AML in the Company: Duties, Penalties, and Step-by-Step Implementation

Introduction

This article discusses practical AML compliance obligations under the Act on Counteracting Money Laundering and the Financing of Terrorism: who they apply to, how to implement an AML process in an organization, and what penalties may apply if a company fails to act.

5 key takeaways

1. AML is a process, not a document. Buying a template procedure and saving it to a drive does not protect your company. The regulator cares about how your team applies procedures in day-to-day work.
2. A Risk-Based Approach controls costs. Match the scope of verification to the actual level of risk. Do not copy bank procedures if your business does not need them.
3. Identifying the beneficial owner (UBO) is an area of high fines. Bank Ochrony Środowiska (BOŚ) paid PLN 1.2 million for errors in identifying its clients’ UBOs. Complex ownership structures require in-depth analysis.
4. Sanctions lists have changed the importance of AML procedures since 2022. Unknowingly doing business with a sanctioned entity may mean frozen funds, criminal liability, and loss of banking relationships.
5. The management board is responsible for AML. Appointing a compliance officer does not remove the board’s duty to supervise. Administrative and criminal penalties can apply to decision-makers.

Good practices and key takeaways

The training highlighted recurring mistakes in how companies approach AML and specific mechanisms for eliminating them. Below are the key areas requiring the attention of management boards and compliance officers.

Making AML operational: from a document to a daily process

The most common problem we encounter in advisory work is treating AML as a one-off documentation project. A company buys a ready-made procedure template, saves it to a drive, and considers the matter closed. During an inspection, however, GIIF (the General Inspector of Financial Information) does not ask whether you have a document. It asks how your team verifies counterparties, who decides to hold a transaction, and how quickly you report suspicious operations.

AML is a continuous operational process consisting of specific steps: enterprise risk assessment, customer risk assessment, applying customer due diligence measures, monitoring business relationships, and reporting to GIIF in cases of suspicious transactions. Each step requires documentation, an accountable person, and a control mechanism.

“A company buys some document templates, or perhaps someone prepares them for the company. Then the documents get put away in a drawer or saved to a drive. The person thinks the company has AML in place and is meeting all its obligations. Nothing could be further from the truth, because AML is a whole process that must be carried out virtually every day of business.”
Speaker, AML Training / Sawaryn & Partners Law Firm

What this means in practice for your company:

• The internal procedure must be a living document. Turn the legal document into simple team instructions. One A4 page, concrete steps, no jargon. If a salesperson does not know what to do with a new client within 30 seconds, the procedure is poorly designed.
• Training must be recurring. Every new employee goes through AML onboarding. Existing employees receive periodic training. This is not optional; it is a statutory obligation.
• Documentation must be up to date. A customer risk assessment should be recorded, dated, and available in case of an inspection. If you performed the assessment but did not document it, as far as the regulator is concerned, it does not exist.

Risk-Based Approach: not every client needs bank-level verification

The Risk-Based Approach means the customer due diligence measures you apply should match the actual level of money-laundering risk. This key rule helps companies avoid two extremes: excessive bureaucracy (over-compliance) and insufficient verification.

In practice, the scale ranges from banks with advanced transaction-monitoring systems to virtual offices issuing an invoice for PLN 150 per month. Both entities must apply AML, but the scope of their obligations is fundamentally different.

Customer risk categories fall into four levels:

• Lower risk (simplified due diligence): entities from the EU, registered in the KRS, operating through a bank account, with a known identity.
• Normal risk (standard due diligence): ordinary counterparties with no risk factors that increase their risk level.
• Elevated risk (enhanced due diligence): clients from high-risk jurisdictions, complex ownership structures, transactions without a logical economic purpose, and PEPs (politically exposed persons).
• Unacceptable risk: entities on sanctions lists. Cooperation is categorically prohibited and a report to GIIF is required.

Decision rule: if you serve local Polish companies registered in the KRS with transparent ownership structures, use simplified due diligence. Reserve your resources for foreign clients, high-value transactions, and complex holding structures.

Beneficial owners and sanctions lists: two areas with the highest penalty risk

A beneficial owner (UBO, or Ultimate Beneficial Owner) is the natural person who ultimately controls an entity. In the simplest case, it is a shareholder of a Polish limited liability company who holds more than 25% of its shares. In practice, especially when advising companies involving foreign funds or holding companies, identifying the UBO can be a multi-level process requiring analysis of a chain of entities across several jurisdictions.

The risk is real. Bank Ochrony Środowiska received a fine of PLN 1.2 million for incorrectly applying the rules on identifying its clients’ beneficial owners.

