AML vs Sanctions — What Is the Difference and Why They Are Not the Same

If someone told you that sanction screening is a matter for banks and firms covered by the AML Act (the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing), you were misinformed. AML and the EU sanctions regime are two separate legal systems — with different legal bases, different scopes of application, and different supervisory authorities. Council Regulation (EU) No 269/2014¹ applies to every company operating in the European Union, regardless of whether it is an obliged entity within the meaning of the AML Act. This article explains that distinction once and for all.

Legal status as of: 2026-05-20.

TL;DR — six key differences at a glance

• AML (anti-money laundering and counter-terrorist financing) is the Act of 1 March 2018, which imposes obligations on a closed list of entities — so-called obliged entities — primarily banks, accounting offices, estate agents, notaries, and similar.
• EU sanctions arise from EU regulations (chiefly No 269/2014¹ and No 833/2014²), which apply directly to every natural and legal person on the territory of the Union — without any sectoral exception and without any threshold based on company size.³
• If your company is not an AML obliged entity, you still have a sanction screening obligation arising directly from EU regulations and the Act of 13 April 2022.⁴
• The authority responsible for AML is the GIIF (Generalny Inspektor Informacji Finansowej — General Inspector of Financial Information); the authority responsible for sanctions enforcement against non-financial firms is the Head of the National Revenue Administration (Szef Krajowej Administracji Skarbowej)⁵ — these are two different institutions with two different inspection procedures.
• The administrative fine for a breach of the sanctions obligation is up to PLN 20,000,000⁶, regardless of whether the company is an AML obliged entity.
• If your company is an AML obliged entity, you are subject to both regimes simultaneously — they are not alternatives; they are overlapping requirements.

The most common misconception — “AML and sanctions are the same thing”

This belief is widespread and understandable. Both topics arise together in compliance discussions, both involve verifying clients and counterparties, and the abbreviations — AML, KYC, PEP, sanctions — sound like one set of rules for the financial sector. Operationally they do look similar: you check who you are doing business with.

However, operational similarity does not mean legal identity. Conflating the two regimes leads to one specific mistake: a company outside the list of AML obliged entities concludes it has no verification obligations at all. A travel agency that is not an AML obliged entity says: “this doesn’t apply to us.” A marketing agency serving clients across Europe says: “we’re not a bank.” That mistake can cost up to PLN 20 million in administrative fines⁶.

The distinction is straightforward once you look at the legal bases of the two systems — so let us start there.

What is AML — the Act of 1 March 2018 and obliged entities

AML stands for Anti-Money Laundering. In Poland this area is governed primarily by the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (Journal of Laws 2023 item 1124, consolidated text) — hereinafter: the AML Act.

The AML Act imposes obligations on obliged entities — a closed list of entities set out in Article 2(1) of that Act. The list is long but coherent: it covers mainly entities from the financial sector and entities performing particular functions in economic transactions. Alongside banks and financial institutions you will find, among others: accounting offices and tax advisers, notaries and legal advisers in relation to specified activities, estate agents, and auction houses for transactions above a defined value.

What must an obliged entity do? AML obligations are extensive. They include applying customer due diligence measures (identity verification, i.e. KYC — Know Your Customer), assessing the money-laundering risk, ongoing monitoring of transactions for suspicious patterns, registering transactions above a defined value, and — crucially — reporting suspicious transactions to the GIIF (Generalny Inspektor Informacji Finansowej — General Inspector of Financial Information)⁷. The GIIF is a state administrative authority operating within the Ministry of Finance that coordinates anti-money-laundering efforts in Poland.

The key word is “obliged entities”: if you are not listed in Article 2(1) of the AML Act, the AML Act essentially does not apply to you. That is precisely where the false conclusion arises: since AML does not apply to me, “compliance” does not apply to me.

What is sanction screening and who is subject to it

Sanction screening is the verification of a counterparty, client, or transaction against sanctions lists — registers of persons, companies, and organisations subject to restrictive measures issued by the EU, the UN, or national authorities. The result of that verification is one of three states: MATCH (confirmed hit — transaction prohibited), POSSIBLE (possible hit — requires further investigation), or CLEAR (no hit found).

The obligation to conduct sanction screening arises from an entirely different set of rules than the AML Act. Its legal basis consists of Council Regulations of the European Union — primarily Regulation No 269/2014 of 17 March 2014¹ and Regulation No 833/2014 of 31 July 2014² — and the Polish Act of 13 April 2022 on special measures to counter the support of aggression against Ukraine and to protect national security (Journal of Laws 2022 item 835)⁴.

