased risk, — the company must conduct a check. If suspicions are confirmed, information must be immediately transferred to the Financial Analytical Office of the Czech Republic (FAÚ).

Czech legislation requires promptly submitting notifications about suspicious operations, and the responsible AML officer must support constant interaction with financial intelligence. In practice, such notifications are often sent within 24 hours after the detection of suspicious activity.

Also it is necessary to timely implement all new requirements of legislation — both national and European. In particular, companies already must fulfill the provisions of the Sixth EU Directive on the fight against money laundering (6AMLD) and requirements of the Crypto Travel Rule, which foresee the exchange of information about senders and recipients of cryptocurrency transfers.

The regulator expects that employees will regularly undergo training on AML/CFT issues, and the Czech National Bank and FAÚ can conduct checks or request additional information regarding the effectiveness of internal procedures.

Precisely deficiencies in the sphere of AML most often become the reason for the application of sanctions after acquiring a license, therefore this sphere must be given special attention.

Audits and testing

Licensed crypto companies must regularly check the effectiveness of their internal processes and control systems.

Usually financial reporting every year passes an independent audit, especially if the company exceeds indicators established by law or stores assets of clients. If necessary, audit conclusions can be submitted to the Czech National Bank.

In addition to the financial audit, it is recommended to regularly conduct independent compliance checks. For example, to involve external experts for the evaluation of AML procedures and their compliance with current requirements of legislation.

Although a separate mandatory audit specifically for crypto companies is currently not provided, the presence of independent conclusions or certifications (for example, ISO in the sphere of information security) positively influences the evaluation of the company by the regulator.

IT infrastructure also must be regularly checked for vulnerabilities — in particular with the help of penetration tests (penetration testing) and other tools of cybersecurity.

Separate attention should be paid to testing business continuity plans and disaster recovery procedures in accordance with requirements for operational resilience.

Such checks help not only to timely detect risks, but also confirm to the regulator that the company properly fulfills its duties.

Change management

After obtaining a license, any significant changes in the company’s activity must be agreed with the regulator or at least reported.

This applies, in particular, to:

• Change of ownership structure.
• Appearance of new investors.
• Appointment of a new director, general director or AML officer.
• Change of business model or list of services.
• Relocation of the office.
• Transfer of important functions to outsourcing.

For example, if a new investor plans to acquire about 20% of the company, the Czech National Bank will likely require to previously check such a shareholder and provide its consent.

Similarly, if a company that has a license only for crypto-asset exchange decides to provide cryptocurrency custody services, it is necessary to make sure that this is allowed by the current license, as well as notify the regulator of the changes.

A license is issued on the basis of specific conditions — a defined ownership structure, management, capital size and business plan. Significant deviations from these conditions without agreement can put the validity of the license at risk.

That is exactly why an open dialogue with the regulator and timely agreement of important changes help to avoid problems in the future.

Protection of client rights and rules of conducting activity

Despite the fact that crypto-assets are not legal tender in the Czech Republic, and the system of investor protection in this sphere is still forming, the MiCA regulation already establishes clear standards of conduct for licensed CASPs.

The company must provide:

• Clear conditions of service and transparent system of commissions.
• Fair advertising without unfounded promises of guaranteed profit.
• Proper protection of funds and crypto-assets of clients.
• Separate storage of own assets and assets of users.
• Fulfillment of requirements regarding information disclosure during the issuance of new tokens.

The regulator expects that crypto companies will act in good faith and in the interests of their clients — according to the same principles applied to other financial institutions.

In addition, the company must have a clear procedure for handling complaints. Clients must have the opportunity to easily submit an appeal, and the company — to timely consider it, record it and provide an answer within established timeframes.

If previously the requirements regarding client protection in the crypto sphere were mostly limited to AML rules, then after MiCA entered into force, the standards significantly increased.

Practice shows that orientation toward the interests of users (from a high level of cybersecurity to rapid information about any incidents) increases client trust and helps the company to meet modern regulatory requirements.

