{"id":3895,"date":"2026-08-19T13:16:56","date_gmt":"2026-08-19T13:16:56","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3895"},"modified":"2026-10-23T11:18:13","modified_gmt":"2026-10-23T11:18:13","slug":"aml-inspection-working-system","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/aml-inspection-working-system\/","title":{"rendered":"An AML Procedure in a Drawer Won\u2019t Protect You During an Inspection"},"content":{"rendered":"

If your company has an AML procedure that no one has opened since the day it was implemented, this article is for you. During an inspection, the General Inspector of Financial Information (GIIF) does not check whether you have a document. It checks whether your system actually works<\/strong>: whether you monitor transactions, document changes in customer profiles, train the team, and archive decisions. A Supreme Audit Office report covering January 2022 to June 2024 assessed Poland\u2019s anti-money laundering system as insufficiently effective, citing, among other things, supervisory gaps and delays in administrative proceedings. Poland ranked among the ten European countries with the highest money-laundering risk.<\/p>\n

For CEOs and founders of fintechs, accounting firms, and payment institutions, the message is simple: an AML procedure in a drawer will not protect you during an inspection. This article explains what an inspection authority actually checks, what continuous monitoring means in day-to-day work, and how to move from a dormant document to a system that can withstand scrutiny. This is relevant to companies relying on legal support for startups<\/strong> and regulated entities.<\/p>\n

Key terms you need to know<\/h2>\n

Before we continue, it is useful to clarify the terminology. The abbreviations and terms below are worth understanding from the outset.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
GIIF<\/strong><\/td>\nGeneral Inspector of Financial Information, the authority responsible for supervising obliged entities\u2019 AML duties.<\/td>\n<\/tr>\n
Obliged entity<\/strong><\/td>\nAn entity required by the AML Act to apply customer due diligence measures, including fintechs, accounting firms, currency exchanges, and payment institutions.<\/td>\n<\/tr>\n
Customer due diligence measures<\/strong><\/td>\nFour required activities: identifying the customer, identifying the beneficial owner, assessing the business relationship, and ongoing monitoring.<\/td>\n<\/tr>\n
KYC (Know Your Customer)<\/strong><\/a><\/td>\nThe \u201cknow your customer\u201d procedure for verifying a customer\u2019s identity and information.<\/td>\n<\/tr>\n
PEP<\/strong><\/td>\nA politically exposed person, a customer requiring enhanced due diligence measures.<\/td>\n<\/tr>\n
CRBR<\/strong><\/td>\nThe Central Register of Beneficial Owners, a public register where companies disclose their beneficial owners.<\/td>\n<\/tr>\n
Risk assessment<\/strong><\/a><\/td>\nA document in which an obliged entity identifies and assesses money-laundering risks associated with its business, customers, and products.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What GIIF actually checks during an inspection<\/h2>\n

Many business owners assume a GIIF inspection checks whether the company has an AML procedure. That is incorrect. The authority examines the entire system<\/strong>, from risk assessment and customer due diligence measures to complete records and reporting quality.<\/p>\n

Scope of the review, step by step<\/h3>\n

The Act of 1 March 2018 on Counteracting Money Laundering and the Financing of Terrorism (the AML Act) imposes a range of separate duties on obliged entities<\/a>. GIIF verifies each one separately:<\/p>\n

    \n
  1. Institution-level risk assessment (Article 27 of the AML Act)<\/strong>: does it cover all required risk factors, including customers, countries and geographic areas, products, services, transactions, and distribution channels? Is it updated at least every 2 years? Has it been approved by the management board and presented to the supervisory board?<\/li>\n
  2. Customer due diligence measures (Article 34)<\/strong>: customer identification and verification, identifying the beneficial owner, assessing the purpose and nature of the business relationship, and ongoing monitoring.<\/li>\n
  3. Ongoing transaction monitoring (Article 43)<\/strong>: does the entity have systems and procedures for continuous monitoring? Does it use transaction scenarios and rules? Does it keep alert records and document how alerts are handled?<\/li>\n
  4. Internal AML\/CFT procedure (Article 50)<\/strong>: is it current? Do employees know it, including when an inspector asks them directly? Is it linked to the risk assessment and does it describe whistleblowing mechanisms?<\/li>\n
  5. Training (Article 52)<\/strong>: does it cover everyone performing AML duties, including employees, civil-law contractors, agents, and board members? Is it documented with an attendance list and training program?<\/li>\n
  6. Documentation and reporting<\/strong>: are records complete and consistent with the procedure? Are reports of good quality and submitted on time? Are documents kept for 5 years?<\/li>\n<\/ol>\n

