1. Applicability and limitations
A software vendor is not automatically an obliged institution under Polish AML law merely because it sells software online. The company’s actual activities, payment arrangements and any regulated services must be assessed against applicable law. Supporting online payments in software does not itself prove that the seller provides regulated payment services. No AML registration, certification, legal review or successful screening is claimed here.
2. Company verification and responsibility
Before adopting this framework, confirm the registered name, address, KRS, NIP, management and beneficial owners using appropriate official records, including CRBR where applicable. Appoint a responsible person and approve a documented risk assessment and procedures if legally required. These tasks have not been verified or implemented by adding this page.
3. Risk-based customer due diligence
Where the law or a documented risk assessment requires it, identify and verify the customer, representatives and beneficial owners, understand the purpose of the relationship, and assess relevant geography, transaction patterns and politically exposed person risk. Enhanced checks, including source of funds or wealth, may be necessary for higher-risk relationships. Do not invent universal transaction thresholds or collect identification from every visitor without a legal basis.
4. Sanctions and payment controls
A proposed control framework should assess applicable EU, UN and Polish sanctions, resolve potential name matches with reliable identifiers, and use appropriately authorised payment partners. Review unusual third-party payments, inconsistent invoicing, fragmented transactions and unexplained refunds. Document decisions and escalations. This website has no newly implemented screening, identity verification or payment-monitoring system, and does not certify customers as cleared.
5. Suspicious activity and escalation
Staff procedures should identify who reviews warning signs and when activity must be paused, refused or escalated under applicable law. If the company is an obliged institution, notifications to Poland’s GIIF and anti-tipping-off duties must follow the statutory requirements. General suspicions do not justify declaring a customer criminal. A public contact form is not an official GIIF reporting channel and should not receive identity documents or sensitive financial evidence.
6. Records, privacy and training
If Polish AML retention duties apply, covered records are generally retained for five years from the legally defined starting point, with extensions only on a lawful basis. This is not a blanket retention period for all website enquiries. Define access controls, secure evidence storage, deletion, staff training, periodic reviews and independent checks as required. No such operating programme or training record has been confirmed for this copy.
7. Evidence required for a review
A reviewer may request registration documents, ownership information, the actual business model, risk assessment, adopted procedures, named responsibilities, payment-provider arrangements and evidence that controls work. Provide authentic current records, not invented compliance claims. Whether any particular review is passed remains the reviewer’s decision. This draft cannot guarantee AML, bank, payment-provider or legal approval.
8. Legal references
Assess the Polish Act of 1 March 2018 on counteracting money laundering and terrorist financing, applicable sanctions rules and GDPR. EU Regulation 2024/1624 generally applies from 10 July 2027, with exceptions; do not describe all of it as already applicable in October 2026. Obtain a qualified assessment of the business’s actual obligations before adopting this draft.