KYC & AML Compliance in Slovakia (2026): What Payment and Fintech Teams Need to Build

Slovak payment and fintech teams need a customer file that connects identity evidence, risk rationale, review decisions, monitoring, and escalation.

For: Payment institutions, e-money teams, and cross-border fintech operators Focus: Customer due diligence, remote onboarding, case continuity As of: 28 July 2026 · 5 min read

The operating answer

A Slovak payment or fintech business needs to establish its regulatory perimeter, apply risk-based customer due diligence, identify beneficial owners where relevant, monitor the relationship, and preserve an explainable case record. The operational challenge is making those controls work as one workflow rather than as separate document, screening, and review tasks.

VOVE ID helps payment and fintech teams keep identity evidence, screening context, exceptions, and reviewer actions connected. The recurring gap: a team can show that a document was collected but cannot reconstruct why a customer was accepted, escalated, or kept under review — and that gap is usually where a Slovak regulator's questions start.

Establish the Slovak perimeter

Národná banka Slovenska (NBS) states that Slovak payment institutions operate under authorization to provide payment services and are supervised by NBS. Its payment-services guidance also makes clear that payment institutions must comply with AML/CFT and consumer-protection rules alongside prudential requirements. NBS's payment-institution overview is the practical starting point for a team checking its perimeter.

For AML/CFT, the core Slovak statute is Act No. 297/2008 Coll. on protection against money laundering and terrorist financing. NBS directs supervised payment firms to the national risk assessment, international-sanctions material, the Police Force Financial Intelligence Unit's guidance, and EBA materials.

Licensing, onboarding, and AML operations cannot be designed as separate projects. Teams need to establish the exact activities they perform, their applicable obligations, and the evidence required for each decision.

For the underlying identity-control model, see our KYC requirements framework.

Build the decision record

An onboarding flow needs more than a completed identity check. It needs enough evidence to identify the customer, understand the intended relationship, apply the team's risk model, and explain exceptions.

For business relationships, that file should connect the entity, authorized representative, beneficial ownership where relevant, expected use, supporting evidence, screening result, risk rationale, and accountable decision owner. A separate document folder and a separate reviewer inbox do not form an auditable customer file.

Remote onboarding needs a defined assurance standard. The EBA's remote customer-onboarding guidelines set common EU expectations for risk-sensitive initial CDD and for assessing the adequacy and reliability of remote-onboarding tools.

For the broader entity- and beneficial-ownership model, see our KYB requirements framework.

Case note: a clean document, an incomplete case

A Bratislava payment startup onboards a small logistics business that will receive international marketplace payouts. The customer submits a company extract and incorporation evidence, an identity document for the director, a short description of expected payment activity, and an ownership declaration.

Then the inconsistencies appear. The director's authority is not connected to the entity record in the case file; the declared owner is reviewed in a separate spreadsheet, and the expected activity is captured only in the sales workflow.

The identity check may pass, but the reviewer cannot see one coherent relationship. The account is approved, then reopened when payment activity differs from the sparse profile. This is not a document-verification failure. It is a collection and case-management failure.

Make exceptions an explicit route

VOVE ID supports identity verification, biometric liveness, face matching, AML screening, KYB, and transaction monitoring, and can help teams surface document-template inconsistencies, invalid MRZ checksums, barcode or QR inconsistencies, and image manipulation across a wide range of document types and countries.

The product does not determine a firm's regulatory status, risk appetite, or suspicious-reporting decision. It helps a compliance team organize evidence and route exceptions so the logic behind an approval is not lost after onboarding.

Turn approval into a managed loop

NBS's payment-services guidance points supervised firms to AML/CFT obligations and the Police Force Financial Intelligence Unit's methodological material. A team therefore needs written trigger logic for activity, ownership, documentation, or risk changes, plus an accountable internal escalation route.

In practice, monitoring starts with the original relationship profile. A new beneficiary pattern, a change in beneficial ownership, unexplained activity, or evidence that no longer supports the file should create a case with an owner and a decision deadline.

Teams should define when a concern becomes an internal escalation and how the applicable reporting process is handled. Do not treat a screening alert or a changed transaction pattern as a standalone ticket with no connection to the original customer decision.

For the broader screening, case-management, and escalation model, see our AML requirements framework.

Make the file retrievable

Identity and payment evidence is sensitive. Access, retention, vendor responsibilities, and auditability therefore need to be built into the workflow. The exact retention and privacy obligations depend on the firm's services and circumstances, so teams should confirm current requirements with qualified Slovak advisers.

The practical test is simple. Can a reviewer reconstruct what the team collected, why it accepted or escalated the customer, who approved an exception, and what changed afterwards? If the answer depends on searching email threads, the control is incomplete.

Field checklist

Governance

• Confirm the NBS authorization or registration perimeter before designing the flow.
• Map AML/CFT responsibilities, escalation owners, and outsourced steps.
• Validate policies against current Slovak law, NBS material, and FIU guidance.

Customer due diligence

• Connect identity, authority, ownership, relationship purpose, and risk evidence before approval.
• Define what automated results resolve and what requires manual review.
• Record the rationale for every exception and final decision.

Monitoring and reporting

• Define trigger events for activity, ownership, documentation, and risk changes.
• Compare observed activity with the relationship profile held in the case.
• Maintain a tested internal escalation and applicable reporting route.

Records and audit

• Retain source evidence, reviewer actions, and decisions together.
• Restrict sensitive case data by role.
• Test whether an independent reviewer can reconstruct a case quickly.

Questions teams ask before launch

Which authority supervises Slovak payment institutions?

NBS supervises payment institutions and issues or amends their authorizations under the Payment Services Act. The exact perimeter depends on the services the firm provides.

Does remote identity verification complete CDD?

No. It provides evidence for the customer file, but teams still need risk assessment, purpose and ownership handling where relevant, exception management, monitoring, and retrievable records.

What should trigger an onboarding escalation?

Examples include inconsistent identity or business evidence, unclear authority or ownership, an unexplained relationship purpose, or a concern that cannot be resolved within the firm's policy.

What should a team retain for auditability?

Retain the source evidence, risk assessment, screening and review actions, escalation record, and decision rationale in one access-controlled case record.

The operating position

Slovak KYC and AML compliance is not won at the document-collection stage. It is won by keeping licensing scope, identity evidence, beneficial ownership, and monitoring history inside one explainable case, so a reviewer never has to reconstruct a decision from separate tools.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.