Does an accounting firm have to run sanction screening?

If you run an accounting firm or provide tax advisory services, you have an obligation to screen your clients against the EU sanctions lists — and this obligation is not reserved exclusively for banks. The rules apply to your firm directly, and most accounting-firm owners are surprised to learn it: having an AML (anti-money laundering) procedure in place is not enough, because sanction screening is a separate, independent legal regime.

It is precisely this misunderstanding that costs firms the most: they assume that because they have met their obligations towards the Polish Financial Intelligence Unit, they are safe. In reality, the European Union’s sanctions regulations apply directly, with no further national implementation — and they bind every entity providing services within the EU. Penalties for a breach reach up to PLN 20 million¹, and the planned criminal liability — up to several years’ imprisonment².

TL;DR — the essentials in 60 seconds

• An accounting firm is an obliged institution under Article 2(1)(17) of the Act of 1 March 2018 on counteracting money laundering and terrorist financing³; a tax adviser — under point 15 of the same article⁴.
• Sanction screening is a separate obligation — it flows from EU Regulations 269/2014⁵ and 833/2014⁶ and from the Act of 13 April 2022¹, not only from the AML Act. You can have a complete AML procedure and still breach the sanctions rules.
• You must screen the client and the beneficial owner against the EU list (Consolidated List), the Polish MSWiA list and the UN list — at every onboarding and on an ongoing basis.
• The 50% ownership rule: the verification obligation also covers entities in which a listed person holds at least 50% of the shares or voting rights — details in the article on the 50% ownership rule.
• The administrative penalty for breaching the Act of 13 April 2022 is up to PLN 20,000,000 — it is imposed by the Head of the National Revenue Administration¹.
• Directive (EU) 2024/1226 obliges Member States to criminalise breaches of sanctions² — the implementation deadline is 20 May 2025; the national legislative process — the “large sanctions act” (draft UC92) — is ongoing.
• The minimum you must implement: verification at onboarding, alerts on list changes, keeping a record of hits, and an internal sanctions procedure.

An accounting firm as an obliged institution — where does the obligation come from?

The Act of 1 March 2018 on counteracting money laundering and terrorist financing (Journal of Laws 2018, item 723; consolidated text Journal of Laws 2023, item 1124 — hereinafter: the AML Act) contains a catalogue of entities required to apply financial-security measures. In that catalogue, in Article 2(1), you will find two categories that directly concern the accounting sector: point 15 — tax advisers in respect of tax advisory activities⁴ — and point 17 — entities carrying on business in the provision of services for the keeping of accounting books³. If your firm falls within either of these descriptions, you are an obliged institution.

In practice this covers sole-trader accounting firms, companies providing bookkeeping services, tax advisers affiliated with the National Chamber of Tax Advisers (KIDP), and statutory auditors — in respect of the services they provide. What matters is what you actually do, not your company’s name or the business-activity code entered in the National Court Register. As at the date this article was published, the National Chamber of Tax Advisers has not issued dedicated guidance on sanction screening for tax advisers — the obligations flow directly from the AML Act and the EU regulations.

Being an obliged institution means specific tasks: identifying the client and the beneficial owner, risk assessment, monitoring the business relationship and — where necessary — reporting to the General Inspector of Financial Information (GIIF), which operates within the structure of the Ministry of Finance⁷.

When is an accounting firm NOT an obliged institution?

The obligation does not apply to every company that has “accounting” in its name. If you provide solely IT services for accounting departments, HR-and-payroll services without keeping accounting books, or purely consulting work without handling a client’s financial operations, you may fall outside this regime. What decides is the scope of the services actually provided — and if in doubt it is worth consulting a legal adviser, because misclassifying yourself carries the same legal risk as having no procedure at all.

Rule: if you keep a client’s accounting books, you are an obliged institution. No matter what your company is called.

AML versus international sanctions — two different obligations, one entity

This is the most important thing in this article and at the same time a gap you will find in almost every Polish text on the subject: AML and sanctions are two separate legal regimes. Confusing them is a mistake that can cost you even if you keep model AML documentation.

The table below shows the difference:

The key point that distinguishes sanctions from AML: EU Council regulations apply directly in every Member State from the day they enter into force. They require no implementing statute — Poland did not need to enact a separate act for Regulation 269/2014 to start binding your firm. It has been in force since 17 March 2014 and currently prohibits making funds or economic resources available to the persons and entities listed in Annex I to that regulation⁵.

Council Regulation (EU) No 833/2014 of 31 July 2014, in turn, introduces sectoral sanctions against Russia — including a ban on providing technical and financial assistance to Russian entities⁶. Council Regulation (EC) No 765/2006 of 18 May 2006 covers sanctions against Belarus⁸. Both apply without exception, regardless of what you have implemented in the AML area.

Important: if your firm’s client is on the EU sanctions list, providing services to them is prohibited — regardless of whether you meet your AML obligations and whether your documentation is complete.

You will find more on how the two regimes differ in the article on the difference between AML and sanctions.

Which sanctions lists must an accounting firm in Poland screen against?

