{"id":3871,"date":"2026-09-07T12:56:29","date_gmt":"2026-09-07T12:56:29","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3871"},"modified":"2026-10-23T11:32:01","modified_gmt":"2026-10-23T11:32:01","slug":"suspicious-transaction-reporting-giif","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/suspicious-transaction-reporting-giif\/","title":{"rendered":"Suspicious Transaction Reporting to GIIF: Decision-Making and Avoiding Disruption"},"content":{"rendered":"

If your company is an obliged entity<\/a> under the Polish AML Act, sooner or later a customer transaction may raise suspicion. Who in your organization decides whether to report it to GIIF? How quickly? And what happens to business operations when the transaction is suspended?<\/p>\n

Unclear responsibilities, undocumented decisions and chaotic customer communications during the 24-hour waiting period for GIIF\u2019s response are three common sources of problems. Each can lead to reporting delays, formal errors and personal liability risks for a board member.<\/p>\n

This article breaks down reporting a suspicious transaction to GIIF<\/strong> into practical stages: identifying suspicion, deciding whether to report and managing the 24-hour transaction suspension period. It provides an escalation path, allocates responsibilities and offers recommendations for businesses of different sizes.<\/p>\n

Key terms you need to know<\/h2>\n

Before looking at the reporting process, it helps to clarify terms that are sometimes used interchangeably but have different legal consequences under the AML Act.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\nLegal basis<\/th>\n<\/tr>\n<\/thead>\n
Threshold transaction<\/strong><\/td>\nA transaction with a value exceeding the equivalent of EUR 15,000, reported regardless of whether it is suspicious.<\/td>\nArticle 72 of the AML Act<\/td>\n<\/tr>\n
Suspicious transaction<\/strong><\/td>\nA transaction about which the institution has reasonable grounds to suspect a connection with money laundering or terrorist financing. There is no monetary threshold.<\/td>\nArticles 74 and 86 of the AML Act<\/td>\n<\/tr>\n
GIIF<\/strong><\/td>\nThe General Inspector of Financial Information, the authority to which the report is sent.<\/td>\nAML Act<\/td>\n<\/tr>\n
AMLRO<\/strong><\/td>\nA person in a managerial position responsible for ensuring the institution\u2019s compliance with AML rules.<\/td>\nArticle 8 of the AML Act<\/td>\n<\/tr>\n
UPO<\/strong><\/td>\nOfficial acknowledgment of receipt generated by GIIF\u2019s system, showing the date and time the report was accepted. The 24-hour period starts at this point.<\/td>\nArticle 86 of the AML Act<\/td>\n<\/tr>\n
Customer due diligence measures<\/strong><\/td>\nProcedures for identifying the customer, verifying identity, identifying the beneficial owner and monitoring transactions.<\/td>\nArticles 33 to 43 of the AML Act<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Two concepts require particular attention: \u201ccircumstances that may indicate\u201d<\/strong> a connection with money laundering, which may require recording a transaction and enhanced monitoring, and \u201creasonable suspicion,\u201d<\/strong> which triggers the duty to notify GIIF. The distinction determines when the reporting deadline starts. The institution does not need certainty that a crime occurred; reasonable suspicion is sufficient.<\/p>\n

Articles 72 and 86 of the AML Act: two separate duties that may overlap<\/h2>\n

Obliged entities often confuse reporting threshold transactions with notifying GIIF about suspicious transactions. These are independent regimes and may both apply to the same transaction, in which case both duties must be performed.<\/p>\n\n\n\n\n\n\n\n\n
Feature<\/th>\nThreshold transaction (Article 72)<\/th>\nSuspicious transaction (Articles 74 and 86)<\/th>\n<\/tr>\n<\/thead>\n
Reporting criterion<\/td>\nObjective threshold of EUR 15,000<\/td>\nReasonable suspicion of a connection to ML\/TF; no monetary threshold<\/td>\n<\/tr>\n
Reporting deadline<\/td>\n7 days from the transaction<\/td>\nWithout delay, no later than 2 business days after suspicion is confirmed<\/td>\n<\/tr>\n
Nature<\/td>\nBulk reporting of data<\/td>\nSelected analytical notifications<\/td>\n<\/tr>\n
Effect<\/td>\nNo transaction suspension<\/td>\nTransaction suspension for up to 24 hours from the UPO<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Reporting a transaction as suspicious does not remove the duty to report it as a threshold transaction, or vice versa. If a transaction was first recorded as threshold and later found suspicious, the institution corrects the transaction record by adding the suspicious-transaction code and an explanation of the circumstances, then sends the correction to GIIF.<\/p>\n