    Why the document alone is not enough<\/h3>\n

    An AML procedure is evidence of an adopted approach, not evidence that it was implemented. GIIF assesses whether the factual situation matches the written requirements<\/strong>. If the procedure describes transaction monitoring but the company keeps no alert register and does not document analysis results, the authority will consider this a violation.<\/p>\n

    GIIF Communication No. 92, issued jointly with UKNF and NBP, requires the procedure to be updated after every significant change to AML\/CFT rules. UKNF treats the risk assessment as a document requiring regular updates, approval by the management board, and presentation to the supervisory board.<\/p>\n

    The AML system is based on proportionality to risk, or the risk-based approach under AML Directive IV. The entity must not only have procedures, but also demonstrate that its actions are adequate to the risks identified<\/strong>, including both enhanced and simplified measures.<\/p>\n

    Contact us<\/a><\/p>\n

    Continuous monitoring: what an \u201congoing process\u201d means in daily work<\/h2>\n

    Ongoing monitoring of a customer\u2019s business relationship follows from Article 34(1)(4) and Article 43 of the AML Act. It is one of the four equivalent customer due diligence measures. Article 43(3) expressly says that obliged entities must conduct ongoing analysis of transactions<\/strong>. Monitoring cannot be an occasional activity.<\/p>\n

    Three pillars of ongoing monitoring<\/h3>\n

    The Act defines three elements of continuous monitoring (Article 34(1)(4)(a) to (c)):<\/p>\n\n\n\n\n\n\n\n
    Pillar<\/th>\nWhat it involves<\/th>\nOperational meaning<\/th>\n<\/tr>\n<\/thead>\n
    Transaction analysis<\/strong> (letter (a))<\/td>\nEnsuring transactions are consistent with the entity\u2019s knowledge of the customer, the nature and scope of the customer\u2019s business, and AML risk.<\/td>\nCompare every operation with the customer profile by value, frequency, geographic direction, and transaction type.<\/td>\n<\/tr>\n
    Examining the source of funds<\/strong> (letter (b))<\/td>\nEstablishing the origin of assets where the circumstances justify it.<\/td>\nRequest explanations or documents from the customer. For PEPs, do this systematically, not occasionally.<\/td>\n<\/tr>\n
    Keeping data current<\/strong> (letter (c))<\/td>\nOngoing updating of customer documents, data, and information.<\/td>\nSet a review schedule and \u201con event\u201d updates, for example, after an ownership change.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Brief explanations are not enough<\/h3>\n

    GIIF Communication No. 31 makes clear that accepting cursory explanations from a customer does not satisfy the monitoring duty<\/strong>. The entity must know and understand the business rationale for a transaction. Carrying out transactions inconsistent with the customer\u2019s declarations about value, frequency, type, or geographic direction may be treated as a breach of Article 34(1)(4).<\/p>\n

    When you must intensify monitoring<\/h3>\n

    Under Article 43(4) of the AML Act, as discussed in GIIF Communication No. 31, an unusual transaction<\/strong> that is inconsistent with knowledge of the customer and AML risk requires clarification and more intensive monitoring.<\/p>\n

    Enhanced due diligence measures are mandatory in four cases:<\/p>\n

      \n
    1. Relationships with PEPs (politically exposed persons)<\/li>\n
    2. Correspondent relationships<\/li>\n
    3. Customers from high-risk third countries<\/li>\n
    4. Identification of unusual transactions (Article 43(4))<\/li>\n<\/ol>\n

      GIIF Communication No. 73 also warns against \u201cderisking,\u201d meaning mass rejection of customers from particular industries or regions without an individual risk assessment. Intensified monitoring cannot be replaced by simply rejecting entire customer categories.<\/p>\n