The crucial difference in scope: EU regulations are directly applicable in every Member State without any need for transposition³ and bind every natural person, every legal person, every entity, and every body on the territory of the European Union. Article 2(1) of Regulation No 269/2014 requires the freezing of funds belonging to listed persons and prohibits making funds available to them — that prohibition applies to everyone, not only to banks.¹

This means your travel agency, leasing company, marketing agency, or e-commerce shop has a direct legal obligation arising from EU regulations — regardless of whether it is an obliged entity within the meaning of the AML Act. A detailed description of exactly who is subject to the sanction screening obligation in Poland can be found in the article sanction screening obligation — who is affected.

Comparison table — AML vs EU sanctions

The table below sets out both regimes across six dimensions that matter in practice for an SME.

Why a company outside the AML obliged entities must still conduct sanction screening

This is the crux of the entire article. Most SME owners, when they hear “compliance” and “client verification,” think: “that’s for banks.” Yet these two concepts relate to two different legal systems with entirely different reach.

The AML Act creates a narrow list of entities with extensive obligations. The EU sanctions regime creates a broad, universal prohibition — applicable to everyone — with one central command: do not do business with an entity on the sanctions list.

EU regulations are a special type of legal act: they enter into force without implementation by national parliaments and apply directly to every citizen and every company in the Union.³ You do not need to be a bank or an accounting office to be addressed by Regulation 269/2014. It is enough that you carry on business in the EU and enter into commercial transactions.

A few practical examples:

• Your estate agency is acting as an intermediary in the sale of a flat. The buyer is on the sanctions list. If the transaction proceeds — you have breached the prohibition in Article 2 of Regulation 269/2014¹, even if you are not an AML obliged entity (although estate agents are simultaneously obliged entities — which makes this a good example of the two regimes overlapping).
• Your travel agency sells a holiday package. The client is on the EU sanctions list. Accepting the payment and providing the service constitutes a sanctions breach — regardless of the fact that travel agencies are not AML obliged entities.
• Your insurance company issues a policy. The policyholder is listed on the Polish MSWiA list⁹ maintained by the minister responsible for internal affairs. The transaction is prohibited by operation of the Act of 13 April 2022.⁴

The authority that will inspect your company and impose any fine is not the GIIF (which inspects AML obliged entities), but the Head of the National Revenue Administration.⁵ The maximum administrative fine is PLN 20,000,000.⁶ Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures¹⁰ required Member States to criminalise such violations — the implementation deadline was 20 May 2025.¹¹ Legislative work on the national implementing act is ongoing in Poland.

What to do if your company is subject to both regimes

Some companies are simultaneously AML obliged entities and addressees of the EU sanctions regime. This applies, among others, to estate agents, insurance brokers, and accounting offices. The choice is not between one or the other — both apply in parallel and both must be complied with.

Step 1: Identify which regime (or both) applies to you. Check whether your sector or form of business is listed in Article 2(1) of the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing. If it is — you are an AML obliged entity. Regardless of the outcome of that check, you are also an addressee of EU regulations as an entity carrying on business on the territory of the Union.³

Step 2: Keep the compliance procedures separate. AML obligations (customer risk assessment, transaction monitoring, reporting to GIIF) and sanctions obligations (verification against sanctions lists before every transaction) are two distinct processes. In practice, sanctions verification is an element of the KYC process — you conduct it at client onboarding alongside identity verification. But they must not be confused conceptually.

Step 3: Establish who in the company is responsible for what. AML obliged entities are required to designate a responsible person (Article 8 of the AML Act). For sanctions obligations there is no identical statutory requirement for non-financial firms — but designating a responsible person and documenting the internal procedure in writing is good practice and evidence of due diligence. How to allocate that responsibility without creating a new post is explained in the article on the sanctions compliance officer in a small company.

Step 4: Build your documentation. For the AML regime the requirements are: a risk assessment, internal procedures, a transaction register, and reports to GIIF. For the sanctions regime: a verification register (who, when, which list, result), a sanctions policy, and a procedure for handling MATCH and POSSIBLE results. Article 49 of the Act of 1 March 2018 on Counteracting Money Laundering specifies a five-year retention period for documentation kept by obliged entities¹² — you may use that as a reference point for sanctions documentation as well.

Step 5: Monitor sanctions lists on an ongoing basis. Lists are updated on a rolling basis, without a fixed schedule. The Polish MSWiA list is updated after each decision by the minister responsible for internal affairs¹³; the EU list is updated after each sanctions package. Checking once at contract signature is not sufficient. Re-verify at every material transaction with an existing counterparty — more on how to organise ongoing monitoring is set out in the article on sanctions list updates. More on what the current EU sanctions list looks like can be found in the article the sanctions list — what it is and who it affects.

FAQ — frequently asked questions

Does a company that is not an AML obliged entity have to conduct sanction screening?

Yes. The sanction screening obligation does not arise from the AML Act — it arises directly from Council Regulations (EU) No 269/2014¹ and No 833/2014², which apply to every natural and legal person on the territory of the European Union.³ The absence of AML obliged-entity status does not exempt a company from this obligation.

What is the GIIF and does it inspect companies outside the financial sector?

