The worst AML situation is not having no procedure. It is having a procedure that no one follows. Because then you cannot say that you were unaware of your obligations. You had them in black and white. You simply failed to meet them.
If your company accepts cash payments for high-value goods , vehicles, machinery, equipment , and implemented an AML procedure two years ago, but since then no one has monitored transactions, completed identification forms or reported to the GIIF, you have a problem. Not a theoretical one. A real one.
The Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (the AML Act) requires obliged institutions , including businesses accepting cash payments for goods worth at least EUR 10,000 , to report above-threshold transactions (over EUR 15,000) to the General Inspector of Financial Information (GIIF) within 7 days. A breach of this obligation may result in administrative penalties of up to the equivalent of EUR 5 million or 10% of turnover, while the person responsible for AML may face a fine of up to PLN 1,000,000.
In this article, I will show you how to check in five steps whether your AML system actually works before the GIIF does it for you.
Key terms you need to know
Before you begin the audit, make sure you understand the basic terms. Without them, you will not be able to determine whether your company has any outstanding compliance issues.
| Term | Meaning |
|---|---|
| Obliged institution | A company that is legally required under the AML Act to apply anti-money laundering procedures. Vehicle dealers, used-car dealerships and other businesses accepting cash for goods worth ≥ EUR 10,000 automatically fall into this category , even if such a transaction occurs only once a year. |
| Above-threshold transaction | A transaction (deposit, withdrawal or transfer) worth at least EUR 15,000 that must be reported to the GIIF within 7 days of being carried out. |
| Customer due diligence measures | A set of customer identification measures: establishing identity, checking PEP status (politically exposed person), screening against sanctions lists and identifying the beneficial owner. |
| GIIF | General Inspector of Financial Information , the supervisory authority that monitors compliance with AML regulations and receives transaction reports. |
| AMLRO | The person responsible for AML within a company (Anti-Money Laundering Reporting Officer). They must be formally appointed and have a clearly defined scope of responsibilities. |
| EUR 10,000 threshold | The value of an occasional cash transaction at which a trader in goods becomes an obliged institution and must apply customer due diligence measures. |
The three most common gaps after implementing AML
Most companies that come to us with an AML problem have a procedure in place. It is often even well written. The problem is that the procedure sits in a binder while cash transactions pass through the till without any documentation.
These are the three gaps we see most often:
No reports submitted to the GIIF
Cash transactions over EUR 15,000 were not reported. Sales staff did not know they were required to do so. The accounting department did not monitor payment amounts. No one checked whether the threshold had been exceeded.
Risk: an administrative penalty of up to the equivalent of EUR 5 million or 10% of annual turnover. Criminal liability under Article 156 of the AML Act , imprisonment from 3 months to 5 years for failing to submit a notification to the GIIF.
No designated person responsible for AML
The owner “appointed someone from the office,” but never defined their responsibilities. There is no document confirming the appointment. In the event of an inspection, it is unclear who is responsible for specific failings.
Article 154 of the AML Act allows a fine of up to PLN 1,000,000 to be imposed on the person who was responsible for fulfilling AML obligations at the time of the breach. If that person was not formally appointed, liability may fall on a management board member.
Failure to use identification forms (KYC)
The company has PEP forms and customer declarations, but sales staff do not complete them. The registers are empty. Sanctions screening has not been carried out. Beneficial owners have not been identified.
GIIF Announcement No. 31 explicitly identifies as unacceptable a situation in which an obliged institution has an AML procedure but fails to apply customer due diligence measures to customers carrying out transactions inconsistent with their established profile.
How to calculate the EUR 15,000 threshold , the aggregation trap
This is one of the most commonly misunderstood aspects of the AML Act. Many businesses assume that the threshold applies to a single payment. That is a mistake.
When aggregation is mandatory
Article 35 of the AML Act and Article 2(1)(21)-(23) explicitly state that the value of a transaction is calculated regardless of whether it is carried out as a single operation or as several operations that appear to be linked.
| Scenario | Whether aggregation applies | Legal basis |
|---|---|---|
| A customer pays for a vehicle in three cash instalments of EUR 6,000 each (EUR 18,000 in total) | Yes , customer due diligence measures | Article 35 of the AML Act |
| A customer buys two vehicles under a single agreement , total value EUR 20,000, paid in cash | Yes , reporting to the GIIF and customer due diligence measures | Articles 72 and 35 of the AML Act |
| A customer pays EUR 8,000 in cash and EUR 12,000 by bank transfer for one vehicle | Customer due diligence measures , yes (total value > EUR 15,000). Above-threshold reporting , no individual operation exceeds EUR 15,000 | Article 35 of the AML Act; gap in Article 72 |
| A customer buys three vehicles under three separate agreements, each below EUR 15,000, within one month | Strictly speaking, they are not subject to above-threshold reporting, but they may be treated as suspicious transactions | Article 74 of the AML Act |
Interpretative gap in Article 72
Article 72 of the AML Act , the provision governing the reporting of above-threshold transactions , does not explicitly include wording requiring linked operations to be aggregated. The Supreme Audit Office (NIK) identified this asymmetry as a source of interpretative uncertainty. There are no official GIIF guidelines clarifying whether individual payments for vehicles sold on an instalment basis must be aggregated for reporting purposes.
