Suspicious Transactions: What the AML Act Leaves Undefined

The Act of 1 March 2018 on counteracting money laundering and terrorist financing (the AML Act) contains no definition of a suspicious transaction. It uses only the concept of reasonable suspicion (Article 86(1)), leaving each obliged entity to develop its own identification criteria. If you run a fintech, accounting firm,virtual-currency exchange office, or real-estate brokerage business, the lack of tailored criteria in your internal procedure is a common gap identified by GIIF during inspections. In 2024, KNF conducted 17 AML/CFT inspections and identified 428 irregularities, most often involving customer risk assessment and transaction analysis. This article explains why lawmakers deliberately left the term undefined, which four analytical criteria to include in an AML procedure, how to tailor them to your business model, and what consequences may follow if a GIIF inspection finds that your internal procedure lacks its own criteria for identifying a suspicious transaction.

Terms you need to know

Before we continue, let’s clarify the terminology. Legal support for businesses in AML requires precision. These terms recur throughout the article.

Why the AML Act does not define a suspicious transaction, and what that means for your business

Article 86(1) of the AML Act requires an obliged entity to notify GIIF promptly when it has reasonable suspicion that a transaction or assets may be connected with money laundering or terrorist financing. But the Act does not explain what that suspicion means. This is not a legislative oversight. The absence of a definition follows from several considerations:

1. Consistency with EU directives and FATF recommendations. AML directives (from the First through Fifth) and FATF standards use the concept of suspicion and require Suspicious Transaction Reports, without enumerating what makes a transaction suspicious.
2. System flexibility. A rigid definition with specific monetary thresholds or characteristics could quickly become outdated as criminal schemes evolve.
3. Risk of evading the law. An exhaustive list of suspicious-transaction characteristics would show criminals how to structure operations to avoid the criteria.
4. Consistency with criminal law. The concept of reasonable suspicion is widely used in criminal law without a strict statutory definition.

What this means for your business

The burden of defining a suspicious transaction rests with you. You must develop and update identification criteria in your internal AML procedure. This is an obligation, not an option, under Article 27 of the AML Act (institution-level risk assessment) and Article 33(2) and (3) (customer-level risk assessment). The absence of original criteria creates two risks:

1. Risk of failing to report a suspicious transaction because your team does not know what to look for.
2. Risk of over-reporting because, without clear rules, employees report transactions just in case, burdening resources and reducing report quality.

It is important to distinguish two separate reporting obligations to GIIF:

A suspicious transaction can involve as little as PLN 500 if the circumstances indicate a connection to money laundering. Conversely, a EUR 100,000 transfer may be entirely lawful if it is consistent with the customer profile.

How to recognize a suspicious transaction when the law does not define it

Article 43(4) of the AML Act, as amended on 30 March 2021, identifies four categories of transactions that require clarification. This is the closest statutory approximation of a suspicious transaction:

1. Complex transactions: multi-stage sequences of operations, complex corporate structures, or multiple intermediaries from different jurisdictions.
2. High-value transactions that are not justified by the circumstances: amounts disproportionate to the customer’s profile and transaction history.
3. Transactions carried out in an unusual way: a sudden change in payment channel, use of anonymous instruments, or nighttime operations if these differ from the customer’s profile.
4. Transactions that appear to lack a legal or economic rationale, such as repeated transfers with no apparent business purpose.

In documents on virtual assets and ML/TF risk indicators, the Ministry of Finance says that a red flag alone is not enough to establish suspicion; it is a signal for further examination. Only a substantiated reasonable suspicion should lead to a report.

Practical examples

Here are specific situations that should trigger a closer analysis at your institution:

GIIF Communication No. 31 identifies two scenarios that call for immediate action: (1) a long-standing customer’s account receives a one-time inflow several times greater than all inflows over the preceding 12 months, and the institution takes no action; (2) a new customer’s account receives substantial deposits despite having no transaction history to justify them. In both cases, GIIF considers failure to apply customer due diligence measures an unacceptable practice.

Four analytical criteria to include in your AML procedure

These criteria do not come from a single provision. They result from a systemic interpretation of Articles 27, 33, 34-35, 41, 43, 74, and 86 of the AML Act and GIIF Communications Nos. 22, 31, and 45. Identifying a suspicious transaction among all operations depends on establishing the circumstances around it; the more you can establish, the easier it is to identify transactions that require reporting.

