AML and Sanctions Legal Services

You report two things: above-threshold transactions over the equivalent of EUR 15,000, and every suspicious transaction (SAR/STR), regardless of amount. Above-threshold transactions are reported within the statutory deadline; suspicious ones without undue delay, once a reasonable suspicion of money laundering or terrorist financing arises.

What matters is not the amount alone but the signals: an unusual pattern, an unclear source of funds, haste, structured payments. It's a judgement, not an automation.

We set the monitoring rules and train the team to document the decision — including a decision not to report, which is also reviewed.

The beneficial owner (UBO) is the natural person who really controls a client or a company — generally holding above 25% of shares or votes, or exercising control in another way. UBO data is filed to the Central Register of Beneficial Owners (CRBR).

There's a trap: as an obliged institution you cannot rely on the CRBR entry alone. You must establish and verify the UBO yourself, because the liability for a mistake is yours, not the register's.

We establish ownership structure — including for foreign and multi-level companies — and tidy up the CRBR filings.

You apply CDD (standard due diligence) to every client; EDD (enhanced) when risk is elevated: a high-risk client, links to a tax haven, a PEP (politically exposed person) or an unusual transaction. EDD means a deeper check of the source of wealth and funds and closer monitoring.

There's a risk the other way too: over-checking where it isn't needed chokes sales and deters good clients.

We calibrate the process to real risk — so it protects the firm rather than blocking it at every step.

Administrative fines reach millions of euro — generally up to twice the benefit or up to EUR 1,000,000, and for certain institutions up to EUR 5,000,000 or 10% of annual turnover; in extreme cases criminal liability follows. GIIF imposes the fine, and breaches also engage Art. 299 of the Criminal Code (money laundering).

The risk is not only money: losing your bank account, licence and reputation can hurt more than the fine itself.

We defend in proceedings and, more importantly, help fix compliance before an inspection turns to it.

AMLA is the new EU anti-money-laundering authority, seated in Frankfurt, which — together with the AMLR regulation — harmonises AML rules across the EU. As a regulation, the AMLR applies directly: the same text binds firms in every Member State, with no national transposition.

AMLA is already operating; direct supervision of the largest cross-border groups starts on 1 January 2028, and full application of the AMLR on 10 July 2027. This is not a tomorrow problem, but the preparation starts today.

We run a gap analysis and an adaptation plan so the new rulebook doesn't take you by surprise.

Screening means checking a counterparty, its owners and transactions against sanctions lists: the EU Consolidated List, UN lists and the US OFAC lists. Checking the name on the invoice is not enough — sanctions also reach entities controlled by listed persons, in the US (OFAC) generally from aggregate ownership of 50% or more, and in the EU from ownership above 50% or, separately, from control — so a company can be caught without a majority stake.

Lists change often, so a one-off check offers no protection — you need a process and repeated screening.

We set the verification rules, examine ownership structure and flag when a transaction is better not done.

A sanctions breach in Poland carries an administrative fine imposed by the Head of KAS — up to PLN 20,000,000 — and at EU level Directive (EU) 2024/1226 introduces criminal liability: up to 5 years' imprisonment, and for companies fines up to EUR 40 million or 5% of worldwide turnover. A breach includes making funds available to a listed person or circumventing a freeze.

The risk is real: the National Revenue Administration has already imposed a PLN 20 million fine for a sanctions breach.

We advise how to build a control that catches the risk before it becomes a proceeding.

When a counterparty or funds are subject to sanctions, you generally must freeze the assets, stop making funds available and report the matter to the competent authority — not wait it out and process the payment. Breaching the ban, even unintentionally, creates liability.

In some situations the law allows you to apply for an authorisation to release funds (a derogation) — e.g. for wages, pre-sanctions contracts or basic costs. That's an exception, not a rule, and it requires an application.

We walk you through the decision — freeze, report, or apply for an authorisation — and prepare the documents.

The travel rule requires that, with every crypto-asset transfer, the originator's and beneficiary's data travel with the transfer — for crypto transfers with no de-minimis threshold at all. It stems from the EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) and has applied since 30 December 2024.

For a crypto-asset firm this means concrete infrastructure: collecting, verifying and passing on the parties' data, plus a procedure for incomplete transfers.

We build the travel-rule compliance process and plug it into the wider AML regime and MiCA.

If you provide crypto-asset services in the EU, you need a CASP (crypto-asset service provider) licence under the MiCA regime, which has replaced the former VASP register. MiCA provided a transitional period for firms operating before 30 December 2024, but it is already ending — today the key step is establishing your current status.

A CASP licence is not just a form: it's AML procedures, the travel rule, capital requirements and KNF supervision.

We guide crypto-asset firms through the licensing process and build the compliance the supervisor expects — not a paper minimum.

An AML audit checks whether your risk assessment, procedures, KYC and reporting actually work — it ends with a report on your level of compliance and a list of recommendations. It's the cheapest moment to find a gap: before an inspection, not during one.

An inspection looks not only at documents but at whether the team knows when to report a transaction and how to document the decision.

We run the audit, close the gaps and prepare the firm and the AML Officer for the conversation with the authority — calmly, with the paperwork in order.