The Czech Republic has recently implemented new regulations for crypto-asset service providers, marking a significant step in aligning its legal framework with European Union standards. The Act on Digitalisation of the Financial Market (ZDFT), effective as of 15 February 2025, introduces comprehensive rules for the rapidly evolving digital finance sector. This article delves into the main features of the new law, its practical implications, and the specifics of the Czech regulation in the area of digital finance and crypto-assets.
Key regulatory changes
The ZDFT responds to the challenges associated with the application of key European regulations, namely:
- Digital Operational Resilience Act (DORA): Regulation (EU) 2022/2554 focuses on enhancing the digital operational resilience of the financial sector.
- Markets in Crypto-Assets Regulation (MiCA): Regulation (EU) 2023/1114 establishes a harmonised legal framework for crypto-asset providers across the EU.
These regulations aim to foster stability and security in digital financial transactions, and the ZDFT serves as the foundation for their application within the Czech Republic.
MiCA and the scope of regulation
MiCA introduces strict requirements for crypto-asset service providers operating within the EU. It categorises crypto-assets into three main types:
- Asset-Referenced Tokens (ARTs): Crypto-assets pegged to a basket of assets to maintain stability.
- E-Money Tokens (EMTs): Tokens serving as digital alternatives to traditional fiat currencies.
- Other Crypto-Assets: A broad category that includes most non-fungible tokens (NFTs) and utility tokens.
Under MiCA, service providers dealing with these assets must comply with stringent transparency and disclosure obligations. This includes preparing detailed business plans outlining technical features, risks and investor rights.
The role of the Czech National Bank
The Czech National Bank (CNB) assumes a central role as the primary regulatory authority under both DORA and MiCA. The CNB is responsible for overseeing compliance with the new rules and supervising crypto-asset service providers and other digital finance entities.
The key powers and responsibilities of the CNB include:
- Supervision and oversight: Monitoring compliance with DORA and MiCA regulations.
- Incident reporting: Receiving reports of incidents under DORA, as the Czech Republic has opted not to establish separate Computer Security Incident Response (CSIRT) teams.
- Interim measures: Imposing specific interim measures to prevent market abuse, including the ability to order the freezing of assets or funds in sanction proceedings.
- Enforcement fines: Levying enforcement fines for non-compliance with corrective measures, up to approximately EUR 200,000 (CZK 5 million) per fine, with an aggregate limit of approximately EUR 800,000 (CZK 20 million).
- Maintenance of registers: Maintaining informative registers of white papers, stablecoin issuers and crypto-asset service providers.
- Sanctions for offences: Imposing sanctions for violations of DORA, MiCA and the ZDFT.
Licensing and fees
As of 15 February 2025, entities providing crypto-related services in the Czech Republic are subject to specific licensing requirements, while the CNB oversees the licensing process. The following fees are imposed for applications (no additional fees are required as of now):
- Crypto-asset service providers (CASPs): CZK 20,000 (approx. EUR 800)
- Issuers of asset-linked tokens (ARTs and EMTs): CZK 50,000 (approx. EUR 2,000)
- Application for a licence to provide virtual asset services (VASP): CZK 10,000 (approx. EUR 400)
Licensing requirements for crypto-asset service providers
Entities seeking authorisation as Crypto-Asset Service Providers (CASPs) must submit a detailed application to the CNB, including:
- A business plan detailing the types of crypto-asset services to be offered, target markets and marketing strategies.
- Proof of compliance with prudential safeguards under MiCA Article 67.
- Governance structure documentation, demonstrating sound internal controls.
- Financial stability evidence, proving that management has the required knowledge, expertise and integrity.
- Risk management frameworks, ensuring compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
- ICT security documentation, outlining cybersecurity protocols as required by the Digital Operational Resilience Act (DORA).
These stringent requirements aim to ensure that only well-prepared and financially stable entities enter the market, protecting both investors and the broader financial system.
Penalties for non-compliance
The ZDFT prescribes a range of penalties for offences related to DORA and MiCA violations. While the Czech Republic has not opted for criminal sanctions, the financial penalties can be significant.
- DORA violations: Maximum fine of approximately EUR 2 million (CZK 50 million) for breaches related to risk management, business continuity, notification obligations and digital resilience testing.
- MiCA violations:
- Natural persons: Maximum penalty of approximately EUR 4,700,000 (CZK 118,475,000) or three times the amount of the undue benefit.
- Legal persons: Maximum penalty of approximately EUR 14,100,000 (CZK 355,425,000), 15% of total annual turnover, or three times the amount of the undue benefit.
Specifics of crypto-asset services
The ZDFT specifies the application of MiCA requirements within the Czech legal framework, linking it to existing laws such as the Payment Transactions Act and the Insolvency Act. Service providers must periodically inform the CNB of relevant information, including submitting officially audited financial statements.
The Act also addresses the competence of service providers, requiring them to possess knowledge of crypto-asset regulations, the ability to explain the nature of crypto-assets and the capacity to provide appropriate recommendations.
Conclusion
The implementation of the Act on Digitalisation of the Financial Market in the Czech Republic represents a decisive move towards regulated digital finance. As of 15 February 2025, entities providing crypto-related services must now navigate the licensing requirements, including the new CASP licence, and ensure compliance with stricter operational and cybersecurity standards. While the Czech Republic has opted for financial penalties rather than criminal sanctions, the potential fines for non-compliance, reaching millions of euros, underscore the importance of adhering to the new regulations. Service providers must prioritise preparing comprehensive documentation, strengthening internal controls, and ensuring their staff possess the necessary expertise to navigate this evolving regulatory landscape. The Czech Republic's approach, while adhering to EU standards, also emphasises a practical perspective, ensuring that even smaller entities can comply with the new requirements.
By Lukas Tomanek, Senior Associate, JSK, PONTES
