AML obligations are not limited solely to checking a customer before starting a business relationship. An obliged institution should establish a system that enables it to identify and mitigate the risk of money laundering and terrorist financing at every stage of the relationship with the customer. In practice, this means, among other things, the need to carry out risk assessments, apply customer due diligence measures, monitor customers and transactions, implement an AML procedure, train persons responsible for AML obligations, and provide the required information to the General Inspector of Financial Information.
The scope of individual obligations depends on the type of institution and the nature of its activities. However, the basic elements of the AML system are common to obliged institutions specified in the Act on Counteracting Money Laundering and Terrorist Financing.
Who is subject to AML obligations?
The obligations arising from the AML Act apply to obliged institutions. This concept is much broader than banks or financial institutions. The Act includes, among others, certain payment institutions, investment firms, insurance companies, accounting firms, real estate agents, currency exchange businesses, notaries, as well as certain representatives of legal and tax professions and other businesses meeting the statutory criteria. The full list is set out in Article 2 of the AML Act.
The mere fact of being subject to the Act means that the business must be organised in such a way that the institution is capable of fulfilling its AML obligations in practice, rather than merely possessing the appropriate documentation.
Example: an accounting firm that is an obliged institution does not fulfil AML requirements merely by keeping an AML procedure in a binder. It must also assess risk, apply appropriate measures to customers, train persons performing AML duties and document the activities carried out.
What are the most important AML obligations?
The scope of AML obligations is broad, but the most important elements can be divided into several key areas:
- identifying and assessing the risk of money laundering and terrorist financing,
- applying customer due diligence measures, including KYC,
- identifying and verifying beneficial owners,
- ongoing monitoring of business relationships and transactions,
- implementing and updating the internal AML procedure,
- defining responsibility for performing AML obligations,
- training persons performing AML-related tasks,
- documenting activities and retaining required information,
- providing information and notifications to GIIF,
- applying appropriate measures in higher-risk cases, e.g. in relation to PEPs,
- applying restrictive measures and taking applicable sanctions into account.
In practice, these obligations form a single system. Risk assessment affects how KYC is conducted, the outcome of KYC affects customer monitoring, and the manner in which all of these activities are performed should be defined in the AML procedure.
Assessment of money laundering and terrorist financing risk
One of the fundamental obligations of an obliged institution is to identify and assess AML risk. However, it is important to distinguish between two levels of such assessment.
Assessment of the institution’s business risk
An obliged institution should analyse the risk associated with its entire business activity.
Such an assessment takes into account, among other things, factors related to:
- customers,
- countries and geographical areas,
- products and services,
- types of transactions,
- distribution channels or the manner in which services are provided.
The assessment should reflect the actual nature of the business. It should not merely be a copied template that fails to take into account the customers, products and risks specific to a particular organisation. GIIF points out that activities related to risk assessment should be proportionate to the nature and size of the obliged institution.
We discuss this topic in more detail in the article AML Risk Assessment – What Is It and How to Prepare It?.
Assessment of the risk associated with a specific customer
The second level concerns the risk associated with a specific customer, business relationship or occasional transaction. The institution should identify and assess this risk and document it appropriately.
Relevant factors may include:
- type of customer,
- ownership structure,
- geography,
- purpose of the relationship,
- type of product used,
- value and nature of transactions,
- frequency and duration of the relationship.
Only on this basis can the institution determine how intensive its further measures towards the customer should be. The AML Act requires the scope of customer due diligence measures to reflect the identified level of risk.
KYC and customer due diligence measures
One of the most visible AML obligations is the application of customer due diligence measures. In practice, these include the process of getting to know the customer, i.e. KYC. An obliged institution should, among other things:
- identify the customer,
- verify their identity,
- identify the beneficial owner,
- take reasonable measures to verify the identity of the beneficial owner,
- understand the customer’s ownership and control structure where required,
- assess the business relationship and its intended nature,
- monitor the relationship over time.
These elements of customer due diligence measures arise directly from Article 34 of the AML Act. However, merely collecting data is not sufficient.
Example: if the customer is a company, checking its name and KRS number is not enough. The institution should also determine who its beneficial owner is, understand its ownership and control structure, and assess the risk associated with the relationship.
Depending on the outcome of the risk assessment, measures may be applied with varying degrees of intensity. A customer with a simple structure and a low risk level may require a different scope of measures than a customer with a multi-layered foreign structure, links to a high-risk country or an unusual business profile.
Customer monitoring and transaction analysis
AML obligations do not end once onboarding has been completed. An obliged institution should conduct ongoing monitoring of business relationships. Monitoring includes, among other things, analysing transactions carried out during the relationship to determine whether they are consistent with the institution’s knowledge of the customer, their business activity and the identified risk profile.
In practice, this means paying attention to:
- unusual changes in activity,
- transactions inconsistent with the customer’s profile,
- changes in the nature of the business,
- changes in the ownership structure,
- the emergence of new risk factors,
- outdated KYC data.
Example: a customer declares that they run a small service business and, for a year, carries out transactions typical for that activity. Subsequently, significantly larger international transfers begin appearing in their account, the nature of which does not correspond to the known business activity. Such a change should be appropriately analysed.
Monitoring therefore does not mean merely technically detecting transactions exceeding certain values. Its purpose is also to identify behaviour that deviates from the institution’s knowledge of the customer.
