What is AML (Anti-Money Laundering)?

AML (Anti-Money Laundering) refers to measures aimed at preventing money laundering. In regulatory practice, this area operates alongside countering the financing of terrorism, which is why the term AML/CFT (Anti-Money Laundering / Countering the Financing of Terrorism) is commonly used.

AML is not a single document, an isolated control, or merely a customer check performed before entering into a business relationship. It is a continuous, risk-based process designed to identify risks associated with the customer, the relationship, and the customer’s activity, and to take appropriate and justifiable measures in response.

In practice, this includes, among other things, risk assessment, customer identification and verification, identification of the beneficial owner, screening, monitoring of business relationships and transactions, analysis of risk indicators, escalation, and documentation of decisions made.

In Poland, the primary national legal act governing this area is the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing. Money laundering itself is a separate concept. AML, on the other hand, refers to the system of measures designed to reduce the risk of an organisation being used for such activity.

What does AML involve in practice?

The foundation of AML is identifying and assessing risk, followed by selecting measures appropriate to that risk. Not every customer, product, transaction, or business relationship presents the same level of risk. Relevant factors may include, among other things, the customer’s profile and business activity, ownership structure, the type of products or services used, the way transactions are carried out, the geographical scope of operations, or the nature of the relationship with the institution.

Effective AML should therefore not consist of mechanically applying the same set of measures to every customer. In practice, the AML process may include:

• risk assessment: determining the risk associated with the organisation’s activities and with a specific customer relationship;
• customer identification and verification: collecting and verifying the required information about an individual or entity;
• identification of the beneficial owner: identifying the person or persons who ultimately exercise control over an entity;
• understanding the purpose and intended nature of the relationship: determining why the customer uses particular services and what their typical activity may look like;
• screening: checking information relevant from the perspective of PEP status, sanctions, and other risk factors;
• monitoring business relationships and transactions: assessing whether the customer’s activity remains consistent with the institution’s knowledge of their business and risk profile;
• analysis of alerts and unusual activity: determining what a detected signal means and whether further action is required;
• escalation and reporting: taking further measures where required by the results of the analysis or by applicable regulations;
• documentation: recording the basis for the assessment, the analysis performed, and the decision made.

An important distinction must be made between a signal and a decision. An alert does not in itself mean that money laundering has occurred. A screening result should not automatically determine the course of action, and successful verification of a customer’s identity does not mean that the AML process has been completed. Information must be assessed in the appropriate context, followed by a decision as to whether standard measures are sufficient, enhanced analysis is required, the risk assessment should be revised, the matter should be escalated, or another action provided for by internal procedures and applicable regulations should be taken. The AML process can therefore be simplified as follows:

risk identification → collection and analysis of information → decision → monitoring → response to changes in risk → documentation.

Who is subject to AML obligations in Poland?

Obligations arising from the AML Act primarily apply to obliged institutions, meaning entities designated by the legislator that, due to the nature of their activities, are required to perform specific duties related to the prevention of money laundering and terrorist financing. This group includes, among others, banks, certain financial and payment institutions, businesses engaged in currency exchange activities, as well as entities specified in the Act that provide certain accounting, tax, legal, or real estate-related services.

This does not mean, however, that every company operating broadly within the financial, legal, or accounting sector is automatically subject to the same obligations. The status of an obliged institution depends on specific statutory criteria and should be assessed on the basis of the entity’s actual business model.

The obligations of an obliged institution are also not limited to maintaining an AML procedure. The organisation should actually carry out the required processes, including assessing risk, applying appropriate customer due diligence measures, conducting adequate monitoring, and documenting how its obligations are fulfilled.

AML vs KYC – what is the difference?

KYC is an element of AML, not a synonym for it. KYC (Know Your Customer) focuses on understanding the customer. It primarily includes customer identification and verification, as well as collecting the information necessary to understand the relationship and assess the associated risk. AML is a broader concept. In addition to KYC, it includes, among other things, risk assessment, identification of beneficial owners, screening, monitoring of business relationships and transactions, analysis of alerts, escalation, reporting, and the organisation’s internal processes and control mechanisms.

KYC can therefore be said to provide part of the information required to make decisions within the AML framework. Merely confirming a customer’s identity is not sufficient if the organisation does not assess that information in the context of risk and does not respond to material changes occurring later in the relationship. For example, a customer may be properly identified and verified at the beginning of a business relationship, but a subsequent change in their business activity, ownership structure, use of services, or transaction patterns may affect the risk assessment and require additional measures.

What role does the GIIF play in the AML system?

A central element of Poland’s system for preventing money laundering and terrorist financing is the General Inspector of Financial Information (GIIF). The GIIF performs the tasks specified in the AML Act, including those related to obtaining, collecting, processing, and analysing information. In carrying out these tasks, the GIIF is supported by the Financial Information Department of the Ministry of Finance, which performs the functions of Poland’s financial intelligence unit.

From the perspective of an obliged institution, this means, among other things, that certain information, transactions, or the results of an analysis may give rise to information or notification obligations towards the GIIF. However, not every alert and not every unusual transaction automatically requires a notification to be submitted. An alert is primarily a signal requiring analysis. Only the outcome of that analysis, assessed in the context of the available information and applicable regulations, should lead to an appropriate decision.

The role of AML is therefore not limited to reporting to the GIIF. Its foundation remains an effective risk management process: from understanding the customer and assessing the relationship, through monitoring and analysing signals, to taking the appropriate action and documenting the decision made.

Why is AML a continuous process?

The risk associated with a customer is not static. During the course of a business relationship, the customer’s activities, ownership structure, use of products, geographical scope of operations, transaction patterns, or other circumstances relevant from an AML perspective may change. Proper verification at the beginning of the relationship is therefore not sufficient for the entire duration of the relationship.

An effective AML system should enable an organisation to answer several fundamental questions:

• who the customer is and what they do;
• who ultimately controls the entity;
• what risk is associated with the relationship;
• whether the customer’s activity is consistent with the information held about them;
• whether circumstances have arisen that affect the previous assessment;
• whether a detected signal requires additional analysis or escalation;
• why a particular decision was made in a given situation.

Only the combination of risk assessment, knowledge of the customer, monitoring, analysis, escalation, and documentation of decisions creates an AML system that works in practice rather than existing solely at the level of procedures.