This means that the safer strategy is to use the total value of the agreement as the reference point , rather than the value of a single instalment.
Five steps to check whether your AML system works
Step 1: prepare a list of cash transactions
Review all cash transactions since the AML procedure was implemented. Identify those where the cash value may have exceeded the EUR 15,000 threshold , in aggregate within the business relationship with a given customer.
Do not limit your review to one-off payments. Check:
- Instalment payments for a single item
- Several transactions with the same customer over a short period
- Mixed payments (cash + bank transfer) where the total agreement value exceeds the threshold
Step 2: verify whether the required reports were submitted to the GIIF
Compare the list of above-threshold transactions with the register of reports submitted to the GIIF. If reports are missing, you have outstanding compliance issues.
Article 72(5) of the AML Act requires information about an above-threshold transaction to be submitted within 7 days of its completion. GIIF Announcement No. 15 specifies how this deadline is calculated.
If the deadline has passed, consult an AML lawyer on how to address the outstanding reports. Article 150(4) of the AML Act states that, when determining the penalty, the authority takes into account the obliged institution’s level of cooperation with the competent authorities. Voluntarily disclosing outstanding matters may be treated as a mitigating circumstance, although it does not guarantee that sanctions will be avoided.
Step 3: formally appoint a person responsible for AML
Check whether your company has an appointed AMLRO with a clearly defined scope of responsibilities. The appointment must be documented , by a management board resolution or another internal document.
According to the EBA Guidelines (EBA/GL/2022/05) and the position issued by the Polish Financial Supervision Authority (UKNF) on 1 December 2022, the AMLRO should:
- Have direct access to the management board on AML matters
- Have sufficient resources and authority to perform their duties
- Be responsible for reporting to the GIIF, monitoring transactions and updating the procedure
- Be trained in AML obligations
Step 4: remedy gaps in KYC documentation
Check whether the required customer due diligence measures were applied to cash-paying customers:
- Identification forms , customer details, identity document
- PEP declarations , whether the customer or a close associate holds a prominent public position
- Sanctions screening , whether the customer appears on EU, UN or national sanctions lists
- Beneficial owner identification , who actually controls the purchasing entity
If the forms were not completed, fill them in retrospectively wherever possible and implement a procedure for future use.
GIIF Announcement No. 22 of 7 April 2020 specifies what information should be included in the grounds for a report, including the customer’s business profile, declared transaction frequency and source of assets. This provides a practical benchmark for assessing whether your documentation is sufficient.
Step 5: update the AML procedure
The procedure must reflect how payments are actually accepted within your company. If any of the following have changed since implementation:
- Cash acceptance channels
- Sales structure (new branches, new product categories)
- Customer profile (more foreign customers, more cash transactions), the procedure needs to be updated.
Do not forget the procedure for anonymously reporting AML breaches (Article 53 of the AML Act). Failure to have this procedure constitutes a separate administrative offence (Article 147(10)). The reporting channel does not have to be separate from channels operating under other laws, but it must ensure anonymity.
Penalties for breaching AML obligations , how much it can cost
The cost of reviewing and bringing your AML compliance into order is low compared with the potential sanctions. Below is a summary of penalties that may affect your company and you personally.
| Type of sanction | Legal basis | Maximum penalty |
|---|---|---|
| Financial penalty for an obliged institution | Article 150(2) of the AML Act | Up to the equivalent of EUR 1 million (institutions in general) or up to EUR 5 million / 10% of turnover (financial institutions) |
| Financial penalty for the person responsible for AML (AMLRO) | Article 154 of the AML Act | Up to PLN 1,000,000 |
| Imprisonment | Article 156 of the AML Act | From 3 months to 5 years |
| Disqualification from holding managerial positions | Article 150(1)(5) of the AML Act | Up to 1 year |
| Publication of information about the breach in the Public Information Bulletin | Article 152(1) of the AML Act | Mandatory |
| Revocation of a licence or permit | Article 150(1)(3) of the AML Act | Indefinite |
Decisions issued by supervisory authorities to date indicate that penalties for specific breaches have ranged from PLN 2,500 to PLN 10,000 , but these concerned individual failings (lack of training, lack of risk assessment). Where above-threshold transactions have gone unreported for an extended period, the amounts may be many times higher.
In particularly justified cases involving breaches of negligible significance, the authority may waive the penalty (Article 150(5) of the AML Act). The degree of cooperation with the authority , including voluntary disclosure of outstanding matters , is one of the criteria considered when determining the penalty.