      Documenting changes in a customer profile: the minimum you must meet<\/h2>\n

      This is an important regulatory gap: the AML Act and GIIF communications do not provide a detailed list of \u201cminimum fields\u201d<\/strong> or specific formats for documenting changes to a customer profile. Minimum requirements must be reconstructed from general rules and guidance.<\/p>\n

      Which changes you must document<\/h3>\n

      Under Articles 34, 36, and 43 of the AML Act and GIIF Communications Nos. 22, 45, and 114, every significant change in the following areas must be recorded:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      Profile change<\/th>\nLegal basis<\/th>\n<\/tr>\n<\/thead>\n
      Change in identifying data, such as name, citizenship, address, legal form, or registration data, with supporting document<\/td>\nArticle 36 of the AML Act; GIIF Communication No. 114<\/td>\n<\/tr>\n
      Change in beneficial owner or ownership structure, with verification measures<\/td>\nArticle 34(1)(2) and Article 36 of the AML Act<\/td>\n<\/tr>\n
      Change in the purpose and intended nature of the business relationship, such as new products, markets, or transaction scale<\/td>\nArticle 34(1)(3) of the AML Act<\/td>\n<\/tr>\n
      Analysis of transactions that deviate from the profile and conclusions about consistency with risk<\/td>\nArticle 34(1)(4)(a); GIIF Communications Nos. 22 and 45<\/td>\n<\/tr>\n
      Source-of-funds review, including requested explanations, documents received, and analytical conclusions<\/td>\nArticle 34(1)(4)(b); GIIF Communication No. 22<\/td>\n<\/tr>\n
      Register of updates to documents and data, including dates, scope, and impact on risk assessment<\/td>\nArticle 34(1)(4)(c); GIIF Communications Nos. 22 and 45<\/td>\n<\/tr>\n
      Factors considered when changing the risk assessment and the result, including a change in risk category<\/td>\nArticle 33(2) and (3) of the AML Act<\/td>\n<\/tr>\n
      Decision to apply enhanced due diligence measures in response to a profile change<\/td>\nArticle 43 of the AML Act<\/td>\n<\/tr>\n
      Profile-change history supporting a notification to GIIF<\/td>\nArticles 74 and 86 of the AML Act<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Customer profiles under GIIF Communication No. 114<\/h3>\n

      GIIF Communication No. 114 says an obliged entity should build a customer profile covering:<\/p>\n

        \n
      1. How the customer intends to use the relationship with the institution<\/li>\n
      2. Typical transaction amounts and frequency<\/li>\n
      3. Products and services used<\/li>\n
      4. Geographic areas of activity<\/li>\n
      5. Legal form, whether a natural or legal person<\/li>\n
      6. The customer\u2019s business profile<\/li>\n<\/ol>\n

        Every customer activity is compared with this profile. GIIF Communication No. 45 clarifies that even a review that does not change the risk category must be recorded<\/strong>.<\/p>\n

        Discrepancies with CRBR<\/h3>\n

        Articles 50 to 61 of the AML Act require discrepancies between CRBR information and the entity\u2019s findings to be recorded. GIIF Communication No. 114 emphasizes that an obliged entity cannot rely solely on CRBR information<\/strong> when identifying the beneficial owner. Independent verification steps are required.<\/p>\n

        Data retention: who can access it, for how long, and in what form<\/h2>\n

        The 5-year retention period: from what date?<\/h3>\n

        Article 49 of the AML Act sets a 5-year<\/strong> retention period, but the starting point depends on the category of data:<\/p>\n\n\n\n\n\n\n\n
        Data category<\/th>\nRetention period<\/th>\nPeriod starts from<\/th>\n<\/tr>\n<\/thead>\n
        Copies of KYC documents, risk assessments, and beneficial-owner data<\/td>\n5 years<\/td>\nEnd of the business relationship or the date of an occasional transaction<\/td>\n<\/tr>\n
        Evidence and records of transactions<\/td>\n5 years<\/td>\nEnd of the business relationship or the occasional transaction<\/td>\n<\/tr>\n
        Results of ongoing transaction analyses<\/td>\n5 years<\/td>\nDate of the analysis, regardless of whether the customer relationship has ended<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        GIIF may extend the retention period, for example, for criminal proceedings.<\/p>\n

