In this episode of the AML training delivered by Sawaryn & Partners, we walk through customer due diligence measures step by step: from identifying a client and verifying the beneficial owner to monitoring transactions and deciding what to do when verification fails.
5 key takeaways
- Identity verification is not a formality. Collecting identifying details is not enough. Before starting a business relationship, you must confirm that the client is who they claim to be.
- Remote verification is legal and effective. A selfie with an identity document, a PLN 1 transfer, OSINT, and automated software are methods expressly permitted by AML regulations.
- Identifying the UBO takes more than a registry extract. The CRBR data may be outdated or incorrect. You must verify the information independently and document every step.
- Transaction monitoring is continuous, not a one-off check. Throughout the client relationship, look for unusual or excessively complex transactions, or transactions without an economic purpose.
- If verification is not possible, you must stop the relationship. If you cannot apply customer due diligence measures, you may not start or continue the business relationship.
How it works in practice: procedures, tools, and decisions
Identifying and verifying a client: what to check and how to document it
The first step in every KYC process is identifying the client. For an individual, check an identity card or passport and collect their first and last name, PESEL number, country of birth, citizenship, and NIP number if they operate a business. For legal entities, also verify the organizational form, registered address, NIP number, and details in the KRS.
Collecting data is only half the work. The other half is verification: confirming that the information is true and that the person is who they claim to be.
What verification methods are available to you?
- Presenting an identity document at an in-person meeting
- Connecting with the client online and viewing their document on video
- A selfie with an identity document (remote identity confirmation)
- A verification transfer of PLN 1 (confirming that the bank account is in the client’s name)
- Checking public registers: CEIDG, KRS, and foreign registers
- OSINT, meaning a review of publicly available sources: search engines, social media, and industry portals
- Specialist software for collecting and recording KYC data
“If we cannot meet in person, we can connect with the person online or ask them to send us a photo, a so-called selfie, with their identity document. (…) We can also use specialist software that helps collect and record data.”
Speaker, AML Training, Sawaryn & Partners
Importantly, identity verification must take place before a business relationship is established or an occasional transaction is carried out. Not afterwards. Not “within a week.” Before.
If your team collects data manually and enters it into Excel, you lose time and increase the risk of errors. Tools such as AMLtrack guide the team through each process step, automate data collection, and require every decision to be documented. With 50 clients, Excel sort of works. With 500, the procedure exists only on paper.
Beneficial owner (UBO) and transaction monitoring: two areas where companies make the most mistakes
Identifying the UBO
A beneficial owner (UBO) is a natural person who controls a client directly or indirectly through shares, voting rights, personal connections, or other mechanisms that provide real influence. Identifying the UBO is mandatory for every relationship with a client that is not a natural person: a company, foundation, or association.
An entry in the CRBR (Central Register of Beneficial Owners) alone is not enough. Register data may be outdated, incomplete, or incorrect. You must:
- Compare CRBR data with the KRS extract and the company’s articles of association
- Check whether the ownership structure has multiple levels
- Consult foreign registers if the client is an entity from another country
- Ask the client directly about the control structure if the documents do not give a clear picture
- Document every verification step
GIIF checks not only whether you identified the UBO but whether you can show how you reached that conclusion. No decision trail is a problem even when the result itself is correct. If your KYC process ends with downloading a registry extract, you still have several steps to complete.
Monitoring business relationships
Transaction monitoring is not a one-time onboarding task. It is an ongoing process that continues throughout the client relationship. In practice, this means paying attention to specific signals:
- Is a transaction unusual or atypical for this client’s profile?
- Does the transaction make economic sense, and is the service appropriate for the price?
- Has the transaction been artificially divided into several smaller ones (so-called structuring)?
- Does the client insist on cash transactions without financial documentation?
- Does anything about the transaction raise your suspicions?
“The main point is for obliged entities to look for transactions that are unusual, excessively complex, or seem to have no clear economic purpose.”
