AML in a Polish Property Development Group: Which Companies Have Duties, and What Can the Bank Require?

The management board of a property development group asks: “are we subject to AML?”. There is no single answer — there are more than a dozen, one for each company in the structure. At the same time, there is another answer that you will not find in the legislation, but in the credit agreement: the bank has already decided that you must carry out verification.

Your company may not be an obliged entity within the meaning of the Act of 1 March 2018 on Counteracting Money Laundering, yet still be required to conduct documented checks on counterparties. This obligation arises from the agreement with the bank financing the development — not from legislation, but from a covenant. And it is often this second regime that proves more urgent, because the bank does not wait for a GIIF inspection — it demands evidence itself.

In this article, I will explain how to determine the status of each company in the group, how to distinguish between statutory and contractual obligations, and what to do to ensure that counterparty checks are documented — regardless of their legal basis.

Key terms before we continue

Before going into detail, it is worth clarifying several terms used later in the article.

Why AML status must be determined company by company

Corporate groups — particularly in the property development sector — consist of a dozen or sometimes several dozen entities with different functions. Project companies build developments and accept payments from buyers. The sales company acquires customers and conducts negotiations. The management company handles accounting for the entire holding group.

The management board naturally asks: “are we subject to AML as a group?”. There is only one answer: there is no collective AML status for a corporate group. The list of obliged entities in Article 2(1) of the AML Act is exhaustive and refers to activities actually performed by a specific entity — not to its ownership structure.

Three questions for each company

For each entity in the group, answer three questions:

1. What activities does this company actually perform?
2. Do any of these activities fall within the list in Article 2(1) of the AML Act?
3. Does the company accept cash payments exceeding the equivalent of 10 000 euro?

Record the outcome of this analysis in a document — it explains why some companies do not have, and are not required to have, AML procedures.

Where obliged entity status most commonly arises within a property development group

As a general rule, a developer that sells only units built in its own name and for its own account is not an obliged entity — it sells its own product and does not act as an intermediary. However, a company that sells units on behalf of project companies displays the characteristics of a real estate intermediary. Its classification depends on who is a party to the agreement with the buyer, who concludes reservation and property development agreements, and whether the sales company acts under a power of attorney.

The separate legal personality of companies within the group is relevant here. The sales company does not acquire legal title to the units merely by belonging to the holding group (AML Act — consolidated text in ISAP).

Important: the group-wide procedure under Article 51 of the AML Act does not allow all companies in a holding group to be covered by a single procedure. It applies only to obliged entities within the group, their branches and majority-owned subsidiaries in a third country. A separate set of documents must be prepared for each company subject to the Act — even if based on a common template (Ministry of Finance Notice No. 35 — group-wide AML/CFT procedures).

The second regime: when an AML obligation arises from an agreement with a bank

This is where a rarely discussed issue begins. Your company has been assessed and is not an obliged entity — yet the bank financing the development still demands evidence that you verify customers and counterparties.

Where this requirement comes from

The bank is itself an obliged entity. Articles 33–36 of the AML Act require it to identify and verify its customer, identify the beneficial owner and continuously monitor the relationship. If the bank cannot apply the required measures, the Act prohibits it from establishing a business relationship or requires it to terminate that relationship (AML Act — consolidated text in ISAP).

In addition, Article 70 of the Banking Law requires the bank to assess creditworthiness before concluding an agreement. Banks analyse registry data, financial statements and cash flows (PARP material — business financing).

These statutory obligations imposed on the bank provide a practical basis for imposing information and verification requirements on the borrower — in the form of covenants in the credit agreement.

What this means for your company

This distinction is fundamental. A company that verifies counterparties solely at the bank’s request does not become an obliged entity and should not claim that status. If an entity that is not an obliged entity declares itself to be one, it voluntarily assumes the full regime of obligations and liability — without any statutory basis.

Distinguish and name both regimes in your internal documents. State explicitly: “counterparty checks are conducted pursuant to the obligation set out in § X of credit agreement No. Y, not pursuant to the AML Act”.

Contact us if you need support in separating the two regimes and preparing the appropriate documentation.

Consequences of having no procedure or documentation — penalties and sanctions

Statutory penalties

Article 147 of the AML Act provides for a range of administrative penalties that may be imposed on obliged entities:

1. Publication of information about the infringement
2. Order to cease an activity
3. Withdrawal of a licence or permit
4. Disqualification from performing managerial duties — a penalty imposed on a specific natural person
5. Financial penalty

A decision of the Minister of Finance confirms the imposition of a PLN 50 000 penalty for multiple infringements: failure to appoint a responsible person (Article 8), failure to conduct a risk assessment (Article 27), failure to apply customer due diligence measures (Article 33), and failure to implement an internal procedure (Article 50) (Administrative penalty — Gov.pl).

The GIIF report for 2024 confirms the total value of penalties imposed by decisions issued that year: PLN 441 500 (31 decisions imposing financial penalties, 2 decisions ordering publication in the Public Information Bulletin) (GIIF annual report for 2024).

