Customer due diligence measures are actions that an obliged institution applies to customers in order to identify and mitigate the risk of money laundering and terrorist financing. They are not limited solely to checking an identity document. They also include identifying the beneficial owner, understanding the purpose and nature of the relationship with the customer, and conducting ongoing monitoring.
The Polish AML Act requires obliged institutions to identify and assess the risk associated with a specific customer, business relationship or occasional transaction. The scope and intensity of the measures applied should correspond to that risk.
In practice, this means that a proper process does not end with a one-off KYC check during onboarding. Customer due diligence measures should operate throughout the entire relationship with the customer, and some activities related to their application may be entrusted to an external provider under the rules set out in the Polish AML Act.
What are customer due diligence measures?
Customer due diligence measures are a statutory element of the system for counteracting money laundering and terrorist financing. Under Article 33 of the Polish AML Act, obliged institutions apply them to their customers and identify and assess the risk of money laundering and terrorist financing associated with a business relationship or occasional transaction.
They are therefore not a single form or a one-off activity performed at the beginning of cooperation. Customer due diligence measures form a process that allows the institution to answer questions such as:
- who the customer is,
- who actually controls a customer that is, for example, a company,
- what the purpose of the relationship is,
- what type of activity can be expected from the customer,
- what level of risk is associated with the relationship,
- whether subsequent transactions are consistent with the institution’s knowledge of the customer.
The manner in which these measures are applied should result both from the regulations and from the identified level of risk.
What customer due diligence measures are provided for under the Polish AML Act?
Article 34 of the Polish AML Act identifies four basic areas of customer due diligence measures: customer identification and verification, identification and verification of the beneficial owner, assessment of the business relationship, and ongoing monitoring of that relationship.
1. Customer identification and verification of identity
The first element is determining who the institution is dealing with. It is worth distinguishing between two concepts:
customer identification involves establishing the required data, while identity verification involves confirming that data on the basis of appropriate documents, data or information obtained from a reliable and independent source.
In the case of a natural person, this therefore involves more than simply collecting their name or document number. The institution must also confirm that the data obtained actually relates to the person with whom it is establishing the relationship. In the case of a company, the process includes, among other things, establishing the details of the entity and the persons representing it and verifying them using appropriate sources.
This is one of the fundamental elements of the KYC process, but it does not cover the entire scope of customer due diligence measures.
2. Identification and verification of the beneficial owner
If the customer is a company, foundation, trust or another structure, the obliged institution should determine who its beneficial owner is. This is not limited to identifying the person listed in a register. The institution should:
- identify the beneficial owner,
- take reasonable measures to verify their identity,
- where appropriate, determine the customer’s ownership and control structure.
Example: the customer is a company owned by another company, which in turn is controlled by another foreign entity. Checking only the direct shareholders of the first company is not sufficient. The structure must be analysed down to the level of the natural person or persons exercising ultimate control.
The Polish Central Register of Beneficial Owners (CRBR) may be used in this process, but checking an entry in the register alone does not replace the obligation to properly identify and verify the beneficial owner.
3. Assessment of the purpose and nature of the business relationship
Customer due diligence measures also include assessing the business relationship and, where appropriate, obtaining information about its purpose and intended nature. The institution should therefore know not only: “Who is the customer?”
but also:
“Why does the customer want to use our services and what type of activity can we expect from them?”
Example: a company declares that it will use a particular product to settle its ongoing domestic business activity. This information provides context for subsequent monitoring. If, after the relationship begins, numerous high-value transactions appear involving countries with which the customer previously had no links, this may require additional analysis.
The purpose of the relationship should therefore not be information collected solely to complete a field in a KYC form.
4. Ongoing monitoring of business relationships
The application of customer due diligence measures does not end once the customer has been accepted. The Polish AML Act requires ongoing monitoring of business relationships. This includes, among other things:
- analysing transactions in the context of the institution’s knowledge of the customer, their business activity and risk level,
- examining the source of funds or assets where justified by the circumstances,
- ensuring that documents, data and information relating to the relationship are kept up to date.
Example: a customer operates for two years with a relatively stable business profile. They then change their ownership structure, begin operating in new countries and significantly increase the value of their transactions. The institution should not rely solely on information obtained two years earlier.
Monitoring and KYC updates are an integral part of customer due diligence measures.
When should customer due diligence measures be applied?
