Suspicious Transaction Reporting to GIIF: Decision-Making and Avoiding Disruption

If your company is an obliged entity under the Polish AML Act, sooner or later a customer transaction may raise suspicion. Who in your organization decides whether to report it to GIIF? How quickly? And what happens to business operations when the transaction is suspended?

Unclear responsibilities, undocumented decisions and chaotic customer communications during the 24-hour waiting period for GIIF’s response are three common sources of problems. Each can lead to reporting delays, formal errors and personal liability risks for a board member.

This article breaks down reporting a suspicious transaction to GIIF into practical stages: identifying suspicion, deciding whether to report and managing the 24-hour transaction suspension period. It provides an escalation path, allocates responsibilities and offers recommendations for businesses of different sizes.

Key terms you need to know

Before looking at the reporting process, it helps to clarify terms that are sometimes used interchangeably but have different legal consequences under the AML Act.

Two concepts require particular attention: “circumstances that may indicate” a connection with money laundering, which may require recording a transaction and enhanced monitoring, and “reasonable suspicion,” which triggers the duty to notify GIIF. The distinction determines when the reporting deadline starts. The institution does not need certainty that a crime occurred; reasonable suspicion is sufficient.

Articles 72 and 86 of the AML Act: two separate duties that may overlap

Obliged entities often confuse reporting threshold transactions with notifying GIIF about suspicious transactions. These are independent regimes and may both apply to the same transaction, in which case both duties must be performed.

Reporting a transaction as suspicious does not remove the duty to report it as a threshold transaction, or vice versa. If a transaction was first recorded as threshold and later found suspicious, the institution corrects the transaction record by adding the suspicious-transaction code and an explanation of the circumstances, then sends the correction to GIIF.

Threshold transactions are reported electronically through GIIF’s dedicated IT system using XML schemas. The 7-day period is calculated under Article 57 of the Code of Administrative Procedure: the event date is excluded, and a deadline falling on a public holiday or Saturday moves to the next business day.

Consider linked transactions, or structuring. Several smaller transactions may together exceed EUR 15,000 if they are connected by parties, timing, economic purpose or function. Deliberately splitting transactions to avoid the threshold, known as structuring or smurfing, should result in treating them as one threshold transaction.

Contact us if you need help organizing your company’s reporting procedures.

Who in the company should decide to report, and why it cannot be “anyone”

Deciding whether to report a suspicious transaction to GIIF is a legal and analytical decision. It cannot be made automatically by a system, left to the intuition of a front-line employee or sent to the board without prior analysis. The AML Act assigns distinct roles and responsibilities.

Three levels of responsibility in the company

Management board, the managing body (Article 7 of the AML Act):

1. Appoints one of its members to be responsible for implementing AML obligations.
2. Approves the overall AML/CFT policy and is responsible for its implementation.
3. Must have adequate knowledge of the law and frameworks for managing money-laundering and terrorist-financing risk.
4. Does not make routine decisions on classifying individual transactions, except in particularly important cases involving large amounts, key customers or reputational risk.
5. Should regularly receive reports on suspicious-transaction reports, internal review results and deficiencies.

AMLRO, the designated employee in a managerial position (Article 8):

1. Ensures the institution’s business complies with AML/CFT rules.
2. Supervises the application of customer due diligence measures.
3. Is responsible for employee training.
4. Cooperates with GIIF and submits notifications under Articles 74, 86, 89 and 90 on behalf of the institution.
5. Makes the final decision on classifying a transaction as suspicious and submitting a report.

Front-line employees:

1. Initiate the process by flagging unusual transactions.
2. Must promptly report suspicions to the designated AML person or unit.
3. Do not make the final reporting decision.
4. Failure to report may be treated as a breach of employment duties.

How responsibilities vary by company size

Failure to appoint responsible persons may result in an administrative fine under Article 147 of the AML Act. Penalties may reach EUR 5 million or 10% of annual turnover for financial institutions. A PLN 50,000 fine imposed by the Minister of Finance on an entity that failed to implement basic organizational AML duties shows that authorities take these requirements seriously.