What will change in 2027 , new EU regulations
Regulation (EU) 2024/1624 (AMLR) will introduce an EU-wide cash payment limit of EUR 10,000 for purchases of goods and services from 10 July 2027. This means:
- Lowering the cash threshold from the current EUR 15,000 to EUR 10,000
- Introducing a EUR 3,000 threshold for customer identification obligations in occasional cash transactions
- An explicit requirement to aggregate “several operations that appear to be linked” , which may resolve the current interpretative gap in Article 72 of the AML Act
For companies in the automotive and high-value goods sectors, this means that the number of transactions subject to AML obligations will increase significantly. Bringing your AML system into order now , before the new regulations take effect , will help you avoid doing the work twice.
Contact us if you would like to find out how the new EU regulations will affect your company.
How we can help you
Not sure whether your cash transactions should have been reported to the GIIF? Unsure whether the person appointed as AMLRO knows what to do? Are your registers empty and your KYC forms still blank?
We combine AML legal advice with AMLtrack, a tool that guides your team through the process step by step , from customer identification and risk assessment to reporting.
Our support covers three areas:
- Audit and risk map. We analyse your cash transactions, compare them against the register of reports submitted to the GIIF, identify outstanding matters and assess their scale. We check whether the AMLRO has been formally appointed, whether KYC forms have been used and whether the procedure reflects your actual sales model.
- AML system implementation. We update the procedure, prepare overdue reports for the GIIF (where appropriate), and implement forms and registers tailored to your industry. We train your sales and cash-handling teams , focusing on scenarios rather than the theory behind the Act.
- Ongoing support and monitoring. We monitor regulatory changes (including the implementation of the AMLR from 2027), update procedures and respond as needed , so that your AML system does not end up back on the shelf.
Bring your AML compliance into order before the GIIF does
An AML procedure that is not followed is worse than having no procedure at all , because it documents your awareness of your obligations. If the GIIF conducts an inspection and sees empty registers next to a written procedure, the conclusion will be clear: you knew what to do and failed to do it.
The good news is that outstanding matters can be addressed. Voluntary cooperation with the authority is taken into account when determining the penalty. And the cost of an AML review is a fraction of the potential sanctions.
If you would like to find out whether your company has any outstanding obligations towards the GIIF and what to do about them , contact us.
Frequently asked questions
I have had an AML procedure for two years , how can I tell whether it is being followed properly?
Check three things: whether cash transactions over EUR 15,000 were reported to the GIIF within 7 days, whether identification forms were completed for cash-paying customers (KYC, PEP, sanctions screening), and whether AML activity registers are kept up to date. If even one of these is empty, the procedure has not been followed.
What penalties could I face if I failed to report a cash transaction over EUR 15,000 to the GIIF?
An administrative penalty of up to the equivalent of EUR 1 million (for obliged institutions in general) or up to EUR 5 million / 10% of turnover (for financial institutions). The person responsible for AML may face a penalty of up to PLN 1,000,000. Deliberately failing to notify the GIIF may result in imprisonment from 3 months to 5 years (Article 156 of the AML Act). In addition, the authority may publish information about the breach in the Public Information Bulletin.
Can I report overdue transactions to the GIIF now, or is it too late?
Retrospective reporting is technically permissible. Article 150(4) of the AML Act requires the authority to take into account “the obliged institution’s level of cooperation with the competent authorities” when determining the penalty. Voluntary disclosure of outstanding matters may be treated as a mitigating circumstance, although it does not guarantee that sanctions will be avoided. Consult an AML lawyer on how to address the outstanding matters before contacting the GIIF.
Who should be responsible for AML in my company , me as the owner, the accountant or the sales department?
The Act requires a specific person (AMLRO) from senior management to be appointed, with a clearly defined scope of responsibilities. The appointment must be documented. The AMLRO should have direct access to the management board, sufficient resources and authority, and appropriate AML training. If no one is formally appointed, liability may fall on a management board member or the owner.
If a customer pays partly in cash and partly by bank transfer, does it count towards the threshold?
The EUR 15,000 threshold for above-threshold transactions (Article 72 of the AML Act) applies to both cash and non-cash operations. The EUR 10,000 threshold for occasional cash transactions (Article 35) applies only to the cash portion. If the total agreement value exceeds EUR 15,000, you must apply customer due diligence measures regardless of the payment method.
Does the GIIF inspect companies in the automotive industry?
Yes. Vehicle dealers, used-car dealerships and companies trading in high-value goods that accept cash payments of ≥ EUR 10,000 are obliged institutions and are subject to GIIF inspections. In 2025, the GIIF conducted 7 on-site inspections and identified 191 irregularities. Other supervisory authorities conducted 479 inspections. The lack of publicly available statistics broken down by industry does not mean that your industry is beyond the reach of inspections.