Customer due diligence measures are applied primarily when establishing a business relationship, but the Polish AML Act also provides for a number of other situations. Under Article 35 of the Polish AML Act, the obligation may arise, among other things, when:
- establishing a business relationship,
- carrying out an occasional transaction with a value equivalent to at least EUR 15,000,
- carrying out certain transfers of funds exceeding the equivalent of EUR 1,000,
- carrying out certain transactions involving virtual currencies with a value equivalent to at least EUR 1,000,
- carrying out certain occasional cash transactions with a value of at least EUR 10,000,
- carrying out certain gambling-related activities with a value of at least EUR 2,000,
- there is a suspicion of money laundering or terrorist financing,
- there are doubts as to the accuracy or completeness of previously obtained customer identification data.
The specific thresholds and situations do not apply to all obliged institutions in exactly the same way. Their application should take into account the category of the entity and the full wording of the relevant provisions.
Are customer due diligence measures applied only to new customers?
No. The Polish AML Act also requires them to be applied to existing customers with whom the institution already maintains business relationships, taking into account the identified risk. This may be necessary in particular where:
- the nature or circumstances of the business relationship have changed,
- the customer’s data has changed,
- the beneficial owner’s data has changed,
- another situation arises that requires information to be reverified.
This means that KYC should not be treated as a procedure performed only once during onboarding. If the customer or the nature of the relationship changes, the institution’s understanding of the risk should also change.
What determines the scope of customer due diligence measures?
The Polish AML Act bases the application of customer due diligence measures on a risk-based approach. An obliged institution should identify, assess and document the risk associated with a specific business relationship or occasional transaction. The assessment takes into account, among other things:
- the type of customer,
- the geographical area,
- the intended use of the account,
- products and services,
- the way they are distributed,
- the value of assets or transactions,
- the purpose of the relationship,
- its regularity and duration.
Only on this basis does the institution determine the scope and intensity of the measures applied.
Example: a local company with a simple ownership structure and a transparent business profile may require a different level of verification than a company with several layers of ownership across different jurisdictions, carrying out high-value transactions involving higher-risk areas.
This does not mean, however, that an institution can simply abandon its statutory obligations where the risk is lower. The risk-based approach concerns the manner and intensity with which those obligations are performed. We discuss the risk identification process in more detail in the article AML Risk Assessment – What Is It and How to Prepare It?.
Simplified customer due diligence measures – when can they be applied?
If the assessment of a specific relationship or transaction confirms a lower risk of money laundering or terrorist financing, the institution may apply simplified customer due diligence measures. A lower level of risk may be indicated, among other things, by the characteristics of the customer, the nature of the product or service, the transparency of the structure and links to countries considered lower-risk jurisdictions on the basis of reliable sources.
Simplification does not mean: “we do not need to perform KYC”. It means adapting the manner in which the measures are applied to the confirmed lower level of risk.
Importantly, simplified measures cannot be applied where there is a suspicion of money laundering or terrorist financing or doubts as to the accuracy or completeness of the customer identification data held. The decision to apply simplified measures should therefore result from a documented risk assessment rather than merely an assumption that a particular customer “seems safe”.
Enhanced customer due diligence measures – when are they required?
If the institution identifies a higher risk of money laundering or terrorist financing, it should apply enhanced customer due diligence measures. The Polish AML Act identifies a number of factors that may indicate higher risk. These include, among other things:
- establishing a relationship in unusual circumstances,
- an unusual or excessively complex ownership structure of the customer,
- a significant number or high value of cash transactions,
- the use of products that favour anonymity,
- certain relationships established without the customer’s physical presence where the risk has not been adequately mitigated,
- links to certain high-risk countries or geographical areas.
Enhanced measures are also applied in specific situations set out in further provisions of the Act, including relationships with persons who have PEP status. The scope of additional measures depends on the specific circumstances.
These may include, for example:
- obtaining additional information about the customer and beneficial owner,
- establishing the source of wealth or funds in greater detail,
- obtaining additional clarification of the purpose of a transaction,
- increasing the frequency of monitoring,
- analysing a greater number of transactions,
- obtaining appropriate internal approval.
In higher-risk cases, it is therefore not sufficient simply to label the customer as “high risk”. The outcome of the assessment should lead to specific actions.
Customer due diligence measures and KYC – are they the same thing?
They are not completely identical concepts. KYC (Know Your Customer) is a commonly used term for the process of getting to know and verifying a customer. Customer due diligence measures, on the other hand, are a concept arising directly from the Polish AML Act and cover a broader process. They include, among other things:
- customer identification and verification,
- identification and verification of the beneficial owner,
- analysis of the ownership and control structure,
- assessment of the purpose and nature of the relationship,
- ongoing monitoring,
- transaction analysis,
- updating customer information.
KYC can therefore be described as a very important part of the practical implementation of customer due diligence measures, but customer due diligence measures do not end with KYC performed during onboarding.
What if customer due diligence measures cannot be applied?