From identification to submission: a step-by-step escalation path

The AML Act does not provide an official document setting out the internal escalation path step by step. The sequence below is reconstructed from the Act, GIIF communications, including Communication No. 22 of 7 April 2020 and the communication of 27 June 2019, and KNF positions.

Stage 1: identify suspicious circumstances

A front-line employee or IT system identifies a transaction that differs from the customer’s profile. Under GIIF’s communication of 27 June 2019, the transaction is recorded while it is being carried out or after completion, as soon as the institution learns of circumstances that may indicate a link to money laundering or terrorist financing.

At this stage, the transaction is recorded as suspicious in the institution’s transaction register. This begins further analysis; it is not yet a report.

Stage 2: conduct an in-depth review in the AML unit

The review covers:

1. Customer data and risk profile.
2. Transaction history, including value, frequency, product type and stated purpose.
3. Ownership structure and beneficial owners.
4. Geographic and product-related factors.
5. Checks against sanctions lists.

GIIF Communication No. 31 says an institution should know and understand the economic rationale for a customer’s transaction. For complex, high-value or unjustified transactions, it should make inquiries and intensify due diligence under Article 43(4) of the AML Act.

Stage 3: make inquiries to confirm the suspicion

Before submitting a report, the institution should apply enhanced due diligence measures, for example:

1. Ask the customer for documents relating to the transactions.
2. Analyze the source of the funds or other assets.
3. Check whether the transaction is consistent with the customer’s business profile.

The Article 74 reporting period begins when the suspicion is confirmed, not when it first arises. This allows time for a sound review, but not for unjustified delay.

Stage 4: AMLRO decides whether reasonable suspicion exists

The AMLRO assesses whether the information supports “reasonable suspicion,” meaning a high probability that an offense under Article 165a or 299 of the Polish Criminal Code was committed. The decision is legal and analytical, not purely automatic.

From a practical perspective, after reasonable suspicion arises and before the report is sent to GIIF, the institution should not carry out the transaction. In some cases it may defer execution itself, for example, by processing a transfer in the next Elixir session.

Stage 5: select the reporting route

“Without delay” does not mean “immediately.” A Supreme Court judgment of 30 June 2011 (III CSK 282/10) describes it as a “realistic period, taking account of the circumstances of place and time.” In AML, it means the time needed to identify a suspicious transaction and prepare a report with due care. Institutions should aim to report suspicious transactions before they are carried out.

Stage 6: submit the notification electronically

The report is submitted electronically through GIIF’s IT system. Under Article 74(3) of the AML Act it includes:

1. Identification data for the customer and transaction parties.
2. The type and value of assets.
3. The account number.
4. Information about the transaction or attempted transaction.
5. Information about identified ML/TF risk.
6. The reasons for the report.

GIIF promptly confirms receipt with a UPO showing the date and time. The 24-hour transaction suspension period starts at that point.

Waiting 24 hours for GIIF: managing the team and customer communications

How the 24-hour period works

After receiving the UPO, an obliged entity must not carry out the reported transaction or other transactions debiting the account holding the assets covered by the report for up to 24 hours. This duty applies automatically and does not require a separate GIIF request.

Saturdays and public holidays are excluded from the 24-hour calculation under Article 92 of the AML Act. A “24-hour” period therefore does not always mean one calendar day.

The restriction is broader than the reported transaction: it covers all customer instructions that debit the account in question. This has direct operational implications for the customer-service team.

Three ways the 24-hour period can end

After GIIF releases the institution, it need not take further action or notify the prosecutor. The division of powers is that GIIF handles ML/TF under Article 86, while the prosecutor handles other offenses under Article 89. This is important for a board concerned about liability after a report is “rejected.”

Customer communications: what you may and may not say

Article 54 of the AML Act prohibits tipping off the customer about:

1. The fact that a report was submitted to GIIF.
2. The fact that the transaction was classified as suspicious.
3. Details of the AML analysis.

