Post-licensing obligations in 2026: AML, Travel Rule, DORA, reporting, audit
A CASP authorization in Slovakia creates an ongoing supervised business. The firm must maintain compliance, not simply preserve a certificate. In 2026, the operational burden is shaped by four pillars: AML/CFT, TFR Travel Rule, DORA, and tax / data reporting readiness, including DAC8.
AML/CFT and suspicious transaction reporting
CASPs should maintain a risk-based AML framework covering onboarding, KYB, UBO verification, sanctions and PEP screening, transaction monitoring, escalation, and suspicious transaction reporting to the competent FIU where required. Recordkeeping periods should be checked against the applicable Slovak legal requirements, but firms should generally plan for long-form auditability rather than minimum-only retention.
One practical trend in 2026 is the increasing use of blockchain analytics not only for onboarding but for ongoing behavioral monitoring. Regulators expect firms to understand exposure to sanctioned wallets, mixers, darknet-linked flows, and typologies that may not be visible through fiat-side monitoring alone.
Travel Rule operations under TFR
Since 30 December 2024, the Travel Rule under Regulation (EU) 2023/1113 requires CASPs to collect, verify where applicable, and transmit originator and beneficiary information for in-scope transfers. This is an operational workflow, not a checkbox. Firms need data fields, screening logic, counterparty handling, exception management, and procedures for transfers involving unhosted wallets.
In practice, many firms use interoperability standards such as IVMS101 and connect to specialist Travel Rule networks. The legal point is simple: if your transfer flow is not technically able to exchange required information with counterparties, your compliance model is incomplete.
DORA operational resilience and incident reporting
DORA requires governance over ICT risk, not just technical controls. CASPs should maintain an ICT risk framework, incident classification and escalation logic, resilience testing, backup and recovery capability, and oversight of third-party ICT providers. Boards and senior management should be able to evidence oversight, not merely delegate everything to IT vendors.
DAC8 and tax-reporting readiness from 2026
DAC8 makes customer and transaction data architecture a board-level issue. If residency data, wallet identifiers, transfer metadata, and transaction categories are not captured cleanly at onboarding and execution stage, later reporting becomes expensive and error-prone. The best time to solve DAC8 is before launch, not after supervisory questions begin.
For broader operational preparation, founders often combine this page with Cryptocurrency Taxation in Slovakia and Accounting Services in Slovakia.