        AML and GDPR<\/h3>\n

        The AML Act as a special law justifies retaining data for 5 years even where the GDPR data-minimization principle<\/a> might suggest a shorter period. However, the President of UODO says that the right to copy identity documents is not absolute. The institution must assess whether copying is necessary in the specific case, in line with proportionality.<\/p>\n

        After the 5-year retention period, data should be deleted or anonymized unless another law, such as tax, accounting, or procedural rules, justifies retaining it longer. Your company therefore needs a consistent retention policy that accounts for both regimes.<\/p>\n

        Access rules<\/h3>\n
          \n
        1. Need-to-know principle:<\/strong> access to AML data only for people who need it to perform their duties.<\/li>\n
        2. Role and permission system:<\/strong> IT access controls should reflect the organizational structure.<\/li>\n
        3. Access logs:<\/strong> record who accessed which data and when.<\/li>\n
        4. Confidentiality clauses:<\/strong> apply to AML data and remain in force after employment ends.<\/li>\n
        5. Oversight of closed alerts:<\/strong> should be performed by the person managing the AML\/CFT unit, according to the KNF position.<\/li>\n<\/ol>\n

          How often to review KYC<\/h3>\n

          KNF\u2019s Position (Appendix D) sets recommended minimum review frequencies:<\/p>\n\n\n\n\n\n\n\n
          Customer risk level<\/th>\nMinimum KYC review frequency<\/th>\n<\/tr>\n<\/thead>\n
          Low<\/td>\nEvery 4 to 5 years<\/td>\n<\/tr>\n
          Standard<\/td>\nEvery 2 to 3 years<\/td>\n<\/tr>\n
          High<\/td>\nAt least once a year<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          The model procedure of the National Chamber of Legal Advisers (KIRP) adds that a significant change in risk factors requires an immediate update, without waiting for the annual review.<\/p>\n

          Remediation plan: four steps from a dormant procedure to a working system<\/h2>\n

          If your company has an AML procedure but cannot demonstrate continuous monitoring, documented customer-profile changes, or complete decision records, you need a remediation plan. The four stages below can take you from a \u201cdocument on a shelf\u201d to a system that can withstand inspection.<\/p>\n

          Step 1: diagnose the current state<\/h3>\n

          Start by comparing what you have with what the AML Act requires. Check:<\/p>\n

            \n
          1. Does your risk assessment cover all required categories, including customers, countries, products, services, transactions, and distribution channels? Was it updated within the last 2 years?<\/li>\n
          2. Do you maintain a transaction-alert register and document how alerts are resolved?<\/li>\n
          3. Are customer profiles current? Do you record changes to identifying data, beneficial owners, and the purpose of business relationships?<\/li>\n
          4. Do you have training records, including attendance lists and programs, covering everyone who performs AML duties?<\/li>\n
          5. Is documentation stored securely with controlled access?<\/li>\n<\/ol>\n

            Step 2: update the risk assessment and procedure<\/h3>\n

            Based on the diagnosis, update:<\/p>\n

              \n
            1. Institution-level risk assessment<\/strong><\/a>: include changes in the regulatory environment, new products, new markets, and changes in customer profiles. Submit it to the management board for approval.<\/li>\n
            2. Internal AML\/CFT procedure<\/strong><\/a>: align it with the current risk assessment and add missing elements, such as whistleblowing mechanisms, rules for updating customer profiles, and escalation scenarios.<\/li>\n
            3. Data-retention policy<\/strong>: align it with the AML Act\u2019s 5-year period and GDPR data minimization after retention ends.<\/li>\n<\/ol>\n

              Step 3: implement operational processes<\/h3>\n

              The procedure must translate into day-to-day action:<\/p>\n

                \n
              1. Set a KYC review schedule consistent with KNF\u2019s position: annually for high-risk customers, every 2 to 3 years for standard-risk customers, and every 4 to 5 years for low-risk customers.<\/li>\n
              2. Implement \u201con event\u201d updates, such as automatic alerts after a change in CRBR data or a transaction that deviates from the profile.<\/li>\n
              3. Assign someone responsibility for the alert register and oversight of closed cases.<\/li>\n
              4. Provide training before assigning AML duties to new people and after each significant regulatory change (Article 52 of the AML Act and GIIF Communication No. 92).<\/li>\n
              5. Document every review, even when it does not change the customer\u2019s risk category (GIIF Communication No. 45).<\/li>\n<\/ol>\n

