AML in a Polish Property Development Group: Which Companies Have Duties, and What Can the Bank Require?

AML in a Polish Property Development Group: Which Companies Have Duties, and What Can the Bank Require?

When the board of a property development group asks, “Are we subject to AML requirements in Poland?”, the answer must be worked out company by company. A second answer may be waiting in the financing agreement: even if a company is not an obliged entity under Polish anti-money laundering law, its bank may require documented checks on customers and counterparties.

These are different regimes. One arises under the Polish Act of March 1, 2018 on Counteracting Money Laundering (the AML Act); the other arises from a covenant in a credit agreement. The contractual requirement can be particularly urgent because the bank may ask for evidence directly, without waiting for an inspection by Poland’s AML authority.

This article explains how to assess each group company, keep statutory and contractual requirements separate, and build a verification process that leaves a usable record.

Key terms

Determine AML status company by company

Corporate groups in property development may contain a dozen or several dozen entities with different roles. Project companies build developments and receive buyers’ payments. A sales company finds buyers and negotiates transactions. A management company may keep the accounts for the group.

There is no collective AML status for the group. Article 2(1) of the AML Act sets out an exhaustive list of obliged entities. Classification depends on what a particular company actually does, not on its place in the ownership structure.

For each company, ask:

1. What activities does it actually perform?
2. Do any of those activities fall within Article 2(1) of the AML Act?
3. Does it accept cash payments exceeding the equivalent of EUR 10,000?

Document the assessment. The record should explain both why certain companies need AML procedures and why others do not.

Where status is most likely to arise

As a general rule, a developer selling only units built in its own name and for its own account is not an obliged entity on the basis of real estate intermediation. A separate sales company acting on behalf of project companies may be different. Examine who contracts with the buyer, who concludes reservation and development agreements, and whether the sales company acts under a power of attorney.

Separate legal personality matters: a sales company does not acquire title to a project company’s units simply because both belong to the same group. See the AML Act consolidated text in Poland’s official legal information system, ISAP.

A group-wide procedure does not replace each obliged company’s documentation. Article 51 of the AML Act does not allow one statutory procedure to cover every holding-company subsidiary indiscriminately. It concerns obliged entities within the group, their branches, and majority-owned subsidiaries in a third country. Each company subject to the Act needs its own set of documents, although the documents can use a common template. See Ministry of Finance Notice No. 35 on group-wide AML/CFT procedures.

Separate the bank covenant from the statutory AML duty

A company may conclude that it is not an obliged entity and still receive a request from its financing bank to show how it verifies customers and counterparties.

The bank is itself an obliged entity. Articles 33–36 of the AML Act require it to identify and verify its customer, identify the beneficial owner, and monitor the relationship. If it cannot apply required measures, the Act prohibits it from establishing a business relationship or requires it to end one. See the AML Act.

Article 70 of the Polish Banking Law also requires a bank to assess creditworthiness before entering into a credit agreement. Banks review registry information, financial statements, and cash flows; see this PARP material on business financing. These obligations provide the practical background for information and verification covenants imposed on borrowers.

A bank’s requirement does not turn a borrower into an obliged entity. A company verifying counterparties solely because its financing agreement requires it should not claim obliged-entity status. The approved source warns that declaring that status without a statutory basis amounts to voluntarily taking on the full regime of duties and liability.

Keep the two bases distinct in internal documents. For example: “Counterparty verification is performed under the obligation in § X of credit agreement No. Y, not under the AML Act.”

If you need help distinguishing the regimes and preparing the documentation, contact us.

What happens if procedures or evidence are missing?

Statutory penalties

Article 147 of the AML Act provides for administrative measures against obliged entities, including:

1. Publication of information about an infringement
2. An order to cease an activity
3. Withdrawal of a license or permit
4. A ban on performing managerial duties, directed at a particular individual
5. A financial penalty

A Minister of Finance decision records a PLN 50,000 penalty for combined infringements: no person responsible under Article 8, no risk assessment under Article 27, failure to apply customer due diligence measures under Article 33, and no internal procedure under Article 50.

