Does my company have to run sanction screening? Check who it applies to

If you run a company in Poland — a travel agency, an estate agency, an online shop, a leasing company — there is a real chance you have an obligation to check your counterparties and customers against EU sanctions lists. EU economic sanctions, including the EU sanctions lists introduced after Russia’s aggression against Ukraine, apply directly to every entity carrying on business in the European Union — not only to banks. Ignoring this obligation can result in a financial penalty of up to PLN 20,000,000 imposed by the Head of the National Revenue Administration¹, as well as criminal liability under Article 15(1) of the Act of 13 April 2022².

This article explains, step by step, whether the sanction screening obligation applies to your company, where it comes from, and what specifically you have to do.

TL;DR — the essentials in 30 seconds

• Sanction screening is checking whether a counterparty or customer appears on a list of entities subject to EU, UN or MSWiA sanctions — before you enter into a contract with them or execute a transaction.
• The obligation flows directly from EU regulations — No 269/2014³ and No 833/2014⁴ — and applies to every entity carrying on business in the Union, with no exemption for industry or company size.
• The Polish Act of 13 April 2022⁵ supplements this obligation: it designates the Head of KAS as the enforcement authority and establishes a Polish sanctions list maintained by MSWiA⁶.
• A failure to screen carries a financial penalty of up to PLN 20 million (administrative track)¹ and a custodial sentence of no less than 3 years (criminal track)².
• The deadline for transposing Directive (EU) 2024/1226 — which obliges EU states to criminalise sanctions breaches — fell on 20 May 2025⁷; Poland has a draft implementing act (UC92), whose status you can check at legislacja.rcl.gov.pl.
• Obliged institutions within the meaning of the AML Act (the Act of 1 March 2018 on counteracting money laundering and terrorist financing) have the sanctions obligation plus additional duties — these are two distinct legal regimes.
• First step: check the table in section 4 to see whether your industry is listed — then designate a person responsible for compliance.

1. What is sanction screening?

Sanction screening is nothing more than checking whether the person or company you intend to do business with is on a list of entities subject to sanctions. These lists contain the names of natural persons, businesses and organisations that are banned from carrying out certain transactions, have had their assets frozen, or have restricted access to the European Union market.

In practice, you check: the first and last name or the company name, the country of registration and, where applicable, the counterparty’s identification number. It is not about credit history or solvency — only about whether the entity appears on a sanctions list. The result of the check takes one of three forms: MATCH (a hit — the transaction is blocked), POSSIBLE (an uncertain hit — it requires further checking) or CLEAR (no hit — you may proceed).

We cover the detailed mechanics of screening — how the matching algorithm works, where false positive results come from and how to handle them — separately in the article what sanction screening is and how it works.

It is worth dispelling one myth straight away: sanction screening is not the same as KYC (Know Your Customer) / AML (anti-money laundering and counter-terrorist financing) verification that banks carry out. Banks do, of course, have a sanctions screening obligation as part of a broader AML process, but verification against sanctions lists in itself is a separate, simpler procedure. You can run it without having anything to do with the financial sector.

1.1 Economic sanctions vs AML — two different things

This misunderstanding comes up very often: many companies think that “sanctions are a matter for banks”, or that the obligation applies only to “obliged institutions” within the meaning of the AML Act. Both beliefs are wrong.

The Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124) creates a narrow catalogue of obliged institutions — banks, accounting offices, notaries, real-estate agents, certain lawyers and other entities listed in Article 2(1) of that Act. These institutions have extensive duties: customer risk assessment, transaction monitoring, reporting to GIIF (the General Inspector of Financial Information).

The sanctions obligation, however — that is, the need to check whether you are not doing business with an entity from a sanctions list — flows directly from EU regulations and applies to every entity carrying on business in the Union. You do not need to be an AML obliged institution to have this obligation. Your online shop, transport company or travel agency are addressees of Regulation 269/2014³ and Regulation 833/2014⁴ in exactly the same way as a bank. You will find a detailed comparison of the two regimes — AML and sanctions — in the separate article the difference between AML and sanctions.

The practical conclusion: if you are not an AML obliged institution, you do not have to report to GIIF. But you still have to check sanctions lists before every transaction with a new counterparty.