“A few months ago, Bank Ochrony Środowiska received a fine of PLN 1.2 million precisely for incorrectly applying the rules on identifying its clients’ beneficial owners. As far as I checked, no appeal was filed, so the bank accepted the decision, colloquially speaking, and apparently had to pay the PLN 1.2 million.”
Speaker, AML Training / Sawaryn & Partners Law Firm

Verification tools worth using:

• In Poland, the Central Register of Beneficial Owners (CRBR) lets you quickly check the beneficial owners reported for Polish companies.
• Foreign registers operate in most EU countries and in some U.S. states.
• The Basel AML Index can help assess money-laundering risk associated with a counterparty’s country of origin.

Since February 2022, following Russia’s invasion of Ukraine, sanctions-list screening has added another dimension to AML rules. Doing business with a sanctioned entity, even unknowingly, carries a risk of freezing company funds, losing relationships with banks and payment providers, criminal liability for decision-makers, and reputational damage.

If your company operates in foreign markets, expands across borders, or serves clients with complex ownership structures, automated counterparty screening against sanctions lists (OFAC, EU, and UN lists) is essential. Lists change from day to day, so checks must take place before an agreement is signed and periodically throughout the relationship.

How to put these takeaways into practice in your company

Below are concrete implementation steps, ordered from the most urgent actions to recurring ones.

Step 1: Determine whether your company is an obliged entity

Obliged entities are not limited to banks. The list includes, among others, financial-sector companies (including cryptocurrency businesses and fintechs), accounting firms, law firms, virtual offices, real-estate agents, car dealerships, art dealers, casinos, and gambling businesses. Even if your company does not fall into any of these categories, AML obligations apply if you accept cash payments above EUR 10,000, whether in a single transaction or in linked transactions.

If you run an IT law firm or software house with a financial-services component, a fintech, or an e-commerce platform that accepts crypto payments, verify your status.

Step 2: Conduct risk assessments at two levels

At the company level: assess how criminals could use your products, services, IT systems, or employees to launder money. Create a scoring scale and a list of red flags. Use the national risk assessment prepared by GIIF.

At the client level: assess risk factors for each counterparty: behavioral (does the client want to be identified?), geographic (country of origin and operation), product-related (which services do they use?), and channel-related (an anonymous online transaction versus an in-person meeting). Assign a risk category and choose appropriate customer due diligence measures.

Step 3: Add KYC to the client onboarding process

Client identification (the Know Your Customer process) should take place before cooperation begins. It includes:

• Collecting an individual’s identifying details: first and last name, PESEL number, document series and number, and place of birth and residence.
• For a company: identifying the entity (registered office, legal form, KRS, and NIP) and the person representing it.
• Verifying identity (verification transfer, selfie with an identity document, and screening against public registers and social media).
• Identifying the beneficial owner and checking PEP status.

Integrate these steps into your sales process and CRM. Verification must not block sales, but it must take place before you sign the contract.

Step 4: Define red flags and an escalation path

Develop a list of red flags specific to your industry. Universal signals include:

• The client insists on a large cash transaction.
• Frequent changes to the company name, CEO, or proxies.
• A transaction with no logical economic purpose.
• The client avoids identification or conceals information.
• A company registered a few days ago is entering a transaction worth millions.
• One transaction is split into many smaller ones without a reason.

Decide who in the company may hold a transaction, who informs the management board, and who reports to GIIF.

Step 5: Assign responsibility and plan a monitoring cycle

• Appoint a management board member responsible for AML by resolution.
• Appoint an AML analyst responsible for day-to-day process supervision.
• Plan recurring reviews: assess company risk every 2 years (more often if significant changes occur), provide periodic team training, and update the internal procedure.
• Implement an anonymous breach-reporting procedure linked to obligations under the Whistleblower Protection Act.

Step 6: Prepare for reporting obligations

Know the four situations that require a report to GIIF:

• A reportable transaction of EUR 15,000 or more: you carry out the transaction and report it within the specified time limit.
• Inability to apply customer due diligence measures: do not carry out the transaction and report it.
• Suspicion of money laundering or terrorist financing (Article 74): do not carry out the transaction and report it.
• Reasonable suspicion of money laundering or terrorist financing (Article 86): do not carry out the transaction and report it.

An AML system that protects your company without blocking operations

Legal support for companies on AML is not a one-off exercise in preparing documentation. It means designing a system that works in the background: reducing the risk of sanctions and personal liability for the management board without paralyzing sales and client onboarding.

Increasing GIIF activity, a changing sanctions landscape, and increasingly complex counterparty ownership structures mean companies need an operational approach, not another document for a binder. This is particularly true for technology companies, fintechs, e-commerce platforms, and businesses expanding internationally, where the pace and complexity of business relationships require efficient compliance processes.

If you are unsure whether your AML procedure actually works in your organization, or need help implementing an AML system tailored to your industry, contact our team.