What is an AML procedure?

An AML/CFT procedure is an internal regulation of an obliged institution that defines how the organisation fulfils its obligations related to counteracting money laundering and terrorist financing. It should not be a copy of the Act or a universal template detached from the company’s actual activities. Its purpose is to translate legal requirements and identified risk into specific operating rules: who performs a given activity, what information is analysed, who makes the decision, when escalation takes place, and how fulfilment of the obligation is documented.

The procedure should take into account the nature, type, and scale of the activities carried out. It must also be subject to ongoing review and – where necessary – updating. Before being implemented, the procedure and its updates require approval from senior management. An AML procedure is not a document “for the shelf”. It should describe how the organisation actually performs its AML/CFT obligations.

Who must have an AML procedure?

The obligation to introduce an internal AML/CFT procedure applies to obliged institutions. This does not mean that every company operating in Poland must have an AML procedure. It is first necessary to determine whether the entity falls within the catalogue of obliged institutions specified in the AML Act. Only such status gives rise to obligations under the AML/CFT framework, including the obligation to have an appropriate internal procedure.

The framework can therefore be simplified as follows:

type of activity → status as an obliged institution → AML/CFT obligations → AML procedure.

The procedure itself should also not look identical in every organisation. Different risks, processes, and solutions may arise in an accounting firm, different ones in a payment institution, and still others in an entity serving a large number of customers or operating exclusively remotely. The starting point should therefore be the organisation’s actual business model, not a ready-made document template prepared for an entire sector.

What should an AML procedure contain?

The scope of the internal AML procedure is set out in Article 50 of the AML Act. However, the provision should not be treated solely as a checklist of chapters to be included in the document. Above all, the procedure should explain how the organisation performs its individual obligations in practice.

It should include, among other things, rules concerning:

• actions taken to mitigate money laundering and terrorist financing risk;
• identifying and assessing the risk of a customer or occasional transaction;
• reviewing and updating previous risk assessments;
• applying customer due diligence measures;
• retaining documents and information;
• fulfilling information and notification obligations;
• promoting AML/CFT knowledge among employees;
• reporting actual or potential breaches;
• internal control or supervision of compliance with regulations and the procedure;
• handling information concerning the beneficial owner and discrepancies in this area.

In practice, the procedure may also regulate in detail such processes as KYC and KYB, PEP and sanctions screening, transaction monitoring, alert analysis, handling higher-risk customers, or escalation rules. It is not sufficient simply to state that “the institution applies customer due diligence measures in accordance with the Act”.

The document should make it possible to determine, among other things:

• who performs specific activities;
• at what stage they are performed;
• what information and sources are used;
• who makes the decision;
• when escalation is required;
• how the outcome of the analysis is documented.

The regulations define the obligations. The procedure should show how the organisation performs them in practice.

How does an AML procedure differ from a risk assessment?

An AML procedure and the obliged institution’s risk assessment are directly related, but they are not the same document. An AML/CFT risk assessment primarily answers the question:

What money laundering and terrorist financing risks exist in our business and where are they greatest?

When preparing it, factors concerning customers, countries and geographic areas, products, services, transactions, and delivery channels are analysed, among other things. An AML/CFT procedure, on the other hand, answers the question:

How does the organisation manage the identified risk and how does it fulfil the obligations arising from the regulations?

Put simply:

Document	Main question
AML/CFT risk assessment	What risks exist in the business?
AML/CFT procedure	How does the organisation manage risk and fulfil its obligations?

The risk assessment therefore affects the content of the procedure. If the organisation identifies certain customer groups, products, service channels, or geographic areas as higher risk, the procedure should specify how such risk is handled in practice. The rules for updating the two documents are also different.

The obliged institution’s risk assessment should be updated where necessary, but no less frequently than every two years. In the case of the AML procedure, the Act does not provide for an equivalent fixed two-year deadline – it requires ongoing review and updating where necessary. Therefore, the statement that “the AML procedure must be updated every two years” is imprecise. The risk assessment identifies the problem. The procedure defines how the organisation responds to that risk.

When does an AML procedure need to be updated?

An AML procedure should be reviewed on an ongoing basis and updated whenever it no longer reflects applicable regulations, the identified risk, or the organisation’s actual processes. A change in the law may be a reason for an update, but it is not the only one. The need for a change may also arise in connection with:

• introducing a new product or service;
• changing the customer groups served;
• starting operations in new markets or countries;
• changing the customer service model;
• redesigning the KYC or KYB process;
• implementing a new screening tool;
• changing the way transaction monitoring is conducted;
• outsourcing part of the AML process;
• changing the allocation of roles and responsibilities;
• changing escalation paths;
• the results of an inspection, audit, or internal review;
• changes in identified risk factors.

For example, implementing a new screening system may change the way alerts are generated, analysed, and documented. Outsourcing KYC may require a new allocation of responsibilities and rules for controlling the activities performed. A new product may affect both the risk assessment and the way customer due diligence measures are applied.

Not every minor organisational change must result in the creation of a new version of the procedure. The institution should, however, be able to demonstrate that the document is up to date and reflects the processes actually performed within the organisation. The procedure and its updates require approval from senior management before being implemented. The procedure should keep pace with how the organisation actually operates, not only with subsequent amendments to the Act.

Is simply having an AML procedure enough?

No. Formally possessing a document does not mean that the AML/CFT framework is operating properly. The procedure should be reflected in the actual actions of employees, decisions, systems, forms, escalation paths, and documentation of individual cases.

If the document provides for a specific method of assessing customer risk, the organisation should be able to demonstrate that the assessment is actually carried out. If the procedure describes alert analysis, the documentation of specific cases should show what was checked, what information was used, and why the alert was closed or escalated. If the document sets out rules for handling PEP customers, the organisation should be able to demonstrate that the required approvals, findings, and monitoring are actually carried out.

The procedure should also clearly define roles and responsibilities, including, among other things:

• who performs KYC or KYB;
• who assesses customer risk;
• who analyses alerts;
• who makes decisions concerning higher-risk customers;
• who approves relationships with PEPs;
• when a case is subject to escalation;
• who is responsible for fulfilling specific obligations towards GIIF.

A ready-made procedure template may therefore be a starting point, but it does not replace adapting the document to the business, customers, products, technology, risk, and actual organisation of processes. If the team operates differently from what the procedure describes, a discrepancy arises between the formal AML framework and its actual implementation. The procedure describes how the process should work. The documentation of individual cases shows whether it actually does.