                Step 4: internal audit and periodic review<\/h3>\n
                  \n
                1. Conduct an internal audit after implementing changes to check whether processes follow the procedure.<\/li>\n
                2. Plan periodic reviews of the AML system, at least once every 2 years, in line with the risk-assessment update requirement.<\/li>\n
                3. Collect feedback from the team. Employees performing AML duties are often the first to spot process gaps.<\/li>\n
                4. Monitor regulatory changes. The EU AML\/CFT package of 2024 and the creation of AMLA, a new EU AML authority, will bring additional requirements.<\/li>\n<\/ol>\n

                  When to replace spreadsheets and folders with a dedicated tool<\/h2>\n

                  Spreadsheets and network folders may be enough at first, but they have limitations. Missing automatic alerts, risk of overwriting data, access-control problems, and lack of logs become more serious as the business grows.<\/p>\n

                  The European Banking Authority says AML is one of the areas most accessible to product and service solutions in the RegTech context. Tools are available to support KYC, transaction monitoring, risk assessment, and reporting to GIIF.<\/p>\n

                  When to consider a dedicated tool<\/h3>\n\n\n\n\n\n\n\n\n\n
                  Signal<\/th>\nWhy it is a risk<\/th>\n<\/tr>\n<\/thead>\n
                  You serve more than a few dozen customers requiring KYC<\/td>\nManually tracking review deadlines becomes inefficient.<\/td>\n<\/tr>\n
                  Your company processes transactions through several channels, such as branches, a website, and a mobile app<\/td>\nSpreadsheets cannot provide consistent monitoring across all channels.<\/td>\n<\/tr>\n
                  You have high-risk customers, including PEPs or customers from third countries<\/td>\nEnhanced due diligence requires systematic documentation.<\/td>\n<\/tr>\n
                  You cannot demonstrate access logs for AML data<\/td>\nLack of access control breaches the need-to-know principle.<\/td>\n<\/tr>\n
                  Customer-profile updates are delayed by months<\/td>\nAn inspection authority will consider this a breach of the data-currentness requirement.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                  What to watch for when implementing tools<\/h3>\n

                  One risk is rarely discussed in AML automation: analysts relying too heavily on a tool\u2019s recommendations<\/strong>. If the team blindly accepts an algorithm\u2019s results instead of applying its own knowledge and experience, the tool may reduce, not improve, effectiveness. Each institution should assess whether adopting technology will genuinely improve AML processes rather than replace human judgment.<\/p>\n

                  A dedicated tool should:<\/p>\n

                    \n
                  1. Allow integration with GIIF and CRBR using the XML schemas required by the authority<\/li>\n
                  2. Provide role-based access control<\/li>\n
                  3. Record access and change logs<\/li>\n
                  4. Automate alerts when KYC review deadlines approach<\/li>\n
                  5. Generate reports for inspections<\/li>\n<\/ol>\n

                    How we can help<\/h2>\n

                    If your company is an obliged entity with an AML procedure but you are not sure it will withstand an inspection, you need more than document edits. You need to organize the whole system, from risk assessment and operational processes to archived decisions.<\/p>\n

                    We combine legal advice with AMLtrack<\/strong>, which guides the team step by step from customer onboarding and transaction monitoring to reporting. Each component is tailored to the business model and organizational scale.<\/p>\n

                    Our support covers three areas:<\/p>\n

                      \n
                    1. Audit and risk map.<\/strong> We check what you have, what is missing, and where violations may arise, then prepare a report with specific recommendations.<\/li>\n
                    2. AML system implementation (procedures plus AMLtrack).<\/strong> We organize procedures, implement the tool, and train the team. The system guides employees through decisions instead of leaving them open to interpretation.<\/li>\n
                    3. Ongoing support and monitoring of obligations.<\/strong> We track changes in regulations, GIIF communications, and UKNF positions, update procedures, and advise on new requirements.<\/li>\n<\/ol>\n

