The AML Act — what you need to know if you run a business in Poland.

What money laundering and terrorist financing are

Money laundering is bringing assets that come from crime into the legal economy so that their origin disappears from view. In Polish law it is an offence under art. 299 of the Criminal Code, punishable by 6 months to 8 years of imprisonment. Terrorist financing (art. 165a of the Criminal Code) is collecting or transferring funds with the intent of financing a terrorist offence — whether or not the funds themselves are legal.

The process is usually described in three stages:

1. Placement — cash from crime enters the financial system: deposits, currency or crypto purchases, goods, real estate.
2. Layering — a chain of transactions that blurs the trail: transfers between companies, fictitious invoices, loans, trading through several jurisdictions.
3. Integration — the money returns to the perpetrator as "legitimate" income: a property sale, a dividend, a company's profit.

The AML Act does not prosecute these crimes — that is for prosecutors and courts. Its job is to build a system in which businesses that handle other people's money and assets (obliged institutions) know their clients, recognise suspicious transactions and report them to the General Inspector of Financial Information (GIIF).

Who the Act covers — obliged institutions

The Act does not cover every business. Art. 2(1) lists, in 27 points (with lettered sub-points — over 30 entries), the categories that become obliged institutions by operation of law, with no registration or decision. They include:

• banks, credit unions, payment institutions, investment firms, funds, insurers and insurance intermediaries,
• currency exchange offices and virtual currency service providers,
• notaries, attorneys, legal advisers and tax advisers — for specified services, statutory auditors,
• accounting offices and businesses providing bookkeeping and tax services,
• real estate agents (for rentals — from a monthly rent of EUR 10,000),
• postal operators, gambling operators, lending institutions, pawnshops, credit servicers,
• every business that accepts or makes cash payments for goods of EUR 10,000 or more,
• art and antiques dealers, foundations and associations accepting cash from EUR 10,000.

The full list with thresholds and links to the pages for each sector is on Obliged institutions — the full list. If you carry on any of these activities, the Act applies to you in full — even as a one-person accounting office.

The seven duties of an obliged institution

The Act's requirements come down to seven areas. An inspection checks each of them against documents.

1. The institution's risk assessment (art. 27). A written document describing the money laundering risk of your clients, products, channels and countries. Updated at least every 2 years.
2. The internal procedure (art. 50). A document describing how you perform the duties in practice: who identifies the client, when you apply enhanced measures, how you report transactions. Approved by senior management.
3. Financial security measures (art. 33–37). Identification and verification of the client and the beneficial owner, assessment of the business relationship, ongoing monitoring. Applied when a relationship starts, for an occasional transaction from EUR 15,000 and whenever there is a suspicion. Their scope follows the client's risk — simplified (SDD), standard (CDD) or enhanced (EDD). Details: client identification (KYC), beneficial owner, sanctions and PEP.
4. Responsible persons (art. 6–8). A board member responsible for implementing the duties, a managerial employee responsible for reports to GIIF, and in a one-person business — the owner.
5. Training (art. 52). Documented training programmes for staff performing AML duties.
6. Documentation (art. 49). Copies of documents, analysis results and evidence of the measures applied, kept for 5 years from the end of the relationship or transaction. See: 5-year documentation.
7. Reporting (art. 72–74, 86). Above-threshold transactions (from EUR 15,000) to GIIF, notifications of suspected money laundering or terrorist financing, and reporting discrepancies between the CRBR and your own findings (art. 61a).

Add to this an anonymous whistleblowing procedure for employees (art. 53) and the duty to document the level of measures applied — the inspector expects you to show why you rated a client low or high risk.

GIIF and supervision

The General Inspector of Financial Information is Poland's financial intelligence unit: a secretary or undersecretary of state at the Ministry of Finance, served by the Financial Information Department (gov.pl/giif). GIIF receives notifications, analyses transactions, can suspend a transaction or block an account, refers cases to prosecutors and — importantly for every obliged institution — inspects compliance.

GIIF is not the only inspector. Under art. 130 of the Act, inspections are also carried out by the Financial Supervision Authority (KNF) for the financial market, the President of the National Bank of Poland for currency exchange offices, heads of customs and tax offices, presidents of courts of appeal for notaries, and voivodes and district governors for associations and foundations. In 2025 GIIF itself carried out 7 inspections and the other supervisory bodies 479 (GIIF annual report for 2025). What an inspection looks like and what it asks for: GIIF inspection.

Penalties

For failing in its duties the Act provides administrative penalties (art. 147–154): publication of the violation in the Public Information Bulletin (BIP), an order to stop certain activities, revocation of a licence or permit, a ban on managerial functions for up to a year, and a fine. The fine may reach twice the benefit from the violation or, where that cannot be determined, the equivalent of EUR 1,000,000. For financial market institutions (banks, payment institutions, funds and others under art. 2(1) points 1–5, 7–11, 24 and 25) the ceiling is EUR 5,000,000 or 10% of turnover. The board member responsible for implementation may receive a separate fine of up to PLN 1,000,000 (art. 154). Not filing a beneficial owner with the CRBR costs up to PLN 1,000,000 (art. 153).

In practice, fines for small institutions — accounting offices, jewellers, foundations — in published decisions are usually in the low tens of thousands of zloty, but the decision with the company's name goes to the BIP. More: AML penalties — how they are calculated.

What the EU AML package changes: AMLA and AMLR from July 2027

In June 2024 the EU adopted the AML package: the AMLR regulation (EU) 2024/1624, the AMLD6 directive (EU) 2024/1640 and the regulation establishing the AMLA authority (EU) 2024/1620. The AMLR applies directly in all member states from 10 July 2027 — it unifies the catalogue of obliged entities, due diligence measures and the definition of a beneficial owner, and introduces an EU-wide cash payment limit of EUR 10,000. AMLA, a new authority seated in Frankfurt, has been operating since July 2025 and from 2028 will directly supervise selected large financial institutions. The Polish Act will remain — for supervision, GIIF, the CRBR and penalties — but its substantive part will be replaced by the regulation. Overview: AMLA and AMLR 2027.

Sanctions — every company's duty

The Act of 13 April 2022 on special measures to counter support for the aggression against Ukraine created duties independent of the AML Act — and for everyone, not only obliged institutions. Every business must freeze the funds of persons and entities on the MSWiA list and in the EU sanctions regulations and must not make resources available to them. For a breach the Head of the National Revenue Administration may impose a fine of up to PLN 20,000,000; the Act also provides criminal liability. Screening a counterparty and its owners against sanctions lists is therefore a duty of a shop, a wholesaler or a manufacturer too. How to do it: sanctions screening and sanctions lists.

Text of the Act: ISAP — Dz.U. 2025 item 644.

Legal state: October 2026. Informational material, not legal advice.