2. Who must run sanction screening?

Two legal routes lead to the sanction screening obligation, and they may apply to your company independently of one another — or both at once.

Route A is being an obliged institution within the meaning of the AML Act of 1 March 2018. If you run an accounting office, act as an intermediary in real-estate transactions or are an insurance broker — you are probably an obliged institution and have both AML and sanctions duties.

Route B is simply carrying on business in the territory of the European Union. EU regulations apply directly — they require no transposition into Polish law and no additional national decisions. If you conclude commercial contracts, accept payments or sell services in the EU, you are an addressee of these provisions³⁴.

Route B is broader and covers companies that have never heard of the AML Act. It is precisely this mechanism that makes a travel agency, an e-commerce shop or a leasing company subject to the sanctions obligation.

2.1 Obliged institutions under the AML Act — a list of non-financial industries

The AML Act of 1 March 2018 lists, in Article 2(1), a long list of obliged institutions. Besides banks, investment funds and other financial entities, the catalogue covers several industries that may surprise you:

• Real-estate agents — the obligation applies both to agents and to agency owners. Every sale or rental transaction in which you act as an intermediary should be preceded by verification of the parties. More on the specifics of this industry: sanction screening for real-estate agents.
• Accounting offices and tax advisers — keeping accounting books and providing tax advice are activities covered by the AML Act. Your clients must be verified.
• Notaries, advocates and legal advisers — but only when carrying out specific activities (real-estate transactions, asset management, the creation and management of companies).
• Auction houses and second-hand dealers — when trading items above a defined value.

Important information: travel agencies and OTAs are not listed in the catalogue of AML obliged institutions. Their sanctions obligation flows solely from Route B — the direct application of EU Regulations 269/2014 and 833/2014 and the Act of 13 April 2022. More on this for your industry: sanction screening for travel agencies.

2.2 Companies covered directly by EU regulations — every entity operating in the EU

EU regulations are a special type of legal act: they enter into force without the need for implementation by Member States and are directly binding on all addressees.

Council Regulation (EU) No 269/2014 of 17 March 2014 imposes an obligation to freeze funds and a ban on making them available to persons and entities on the sanctions list³. Council Regulation (EU) No 833/2014 of 31 July 2014 introduces trade bans — on the export of certain goods and technologies to Russia and on transactions with Russian entities in the sanctioned sectors⁴. Both legal acts have been amended many times under successive sanctions packages — how many EU sanctions packages against Russia have been adopted and what each of them changed is described in a separate article.

The addressee of both regulations is every natural and legal person, every entity and every body in the European Union. There is no exemption based on industry, company size or the legal form of the business.

How many entities are already on the EU sanctions list and how fast that number is growing — you can check in the article how many entities the EU sanctions list covers.

2.3 Entities under the Act of 13 April 2022 — the Polish set of obligations

The Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security (Journal of Laws 2022, item 835) serves the application of EU Regulations 765/2006, 269/2014 and 833/2014 within the Polish legal order⁵. It does not replace the regulations — it supplements them with national enforcement tools.

A key element of this Act is the Polish sanctions list. It is maintained by the minister responsible for internal affairs (MSWiA), and the list is published in the Public Information Bulletin⁶. This means that, in addition to the EU sanctions list (the Consolidated List maintained by the European Commission), a Polish company must also check the Polish MSWiA list⁸. The current list is available at gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami.

The authority carrying out the tasks and powers arising from the EU regulations — including in relation to entities entered on the Polish list — is the Head of the National Revenue Administration⁹. It is the Head of KAS who imposes the financial penalty through the administrative track. Supervision of compliance with the rules by AML obliged institutions is exercised by GIIF, and entities supervised by the KNF (Polish Financial Supervision Authority) are inspected by the KNF¹⁰ — but for non-financial companies outside the AML catalogue, the Head of KAS is the competent authority.

The Act provides that the MSWiA list is updated irregularly — the minister issues decisions on their own initiative or on a substantiated application, as the need arises¹¹. There is no fixed update schedule, which is why companies should monitor the list continuously, not just once a quarter.