                      The result is an AML system that organizes decisions, automates repetitive tasks, and gives management control over risk without slowing customer onboarding or business relationships.<\/p>\n

                      An AML procedure is not enough: you need a system that works every day<\/h2>\n

                      An AML procedure in a drawer creates financial, regulatory, and reputational risk. GIIF checks the system, not just the document: continuous monitoring, complete records, current customer profiles, and effective training. The Supreme Audit Office report confirms that supervisory authorities are taking a stricter approach, while the EU AML\/CFT package of 2024 will bring further requirements.<\/p>\n

                      If you want to organize your company\u2019s AML system, from diagnosis through process implementation to selecting the right tool, contact us<\/a>. We will help you move from a dormant procedure to a system that can withstand inspection without blocking the team\u2019s day-to-day work.<\/p>\n

                      Frequently asked questions<\/h2>\n

                      Is having an AML procedure enough to pass a GIIF inspection?<\/strong><\/p>\n

                      No. GIIF checks whether the whole system works, including risk assessment, customer due diligence, ongoing transaction monitoring, staff training, and complete documentation. A procedure is evidence of an adopted approach, not evidence that it has been implemented. If you cannot demonstrate continuous monitoring and documented customer-profile changes, the authority will consider this a breach of statutory duties.<\/p>\n

                      How long must AML documentation be kept?<\/strong><\/p>\n

                      Article 49 of the AML Act sets a 5-year retention period, but the starting point depends on the data category. KYC document copies and transaction records are kept for 5 years after the business relationship ends or from an occasional transaction. Results of ongoing transaction analyses are kept for 5 years from the date of the analysis, regardless of whether the customer relationship has ended. GIIF may extend this period for criminal proceedings.<\/p>\n

                      What is \u201ccontinuous monitoring,\u201d and how do you demonstrate it?<\/strong><\/p>\n

                      Continuous monitoring means transaction analysis, source-of-funds review, and data updates are ongoing processes, not one-off activities performed when a relationship starts. Article 43(3) of the AML Act expressly requires obliged entities to conduct ongoing transaction analysis. To demonstrate continuity, keep alert registers, document analysis results, and record customer-profile reviews, even when they do not change the risk category (GIIF Communication No. 45).<\/p>\n

                      How often should customer profiles be updated?<\/strong><\/p>\n

                      KNF\u2019s Position (Appendix D) sets recommended minimum frequencies: every 4 to 5 years for low-risk customers, every 2 to 3 years for standard-risk customers, and at least annually for high-risk customers. A significant change in risk factors, such as an ownership change or PEP status, calls for an immediate update rather than waiting until the next annual review. Document every update.<\/p>\n

                      When do spreadsheets stop being enough for AML?<\/strong><\/p>\n

                      Spreadsheets become risky when you handle more than a few dozen KYC customers, process transactions through multiple channels, serve high-risk customers, or cannot demonstrate access logs for AML data. A dedicated tool should provide role-based access, automatic alerts before KYC reviews are due, and integration with GIIF and CRBR.<\/p>\n

                      What penalties apply if the AML system does not work?<\/strong><\/p>\n

                      AML violations may lead to administrative sanctions, including a fine of up to EUR 1 million, and criminal sanctions, including a fine and\/or imprisonment from 3 months to 5 years. Fines imposed in Poland have ranged from PLN 100,000 to 200,000 to several million zlotys, and the list of sanctioned entities is public on the Ministry of Finance website.<\/p>\n","protected":false},"excerpt":{"rendered":"

                      Learn what GIIF checks, how to maintain continuous monitoring, and how to turn a dormant AML procedure into an operating system.<\/p>\n","protected":false},"author":9,"featured_media":1895,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"","sip_pair_state":""},"categories":[1576],"tags":[1611,1448,1540,1531,1546],"specialization":[1206],"practice_area":[],"class_list":["post-3895","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-anti-money-laundering","tag-aml-en","tag-compliance","tag-internal-procedure","tag-personal-data-protection","tag-risk-assessment","specialization-aml"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3895"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3895\/revisions"}],"predecessor-version":[{"id":4177,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3895\/revisions\/4177"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/1895"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3895"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3895"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}