The verification obligation is not limited to a single list. Depending on your client profile and the type of transactions handled, you may be required to screen several sources at once.

The EU list (Consolidated List) is the starting point for every accounting firm in Poland. The list is updated regularly — changes are published in the Official Journal of the EU and available in EUR-Lex. Manual monitoring without an alert system is simply unworkable given the pace of change.

The Polish MSWiA list is maintained by the minister competent for internal affairs under Article 2(1) of the Act of 13 April 2022¹ and covers persons and entities against which Poland applies its own sanctions measures. You will find the list on the gov.pl website at the address indicated above.

The UN list is partly incorporated through EU regulations, but it is worth screening against it independently — especially for clients from countries not directly covered by the European sanctions packages.

A detailed overview of all the lists and their structure is given in the article on the EU sanctions list and the Polish MSWiA list. For who in Poland must run sanction screening, see the pillar article. A step-by-step guide is in the article on how to check the Polish MSWiA sanctions list.

When must you carry out a verification? Five triggers of the obligation

The mere fact that you are an obliged institution does not yet explain when, specifically, you reach for the sanctions lists. The rules distinguish several situations that automatically trigger the verification obligation.

Trigger 1 — onboarding a new client. Every new client requires verification before signing a contract and before you begin providing services. This applies both to natural persons carrying on business and to companies — in the latter case you must check not only the entity itself but also the beneficial owner.

Trigger 2 — a one-off transaction above the threshold. The AML Act introduces a transaction threshold equal to EUR 15,000 or more for occasional transactions¹². For accounting firms handling clients’ financial operations, this is a trigger for applying financial-security measures, including sanctions-list verification.

Trigger 3 — continuous monitoring and list updates. This is the hardest element in practice: the EU list is updated regularly — new entries and changes appear in the Official Journal of the EU. A client who was clear at onboarding may be listed six months later. Without automatic alerts on list changes (e.g. an EUR-Lex alert subscription, the MSWiA public-information bulletin), manual tracking is inefficient.

Trigger 4 — a change of circumstances on the client’s side. A change of beneficial owner, a new shareholder, a change of owner — each of these situations calls for re-verification. The same goes for a request for a transaction with a country under embargo or the involvement of a listed counterparty.

Trigger 5 — any reasonable suspicion of a link to a sanctioned person or entity. You do not need a formal ground — a circumstance that ought to raise your alertness is enough.

The 50% ownership rule: in line with EU guidance, the verification obligation also covers entities in which a sanctioned person holds, in aggregate, 50% or more of the shares or voting rights — this rule follows from the EU Council Best Practices, not from the text of the regulation itself. The details are explained in the article on the 50% ownership rule.

Step by step — how to implement minimal sanction screening in an accounting firm

Implementing a sanctions procedure need not mean hiring a compliance officer or buying a system costing tens of thousands of zloty. Here is a minimal, workable plan for a sole-trader firm or a small accounting practice.

1. Establish which sanctions lists apply to you. The starting point is always the EU list (Consolidated List) and the Polish MSWiA list — mandatory for every entity operating in Poland. If you serve clients with USD transactions or with US counterparties, add the OFAC list to the set. Also check whether your clients operate in sectors covered by Regulations 269/2014⁵ or 833/2014⁶ — if so, the scope of verification widens.

2. Implement a verification procedure at client onboarding. Before signing any contract, screen the client (National Court Register / CEIDG) and the beneficial owner against the sanctions lists. Do not start providing services until the verification is complete and documented. If you work with many clients a year, prepare a form or a checklist that you fill in for every new client.

3. Set up alerts on list updates. EUR-Lex offers alert subscriptions for changes in legal acts — set a notification for Regulations 269/2014 and 833/2014. Check the MSWiA website regularly or subscribe to public-information bulletin notifications. The alternative is an automated system with real-time list monitoring.

4. Keep documentation of the verification results. Every check carried out — and in particular every hit (MATCH or POSSIBLE) — should be documented: what you screened, when, what the result was and what decision you took. This is good compliance practice, flowing from the obligation to document financial-security measures provided for in the AML Act³.

5. Adopt a procedure for ambiguous hits (POSSIBLE MATCH). A “possible match” result is not the same as a negative result — you cannot ignore it. Verify additional identifying data: date of birth, nationality, address. Document your conclusions. If, after verification, you cannot unambiguously rule out that it is the same person as on the list — halt the relationship and consult a lawyer specialising in sanctions law.

6. Adopt an internal sanctions procedure (policy) as a document. The document should describe at least: the scope of the obligation (which lists you check), the verification procedure at onboarding, the escalation path in the event of hits, and the person responsible for sanctions compliance. The obligation to have internal procedures follows indirectly from Article 50 of the AML Act, which imposes the obligation to apply an internal procedure. A downloadable sanctions-policy template is available in the article sanctions policy template to download.

7. (Recommended) Train your staff. The AML Act obliges obliged institutions to provide their staff with training on the rules on counteracting money laundering and terrorist financing¹³. Training dedicated to sanctions is best compliance practice that goes beyond the statutory minimum, but is worth implementing — especially if more than one person is in contact with clients.