An audit by the Supreme Audit Office confirmed examples of penalties imposed in other proceedings: PLN 60 000 (failure to conduct a risk assessment and apply due diligence measures), PLN 1 500 (infringements concerning risk assessment, documentation and procedures) (Supreme Audit Office report — operation of the AML system).

Contractual sanctions

Failure to demonstrate to the financing bank that the counterparty verification process is operational may trigger sanctions under the credit agreement. The specific mechanisms depend on the wording of the agreement, but may effectively include suspending the next drawdown, terminating the agreement or accelerating repayment of the loan. The source of these sanctions is a private agreement — the relevant authority and procedure differ from those applicable to a GIIF inspection.

No audit trail = no verification

Article 49 of the AML Act requires applied customer due diligence measures to be documented. In its judgment of 22.05.2019 (II GSK 1905/17), the Supreme Administrative Court held that “it is not sufficient for a party to declare that it knows its counterparties well (…) and trusts them”. The Court emphasised that if the claimant had fulfilled its statutory obligations, “it would have had no difficulty demonstrating that fact”.

The conclusion is simple: an activity performed without leaving an audit trail is treated as an activity that was never performed during an inspection — both by GIIF and by a bank demanding evidence.

How to establish a counterparty verification process — scope, sources and evidence

One scope of data for the entire group

Even if the legal basis differs between companies (legislation vs. credit agreement), it is worth standardising the scope of verification. This prevents a situation in which each company checks something different and the results cannot be compared.

Sanctions screening — three mistakes that render it ineffective

Mistake 1: checking only the company name. A sanction may apply to a natural person — a representative, attorney-in-fact or beneficial owner. Screening limited to the entity will not detect this risk. Extend the scope of screening to the natural persons behind the counterparty.

Mistake 2: exact matching. The same surname may appear on lists in several transliterations from a non-Latin alphabet, with different spellings of first names and typographical errors. Searching for an exact string returns “no matches” — formally the check has been performed, but in practice it is merely superficial. Switch screening to fuzzy matching and require the report to show the spelling variants compared.

Mistake 3: a one-off check. Sanctions lists change without notice. Screening performed only once, when concluding an agreement with a regular counterparty, provides protection solely on the day it is carried out. Two months later, the counterparty is added to a list — without a rescreening schedule, no one will know. Set a rescreening frequency for long-term relationships.

The national sanctions list is published by the Ministry of the Interior and Administration in the Public Information Bulletin as an HTML table — with no guaranteed API or downloadable file (Sanctions list of the Ministry of the Interior and Administration — Gov.pl). EU sanctions are available through European Commission tools. Automated retrieval of the national list is possible, but requires HTML parsing with no guarantee that its structure will remain stable.

Risk assessment in two layers

1. Data layer (automated): registry data, sanctions screening results, links and CRBR status
2. Assessment layer (human decision): high-risk sector, consistency between the declared business activity and the transaction, and the counterparty’s cooperation with the verification process

Treat a counterparty’s refusal to cooperate with the verification process as an indicator of increased risk.

In its judgment of 10.08.2021 (V SA/Wa 2574/21), the Provincial Administrative Court stated that verification activities must be “proportionate to the nature and size of the obliged entity”. A smaller company within a property development group does not have to apply bank-level procedures — but it must have and document them.

Evidence of completion — what to retain

1. A verification report in an immutable format (PDF, system record) retained in the case file
2. A system log showing the date, scope of the check and the person who performed it
3. The counterparty’s declaration of PEP status — dated and signed
4. A discrepancy report — e.g. the person signing the agreement is not listed in the KRS as authorised to represent the entity

Retain the documentation for 5 years from the end of the relationship or completion of the transaction (Article 49(1) of the AML Act). GIIF may require it to be retained for longer — but only by financial obliged entities.

Sanctions lists and entities that are not obliged entities

There is another issue worth bearing in mind: the obligation to comply with the national sanctions list under the Act of 13 April 2022 on Special Measures to Counteract Support for Aggression against Ukraine applies to a broad range of entities — including those that are not obliged entities (Act of 13 April 2022 — ELI).

EU sanctions lists (Council Regulations (EC) 765/2006 and (EU) 269/2014) apply directly — without implementation into national law.

Lists maintained by third countries and international organisations are not directly binding on Polish businesses, but they are relevant to relationships with banks and foreign counterparties.

The conclusion: even if your company is not an obliged entity and its credit agreement contains no covenants — sanctions lists still apply to you.