Threshold transactions are reported electronically through GIIF\u2019s dedicated IT system using XML schemas. The 7-day period is calculated under Article 57 of the Code of Administrative Procedure: the event date is excluded, and a deadline falling on a public holiday or Saturday moves to the next business day.<\/p>\n

Consider linked transactions<\/strong>, or structuring. Several smaller transactions may together exceed EUR 15,000 if they are connected by parties, timing, economic purpose or function. Deliberately splitting transactions to avoid the threshold, known as structuring or smurfing, should result in treating them as one threshold transaction.<\/p>\n

Contact us<\/a> if you need help organizing your company\u2019s reporting procedures.<\/p>\n

Who in the company should decide to report, and why it cannot be \u201canyone\u201d<\/h2>\n

Deciding whether to report a suspicious transaction to GIIF is a legal and analytical decision. It cannot be made automatically by a system, left to the intuition of a front-line employee or sent to the board without prior analysis. The AML Act assigns distinct roles and responsibilities.<\/p>\n

Three levels of responsibility in the company<\/h3>\n

Management board, the managing body (Article 7 of the AML Act):<\/strong><\/p>\n

    \n
  1. Appoints one of its members to be responsible for implementing AML obligations.<\/li>\n
  2. Approves the overall AML\/CFT policy and is responsible for its implementation.<\/li>\n
  3. Must have adequate knowledge of the law and frameworks for managing money-laundering and terrorist-financing risk.<\/li>\n
  4. Does not make routine decisions on classifying individual transactions, except in particularly important cases involving large amounts, key customers or reputational risk.<\/li>\n
  5. Should regularly receive reports on suspicious-transaction reports, internal review results and deficiencies.<\/li>\n<\/ol>\n

    AMLRO, the designated employee in a managerial position (Article 8):<\/strong><\/p>\n

      \n
    1. Ensures the institution\u2019s business complies with AML\/CFT rules.<\/li>\n
    2. Supervises the application of customer due diligence measures.<\/li>\n
    3. Is responsible for employee training.<\/li>\n
    4. Cooperates with GIIF and submits notifications under Articles 74, 86, 89 and 90 on behalf of the institution.<\/li>\n
    5. Makes the final decision on classifying a transaction as suspicious and submitting a report.<\/li>\n<\/ol>\n

      Front-line employees:<\/strong><\/p>\n

        \n
      1. Initiate the process by flagging unusual transactions.<\/li>\n
      2. Must promptly report suspicions to the designated AML person or unit.<\/li>\n
      3. Do not make the final reporting decision.<\/li>\n
      4. Failure to report may be treated as a breach of employment duties.<\/li>\n<\/ol>\n

        How responsibilities vary by company size<\/h3>\n\n\n\n\n\n\n\n
        Entity type<\/th>\nOrganizational model<\/th>\nWho decides whether to report<\/th>\n<\/tr>\n<\/thead>\n
        Large financial institution supervised by KNF<\/td>\nExpanded AML department with several approval levels<\/td>\nAMLRO as formal decision-maker, with possible delegation to an AMLO<\/td>\n<\/tr>\n
        Small or medium non-financial company<\/td>\nOne person combines AMLRO responsibilities with other compliance duties<\/td>\nDesignated employee in a managerial position<\/td>\n<\/tr>\n
        Sole trader or professional of public trust<\/td>\nOwner or designated employee identifies, decides and submits the report<\/td>\nOwner or designated employee<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Failure to appoint responsible persons may result in an administrative fine under Article 147 of the AML Act. Penalties may reach EUR 5 million or 10% of annual turnover for financial institutions. A PLN 50,000 fine imposed by the Minister of Finance on an entity that failed to implement basic organizational AML duties shows that authorities take these requirements seriously.<\/p>\n

        From identification to submission: a step-by-step escalation path<\/h2>\n

        The AML Act does not provide an official document setting out the internal escalation path step by step. The sequence below is reconstructed from the Act, GIIF communications, including Communication No. 22 of 7 April 2020 and the communication of 27 June 2019, and KNF positions.<\/p>\n