What do you risk if you do nothing? Penalties for breaching sanctions

Penalties for breaching the sanctions rules are imposed by the Head of the National Revenue Administration⁹ and flow from the Act of 13 April 2022 on special arrangements for counteracting support for aggression against Ukraine and serving the protection of national security (Journal of Laws 2022, item 835). The Act provides for a financial penalty of up to PLN 20,000,000 for failing to fulfil the obligation to freeze funds, failing to comply with the obligation to provide information, or taking part in activities aimed at circumventing sanctions¹.

Criminal liability is the second, independent level of risk. Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures (hereinafter: Directive 2024/1226) obliges Member States to introduce criminal-law penalties for breaches of the EU’s economic sanctions. The Directive provides for a maximum term of imprisonment of at least 5 years for the most serious breaches (including making funds or economic resources available in breach of a prohibition), and at least 1 year for other breaches².

Directive 2024/1226 obliges Poland to implement these rules into national law by 20 May 2025. As at the date this article was published, the national legislative process (draft UC92) is ongoing.

Reputational risk is the third, often underestimated dimension: serving an entity on the sanctions list — even unknowingly — can destroy an accounting firm’s reputation and expose it to joint and several liability with the client. A full overview of the penalties and their legal bases is given in the article on penalties for breaching sanctions.

How Sanqto can help

Sanqto is sanction-screening software designed for companies outside the financial sector — including accounting firms and law firms. You install it in your own infrastructure (on-premise): your clients’ data never leaves your firm and never reaches external servers. Verification runs in under 30 ms and returns a result in three states: MATCH, POSSIBLE or CLEAR — which makes it easier to document decisions and handle ambiguous hits.

The product comes with a package of implementation documents: a sanctions-policy template, a workplace instruction, a hit register, and the option to certify the member of staff responsible for compliance. If you want to implement a sanctions process once, properly, and without constantly returning to the topic — see what sanctions mean for your accounting firm. The article on who in Poland must run sanction screening gives broader context for companies outside the financial sector. If you serve clients in the legal or notarial sector, visit the page for law firms and notaries as well.

Frequently asked questions (FAQ)

Does an accounting firm have to run sanction screening if it does not serve clients from Russia or Belarus? Yes. The obligation to screen against the EU sanctions lists is not limited to clients from particular countries. The EU list covers natural persons and entities from many jurisdictions — not only Russia and Belarus. Your client may be based in Poland while their shareholder appears on the sanctions list.

How does an AML procedure differ from a sanctions procedure? They are two different documents governing two different obligations. The AML procedure (required under the Act of 1 March 2018) describes measures to prevent money laundering: identity verification, risk assessment, reporting to the GIIF. The sanctions procedure describes the process of screening clients against the EU, MSWiA and UN sanctions lists — and what to do in the event of a hit. You can have one without the other. Both are needed.

Should you screen the beneficial owner, or only the direct client? Both. Regulation 269/2014 prohibits making funds available to persons “associated” with listed entities⁵. In line with EU guidance, verification also covers entities controlled by a listed person — hence the need to screen the client’s beneficial owner.

How long do I have to carry out a verification after new sanctions are imposed? EU regulations apply from the day they enter into force — that is, from the day of publication in the Official Journal of the EU. There is no transition period. If your current client becomes listed, you are obliged to suspend the relationship immediately once the regulation appears.

What should I do when the verification result is ambiguous (POSSIBLE MATCH)? Do not ignore it and do not automatically assume it is a false positive. Verify additional identifying data (date of birth, nationality, address, PESEL/tax identification number). Document the course of the verification and your conclusions. If you cannot unambiguously rule out an identity match with a listed person — suspend the provision of services and consult a lawyer.

Has the KIDP issued guidance on sanction screening for tax advisers? As at the date this article was published, the National Chamber of Tax Advisers has not issued dedicated guidance on sanction screening for tax advisers. The KIDP takes part in consultations of the European AML body (AMLA), but the verification obligations flow directly from the AML Act and the EU regulations — regardless of professional-body guidance.

Legal basis

• Act of 1 March 2018 on counteracting money laundering and terrorist financing (Journal of Laws 2018, item 723; consolidated text Journal of Laws 2023, item 1124) — eli.gov.pl
• Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine — EUR-Lex CELEX 32014R0269
• Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine — EUR-Lex CELEX 32014R0833
• Council Regulation (EC) No 765/2006 of 18 May 2006 concerning restrictive measures in view of the situation in Belarus — EUR-Lex CELEX 32006R0765
• Act of 13 April 2022 on special arrangements for counteracting support for aggression against Ukraine and serving the protection of national security (Journal of Laws 2022, item 835) — eli.gov.pl
• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673 — EUR-Lex CELEX 32024L1226

Information, not legal advice. This article is for information and educational purposes only and does not constitute legal advice. The specific legal assessment of an individual case should be carried out with a qualified lawyer specialising in sanctions and export-control law. Legal status: 2026-05-26.