Whistleblowing Policy

Does an exchange office need an internal reporting system?

Yes. Act No. 171/2023 Coll., on Whistleblower Protection, requires an internal reporting system to be put in place not only by employers with 50 or more employees, but also by obliged entities under the AML Act – regardless of headcount. A bureau-de-change operator is an obliged entity under the AML Act, so this duty also applies to small exchange offices with just a few employees.

What must the internal reporting system include?

• reporting channels allowing reports to be made in writing and orally (and, at the whistleblower's request, in person);
• the designation of a competent person who receives and assesses reports – they must be impartial and maintain confidentiality;
• deadlines – acknowledging receipt of a report within 7 days and informing the whistleblower of the outcome as a rule within 30 days;
• protection of the whistleblower's identity and a prohibition of retaliation;
• informing employees and other eligible persons about how to report;
• records of reports and their retention.

What happens if you do not have a policy?

Failure to establish an internal reporting system, or its defective operation, is punishable by a fine of up to CZK 1,000,000. A missing whistleblowing framework is also a finding that comes up in compliance reviews and weakens the exchange office's position in dealings with banks.

How can we help?

• we will draft a tailor-made whistleblowing policy for your exchange office, linked to your internal AML policy;
• we will set up the reporting channels (e-mail, phone, in-person) and prepare information texts for your employees;
• we will provide the competent person function, including the option of outsourcing it to us;
• we will train the competent person and management and set up the records and deadlines.

Where to next?

• AML obligations of an exchange office
• Legal audit of an exchange office
• Duties of a bureau-de-change operator
• Preparing for a CNB inspection