Sawaryn & Partners
Five key takeaways
- KYC is an ongoing process, not a one-time task. Any change involving a client, such as a change in ownership structure, market, or beneficial owner, requires you to update the data and verify the client again.
- Transaction thresholds trigger full AML duties. The thresholds are EUR 15,000 for general transactions and EUR 1,000 for crypto-assets and money transfers. Exceeding a threshold triggers an immediate obligation.
- Risk assessment and customer due diligence measures work in parallel. Separating these processes inside the organization leads to duplicated work and delays in onboarding.
- The set of customer due diligence measures has several parts. Client identification, beneficial-owner checks, ownership structure, sanctions lists, PEP status, and transaction monitoring form one coherent system.
- The management board is personally responsible for gaps in the AML system. GIIF does not ask whether you have a policy. It asks whether your team can show how the system works in practice.
How KYC and customer due diligence measures work
KYC and customer due diligence measures are the foundation of the AML system in every obliged entity. Below, we break them down into concrete elements you need to know and implement.
Customer due diligence measures: what exactly do they include?
Customer due diligence measures are a set of actions an obliged entity must apply to clients and prospective clients. They include:
- Identifying the client and verifying their identity. Establish who the client is: name, PESEL number, and address for an individual; or name, registered office, NIP number, and nature of business for a company.
- Identifying the beneficial owner and verifying their identity. Check who actually controls the entity you work with.
- Establishing the ownership structure. This applies to clients that are companies, foundations, and other entities with a complex capital structure.
- Assessing the business relationship. Determine the purpose of the cooperation, its intended nature, and its business context.
- Ongoing monitoring of the business relationship. Analyze the client’s transactions, investigate the source of the client’s assets, and update the data.
- Identifying an authorized representative. Verify the identity and authority of a person acting on the client’s behalf.
If your company operates in financial services, payments, or crypto, each of these elements must be reflected in a real operational process. Legal support for companies in this area means translating these requirements into concrete procedures and instructions for the team.
When must you apply customer due diligence measures?
The rules identify specific events that trigger the obligation:
- A new contract. Establishing a business relationship with a new client, for example by signing an agreement.
- A change involving an existing client. A change in the client’s business, market, beneficial owners, or ownership structure.
- An occasional transaction at or above the threshold. A one-off transaction worth EUR 15,000 or more, or several linked operations. The threshold for money transfers and virtual currencies is EUR 1,000. For cash transactions, it is EUR 10,000.
- Suspected money laundering or terrorist financing. This applies regardless of the amount if doubts arise about whether the client’s information is true.
The key rule is: do not wait for a GIIF inspection. If your business is scaling and transaction volumes are growing, your AML processes must keep pace. Every day of delay creates risk.
“Data monitoring should always be an ongoing process, and every change should be documented and added to the client’s file.”
Presenter, AML Training, Sawaryn & Partners
Risk assessment and customer due diligence: one process, not two
This is one of the most common organizational mistakes. Companies split client risk assessment and the application of customer due diligence measures between different teams or stages. The result is duplicated work, longer onboarding, and frustration for both sales and compliance.
In practice, these processes must operate in parallel. Data gathered when identifying a client feeds into the risk assessment. The risk-assessment result determines how deeply you verify the counterparty and whether you apply simplified or enhanced measures.
“Risk assessment is usually carried out in parallel with customer due diligence measures. Some of the information gathered when identifying a client can support a more accurate risk assessment, and that more accurate assessment can help determine the appropriate due diligence measures.”
Presenter, AML Training, Sawaryn & Partners
If you work in IT, fintech, or crypto, time matters. An IT law firm that understands your operating model can design one coherent process instead of two parallel tracks. Legal support for companies in the AML context is not about producing documents for a binder. It is about building a mechanism that works in the background without blocking sales.
How to put these rules into practice
Knowing about customer due diligence measures and KYC is only the starting point. Here are concrete steps you can take to make your AML system work operationally.
Step 1: Map the events that trigger AML duties in your company.
Identify which operations regularly approach the transaction thresholds (EUR 15,000 and EUR 1,000 for crypto-assets). Define which changes involving clients should automatically trigger a new verification: a change of beneficial owner, a new market, or a change in the business profile.
Step 2: Combine risk assessment and customer due diligence in one process.
Design a decision tree: collect data, assess risk, and adjust the depth of verification. For simple structures, the team can verify the client using a checklist. For complex holdings and multi-level ownership structures, send the matter to legal counsel with a clear brief.
Step 3: Give the operations team simple rules instead of a 50-page policy.
An effective KYC procedure sets out decision rules: if the client is from a higher-risk country, require additional documents; if a transaction exceeds a threshold, trigger enhanced verification; if the beneficial owner changes, update the risk profile.
Step 4: Add an information clause to B2B agreements.
Require the counterparty to notify you about changes in ownership structure, business profile, and PEP status. This does not paralyze the relationship and gives your AML system access to current information.
Step 5: Schedule regular reviews and updates.
AML procedures must evolve with the organization. Regularly updating the risk assessment, reviewing KYC procedures, and training the team are not formalities. They are requirements GIIF checks first.
If you plan to expand abroad, remember: new markets, jurisdictions, and clients mean the whole AML system needs updating. Customer due diligence measures must be proportionate to the scale and nature of your business. IT agreements and contracts with international partners require you to account for additional regulatory requirements.
An AML system that grows with your business
Customer due diligence measures and KYC are not a project to close and forget. They are a system that must operate continuously, scale with the organization, and withstand a GIIF inspection.
Technology companies, fintechs, and crypto platforms grow quickly. Regulatory debt grows with them. The longer you wait to address it, the higher the cost. A well-designed compliance system works like an early-warning system: quietly in the background, without involving the board in every transaction, but with an immediate response when a real threat appears.
Sawaryn & Partners designs AML systems that meet the requirements of the Act and work operationally inside an organization. We combine regulatory knowledge with an understanding of how technology companies operate. Legal support for companies in AML means balancing legal requirements with the smooth running of your business processes.
Check whether your AML procedures are keeping pace with your growth. Contact us to discuss how to organize this area in your organization.
Watch the training
Watch the full training:
This video is currently unavailable.