        Stage 1: identify suspicious circumstances<\/h3>\n

        A front-line employee or IT system identifies a transaction that differs from the customer\u2019s profile. Under GIIF\u2019s communication of 27 June 2019, the transaction is recorded while it is being carried out or after completion, as soon as the institution learns of circumstances that may indicate a link to money laundering or terrorist financing.<\/p>\n

        At this stage, the transaction is recorded as suspicious in the institution\u2019s transaction register. This begins further analysis; it is not yet a report.<\/p>\n

        Stage 2: conduct an in-depth review in the AML unit<\/h3>\n

        The review covers:<\/p>\n

          \n
        1. Customer data and risk profile<\/a>.<\/li>\n
        2. Transaction history, including value, frequency, product type and stated purpose.<\/li>\n
        3. Ownership structure and beneficial owners.<\/li>\n
        4. Geographic and product-related factors.<\/li>\n
        5. Checks against sanctions lists.<\/li>\n<\/ol>\n

          GIIF Communication No. 31 says an institution should know and understand the economic rationale for a customer\u2019s transaction. For complex, high-value or unjustified transactions, it should make inquiries and intensify due diligence under Article 43(4) of the AML Act.<\/p>\n

          Stage 3: make inquiries to confirm the suspicion<\/h3>\n

          Before submitting a report, the institution should apply enhanced due diligence measures<\/a>, for example:<\/p>\n

            \n
          1. Ask the customer for documents relating to the transactions.<\/li>\n
          2. Analyze the source of the funds or other assets.<\/li>\n
          3. Check whether the transaction is consistent with the customer\u2019s business profile.<\/li>\n<\/ol>\n

            The Article 74 reporting period begins when the suspicion is confirmed<\/strong>, not when it first arises. This allows time for a sound review, but not for unjustified delay.<\/p>\n

            Stage 4: AMLRO decides whether reasonable suspicion exists<\/h3>\n

            The AMLRO assesses whether the information supports \u201creasonable suspicion,\u201d meaning a high probability that an offense under Article 165a or 299 of the Polish Criminal Code was committed. The decision is legal and analytical, not purely automatic.<\/p>\n

            From a practical perspective, after reasonable suspicion arises and before the report is sent to GIIF, the institution should not carry out the transaction. In some cases it may defer execution itself, for example, by processing a transfer in the next Elixir session.<\/p>\n

            Stage 5: select the reporting route<\/h3>\n\n\n\n\n\n\n\n
            Route<\/th>\nLegal basis<\/th>\nWhen to use it<\/th>\nDeadline<\/th>\n<\/tr>\n<\/thead>\n
            Notification of reasonable suspicion that a transaction is linked to ML\/TF<\/td>\nArticle 86 of the AML Act<\/td>\nA transaction or assets may be connected with money laundering or terrorist financing<\/td>\nWithout delay, electronically<\/td>\n<\/tr>\n
            Notification of circumstances that may indicate suspected ML\/TF crime<\/td>\nArticle 74 of the AML Act<\/td>\nCircumstances indicate a suspected offense<\/td>\nWithout delay, no later than 2 business days after suspicion is confirmed<\/td>\n<\/tr>\n
            Notification to the prosecutor of a suspected other offense<\/td>\nArticle 89 of the AML Act<\/td>\nSuspected offense other than ML\/TF, such as a fiscal offense<\/td>\nWithout delay; transaction suspension for up to 96 hours<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            \u201cWithout delay\u201d does not mean \u201cimmediately.\u201d A Supreme Court judgment of 30 June 2011 (III CSK 282\/10) describes it as a \u201crealistic period, taking account of the circumstances of place and time.\u201d In AML, it means the time needed to identify a suspicious transaction and prepare a report with due care. Institutions should aim to report suspicious transactions before they are carried out<\/strong>.<\/p>\n

            Stage 6: submit the notification electronically<\/h3>\n

            The report is submitted electronically through GIIF\u2019s IT system. Under Article 74(3) of the AML Act it includes:<\/p>\n

              \n
            1. Identification data for the customer and transaction parties.<\/li>\n
            2. The type and value of assets.<\/li>\n
            3. The account number.<\/li>\n
            4. Information about the transaction or attempted transaction.<\/li>\n
            5. Information about identified ML\/TF risk.<\/li>\n
            6. The reasons for the report.<\/li>\n<\/ol>\n

              GIIF promptly confirms receipt with a UPO showing the date and time. The 24-hour transaction suspension period starts at that point.<\/p>\n