An inspection by the FIU is the moment of truth for every obliged entity. That's when it becomes clear whether your internal AML processes actually work, or are just a paper exercise. In this article, we explain how an FIU inspection works, what inspectors focus on, and how to prepare so you pass without issues.
Table of contents
What is an FIU inspection and when does it come?
The FIU is the main supervisory body for AML in the Czech Republic. Its inspectors can visit any obliged entity — a bank, real estate agency, accounting firm, jeweller, or lawyer.
An inspection can be planned (based on the risk profile of the sector) or unplanned (based on a tip, suspicious transaction, or anonymous report). In both cases, the FIU is authorised to demand immediate access to your AML documentation.
Important: FIU inspections don't just target large companies. In recent years, the FIU has significantly increased the number of inspections at small and medium-sized businesses, especially in the non-financial sector.
How does an FIU inspection work? 5 phases
A typical FIU inspection has five phases:
- Notification — the FIU contacts you (in writing or by phone) and communicates the subject of the inspection. For unplanned inspections, notification comes on site.
- Document submission — inspectors request your internal policies (SVZ), risk assessment, and records of client identification and due diligence.
- Sample checking — the FIU selects a random sample of clients and transactions and verifies whether you've done everything according to the AML Act.
- Interviews — inspectors may conduct interviews with the compliance officer and rank-and-file employees and persons in a comparable position. They want to know if people know what to do.
- Report and conclusion — after the inspection, you receive a report with findings. Serious deficiencies may result in a fine.
The entire process typically takes several days to weeks, depending on the size of the company and the complexity of business relationships.
What do inspectors focus on most?
Analysis of publicly available FIU decisions shows that inspectors emphasise these areas:
- Internal policies and risk assessment — does it exist? Is it current? Is it relevant to your sector? Or is it a generic template?
- Client identification — did you perform KYC for every client? Do you have copies of documents? Did you verify the beneficial owner?
- Customer due diligence (CDD) — did you assess the purpose of the transaction and source of funds? Did you perform EDD for risky clients?
- Screening — do you check clients against sanctions lists and PEP registers? How often?
- Archiving — are records complete and traceable? Do you retain them for the legally required 10 years?
- Training of employees and persons in a comparable position — are employees and persons in a comparable position trained in AML? Do training records exist?
Key finding: the FIU doesn't just check whether documents exist. It checks whether you actively work with them. A formally correct SVZ that nobody reads is, from the FIU's perspective, almost as bad as having none.
Are you subject to AML?
Enter your company ID (IČO) and instantly find out whether you're subject to AML regulations
Most common findings and reasons for fines
Based on public FIU decisions, the most common reasons for fines are:
- Missing or outdated internal policies — the most common finding, fines often exceed CZK 200,000 (approx. EUR 8K)
- Incomplete or missing client identification — missing document copies, unverified UBO
- No sanctions list screening — especially in the non-financial sector
- Failure to report a suspicious transaction — the most serious violation, can lead to fines in the millions
The level of fines depends on the severity of the breach. Failure to carry out client identification or due diligence may result in a fine of up to CZK 10,000,000, and a missing internal policies system in a fine of up to CZK 1,000,000. For serious or repeated violations, fines can reach up to CZK 30,000,000, for financial institutions up to CZK 130,000,000, and the FIU may also impose a ban on activity. In extreme cases, criminal liability under the Criminal Code applies for negligent legalisation of proceeds of crime.
The FIU regularly publishes decisions on administrative offences on its website. Public disclosure of a fine carries reputational consequences — particularly for lawyers, notaries, and accountants whose client relationships are built on trust. FIU decisions are publicly searchable and may affect relationships with banks and business partners.
How to prepare for an FIU inspection?
Preparing for an FIU inspection is not a one-off task but a continuous process. Here are 5 steps to help you be ready at any time:
- Update your internal policies and risk assessment — at least annually and with every change to your business model
- Conduct an internal audit — review a random sample of clients and verify you have complete records
- Real-time screening — one-off screening at onboarding is not enough; screen clients continuously
- Train employees and persons in a comparable position — at least once a year, document attendance and training content
- Centralise documentation — keep everything in one place, traceable and well-organised
How AML PROOF helps with preparation?
AML PROOF is designed so you're ready for an FIU inspection at any time:
- Internal policies and risk assessment — automatically generated for your industry, always up to date
- Complete client identification and control records — client identification, UBO verification, risk assessment in one place
- Real-time screening — connected to EU, UN sanctions lists and PEP registers
- Central archive — all documentation in one place for the legally required period
When the FIU inspection comes, just open AML PROOF and present everything. No searching through binders, no stress.
Conclusion
An FIU inspection is not a question of 'if' but 'when'. The better prepared you are, the smoother the inspection will be. Quality internal AML processes are not just protection against fines — they're proof that you run your business responsibly.
Don't wait for the inspection. Start with AML PROOF today and keep everything under control.
Obliged entities are legally required to retain records of client identification and due diligence for a minimum of 10 years after the end of the business relationship or completion of the transaction. AML PROOF ensures automatic archiving of all records with a full audit trail ready for immediate presentation during an FIU inspection — no searching through binders or folders.