Suspension or revocation of a crypto license in Czech

The Czech National Bank has the right to suspend the operation of or revoke the CASP license if the company grossly violates legal requirements or ceases to meet licensing conditions. The grounds for such a decision are generally analogous to those operating in other financial sectors. Here they are.

Serious violations of AML/CFT requirements

If a crypto service provider systematically fails to meet requirements for countering money laundering and terrorist financing (for example, does not conduct proper customer due diligence, ignores suspicious transactions, or its services are used for money laundering), the regulator can intervene. Repeated or gross violations of AML requirements or orders of the Czech National Bank can lead to the revocation of the license to protect the financial system.

Non-compliance with technical standards

If a company does not meet the technical requirements of ESMA RTS 2025/305 or violates the operational resilience rules established by the DORA regulation, this can also become a ground for losing the license.

Insufficient capital or financial problems

A CASP is obligated to maintain a minimum capital size and remain financially stable. If the company’s equity decreases below the established minimum (for example, due to significant losses) and the deficit is not covered, or the company becomes insolvent, the license finds itself under threat. In such cases, the regulator may temporarily suspend activity until the problems are eliminated or fully revoke the license if the business is no longer financially viable.

Fraud or improper management

Any evidence of fraudulent actions, misleading the regulator, or serious violations in managing client funds can cause immediate intervention. For example, if a crypto exchange illegally uses client funds or submits false reporting, the Czech National Bank can revoke its license to prevent further risks.

Activity outside the license

Providing services that are not covered by the CASP license or MiCA requirements is also a violation. For example, issuing or circulating electronic money tokens without the appropriate permission or working with securities without the required license can lead not only to fines but also to the revocation of the authorization for activity.

Corporate governance problems

The regulator expects that the company will constantly have competent leadership and a proper management system. If key managers resign and are not replaced, or the company is left without qualified compliance specialists, the Czech National Bank can issue a warning or suspend the license until the deficiencies are eliminated. If corporate governance problems are systemic in nature (for example, the company cannot appoint an AML officer or is actually controlled by persons unapproved by the regulator), the license can be revoked.

Updates to Czech crypto licensing (2024–2026)

In 2023–2025, the rules of regulation of the cryptocurrency market in the Czech Republic significantly changed.

Introduction of MiCA

At the level of the European Union, in 2023, the Markets in Crypto-Assets (MiCA) regulation (EU Regulation 2023/1114) was adopted, which established uniform rules for the operation of the crypto market for all member states. Its provisions entered into force gradually: requirements for token issuers began to operate in the middle of 2024, and the rules for licensing crypto service providers (CASP) — from December 30, 2024.

The Czech Republic promptly adapted national legislation to the new European requirements. At the end of 2024, the parliament adopted the Law on Digitalization of the Financial Market (Digital Finance Act), which endowed the Czech National Bank (CNB) with powers to issue crypto licenses. The lower house of parliament approved the law on December 6, 2024, after which the document was transferred to the Senate on December 30. At the beginning of 2025, the law entered into force, and the CNB officially started accepting applications for obtaining CASP licenses.

Thus, from January 2025, MiCA rules fully operate in the Czech Republic, and national legislation is brought into compliance with European standards. The rapid implementation of the reform confirmed the country’s desire to actively support the EU strategy in the field of digital finance.

Transition period

To prevent the new rules from creating problems for already operating companies, a special transition regime was introduced.

Crypto companies that operated in the Czech Republic on the basis of a regular trade license before December 30, 2024, could continue activity until July 31, 2025, on the condition that they submit an application for obtaining a CASP license before this date.

If the application was submitted on time, the company had the right to work according to the old rules until the final decision of the CNB. At the same time, a deadline was established — July 1, 2026. After this date, continuing activity without a new license is no longer possible, even if the consideration of the application is still ongoing.