The GIIF 2024 annual report records PLN 441,500 as the total value of penalties in decisions issued that year: 31 decisions imposing financial penalties and two ordering publication in the Public Information Bulletin, a Polish government publication system. A Supreme Audit Office report gives examples from other proceedings: PLN 60,000 for missing risk assessment and due diligence measures, and PLN 1,500 for infringements involving risk assessment, documentation, and procedures.

Contractual consequences

If a borrower cannot show its bank that counterparty verification operates in practice, the credit agreement may provide for suspension of the next drawdown, termination, or early repayment of the loan. The exact mechanism depends on the agreement. These are contractual consequences, not GIIF administrative penalties.

Why the audit trail matters

Article 49 of the AML Act requires documentation of customer due diligence measures applied by an obliged entity. In a judgment of May 22, 2019 (II GSK 1905/17), Poland’s Supreme Administrative Court said it was not enough for a party to state that it knew and trusted its counterparties. Had it performed its statutory duties, the Court said, it would not have had difficulty demonstrating that fact.

The operational lesson also matters when a bank asks for proof: a check with no retained record is difficult to demonstrate.

Build a counterparty verification process that produces evidence

Define a consistent scope across the group

The legal basis may differ between companies, but a consistent scope of checks makes results comparable. Apply each company’s own legal and contractual requirements when setting its procedure.

Avoid three sanctions-screening failures

Checking only the company name. A listed person may be a representative, attorney-in-fact, or beneficial owner. Include relevant individuals behind the counterparty.

Using only exact matches. Names may appear in different transliterations, with variant given names or spelling errors. An exact-string search can return “no matches” while missing the relevant entry. Use fuzzy matching and retain a report showing the variants compared.

Checking only at onboarding. Lists change without notice. A check made when an agreement is signed establishes what was found on that date, not what will be found later. Set a rescreening schedule for long-term relationships.

The Polish national sanctions list is published by the Ministry of the Interior and Administration in the Public Information Bulletin as an HTML table. There is no guaranteed API or downloadable file. EU sanctions information is available through European Commission tools. Automated retrieval of the Polish list is possible, but HTML parsing carries no guarantee that the page structure will stay the same.

Combine data checks with a human risk decision

Use two layers:

1. Data layer: registry details, sanctions-screening results, links between parties, and CRBR status.
2. Assessment layer: the sector’s risk, whether the stated business fits the transaction, and whether the counterparty cooperates with verification.

Treat refusal to cooperate as an indicator of increased risk.

In a judgment of August 10, 2021 (V SA/Wa 2574/21), the Provincial Administrative Court said verification activities should be “proportionate to the nature and size of the obliged entity.” The source’s practical point is that a smaller property development group company need not use bank-level procedures, but an obliged company still needs procedures and evidence that it follows them.

Retain proof of each check

Keep, as applicable:

1. A verification report in a non-editable format, such as a PDF or saved system record, in the relevant file
2. A system log recording the date, scope, and person who performed the check
3. A dated, signed PEP-status declaration from the counterparty
4. A discrepancy report—for example, where the proposed signatory is not shown in KRS as authorized to represent the entity

Article 49(1) of the AML Act provides a five-year retention period from the end of the relationship or completion of the transaction for documentation within its scope. GIIF may require longer retention, but the source notes this only for financial obliged entities. Do not apply the statutory period automatically to a company performing checks solely under a bank covenant; its retention position needs separate analysis.

Sanctions matter even without obliged-entity status

The obligation to comply with Poland’s national sanctions list under the Act of April 13, 2022 on special measures to counteract support for aggression against Ukraine extends to a broad range of entities, including companies that are not obliged entities under the AML Act.

EU sanctions under Council Regulations (EC) No. 765/2006 and (EU) No. 269/2014 apply directly, without national implementing legislation. Lists maintained by third countries or international organizations are not directly binding on a Polish business merely as such, but can matter in dealings with banks and foreign counterparties.

Even without obliged-entity status or a bank covenant, a company must consider applicable sanctions.