Criterion 1: the circumstances as a whole

This is the complete set of facts about the transaction, customer, third parties, source of funds, payment purpose, and context. It includes quantitative data (amounts, frequency, geography) and qualitative data (transaction purpose, corporate links, relationship history, and management changes). GIIF Communication No. 22 specifies that ongoing monitoring includes examining the source of funds where the circumstances justify it. GIIF Communication No. 45 adds that the institution must assess whether its actions clarified the circumstances under Article 43(4). Elements to analyze:

1. Purpose and intended nature of the business relationship
2. Purpose of the account
3. Transactions ordered by unknown third parties
4. New products, services, or channels
5. Changes in management, acquisitions, or new geographic markets
6. Information sources: identity documents, KRS/CEIDG, sanctions lists, and customer explanations

Criterion 2: transaction scale

Scale is not only absolute value. The same amount may be typical for a large enterprise and suspicious for a small one. Assess it against the customer’s profile and transaction history. Article 35(1)(2) of the AML Act sets the thresholds: occasional transactions equivalent to EUR 15,000 or more (or several linked operations exceeding that amount) and transfers above EUR 1,000 require customer due diligence measures. UKNF says the frequency and parameters of rules used to flag potentially suspicious transactions should not cause lower-value transactions with suspicious characteristics to be overlooked. What to analyze:

1. The total value of operations over defined periods (days, weeks, or months)
2. Deviations from the customer’s established typical scale of activity
3. Accumulation of high amounts over a short period
4. The relationship between transaction value and the declared business profile

Criterion 3: transaction characteristics

GIIF Communication No. 22 defines unusual transactions as operations that are unnaturally complex, involve high amounts, or appear to lack a legal or economic rationale. Examples requiring closer analysis:

Documents you may request from a customer to clarify a transaction include contracts, invoices, payment confirmations, credit documents, and tax certificates.

Criterion 4: customer profile

Article 33(3) of the AML Act identifies six groups of factors (the statutory minimum): customer type, geographic area, purpose of the account, type of products/services/distribution channels, value of assets/transactions, and purpose, regularity, and duration of the business relationship. GIIF Communication No. 45 specifies that this is a minimum list and the institution should expand it to reflect its business. GIIF says a customer profile includes the value of transferred funds and consistency with declarations, transaction frequency and consistency with declarations, transaction type and consistency with declarations, and further elements listed in Communication No. 31. A deviation from the profile is, in practice, an operational definition of a suspicious transaction. The customer profile is dynamic. UKNF sets the following review frequency:

Triggers for immediate profile updates include ownership or management changes, entering new geographic markets, new products or services, a sudden increase in business scale, addition to a sanctions list, PEP status, or discovery of unusual transactions.

How to tailor the criteria to your business model

Each sector has a different ML/TF risk profile. An accounting firm’s AML procedure should not look the same as a fintech’s. The National Risk Assessment (KOR) identifies sectors and transaction types particularly exposed to risk and is a reference point.

Fintechs and payment institutions

Fintechs handle large transaction volumes, often cross-border. Sector-specific red flags include:

1. Numerous large transactions within a short time (for example, 24 hours), expressly identified in the Ministry of Finance document on virtual assets
2. Use of virtual-asset exchanges in jurisdictions with weak AML standards
3. Unusually large deposits of unknown origin that are later exchanged for cash
4. Smurfing: splitting large amounts into smaller transactions below reporting thresholds
5. Refining: exchanging low-denomination banknotes for higher-denomination notes or other currencies

A fintech AML procedure should include automated rules to identify potentially suspicious transactions, parameterized to match typical customer profiles and transaction volume.

Accounting firms and virtual offices

Accounting firms are obliged entities when providing tax-advisory and tax-compliance services. Virtual offices face additional registration requirements: entry in the register of activities for companies or trusts (fee: PLN 616). Sector-specific red flags include:

1. A customer establishes a company with minimal capital and immediately carries out transactions worth many times more.
2. A change in ownership structure, replacing domestic beneficial owners with persons from high-risk jurisdictions.
3. A company with a simple structure is acquired by entities with a complex, multi-level structure involving offshore jurisdictions.
4. The customer is not physically present and there is no contact with the beneficial owner.

Real-estate agents

Real-estate agents are obliged entities, except when mediating leases or tenancies with rent below EUR 10,000 per month (a change in the Real Estate Management Act). Sector-specific red flags include:

1. A property purchase with no coherent explanation of purpose, particularly by entities from high-risk jurisdictions.
2. Cash payments in amounts close to reporting thresholds.
3. Rapid resales of property at prices that deviate from market value.
4. An exchange of real estate of similar value with no additional payment between related entities.
5. The buyer shows no interest in the property’s technical condition or location.

An AML procedure without its own criteria: consequences during a GIIF inspection

Poland ranked 9th among 31 European countries in the Basel AML Index 2022, placing it among Europe’s ten highest-risk countries for AML/CFT. Supervisory authorities respond proportionately to this risk level.