The GIIF (Generalny Inspektor Informacji Finansowej — General Inspector of Financial Information) is a body established by the Act of 1 March 2018 on Counteracting Money Laundering⁷, responsible for coordinating anti-money-laundering and counter-terrorist-financing efforts. The GIIF inspects obliged entities within the meaning of the AML Act — banks, accounting offices, estate agents, and other entities listed in Article 2(1) of that Act. For non-financial companies outside that list, the competent authority in respect of a sanctions breach is the Head of the National Revenue Administration (KAS — Krajowa Administracja Skarbowa)⁵.

Are sanction screening and KYC (Know Your Customer) the same thing?

No. KYC — i.e. customer identity verification — is an element of AML procedures required of obliged entities. Sanction screening is the checking of a counterparty against sanctions lists; it may be an element of the KYC process, but it is a separate activity required by separate legislation. A company that is not an AML obliged entity has no formal obligation to run a full KYC process — it does, however, have an obligation to verify against sanctions lists.

Which authorities enforce sanctions compliance in Poland and who imposes fines?

In Poland, fines for breach of obligations arising from EU regulations are imposed by the Head of the National Revenue Administration (KAS)⁵ — by way of an administrative decision — of up to PLN 20,000,000.⁶ AML obliged entities are additionally supervised by the GIIF⁷. Entities supervised by the KNF (Komisja Nadzoru Finansowego — Polish Financial Supervision Authority) in the area of sanctions are supervised by the KNF.

Am I subject only to Polish law, or also directly to EU law?

Both. EU regulations are directly applicable legal acts³ — they require no transposition and apply to you directly, just like a national statute. The Polish Act of 13 April 2022⁴ supplements them with national implementing tools (the MSWiA lists, the powers of KAS) and penalties. Both levels of law apply simultaneously.

What penalties can we face for a sanctions breach — specific figures?

The administrative fine imposed by the Head of KAS is up to PLN 20,000,000 (Article 6(2) of the Act of 13 April 2022)⁶. At European level, Directive 2024/1226¹⁰ provides for a maximum custodial sentence of at least five years for breaches involving funds or economic resources worth at least EUR 100,000⁸. A detailed discussion of all types of penalties can be found in the article penalties for breaching EU sanctions in Poland.

What to do in practice — 5 steps for a company that is not an AML obliged entity

1. Check whether you are an AML obliged entity. Review Article 2(1) of the Act of 1 March 2018. If your sector is listed — you have additional AML obligations. Regardless of the outcome, proceed to step 2.

2. Accept that the sanctions obligation applies to you. Regulation 269/2014¹ applies to you directly and without exception. Establish which sanctions lists you must monitor — the minimum is the EU Consolidated List and the Polish MSWiA list⁹.

3. Designate a person responsible for sanctions compliance. This may be a member of your administrative staff, someone from your legal team, or an external adviser. What matters: a written authorisation and a documented internal procedure.

4. Implement a verification procedure. Every new counterparty, every new transaction — verification against sanctions lists before it is executed. Document the result in a hit register: date, counterparty details, list used, result (MATCH/POSSIBLE/CLEAR), signature of the responsible person.

5. Ensure continuity of monitoring. Lists are updated irregularly and without advance notice. A counterparty that was CLEAR three months ago may be on the list today. Regular monitoring — or automation of this process — is not optional; it is an element of due diligence.

How Sanqto can help

Sanqto is sanction screening software designed with non-financial companies in mind — travel agencies, estate agencies, insurance brokers, leasing companies, and other entities that have a sanctions obligation but do not fall within the list of AML obliged entities. The software is installed within the client’s own network (on-premise model), which means counterparty data never leaves your infrastructure. The system verifies counterparties against sanctions lists and returns a result in one of three states — MATCH, POSSIBLE, or CLEAR — automatically documenting every check as an audit trail. The package includes a ready-made sanctions policy, an operational procedure, and a hit register — the documents you will show the Head of KAS at any inspection.

Legal basis

• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty, and independence of Ukraine — CELEX 32014R0269

• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — CELEX 32014R0833

• Act of 13 April 2022 on special measures to counter the support of aggression against Ukraine and to protect national security (Journal of Laws 2022 item 835) — eli.gov.pl

• Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (Journal of Laws 2023 item 1124, consolidated text) — eli.gov.pl

• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and on the facilitation of such violations, and amending Directive (EU) 2018/1673 — CELEX 32024L1226

• Polish sanctions list maintained by the MSWiA (Ministry of the Interior and Administration) — maintained by the minister responsible for internal affairs, published in the BIP MSWiA: gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami

Footnotes

Information, not legal advice. This article is informational and educational in nature. It does not constitute legal advice. Legal status as of: 2026-05-20. The specific obligations of your company depend on your business profile and require individual assessment — if in doubt, consult a lawyer or a compliance adviser.