Speaker, AML Training, Sawaryn & Partners
None of these signals alone means a violation has occurred. But each requires a response: ask the client for an explanation, document the answer, and decide whether the risk profile has changed. If your monitoring relies only on monetary thresholds, you miss most situations that genuinely need attention.
Enhanced (EDD) and simplified (SDD) due diligence, and the hard-stop rule
Three levels of due diligence
AML regulations provide for different verification approaches depending on the level of risk:
Simplified due diligence (SDD) applies when AML risk is low. Examples include public-sector finance entities, listed companies, residents of EU countries with low corruption levels, and clients whose transactions are conducted exclusively through bank accounts.
Standard due diligence applies to most clients. It includes identification, identity verification, identifying the UBO, and assessing the purpose of the business relationship.
Enhanced due diligence (EDD) applies when risk is elevated. Situations requiring EDD include:
- The client is a PEP (politically exposed person)
- The client operates in a higher-risk industry (fuel, tobacco, gambling, cryptocurrency, or consulting)
- The client has a complex structure that makes it difficult to identify the UBO
- The client uses services that facilitate anonymity
- Transactions take place without the client’s physical presence and without a qualified signature
- The client comes from a high-risk country or is subject to sanctions
Applying EDD to every client is one of the most common mistakes. Onboarding takes a week, conversion drops, and the sales team bypasses the procedure. Your procedure should include a risk matrix that clearly defines who receives each level of due diligence.
The hard-stop rule
If you cannot apply customer due diligence measures because you cannot establish the client’s full details or beneficial-owner details, or because the client refuses to provide required information, there is only one solution: refuse the transaction or end the relationship.
This is not a recommendation. It is a statutory obligation.
Set out a specific point in the procedure at which your team knows that further service is impossible. No escalation to the management board. No “let’s give them another week.” During an inspection, GIIF looks for such refusals. If it finds none, it will conclude that the procedure does not work.
When to apply the hard stop:
- The client has not confirmed their identity by the deadline
- You were unable to identify the beneficial owner
- The client refuses to disclose the source of funds for a higher-risk transaction
- Information in the documents is inconsistent and the client does not explain the discrepancies
How to implement these rules in your company
Step 1: Review your current AML procedure. Open it. Check the date it was last updated. Find the section that says “refusal” or “termination.” If it is missing, you have a gap to close.
Step 2: Assign responsibilities to specific people. Who verifies the client? Who approves a higher-risk transaction? Who conducts a quarterly review? Without assigned responsibility, the procedure is just a document.
Step 3: Build a risk matrix. Define which client categories receive SDD, which receive standard due diligence, and which receive EDD. Match the scope of verification to the risk level instead of applying the maximum to everyone.
Step 4: Set remote verification methods and describe them in the procedure. Selfie with an identity document, verification transfer, OSINT. Decide which methods you accept and give the team clear instructions.
Step 5: Implement a tool that enforces the sequence of steps. Do not rely on the team’s memory. Tools such as AMLtrack guide users through the process step by step, automate repetitive tasks, and document every decision.
Step 6: Start documenting. Every decision, every refusal, every review. The format does not matter. The decision trail does. GIIF does not ask whether you have a procedure. It asks whether you can prove that you follow it.
An AML procedure works only if you can prove that you follow it
Providing legal support to companies subject to AML obligations requires combining regulatory knowledge with a practical approach to processes. Legal support for companies in financial services, fintech, and e-commerce now means not only preparing documents but designing a system that works as the business scales.
An AML procedure sitting in a folder with a modification date from three years ago is not protection. It is evidence that you knew what to do and did not do it. A well-designed AML system organizes decisions, automates repetitive tasks, and gives the management board control over risk without slowing onboarding and client relationships.
If you plan to grow your client base, enter new markets, or organize compliance processes before a GIIF inspection, start by reviewing what you have. Often, all that is needed is to change the order of steps, add one automation tool, and set clear decision rules.
Contact us to organize your KYC process, implement transaction monitoring, and prepare procedures ready for a GIIF inspection.
Watch the training
Watch the full episode of the AML training:
This video is currently unavailable.