An inability to apply a required measure should not be treated as a simple missing document that can be ignored while customer service continues. Article 41 of the Polish AML Act provides that where an obliged institution cannot apply one of the measures specified in Article 34(1), as a rule it:
- does not establish a business relationship,
- does not carry out an occasional transaction,
- does not carry out a transaction through a bank account,
- terminates the existing business relationship.
The institution should additionally assess whether the inability to apply the measures provides grounds for submitting a notification to the Polish General Inspector of Financial Information (GIIF). The Act also provides for specific exceptions concerning certain activities performed by some legal professionals.
Example: the customer has a multi-layered ownership structure, but despite taking appropriate measures, the institution is unable to reliably establish the information necessary to properly apply customer due diligence measures. It cannot simply mark a field as “no data” and accept the customer under standard conditions.
Such a situation requires a decision consistent with Article 41 and appropriate documentation of the grounds for that decision.
Can customer due diligence measures be outsourced?
Yes. The Polish AML Act expressly provides for the possibility of entrusting the application of customer due diligence measures to an external provider.
Under Article 48, an obliged institution may entrust the application of customer due diligence measures and the conduct and documentation of the results of ongoing transaction analysis to a natural person, legal person or organisational unit acting in the name and on behalf of the obliged institution. The arrangement should be based on a written agreement, and the service provider is treated as part of the obliged institution for this purpose.
In practice, external support may include, among other things:
- customer identification and verification,
- KYC and KYB processes,
- analysis of ownership structures,
- identification and verification of beneficial owners,
- PEP and sanctions screening,
- obtaining and analysing customer documentation,
- support in customer risk assessment,
- updating KYC data,
- ongoing monitoring,
- analysis of alerts and transactions,
- documenting the activities performed.
Entrusting these activities does not, however, mean transferring statutory responsibility. Article 48(2) expressly provides that entrusting the application of customer due diligence measures does not release the obliged institution from responsibility for their application. AML outsourcing should therefore be organised appropriately. The institution should know:
- which activities are performed by the external team,
- according to what rules they are carried out,
- which cases require escalation,
- how completed activities are documented,
- who makes decisions in higher-risk cases,
- how the institution supervises the quality of the process.
Well-designed outsourcing therefore does not involve “transferring responsibility for AML”, but rather the operational performance of specific processes by a specialised team while responsibility and oversight remain with the obliged institution.
Do customer due diligence measures have to be documented?
Yes. The Polish AML Act requires documentation of the customer due diligence measures applied and the results of ongoing transaction analysis. Moreover, at the request of the competent authority, the obliged institution should be able to demonstrate that the scope of the measures applied was appropriate to the identified risk. In practice, the documentation should make it possible to determine, among other things:
- what information was obtained from the customer,
- which sources were used during verification,
- how the beneficial owner was identified,
- which risk factors were identified,
- what risk level was assigned to the customer,
- why a particular scope of measures was applied,
- what additional activities were performed in higher-risk cases,
- how the relationship was monitored and updated.
Example: simply recording “customer verified” in the system does not show what measures were applied or whether they were appropriate to the risk.
Similarly, simply labelling the customer as “high risk” is not sufficient if the documentation does not show which factors led to that assessment and what measures were taken as a result. Failure to properly document the measures applied is also one of the infringements for which the Polish AML Act provides for the possibility of an administrative penalty.
How should customer due diligence measures work in practice?
The proper application of customer due diligence measures should form one coherent process. In simplified form, it may look as follows:
customer identification → identity verification → identification of the beneficial owner → understanding the purpose of the relationship → risk assessment → selection of the intensity of measures → monitoring → data update and reassessment
The individual elements should not operate independently of one another. If an unusual ownership structure is identified while determining the beneficial owner, this should affect the risk assessment. If the customer’s subsequent activity does not correspond to the declared purpose of the relationship, this should affect monitoring and potentially trigger a KYC update. This is why customer due diligence measures should be treated as an ongoing process, rather than a set of forms completed before an agreement is signed.
Part of the operational implementation of this process may be entrusted to an external team in accordance with Article 48 of the Polish AML Act. The obliged institution nevertheless remains responsible for the proper application of the measures and should be able to supervise and reconstruct the activities performed.
If your organisation needs support in applying customer due diligence measures, we can take over ongoing processes related to, among other things, KYC and KYB, customer verification, beneficial ownership analysis, PEP and sanctions screening, risk assessment, data updates and monitoring. The scope of cooperation can be tailored to the type of institution, number of customers, existing procedures and which elements of the process the organisation wishes to perform internally and which it wishes to entrust to an external team.
Contact us
office@amloutsourcing.pl