Breaching this prohibition may result in criminal liability. If a customer asks why a transaction was not completed, you cannot say that AML proceedings are the reason.

Article 86(12) permits telling the customer about a GIIF account-block request, but only after the formal request is made, not during the initial 24-hour suspension period.

Organizing the team during the 24-hour period

The law does not expressly regulate how AML teams must organize work during this period. However, the duty to act without delay and the 24-hour suspension suggest that the institution should be able to respond around the clock, especially for continuously processed electronic transactions.

The internal AML procedure, required by Article 50, should specify:

1. Roles and responsibilities during suspension.
2. Decision paths, including who releases a block after the period expires.
3. Escalation steps if GIIF requests a block.
4. Technical procedures for activating and releasing account blocks.
5. Customer communication scripts that do not breach Article 54.

AML training required by Article 52 must cover practical scenarios, including the 24-hour period. It must take place before an employee is assigned AML duties, and the institution must be able to demonstrate this to inspectors.

Documenting decisions: what to record to show adequate board oversight

Thorough records of the decision process can help reduce the risk of allegations against the board. GIIF Communication No. 22 of 7 April 2020 sets out in detail the elements expected in a report’s rationale.

What the records must contain

1. Customer profile: information and documents collected before establishing the relationship.
2. Current information: data collected during the relationship.
3. Due diligence measures: measures applied after suspicious circumstances arose and their results.
4. Steps taken with the customer: actions such as requesting documents.
5. Documents reviewed: materials examined.
6. Effect on the relationship: whether the findings led to termination, refusal of a transaction or enhanced monitoring.

A brief statement of suspicion is not enough. GIIF expects an account of the reasoning and analysis that led to the reporting decision.

Record-retention period

AML records must be retained for 5 years from the end of the business relationship or the date of an occasional transaction, under Article 49 of the AML Act.

Why documentation protects the board

A board member appointed under Article 7 is responsible for implementing and overseeing the AML system. If the institution cannot show that:

1. Responsible persons were appointed under Articles 7 and 8;
2. An internal AML procedure was implemented under Article 50;
3. Training was provided under Article 52; and
4. Decisions to report or not report were documented and justified,

the board may face allegations of inadequate oversight. A PLN 50,000 fine imposed by the Minister of Finance for failure to implement basic AML organizational duties shows that authorities review not just whether a report was made, but the system behind it.

Implementation recommendations: organizing reporting in your company

What to implement first

1. Appoint an AMLRO. If you have not done so, designate a person in a managerial position responsible for AML compliance under Article 8, and appoint a board member responsible for implementing AML duties under Article 7.
2. Document the escalation path. In your internal AML procedure, specify who flags suspicion, analyzes it, makes the decision and submits the report. Avoid a situation where “everyone is responsible,” because then nobody is.
3. Prepare customer communication scripts. Draft responses that do not breach Article 54 and train front-line employees to use them.
4. Ensure coverage during the 24-hour period. Identify who responds to GIIF messages outside normal business hours. For continuously processed electronic transactions, failure to respond may breach the suspension duty.
5. Document every decision. Record both decisions to report and decisions not to report, with the elements described in GIIF Communication No. 22.
6. Train staff before assigning AML duties. Training should cover practical scenarios and take place before the employee begins performing AML tasks.

Role of systems supporting reporting

Tools such as AMLtrack may help an obliged entity with:

1. Automated transaction monitoring for ML/TF typologies.
2. Maintaining registers of suspicious and threshold transactions.
3. Generating reports that follow the XML schemas required by GIIF’s system.
4. Recording the decision path, including who decided, when and on what basis.
5. Managing deadlines: 7 days for threshold transactions, 2 business days for suspicious transactions and 24 hours for suspension.

GIIF is preparing technical changes through SIGIIF 2.0, based on the UNODC goAML standard, with full launch planned for late February 2028. The EU AML package is scheduled to apply from July 2027. Reporting systems will change, so consider tools that will be updated as requirements evolve.