Internal AML procedure
An obliged institution should have an internal procedure concerning the prevention of money laundering and terrorist financing. The procedure defines how the obligations arising from the Act are to be performed in practice. It should regulate, among other things:
- the method of identifying and assessing risk,
- the application of customer due diligence measures,
- rules for customer identification and verification,
- the method of monitoring relationships,
- rules for dealing with PEPs,
- the provision of information and notifications,
- documenting activities,
- rules for training persons performing AML duties,
- the allocation of responsibility within the organisation.
The procedure should not be a document prepared once and then left unchanged. It should be adapted to the nature, type and scale of the business and updated if the institution’s activities, regulations or risk profile change. We discuss this topic in more detail in the article AML Procedure – Who Must Implement It and What Should It Contain?.
Appointment of persons responsible for AML
A properly functioning AML system requires a clear definition of who is responsible for individual obligations. Depending on the legal form and size of the entity, responsibility may rest, among others, with members of the management board, senior management or a designated employee. Larger organisations often have a person referred to as an AML Officer or AMLRO, who is operationally responsible for organising and performing AML-related duties. However, appointing an AML Officer does not mean that all responsibility is transferred from the organisation to a single employee.
The system should specify, among other things:
- who makes decisions,
- who performs KYC,
- who assesses cases requiring escalation,
- who is responsible for reporting,
- who approves relationships requiring additional approval,
- who oversees the up-to-date status of procedures and training.
We discuss this role in more detail in the article Who Is an AML Officer and What Do They Do?.
Information obligations and notifications to GIIF
One of the important elements of the AML system is cooperation with the General Inspector of Financial Information. Obliged institutions are required to analyse customer information and activity and respond when circumstances arise that may indicate money laundering or terrorist financing. In cases specified in the Act, the institution should provide GIIF with the relevant information or notifications.
This includes, among other things, situations in which there is a suspicion that a particular transaction or assets may be connected with money laundering or terrorist financing. In cases specified by law, there are also obligations concerning the reporting of certain above-threshold transactions.
Not every unusual transaction automatically means money laundering. However, the institution’s role is to identify the situation, analyse it, document it appropriately and take the measures provided for by the Act and its internal procedure.
AML training
Persons performing AML-related duties should have the knowledge necessary to perform them correctly. The Act requires relevant persons to participate in training programmes concerning the performance of AML obligations, taking into account, among other things, personal data protection.
The training obligation does not apply solely to employees working under employment contracts. GIIF, UKNF and NBP indicate that it also covers other persons performing AML duties, e.g. contractors, agents or persons acting on behalf of the institution. A person should be appropriately trained before beginning to perform tasks in this area.
Importantly, AML training should not be treated as a one-off course. The training programme should ensure that knowledge remains up to date and should take into account changes in regulations, the institution’s activities and the risks involved. Supervisory authorities explicitly indicate that training should be an ongoing process.
Documentation and retention of information
In AML, it is important not only to perform a particular activity, but also to be able to demonstrate that it was carried out correctly. The institution should therefore document, among other things:
- risk assessments carried out,
- data and documents obtained during KYC,
- the method used to identify the beneficial owner,
- analysis results,
- customer due diligence measures applied,
- decisions concerning higher-risk cases,
- measures taken in connection with monitoring,
- required reports and notifications.
The documentation should make it possible to reconstruct the manner in which the institution reached a particular decision.
Example: simply recording in the system that a customer has been classified as “high risk” does not explain why that decision was made. The institution should be able to identify the factors that influenced the assessment and the measures applied as a result.
Current GIIF materials also remind obliged institutions of the requirement to retain the required documentation for the period specified by law; under the basic model, documentation obligations cover a period of at least 5 years.
What are the consequences of failing to comply with AML obligations?
A breach of AML obligations may result in administrative liability and other consequences provided for by law. Importantly, the issue is not limited to a complete absence of an AML system. Problems may also arise from improper performance of individual obligations, e.g.:
- failure to carry out an appropriate risk assessment,
- improper application of customer due diligence measures,
- an outdated procedure,
- lack of training,
- improper documentation of activities,
- failure to submit required notifications,
- inadequate monitoring.
For example, failure to properly fulfil the training obligation may provide grounds for imposing an administrative penalty. GIIF, UKNF and NBP also indicate that the institution must be able to demonstrate that this obligation has been properly fulfilled. Therefore, AML compliance should not be treated as a set of documents prepared solely for the purposes of a potential inspection. The system should actually function in day-to-day customer handling.
Can AML obligations be outsourced?
Some AML-related activities may be performed with the support of an external provider. In practice, outsourcing may include, among other things:
- KYC processes,
- identification and analysis of beneficial owners,
- PEP and sanctions screening,
- analysis of ownership structures,
- updating customer data,
- support in risk assessment,
- preparation and updating of AML documentation,
- performance of certain monitoring-related activities.
Using external support does not, however, automatically transfer statutory responsibility from the obliged institution to the service provider. The institution should still ensure that the obligations are properly performed, appropriately supervise outsourced activities and retain control over the process. The joint position of GIIF, UKNF and NBP concerning training points out, for example, that using a third party to perform certain AML tasks does not release an obliged institution from responsibility for applying customer due diligence measures.
Well-designed outsourcing should therefore not involve “handing AML over to an external provider”, but rather dividing tasks in a way that allows the institution to fulfil its obligations more efficiently while retaining control and responsibility. Depending on the needs, we can support obliged institutions both in individual processes, such as KYC or beneficial ownership analysis, and in the broader organisation of the operational AML system.
Learn more about AML outsourcing