What exactly is at stake

Failure to prepare an institution risk assessment (Article 27(3) of the AML Act) is a separate administrative offense. The violation is failure to prepare any assessment, not a flawed assessment, unless the error is so fundamental that the assessment can be considered a sham. Likewise, failure to apply customer due diligence measures (Articles 33 and 43), or applying them disproportionately to the assessed risk, is a separate violation. GIIF Communication No. 31 says transactions inconsistent with customer declarations (value, frequency, type, subject, direction/country) may be considered by inspectors a failure to apply a customer due diligence measure under Article 33 in conjunction with Article 34(1)(4) of the AML Act. The sanctions include:

Impact on reporting

Without criteria in the procedure, your team does not know when to report. This can lead to failure to report (administrative and criminal sanctions) or over-reporting (burdened resources, lower report quality, and loss of credibility with GIIF). Remember that reporting covers not only transactions but also assets held in an account. An obliged entity need not obtain additional customer information for a report; information already held that formed the basis for reasonable suspicion is sufficient. Further data collection unnecessarily delays notification to GIIF.

Checklist: what to review in your AML procedure before an inspection

Here are seven areas to review, each tied to specific provisions and documents:

If any of these areas in your procedure is blank or contains only copied statutory text without original criteria, the procedure needs to be completed.

How we can help your business organize its AML procedures

Legal support for businesses in AML is not a one-time document. It is an ongoing process of audit, implementation, and monitoring. We combine legal advice with AMLtrack, which guides your team step by step from customer identification and risk assessment to transaction monitoring and reporting. Our support covers three areas:

1. Audit and risk map. We check whether your AML procedure contains original suspicious-transaction criteria tailored to your business model. We identify gaps that may be challenged in a GIIF inspection.
2. AML system implementation. We build procedures and monitoring rules tailored to your sector, whether fintech, accounting, real estate, or virtual-currency exchange. Each element is proportionate to organizational risk and scale.
3. Ongoing support and compliance monitoring. We track changes in regulations, GIIF communications, and UKNF positions. We update procedures and inform you of new requirements.

This gives management control over risk and gives the team clear instructions, without blocking customer onboarding or business relationships.

You can address the risk of an AML procedure without criteria today

The AML Act places the burden of defining a suspicious transaction on you. The absence of original criteria in the internal procedure is a common gap identified by GIIF during inspections and a source of sanctions of up to EUR 5 million or 10% of turnover. Four analytical criteria, the circumstances as a whole, transaction scale, transaction characteristics, and customer profile, are the foundation to include in your procedure and tailor to your business model. If you want to check whether your AML procedure meets GIIF requirements or need support implementing an AML system tailored to your industry, contact us.

Frequently asked questions

Does the AML Act define a suspicious transaction?

No. The Act of 1 March 2018 on counteracting money laundering and terrorist financing contains no definition of a suspicious transaction. Article 86(1) uses only the concept of reasonable suspicion that a transaction or assets may be connected with money laundering or terrorist financing. Each obliged entity must develop its own identification criteria in its internal AML procedure.What transaction-analysis criteria should an AML procedure include?

The procedure should cover four criteria: (1) the circumstances as a whole, the facts about the transaction, customer, and context; (2) transaction scale, assessed relative to the customer profile, not only in absolute terms; (3) transaction characteristics, whether it is complex, unusual, or lacks an economic rationale (Article 43(4) of the AML Act); and (4) the customer profile, a dynamic set of information about the customer’s business, transactions, and risk (Article 33(3) of the AML Act).What are the consequences of having no original suspicious-transaction criteria in an AML procedure?

Failure to prepare an institution risk assessment (Article 27(3)) is a separate administrative offense. Sanctions include a financial penalty of up to EUR 5 million or 10% of turnover, a separate penalty on the person responsible for AML, publication of the violation, an order to cease activities, withdrawal of a license or removal from a register, and a ban on holding management positions. In 2024, KNF identified 428 irregularities in 17 AML/CFT inspections.Should a fintech’s AML procedure differ from an accounting firm’s?

Yes. Each sector has a different ML/TF risk profile. Fintechs handle large cross-border transaction volumes and should use automated rules to flag potentially suspicious transactions. Accounting firms should watch for ownership changes and companies set up with minimal capital that immediately carry out transactions worth many times more. Real-estate agents should watch for cash payments near reporting thresholds and rapid resales at prices that deviate from market value.When should a suspicious transaction be reported to GIIF? Should we wait for complete information?

No. Article 86 of the AML Act requires prompt notification once reasonable suspicion arises. An obliged entity does not need to obtain additional information; information already held that formed the basis for suspicion is sufficient. Gathering more material unnecessarily delays the notification and may expose the institution to an allegation of delay.How does reporting a threshold transaction differ from reporting a suspicious transaction?

Threshold transactions (Article 72 of the AML Act), deposits/withdrawals above EUR 15,000 and transfers above EUR 15,000, are reported to GIIF regardless of suspicion, solely because of their value. Suspicious transactions (Article 86) are reported based on reasonable suspicion of a connection to money laundering or terrorist financing, regardless of amount. A transaction of PLN 500 may be suspicious, while a EUR 100,000 transfer may be entirely lawful if consistent with the customer profile.