PRACTICE AREAS
We advise US-managed Polish obliged institutions on AML program design, compliance audits, and regulatory engagement with GIIF.
Senior Associate
I work with IT companies, helping clients draft and negotiate implementation, license, service, and SaaS agreements. I help founders grow their tech projects safely and navigate a business environment that keeps shifting under them. My approach combines analytical thinking with a practical read on what clients actually need and where they're trying to go. Off the clock, you'll usually find me on the tennis court.
Senior Associate
WHO THIS IS FOR
Payment and e-money institutions in Poland are obliged institutions with full AML program requirements — customer due diligence, risk assessment, GIIF reporting, transaction monitoring, and staff training. US-managed Polish payment entities need a program that meets Polish regulatory expectations, not US BSA standards.
Polish crypto entities have been obliged institutions since 2021. The regulatory framework is evolving with EU MiCA implementation. A Polish CASP needs AML documentation, KYC procedures, and GIIF reporting capability that reflects the entity's specific business model.
Real estate agents, accounting firms, auditors, tax advisors, and some corporate service providers are obliged institutions in Poland. US companies whose Polish subsidiaries provide these services may be running AML obligations they haven't assessed.
MOST OFTEN COMMISSIONED BY
OUTCOMES
A functioning Polish AML compliance program provides
Management can prove real oversight - current risk assessments, met obligations, documented training.
Scoped to your actual obligations - not too broad, not too narrow, never overbuilt.
The people making daily calls know the standard and apply it consistently.
GIIF reports go out correctly and on time - silence isn't proof of clean.
Built to work in practice, so a GIIF inspection holds up.
HOW WE WORK TOGETHER
We work with international entities directly – advising the management board, the compliance officer, and the operational team on the Polish AML obligations that apply to the specific entity and business model.
We confirm your obliged-institution status, map the obligations that apply, and check your current program against Polish AML law.
We build or overhaul the program - risk assessment, CDD, GIIF reporting, controls, and the documentation that makes it work.
We train the team on what actually applies - customer ID, risk assessment, red flags, and escalation.
We keep the program running - regulatory updates, periodic reviews, GIIF support, and management reporting.
BLOG
Practical reads on Polish and EU law, written for the people actually running the business – not studying it.
Employment
When deciding to hire a foreigner, it is worth bearing in mind the obligations of the employer that...
IT / AI / IP
Artificial Intelligence (English: Artificial Intelligence, "AI") is an extremely broad topic. It is increasingly being widely discussed in...
Corporate
Special Economic Zones are separate areas within the territory of Poland, where Polish and foreign entrepreneurs can conduct...
YOU OFTEN ASK
On AML, most questions come down to two things – what applies, and who’s personally liable. Here are the answers we give most often.
The EU is implementing a comprehensive AML reform package that includes the establishment of AMLA (the EU Anti-Money Laundering Authority), a new EU-level AML Regulation (directly applicable across all member states, without national transposition), and updated AMLD6 requirements. AMLA will have direct supervisory authority over certain categories of high-risk obliged institutions across the EU from 2026. The EU AML Regulation will create more uniform AML standards across member states. Polish obliged institutions need to monitor both the Polish AML Act and the EU-level reform timeline — requirements will be tightening, and the AML program needs to be structured to evolve with the regulatory environment.
Polish AML Act obligations include: customer due diligence (identification, verification, and ongoing monitoring of business relationships); risk assessment (entity-level assessment of money laundering and terrorist financing risks); enhanced due diligence for high-risk customers, PEPs, and high-risk jurisdictions; internal controls and AML policies and procedures; suspicious transaction reporting to GIIF (Główny Inspektor Informacji Finansowej); staff training; designation of a compliance officer responsible for the AML program; and periodic review of the AML risk assessment. The specific obligations and their intensity depend on the entity’s business model and risk profile.
The Polish AML Act (Ustawa o przeciwdziałaniu praniu pieniędzy i finansowaniu terroryzmu) defines a broad range of obliged institutions that must implement AML compliance programs. The list includes: banks and credit institutions; payment institutions and e-money institutions; investment firms; insurance companies; auditors, tax advisors, and accounting firms; notaries and lawyers (in specific transaction types); real estate agents; gambling companies; crypto asset service providers and virtual currency exchanges; and certain corporate service providers. The scope is broader than many US companies assume — and the classification as an obliged institution triggers the full range of AML obligations under the Act.
GIIF (Główny Inspektor Informacji Finansowej — the General Inspector of Financial Information) is Poland’s financial intelligence unit and the primary AML supervisory authority. GIIF has authority to: receive and analyze suspicious transaction reports (STRs) from obliged institutions; conduct inspections of obliged institutions’ AML compliance programs; impose administrative fines for AML Act violations; refer cases for criminal prosecution for serious violations; and share financial intelligence with law enforcement and international FIU partners. GIIF inspections test the operational reality of the AML program, not just the documentation — inspectors interview staff and review transaction records to assess whether the program functions in practice.
The Polish AML Act creates specific personal liability for management board members and other persons managing the obliged institution. Liability applies for: failure to implement an internal AML compliance program; failure to designate an AML compliance officer; providing false information to GIIF; and failure to apply customer due diligence measures. Fines can be imposed personally on management board members. In cases of serious violation — particularly involving actual money laundering facilitation — criminal liability can apply. US executives managing Polish obliged institutions remotely are within scope of this liability framework if they are management board members of the Polish entity.