The draft act implementing Directive (EU) 2024/1226, designated UC92, was going through the legislative process at the government-work stage — check the current status in the list of work of the Council of Ministers at legislacja.rcl.gov.pl.

2.4 Table: Who must run sanction screening — an industry breakdown

The table below is a quick answer to the question “does this apply to me?”. The “AML?” column indicates whether a given industry is an obliged institution within the meaning of the Act of 1 March 2018 — which imposes additional duties on top of sanction screening itself.

The “to be verified” entry means that the AML obliged-institution status of that industry needs to be verified against the current text of Article 2(1) of the Act of 1 March 2018 by a lawyer or compliance adviser. The sanction screening obligation (the last column) applies to all industries in the table — without exception.

3. Legal basis — which provisions impose the obligation

The sanction screening obligation arises from three levels of law that overlap with one another. Understanding this hierarchy will help you answer the question of what exactly you must do and why.

Level 1 — Directly applicable EU regulations

Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining the territorial integrity of Ukraine freezes assets and bans making funds available to persons and entities on the list³. Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine introduces trade and sectoral bans⁴. Both regulations have been amended many times by successive sanctions packages — their current consolidated text is available on EUR-Lex.

Level 2 — The Polish sanctions act

The Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security (Journal of Laws 2022, item 835) serves the application of the EU regulations mentioned above⁵. It designates the Head of KAS as the enforcement authority⁹, establishes the Polish sanctions list maintained by MSWiA⁶ and sets out the penalties for breaches¹².

Level 3 — The AML Act

The Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124) imposes additional duties on the obliged institutions listed in Article 2(1). It is a narrower catalogue of entities than the addressees of the EU regulations, but with a broader scope of duties (risk assessment, transaction monitoring, reporting to GIIF).

An announced change — Directive 2024/1226

Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures⁷ obliged Member States to criminalise breaches of EU sanctions by 20 May 2025⁷. Poland is processing a draft implementing act (UC92) — check the current status at legislacja.rcl.gov.pl. It is worth noting that the Polish Act of 13 April 2022 already provides for a custodial sentence of no less than 3 years for breaching the bans in the EU regulations² — so in that respect Poland is stricter than the minimum standards of the Directive.

4. Which sanctions lists apply to Polish companies?

The minimum requirement for every Polish company is to check two lists: the EU Consolidated List and the Polish MSWiA list. Depending on your business profile, you may also need to check other lists.

The EU list — the Consolidated List

The EU sanctions list (the Consolidated List) is maintained and updated by the European Commission — the DG FISMA department¹². It contains natural persons, entities and organisations subject to EU financial sanctions. Checking against this list is mandatory for every company carrying on business in the EU. You can download or verify against the list through IT systems at: webgate.ec.europa.eu/fsd. How many entries this list contains and how dynamically it is growing — you can check in the article how many entities the EU sanctions list covers.

The UN list — UN Security Council Sanctions

The list is maintained by the UN Security Council. It covers entities linked to terrorism, to countries under UN sanctions (North Korea, Iran, Sudan, etc.) and to other threats to peace. It is mandatory if you trade with entities outside the EU or have counterparties from high-risk countries.

The Polish MSWiA list

The Polish sanctions list is maintained by the minister responsible for internal affairs and published in the MSWiA Public Information Bulletin⁶⁸. It covers persons and entities subject to special measures under the Act of 13 April 2022. The list is updated irregularly — as new decisions are issued by the minister¹¹. The current list is available at gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami.

The OFAC list — US Treasury

The list maintained by the Office of Foreign Assets Control of the US Department of the Treasury (OFAC) is not mandatory for Polish companies under Polish or EU law. However, if you settle payments in US dollars, have counterparties or partners from the USA, use the services of correspondent banks in the USA, or export products subject to export controls — breaching the OFAC list can have serious consequences in relationships with foreign partners. Many Polish exporters and cross-border companies check OFAC as a standard precaution.

A detailed discussion of all four lists — what each one covers, how to download it and when it is mandatory — can be found in the article sanctions lists that apply to Polish companies.

5. What your company must specifically do — 7 steps

Below is a concrete action plan. Not theory, not “a policy should be implemented” — step by step, what to do in the coming weeks.

