GIIF inspection — what they check and what to show.

Who inspects

Compliance with the AML Act is inspected by the General Inspector of Financial Information (art. 130(1)) and, within their own supervision, by other bodies (art. 130(2)):

In the numbers of the GIIF report for 2025: 7 GIIF inspections (including banks and crypto-asset operators, 191 irregularities found) and 479 inspections by the other bodies, of which the NBP alone inspected 325 businesses running 488 exchange offices and issued 18 penalty decisions totalling PLN 321 thousand. For a small office or agent the most likely visitor is an inspector from a customs and tax office acting within the revenue administration's supervision — with the same powers and the same catalogue of penalties. Annual reports: gov.pl.

How an inspection runs

1. Notice. An inspection of a business follows the Entrepreneurs' Law: the authority gives notice of its intention, and the inspection starts no earlier than 7 and no later than 30 days after delivery. There is no notice when the inspection is justified by a suspected crime or follows directly from EU law — in practice an AML inspection can be unannounced.
2. Authorisation and ID. At least two inspectors act under a written authorisation stating the legal basis, scope, subject, place, start date and expected duration. The inspector shows a service ID. You may check both documents and ask for a copy of the authorisation.
3. Scope. Usually several years back (you keep records for 5 years) and all duties: from the institution's risk assessment to reports to GIIF. It may also concern a single thread — e.g. one client named by a prosecutor.
4. Duration. Activities take place at the institution's premises during business hours. The Entrepreneurs' Law caps the total inspection time for a micro business at 12 working days a year, a small one at 18, a medium one at 24, others at 48; an extension needs written reasons. Inspectors may demand documents, oral and written explanations, copies, access to IT systems and translations of foreign-language documents.
5. Protocol. The inspection is recorded in a protocol with findings, irregularities and attachments. It is signed by the inspectors and the institution's head; each keeps a copy.
6. Objections. Within 14 days of receiving the protocol you may file written objections to the findings. The authority considers and answers them; if you have none, you return the signed protocol within the same period.
7. Post-inspection recommendations. After the protocol (or the reply to objections) the authority sends recommendations with a deadline; the institution reports how it implemented them. Not implementing them is a separate violation.

Obstructing or frustrating an inspection is an offence under art. 157 of the Act — punishable by a fine, restriction of liberty or imprisonment of up to 2 years.

What they ask for: 12 documents

An inspection starts with a list of questions and a demand for documents. A typical list:

1. The institution's risk assessment (art. 27) — written, dated, updated at least every 2 years; the inspector compares it with the actual client list.
2. The internal procedure (art. 50) — approved by senior management, with the dates of adoption and updates.
3. Appointment of responsible persons (art. 6–8) — a board resolution or other document.
4. Client risk assessments (art. 33(2)–(3)) — for each client: risk level, factors, date, person.
5. Evidence of identification and verification of clients and their representatives (art. 36–37): copies of documents, dated register printouts.
6. Determination of the beneficial owner (art. 34(1)(2), art. 37) — who, on what basis, consistency with the CRBR, any discrepancy report (art. 61a).
7. PEP checks — client declarations (art. 46) and evidence of verification.
8. Sanctions screening — proof that the client and the owners were checked against the lists (the act of 13 April 2022, EU regulations).
9. Enhanced due diligence records (art. 43–44) — for high-risk clients: source of wealth and funds, management approval.
10. The transaction register and notifications — above-threshold transactions from EUR 15,000 (art. 72), suspicion reports (art. 74, 86), proof of filing.
11. Training (art. 52) — programmes, attendance lists, certificates, dates.
12. The anonymous whistleblowing procedure (art. 53) and proof it was made available to staff.

The rule is simple: a step that is not in the documents did not happen for the inspector. How to organise the client file: 5-year documentation and due diligence.

The most common findings

In its report for 2025 GIIF names the lack of adequate procedures and the improper application of financial security measures as the most frequent irregularities. Published penalty decisions keep repeating:

• no or outdated institution-wide risk assessment — or one copied from a template, unrelated to the actual clients,
• a template internal procedure, unapproved and unused — staff do not know its contents,
• no client risk assessment, or a single "low" level for everyone with no reasoning,
• no determination of the beneficial owner, or the CRBR copied without verification,
• no PEP declarations and no proof of sanctions-list checks,
• no notifications of above-threshold transactions,
• no documented training and no appointed responsible person,
• documents produced "for the inspection", undated or dated after the notice.

After the inspection: recommendations, penalties, publication

If the violations are not serious and the institution implements the recommendations, the authority may decide not to open penalty proceedings (art. 151). Otherwise an administrative decision follows: publication of the violation in the Ministry of Finance's BIP, an order to stop activities, a ban on managerial functions for up to a year, a fine — up to twice the benefit from the violation or the equivalent of EUR 1,000,000, and for financial market institutions up to EUR 5,000,000 or 10% of turnover (art. 150). The person responsible for implementation may receive a separate fine of up to PLN 1,000,000 (art. 154). The decision can be appealed and then challenged before an administrative court. How the authority calculates a fine and what they amount to in practice: AML penalties.

How to prepare in 30 days

1. Days 1–5: inventory. List which of the 12 documents you have, with what date and in what version. Gaps — on the list.
2. Days 6–10: risk assessment and procedure. Update the institution's risk assessment to the actual client portfolio; align the procedure with what you really do and approve it with a dated management signature.
3. Days 11–20: client files. For every active client: risk assessment, proof of identification, beneficial owner, PEP, sanctions — dated and sourced. A report from an online tool with an identifier and a timestamp closes most gaps in one document.
4. Days 21–25: training and people. Run and document a training session; check the resolution appointing the responsible person.
5. Days 26–30: reporting and order. Check that above-threshold transactions were reported; tidy the 5-year archive; name a contact person for the inspector and prepare a copy of the authorisation for the file.

A document cannot be completed "retroactively" — the inspector compares dates. Better a risk assessment dated today with an honest update note than a backdated one.

Legal state: October 2026. Informational material, not legal advice.