For new companies, a transition regime was not provided: from the beginning of 2025, all new crypto businesses must immediately undergo the licensing procedure according to MiCA rules. Starting from August 2025, companies that did not submit an application for CASP had to terminate the provision of crypto services in the Czech Republic.

Such an approach allowed existing exchanges, custody services, and crypto wallets to gradually transition to the new rules, although at the beginning of 2025, this caused a significant influx of applications to the regulator.

Tightening of requirements for business and AML

Along with the implementation of MiCA, Czech authorities significantly raised the requirements for the real presence of companies in the country and for compliance with anti-money laundering rules (AML/CFT).

Before 2025, requirements regarding local presence were minimal. Now, crypto service providers are equated to financial institutions, so they are expected to conduct real economic activity in the Czech Republic or at least within the EU. The regulator no longer supports the model of companies that exist only formally, without actual management or operational activity.

Simultaneously, requirements in the field of AML were tightened. The Czech Republic implemented the latest EU directives on the fight against money laundering (up to the 6th AMLD inclusive) and updated the relevant national legislation.

In 2024, the CNB also updated the regulatory requirements for internal financial monitoring procedures, adopting a new version of the decree that details the duties of accountable companies.

In addition, the so-called Travel Rule, provided for by EU Regulation 2023/1113, began to apply to crypto transactions. From now on, CASPs must collect and transmit information about the sender and recipient of crypto assets during transfers.

In general, the approach of the regulator can be described by the principle: “same activity — same risks — same rules.” This means that crypto companies must meet almost the same standards as other financial institutions, especially regarding client verification, risk management, and internal control.

Transparency and public registries

The Czech Republic paid special attention to increasing the transparency of the crypto market.

The Czech National Bank maintains (or will maintain) an open registry of licensed crypto service providers. Anyone — clients, partners, or other companies — will be able to check whether a specific provider has a valid license.

In addition to this, in accordance with MiCA, national regulators transmit information to the European Securities and Markets Authority (ESMA), which forms pan-European registries. In particular, a list of all CASP licenses issued in the EU, as well as a database of white papers of crypto assets offered to the general public, will be published there.

The new requirements also provide for the regular submission of statistical reporting to the CNB. Part of such data can be published in aggregate form, as already happens in other sectors of the financial market.

If the regulator applies sanctions to a company — for example, revokes a license — such information can also be made public.

All these changes are intended to make the market more open, increase investor confidence, and ensure the transparency of the work of crypto companies.

Who issues crypto licenses in the Czech Republic?

Before the introduction of MiCA, the Czech approach to regulating cryptocurrencies was quite liberal.

A single special regulator or a separate crypto license did not exist. To start activity, it was enough for a company to register the relevant type of activity through the Trade Licensing Office, which is subordinate to the Ministry of Industry and Trade, as well as to fulfill the requirements of the legislation on financial monitoring.

Control over compliance with AML rules was carried out by the Financial Analytical Office of the Czech Republic (FAÚ) — the national financial intelligence unit. At the same time, the FAÚ did not issue licenses: it only maintained a list of companies that reported the implementation of cryptocurrency activity and controlled their execution of AML requirements.

In fact, until 2025, crypto exchanges, crypto wallet operators, and other market participants worked on the basis of a regular trade license, and their supervision was limited to checks by the FAÚ. The Czech National Bank at that time did not deal with licensing or prudential supervision of crypto business — its competence extended only to banks, payment institutions, and other traditional financial organizations.

The situation changed radically after the entry into force of MiCA.

Today, the sole body that issues licenses to crypto asset service providers (CASP) is the Czech National Bank (CNB). It is defined as the authorized state body responsible for licensing and subsequent supervision of the activities of crypto companies.

Any company that plans to legally provide crypto services in the Czech Republic — regardless of whether it is an exchange, broker, custody service, or other provider — must submit an application directly to the CNB and undergo the official procedure for obtaining a CASP license.

No alternative or private licensing mechanisms exist. The procedure is built on the same principle as the licensing of banks or payment institutions.

