AML penalties — what small firms really pay.

Types of administrative penalties

Art. 150(1) of the AML Act lists five administrative penalties. The authority may impose one or several at once:

Who imposes the penalty depends on who inspected (art. 151): GIIF — on institutions inspected by itself and by heads of customs and tax offices, presidents of courts of appeal, voivodes and district governors; the NBP President — on exchange offices; KNF — on financial market entities. For an accounting office, an agent or a jeweller the decision therefore comes from GIIF.

What the penalties are for

The catalogue of violations is in art. 147–149. The most frequent in decisions against small institutions:

• no internal procedure, or one nobody applies (art. 50),
• no institution-wide risk assessment, or one never updated (art. 27),
• no client risk assessment and no due diligence — no identification, verification, beneficial owner determination or PEP check (art. 33–46),
• no enhanced measures for high-risk clients (art. 43–44),
• no records, or records kept for less than 5 years (art. 49),
• no training (art. 52) and no appointed responsible person (art. 6–8),
• no notifications of above-threshold and suspicious transactions (art. 72, 74, 86),
• recommendations not implemented,
• no beneficial owner filed with the CRBR or false data filed — a separate fine of up to PLN 1,000,000 for the company (art. 153), and for an owner who withheld data from the company — up to PLN 50,000.

A separate chapter is criminal liability: not notifying GIIF of suspected money laundering, or giving false data — imprisonment from 3 months to 5 years (art. 156); obstructing an inspection — up to 2 years (art. 157). These provisions target individuals, not institutions.

How the authority calculates a fine

Art. 150(4) lists the factors the authority must weigh — and describe in the reasoning of the decision:

1. the gravity and duration of the violation — no procedure for 5 years weighs more than a 3-month delay in an update,
2. the institution's scope of responsibility — whether the violation concerned the whole business or one client,
3. the institution's financial capacity — a fine for a one-person office and for a bank differs by orders of magnitude,
4. the benefits gained or losses avoided through the violation, if they can be determined,
5. losses suffered by third parties,
6. the degree of cooperation with the authorities — producing documents, filling gaps during the inspection, implementing recommendations,
7. previous violations — repetition raises the fine.

The Act sets no minimum fine. In especially justified cases the authority may waive it (art. 150(5)): when the violation is negligible and has ceased, or when the institution has already been penalised for the same act by another authority or convicted by a final judgment. The authority may also not open proceedings at all when the violation was not serious and the institution implemented the recommendations (art. 151).

What it comes to in practice. The highest published fine in Poland is PLN 21.66 million for a bank (a GIIF decision of 2022). At the other end — decisions against small institutions: PLN 15,000 for a jeweller for having no responsible person, risk assessment, procedure, training or whistleblowing procedure; PLN 15,000 for a foundation for no risk assessment, no due diligence and no notifications; PLN 30,000 for an exchange office for gaps in transaction reporting. In compilations of published decisions the median fine is in the low thousands of zloty, and the average is inflated by a few fines on large institutions. For a small firm the typical range is the low tens of thousands of zloty — plus publication.

Personal liability of board members

The Act addresses penalties not only to institutions. Art. 154 allows a fine of up to PLN 1,000,000 on the person responsible for implementing the duties — the board member designated under art. 6, or in a sole proprietorship the owner — for violations committed while they held that responsibility. Art. 150(1)(4) additionally allows a ban on managerial duties for up to a year. For financial market institutions the fine on a natural person may reach PLN 20,868,500 (art. 150(3)).

In practice this means the board resolution appointing the responsible person is no formality: it names who pays.

Penalties for breaching sanctions

Independently of the AML Act, the act of 13 April 2022 on special measures to counter support for the aggression against Ukraine applies. For failing to freeze the funds of persons on the MSWiA list or in EU regulations, making resources available to them, not reporting a freeze or circumventing sanctions, the Head of the National Revenue Administration imposes a fine of up to PLN 20,000,000; in public procurement the decision is issued by the President of the Public Procurement Office. The act also provides criminal liability. The duty binds every business — including one that is not an obliged institution. How to check a counterparty and its owners: sanctions screening.

Publication and appeal

Publication. GIIF publishes information on a final decision — the institution's details, the nature of the violation and the type or amount of the penalty — in the Ministry of Finance's BIP (art. 152); it also publishes the filing of a court complaint and the judgment. The data is removed 5 years after publication. The authority may postpone publication or limit its scope (e.g. personal data) where it would be disproportionate to the violation or jeopardise pending proceedings. Publication is a penalty under art. 150(1)(1) — the authority rules on it in the decision, so not every fine means publication, but in practice decisions against small institutions are published.

Appeal. Penalty proceedings follow the Code of Administrative Procedure: the institution has the right to take part, inspect the file and be heard before the decision. A GIIF decision may be appealed to the higher authority — the minister responsible for public finance — within 14 days of delivery, and a final decision challenged before the voivodeship administrative court within 30 days. Filing an appeal suspends enforcement; the appeal should address each factor in art. 150(4) and demonstrate cooperation and remediation.

How the inspection that leads to a decision runs: GIIF inspection. The full catalogue of duties: The AML Act. Text of the Act: ISAP.

Legal state: October 2026. Informational material, not legal advice.