Address GDPR when collecting verification data

Checking counterparties, representatives, and beneficial owners involves processing personal data under the EU General Data Protection Regulation (GDPR). Review three issues:

1. Legal basis. For an obliged entity performing a legal duty, the source identifies Article 6(1)(c) GDPR. For checks performed under a bank agreement, relying on legitimate interests under Article 6(1)(f) requires further analysis. See the GDPR on EUR-Lex.
2. Data scope. Article 5(1)(c) GDPR limits collection to what is necessary. PEP status is not itself a special category of data under Article 9, but verification may involve sensitive data; if it does, an additional basis under Article 9(2) is needed.
3. Retention. The five-year rule in Article 49 of the AML Act applies to obliged entities. Where the basis for verification is contractual, determine retention by reference to the bank agreement and GDPR’s accountability principle.

Plan for July 10, 2027

Regulation (EU) 2024/1624, known as the AMLR, will generally apply from July 10, 2027. Article 80(1) establishes an EU cash-payment limit of EUR 10,000 for persons trading in goods or providing services, covering a single transaction or several linked transactions. Member States may keep or introduce lower national limits. See the AMLR on EUR-Lex.

Article 3 of the AMLR includes real estate intermediaries and entities carrying out certain real estate activities on behalf of a customer within its list of obliged entities.

Until July 10, 2027, the Polish AML Act and its national list of obliged entities continue to apply. Review documentation and procedures ahead of that date. Give each policy and procedure an owner and a review date, with July 10, 2027 recorded as a milestone.

Design the process before buying software

Buying a screening system before deciding what to check can leave a group with a tool configured around an undefined process. Use this order instead:

1. Map each group company and document its status.
2. Identify statutory duties and bank covenants separately.
3. Define the data and sources for verification.
4. Decide who checks, when, how results are recorded, and how often checks recur.
5. Select a tool that supports that process.

The AML Act prescribes no mandatory software. Checks may be manual, semi-automated, or supported by a commercial product, provided the controls are appropriate and their performance can be demonstrated.

If one group company performs checks for others under Article 47 of the AML Act, responsibility for the provider’s errors remains with the company commissioning the work. Using a third party for customer due diligence does not transfer liability. The source identifies this arrangement as limited to the first three measures in Article 34(1)(1)–(3), excluding transaction analysis and periodic verification.

How we can help

Mapping a Polish group’s AML position calls for company-law, AML, sanctions, and credit-agreement analysis together. Our support has three levels:

We do not sell software or purchase tools for clients. We design the process first and select a suitable tool afterward. Get in touch.

Where to start

Statutory AML duties and bank covenants can both call for documented verification, but they have different sources, consequences, and reviewers. Do not present them as a single undifferentiated obligation.

Start by:

1. Assessing and documenting each company’s position
2. Separating statutory and contractual requirements in the records
3. Setting a consistent scope of checks and retaining proof that they were completed

For help mapping the group, preparing procedures, or meeting a financing bank’s verification requirements, contact us.

Frequently asked questions

Does every company in a group need its own status assessment?
Yes. Article 2(1) of the AML Act looks at the activities of the particular entity. Group membership does not transfer obliged-entity status up or down the structure. Document the outcome, including the reasons a company does not need a statutory AML procedure.

Our management company keeps the other group companies’ accounts. Is it an obliged entity?
It may be if it provides accounting services within the statutory definition. Check what it actually does and whether it keeps the accounts under a separate agreement, including an intra-group agreement.

Does a bank covenant requiring counterparty checks make our company an obliged entity?
No. A contractual requirement does not itself confer statutory status. If the company is not an obliged entity, its documents should identify the credit-agreement obligation rather than claim that it verifies under the AML Act.

What if we cannot demonstrate compliance with a bank-only requirement?
The consequences depend on the agreement and may include a suspended drawdown, termination, or acceleration of the loan. This differs from a GIIF administrative penalty, although the financial impact may be substantial.

How often should sanctions screening be repeated?
Set intervals based on risk and the nature of the relationship. A one-off check records the position only when it was made. For regular counterparties, establish periodic rescreening at defined intervals.

Do PEP-status declarations breach GDPR?
PEP status is not itself special-category data under Article 9 GDPR. An obliged entity may rely on the legal-obligation basis identified in Article 6(1)(c); verification under a bank agreement requires analysis of the legitimate-interests basis in Article 6(1)(f). In either case, collect only what is necessary.