At the same time, the FAÚ retains its powers in the field of financial monitoring. Licensed CASPs are still required to report suspicious financial transactions to this body and fulfill AML/CFT requirements.

Thus, today the right to issue crypto licenses in the Czech Republic belongs exclusively to the state represented by the Czech National Bank, and for legal work, crypto companies must undergo the full procedure of official authorization.

Why the Czech Republic crypto license is attractive for startups

The Czech Republic is one of the most attractive ways for entrepreneurs and crypto startups to enter the regulated European market. Here’s why.

Single-scope license (flexibility)

With Czech’s single CASP license covering all crypto-asset services, a startup can launch one product and pivot or expand without regulatory friction. For example, you might start as a crypto broker facilitating trades, and later add a custodial wallet service or a staking offering – all under the same license. You simply ensure compliance with any additional rules for the new activity (like increasing capital if moving to a higher service class) but you do not apply for a new license from scratch. This flexibility is a big advantage for startups in a fast-evolving industry. It allows for innovation and iteration on the business model. You essentially have a broad permission slip to explore various revenue streams in the crypto domain (trading, custody, payments, ICO advisory, etc.) so long as you stay within the MiCA-defined scope. Startups appreciate not being siloed by narrowly defined licenses.

Favorable tax and EU market access

From a business growth perspective, Czechia provides a solid platform. The reasonable 21% corporate tax and absence of VAT on crypto trades mean you keep more of your earnings to reinvest, which is valuable when margins are thin in early stages. There are also possibilities to optimize taxes (for instance, by reinvesting profits into R&D which can have incentives, etc.). Crucially, being in Czechia means being in the European Union – so your licensed startup can immediately access customers in all EU countries. You can market to clients in Germany, France, Italy, etc., without needing separate approvals, vastly enlarging your addressable market. This scale is hard to achieve elsewhere. If you compare with, say, a licensed entity in a smaller non-EU jurisdiction, they might struggle to serve large European economies; the Czech license circumvents that. Thus, a Czech-based crypto startup can quickly go international across Europe, which is a huge boost for growth potential.

Industry credibility and investor appeal

Being a regulated entity in the Czech Republic (and by extension under EU law) gives a stamp of legitimacy that can be very persuasive to partners and investors. Many venture capitalists and institutional partners prefer companies that operate under clear regulations, as it reduces legal uncertainties. The CNB’s oversight signals that the company meets rigorous standards. This can open doors to partnerships with traditional financial institutions – for example, banks or payment processors are far more willing to work with a company that holds an EU license and has proper compliance, as opposed to an unlicensed outfit. Even customers may take comfort in knowing the platform is licensed and monitored. For a startup, this credibility can translate into easier fundraising (some VC funds have mandates to only invest in regulated businesses in certain sectors) and better banking relations (some Czech banks will provide accounts to licensed CASPs whereas they would reject unlicensed crypto businesses). In summary, the Czech license can enhance your reputation domestically and internationally.

Supportive fintech ecosystem

Prague (and Czech Republic generally) has a vibrant tech and fintech scene. There are established communities of blockchain developers, crypto entrepreneurs, and supportive institutions. The government has shown interest in fintech innovation – as evidenced by initiatives like the Czech Blockchain Alliance and various conferences. The availability of local talent in IT and finance is another plus – you can find skilled developers, compliance specialists, and other professionals often at lower cost than in hubs like London or Berlin. Moreover, local advisory firms and law firms are experienced with crypto cases (thanks to the early emergence of crypto in Prague’s tech circles), so startups can find guidance easily. The Czech regulatory authorities also tend to be open to dialogue – the CNB and Ministry have engaged with the industry to ensure regulations are workable. This relatively open environment means as a startup you’re not alone; you have access to a network of experts, potential partners, and even incubators or innovation hubs (Prague is home to several fintech incubators) that understand crypto. All of these factors create an ecosystem where a young crypto company can flourish with the right idea and execution.