GDPR in the counterparty verification process

Collecting data concerning counterparties, their representatives and beneficial owners constitutes the processing of personal data within the meaning of the GDPR. Verify three elements:

1. Legal basis for processing. If your company is an obliged entity — Article 6(1)(c) GDPR (legal obligation). If you conduct verification under an agreement with a bank — Article 6(1)(f) GDPR (legitimate interest) requires additional analysis (GDPR — Polish text on EUR-Lex).
2. Scope of data. The data minimisation principle (Article 5(1)(c) GDPR) limits the information collected to what is necessary. PEP status is not a special category of data under Article 9 GDPR, but verification may involve sensitive data — in which case you need an additional basis under Article 9(2).
3. Retention period. 5 years from the end of the relationship (Article 49 of the AML Act) — but only if you are an obliged entity. For a contractual obligation, determine the retention period based on the agreement with the bank and the GDPR accountability principle.

What will change on 10 July 2027

Regulation (EU) 2024/1624 (AMLR) will generally apply from 10 July 2027. Article 80(1) AMLR establishes an EU cash payment limit of EUR 10 000 for persons trading in goods or providing services, covering a single transaction or several linked transactions. Member States may maintain or introduce lower national limits (Regulation (EU) 2024/1624 — EUR-Lex).

The list of obliged entities in Article 3 AMLR includes real estate intermediaries and entities performing certain real estate activities on behalf of a customer.

Until 10 July 2027, the Polish AML Act and the national list of obliged entities continue to apply. However, documentation and procedures must be reviewed before that date — assign an owner and a review date to each procedure and policy, with the following milestone recorded: 10 July 2027.

The tool comes last, the process comes first

A common mistake is for a company to purchase a verification system first and only then consider what actually needs to be verified. This results in a tool configured for an undefined process and a procedure written around the system’s capabilities.

The correct order is:

1. Map the group company by company — determine each company’s status
2. Separate and name the two regimes (statutory vs. contractual)
3. Define the scope of data and verification sources
4. Design the process: who performs it, when, how it is documented and how often it is repeated
5. Only then select a tool that supports the process

The AML Act does not prescribe any mandatory software. The solution may be manual, semi-automated or commercial — provided that it ensures adequate controls and makes it possible to demonstrate that they have been performed.

Also remember: if one company in the group performs verification on behalf of the others (Article 47 of the AML Act), responsibility for the contractor’s errors remains with the company commissioning the work. Outsourcing customer due diligence measures to a third party does not transfer liability — it is limited to the first three measures under Article 34(1)(1)–(3) and does not include transaction analysis or periodic verification.

How we can help your company

AML mapping for a corporate group is a process that requires simultaneous expertise in company law, the AML Act, the sanctions regime and the specific characteristics of credit agreements. We combine these areas instead of dividing them into separate engagements.

Our support is available at three levels:

We do not purchase tools on behalf of clients or sell software. We design the process — and only then select a tool suited to the agreed scope.

Get in touch

Counterparty checks in a corporate group — where to start

AML obligations may arise from legislation or from an agreement with a bank. Both regimes require documented verification — but they have different sources, different sanctions and different supervisory bodies. Confusing them or combining them in a single document creates risks under both regimes.

Start with three steps:

1. Map the group company by company and record the outcome
2. Separate the statutory obligation from the contractual obligation in the documentation
3. Define one scope of verification and retain evidence that it has been completed

If you need support with group mapping, preparing procedures or designing a verification process to meet the financing bank’s requirements — get in touch.

Frequently asked questions

We have more than a dozen companies in the group — do I really need to conduct a separate analysis for each one?
Yes. The list of obliged entities in Article 2(1) of the AML Act refers to activities actually performed by a specific entity. Membership of a corporate group does not transfer status either up or down the structure. Record the outcome of the analysis in a document — it explains why some companies do not have procedures.

Our management company handles the accounting for all entities in the group. Is it an obliged entity?
If it provides accounting services — it may be. The provision of accounting services is expressly included in the list of obliged entities. Check whether the management company keeps the accounts under a separate agreement (even an intra-group agreement) and whether these activities correspond to the statutory definition.

The bank included an obligation to verify counterparties in our credit agreement. Does this make us an obliged entity?
No. The obligation arises from a private agreement, not from legislation. Your company should not claim obliged entity status if it does not have that status. State explicitly in your internal documents that verification is conducted pursuant to a contractual obligation.

What are the consequences of failing to fulfil an obligation arising solely from an agreement with a bank?
Contractual sanctions — depending on the wording of the agreement. In practice, these may include suspending a drawdown, terminating the agreement or accelerating repayment of the loan. This is a different route from an administrative penalty imposed by GIIF, but the financial consequences may be more severe.

How often should sanctions screening be repeated?
A one-off check provides protection solely on the day it is performed. Sanctions lists change without notice. Establish a rescreening schedule — the frequency should be based on the risk assessment and the nature of the relationship with the counterparty. For regular counterparties, periodic rescreening at defined intervals is the minimum standard.

Does collecting PEP status declarations breach the GDPR?
PEP status is not a special category of data under Article 9 GDPR. For an obliged entity, the legal basis for processing is Article 6(1)(c) GDPR (legal obligation). If you conduct verification under an agreement with a bank, analyse Article 6(1)(f) (legitimate interest). In both cases, apply the data minimisation principle — collect only the data necessary to perform the verification.