Legal support for companies on AML: how we can help

Reporting a suspicious transaction is not a one-off event. It is a process requiring clear responsibilities, documented decisions and effective internal communication. If your company is an obliged entity, whether a fintech, accounting firm, cryptocurrency exchange or real estate intermediary, you need procedures that work under time pressure.

We support obliged entities with:

1. Auditing current AML procedures and identifying gaps.
2. Designing an internal escalation path for the organization.
3. Preparing records that meet GIIF Communication No. 22 expectations.
4. Training teams from front-line staff to the board.
5. Implementing AMLtrack to guide the team through the process.
6. Monitoring regulatory changes and updating procedures.

Corporate legal support on AML is an ongoing part of organizational management, not a one-off project. We combine legal advice with AMLtrack to organize decisions, automate repeatable tasks and give the board oversight of risk without slowing business operations.

Contact us to organize your company’s AML procedures.

Summary

Reporting a suspicious transaction to GIIF requires clear role allocation, from front-line employee to AML analyst to AMLRO, documented decisions at every stage and preparation for the 24-hour suspension period. Failure to appoint responsible people, undocumented decisions and chaotic customer communications are common sources of breaches and areas where board members may face personal liability.

Check whether your company has a documented escalation path, an appointed AMLRO, a trained team and a procedure for suspending transactions. If any element is missing, address it before a GIIF inspection.

Contact us to organize your procedures and prepare your company for AML Act obligations.

Frequently asked questions

Who makes the final decision to report a suspicious transaction to GIIF?

The AMLRO, a managerial employee designated under Article 8 of the AML Act, makes the decision and submits reports on the institution’s behalf. Front-line staff flag suspicions but do not make the final decision. The board oversees and implements the AML system but does not classify individual transactions unless a matter is particularly significant, for example because of a large amount, key customer or reputational risk.

How long does an obliged entity have to report a suspicious transaction?

It depends on the notification route. A report under Article 86, concerning reasonable suspicion of a connection to ML/TF, must be submitted without delay through GIIF’s electronic system. A report under Article 74, concerning circumstances that may indicate an offense, must be submitted without delay and no later than 2 business days after suspicion is confirmed. “Without delay” does not mean “immediately”; it is a realistic period that accounts for the circumstances, but institutions should aim to report before carrying out the transaction.

What happens after a report is sent to GIIF? Is the transaction automatically blocked?

For a limited period, yes. From receipt of the UPO, the institution must not carry out the reported transaction or other transactions debiting the account covered by the report for up to 24 hours. Saturdays and public holidays are excluded from the calculation. After that period, GIIF may request a block for another 96 hours, release the institution from suspension, or take no action, in which case the institution may carry out the transaction.

Can I tell the customer that their transaction was reported to GIIF?

No. Article 54 prohibits disclosing the report, the suspicious classification or details of the AML analysis. Breach may result in criminal liability. The customer may be told about a formal GIIF account-block request under Article 86(12), but not before that stage.

What penalties apply if a company fails to appoint AML-responsible persons?

Article 147 of the AML Act provides for administrative fines for failing to appoint the person responsible for implementing AML duties under Article 7 and the employee responsible for compliance under Article 8. Penalties may reach EUR 5 million or 10% of annual turnover for financial institutions. The Minister of Finance imposed a PLN 50,000 fine on an entity that failed to implement basic organizational AML duties, showing that authorities review the entire system behind reporting.

How does reporting a threshold transaction differ from reporting a suspicious transaction?

They are separate regimes. A threshold transaction under Article 72 is reported because it exceeds EUR 15,000, regardless of suspicion, within 7 days. A suspicious transaction under Articles 74 and 86 is reported because of reasonable suspicion of a connection to money laundering or terrorist financing, with no monetary threshold, without delay and no later than 2 business days after confirmation. Both duties may apply to the same transaction and must be performed in parallel.