Step 1: Establish whether you have an obligation

Use the table in section 2.4. If you carry on business in Poland (or more broadly — in the EU), the answer is almost always “yes”. The only cases where there can be any doubt are purely local activities with no relationships at all with foreign entities — but even then it is safer to assume the obligation exists.

Step 2: Designate a responsible person

Someone in your company must be responsible for sanctions compliance. They do not have to be a lawyer — it can be an administration or accounting employee, or any person designated by the management board. What matters is that they have written authorisation and know what exactly is their responsibility.

Step 3: Develop an internal sanctions policy

A sanctions policy is a document describing: whom you check (customers, counterparties, suppliers, intermediaries), when you check (before the first transaction, at each subsequent one, when the list is updated), how you check (manually or with a system) and how you document the results. It does not have to be long — a few pages is enough to start.

A template sanctions policy with a job instruction and a hit register is available in the article sanctions policy — document templates.

Step 4: Define the verification moments

The absolute minimum: verification before every new commercial relationship and before every first transaction with a new counterparty. Good practice for companies with a higher risk profile (cross-border trade, counterparties from Russia or Belarus, large transaction volumes): verification at every update of the sanctions list for existing counterparties.

Step 5: Implement a checking procedure

The bare minimum for a Polish company: the EU list (the Consolidated List) + the Polish MSWiA list. The UN and OFAC lists — if you do business with entities outside the EU. You can carry out verification manually (a search engine on the EC or MSWiA website), through a spreadsheet (for small volumes, up to a few dozen counterparties) or through a dedicated tool (recommended for any company handling more than a few dozen transactions a month).

You will find a detailed step-by-step verification guide — describing both the manual and the automated approach — in the article how to check a counterparty for sanctions.

Step 6: Document every verification

Although the Act of 13 April 2022 does not explicitly impose an obligation to keep a screening register for non-financial companies, documentation is your best evidence of due diligence in the event of an inspection or proceedings. Record: the date of verification, the counterparty’s details, which list was checked, the result (MATCH/POSSIBLE/CLEAR) and the action taken. In the case of a MATCH or POSSIBLE — be sure to record who made the decision and what they decided.

Step 7: Update the procedure regularly

The EU list is updated by the European Commission as current needs arise — without a fixed schedule. The MSWiA list is updated irregularly, as new decisions are issued by the minister¹¹. Your procedure should account for monitoring changes to the lists — either through manual checking several times a month, or through a tool that does it automatically and alerts you to changes.

5.1 How often should you verify counterparties?

The question of verification frequency is one of the most common — and the answer depends on your company’s risk profile.

The absolute minimum for every company: before the first transaction with a new counterparty. This is an obligation flowing directly from the transaction bans of the EU regulations — you cannot conclude a contract or transfer money without knowing whether the counterparty is on the list.

Good practice, recommended for everyone: at every update of the sanctions list, rescan your active counterparties. EU lists can change from one day to the next — new entries appear in response to political decisions by the Council of the EU.

For companies that are AML obliged institutions (banks, accounting offices, real-estate agents): Articles 33–44 of the AML Act set out the rules for applying financial security measures, the frequency of which depends on the customer risk assessment.

If your company handles many counterparties or works in cross-border mode, manual verification several times a month becomes impractical. Automation — a tool that monitors the lists on its own and alerts you to a new entry concerning your counterparties — is the solution that makes verification frequency stop being a problem.

6. What do you risk if you do not run screening?

The consequences of not running sanction screening fall into two types: legal and business. It is worth being aware of both — not in order to be afraid, but to understand what is at stake.

Legal consequences

Financial penalty (administrative track): The Head of the National Revenue Administration may impose a financial penalty of up to PLN 20,000,000 on an entity that has failed to comply with the obligation to freeze funds or has made funds available to an entity on the list¹. The decision is taken through the administrative track.

Criminal liability (criminal track): Whoever breaches the bans arising from Regulations 833/2014, 765/2006 or 269/2014 is subject to a custodial sentence of no less than 3 years². This is the liability of a natural person — the company owner, the CEO, the person designated for compliance.

Criminalisation at EU level: Directive (EU) 2024/1226 of 24 April 2024 obliged all EU states to criminalise sanctions breaches by 20 May 2025⁷. Poland already meets this requirement through Article 15(1) of the Act of 13 April 2022 — but the UC92 draft may introduce additional provisions. A full discussion of the penalties and their legal bases can be found in the article what penalties you face for breaching sanctions.

Business consequences

Beyond legal sanctions, breaching the sanctions regime carries a reputational risk. Banks increasingly close the accounts of companies that have committed sanctions breaches or that have not implemented basic compliance procedures. For regulated companies (insurance brokers, financial intermediaries) a breach may result in the loss of a licence. Trading partners from Western Europe — particularly German, Dutch and Scandinavian ones — increasingly require their suppliers and cooperating partners to provide documentation confirming that sanction screening is being carried out.

Sanctions breaches have been enforced by national authorities in Germany, France, the Netherlands and other EU states. This is not an abstract risk.

7. How to organise screening in practice — tools and automation

Regardless of company size, you have three practical options for organising screening.

Option 1: Manual verification

You go to the European Commission’s website (the Financial Sanctions Files portal¹²) or the MSWiA website⁸, enter the counterparty’s name and check the result. Advantages: free, simple, no implementation. Disadvantages: time-consuming with a larger number of counterparties, no verification history, risk of human error, no automatic alerts when the list is updated. For a company with a few new counterparties a month — acceptable. For a company handling several hundred transactions — impractical.

Option 2: A spreadsheet with manual documentation

You can keep a verification register in Excel or Google Sheets: date, counterparty name, list, result. This is a step up from manual verification alone — you have a history. Disadvantage: no alerts when the list changes, zero scalability, the risk of out-of-date data with a large counterparty portfolio.

Option 3: A dedicated sanction screening tool

The tool automatically downloads sanctions list updates, checks your counterparties at every update and alerts you to changes. It gives a result in three states: MATCH, POSSIBLE, CLEAR — with automatic documentation of every check. The key things when choosing a tool: the frequency of list updates, the response time, the result format, the ability to integrate with an ERP/CRM system and the option of an on-premise installation (data does not leave your infrastructure).

Documentation generated automatically by the tool is a ready-made audit trail — evidence of due diligence that can be of crucial importance in the event of an inspection or proceedings.

8. How Sanqto can help

Sanqto is sanction screening software designed with companies outside the financial sector in mind — such as travel agencies, estate agencies, insurance brokers, leasing companies and e-commerce shops. The software is installed within the client’s network (on-premise), which means that counterparty data does not leave your infrastructure. The system checks counterparties against sanctions lists and returns a result in three states — MATCH, POSSIBLE or CLEAR — and every verification is documented automatically, creating an audit trail. Beyond the software, we offer a ready-made package of implementation documents: a sanctions policy, a job instruction, a hit register and a risk assessment — templates tailored to your industry. For the person designated for compliance, we have prepared online training with certification, which lets you build competence without hiring an external lawyer. See how Sanqto works in your industry: sanction screening for travel agencies, sanction screening for real-estate agents, sanction screening for insurance brokers.

9. Legal basis

• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine — CELEX 32014R0269

• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — CELEX 32014R0833

• Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security (Journal of Laws 2022, item 835) — ISAP

• Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124) — ISAP

• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and on amending Directive (EU) 2018/1673 — CELEX 32024L1226

• Draft act UC92 (implementation of Directive 2024/1226 into Polish law) — status as at the article’s publication date: to be verified at legislacja.rcl.gov.pl

• The Polish MSWiA sanctions list — published in the MSWiA Public Information Bulletin: gov.pl/web/mswia/lista-osob-i-podmiotow-objetych-sankcjami

• The EU sanctions list (Consolidated List) — maintained by the European Commission (DG FISMA): webgate.ec.europa.eu/fsd

Footnotes

Information, not legal advice. This article is informational and educational in nature. It does not constitute legal advice. Legal status as of: 2026-05-19. Your company’s specific obligations depend on its business profile and require an individual assessment — if in doubt, consult a lawyer or compliance adviser.