UC92 — Poland's major sanctions act. What it really changes for non-financial businesses

The major sanctions act — that is the popular name under which the UC92 bill circulates in the trade press: a framework statute covering the whole Polish system for enforcing EU restrictive measures. For all the emotion it stirs up — penalties of up to 12 years’ imprisonment, liability of collective entities, compulsory administration — at the level of substantive obligations for businesses the bill introduces almost nothing new. And that is not the author’s reading — it is the literal position of the proposing ministry, the Ministry of Foreign Affairs, recorded in the minutes of the Standing Committee of the Council of Ministers. I will return to that quote in the middle of this article, because it is what sets the correct way of reading the whole bill.

UC92 introduces no new obligation for Polish businesses. The obligation to carry out sanction screening — checking whether a counterparty, beneficial owner or delivery recipient appears on a sanctions list — has existed for years. It flows from the directly applicable Council Regulations (EU) No 269/2014¹ and No 833/2014², and, for the Russia–Belarus regime, from the Act of 13 April 2022.³ These instruments bind every company registered in Poland, whether or not anyone ever paid them any attention. UC92 does not change a single comma of that.

It changes something else — and that is precisely why it matters. It clearly names a supervisor. It introduces criminal liability for violations of EU restrictive measures beyond the Russia–Belarus regime. It gives whistleblowers a legal channel. It embeds screening in the state’s actual enforcement. For a non-financial business — an e-commerce shop, a wholesaler, a freight forwarder, a travel agency, an estate agency — this is the shift from an obligation “on paper that nobody enforced” to an obligation with a specific inspector and a criminal offence for breaching it.

What the “major sanctions act” is — the basic facts

In the Council of Ministers’ list of legislative work the bill carries the number UC92.⁴ Proposing authority: the Minister of Foreign Affairs. Function: framework regulation of restrictive measures — it is sometimes called the “major sanctions act” or, in journalistic shorthand, the “sanctions constitution”, though neither label is a legal category. It implements Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures.⁵

The directive’s transposition deadline fell on 20 May 2025.⁵ Poland is more than a year late. The bill was published in the Public Information Bulletin of the Government Legislation Centre on 27 June 2025; public consultations ran from 30 June to 30 July 2025.⁴ As of 27 May 2026 — following the meeting of the Standing Committee of the Council of Ministers on 14 May 2026, which closed with a record of divergences — the bill is before the legal drafting committee, the Council of Ministers and the Sejm.⁴ The bill itself provides that it will enter into force 30 days after promulgation, but nobody today can sensibly predict the date of promulgation.

Keep this chronology in mind as you read on. Every article number I cite refers to the version of the bill after the Standing Committee, May 2026 — the legal drafting committee may change the numbering and the wording, and during the parliamentary stage a print with its own numbering will appear. The direction will not change; the details may.

What the major sanctions act really changes

The loudest change is Chapter 6 of the bill (in the version after the Standing Committee, May 2026) — criminal liability for violations of EU restrictive measures. Until now, criminality under Polish law has covered only violations of the Russia–Belarus regime under the Act of 13 April 2022.³ UC92 extends it to all EU sanctions regimes — Iran, Belarus, North Korea, Syria, Myanmar, terrorism, and any further ones in which the Council of the EU decides to introduce restrictive measures. This is not a new substantive obligation, only a new legal classification of a violation that is already prohibited today.

The second hard element is Article 69 (in the version after the Standing Committee, May 2026) — added at the Standing Committee stage at the request of the Ministry of Justice and agreed with the Government Legislation Centre. It disapplies the lex mitior retro agit principle: the later repeal or amendment of an EU restrictive measure does not release a person from liability for an act committed while the measure was in force. This is a deliberate, intentional choice by the legislator. A sanctions violator will not be “wiped clean” when the sanctions regime ends — when the Council of the EU eventually lifts a given measure, the criminal case for breaching it still proceeds.

The third point — and in practice the most important for a non-financial business — is the clear designation of the inspection authorities. General oversight is exercised by the head of the customs and tax office. Obliged institutions within the meaning of the Anti-Money Laundering Act are supervised by the General Inspector of Financial Information. Financial-market entities — by the Polish Financial Supervision Authority. Three authorities, three supervisory logics, each with its own segment.

Fourth, Article 84 (in the version after the Standing Committee, May 2026) amends Article 5 of the Act of 13 April 2022 — the Head of the National Revenue Administration (KAS) remains the authority competent to grant derogations for the Russia–Belarus regime.³ This is formal tidying-up, not a substantive change.

Fifth, Article 83 (in the version after the Standing Committee, May 2026) adds Article 149a to the Act of 1 March 2018 on counteracting money laundering and terrorist financing — a ne bis in idem clause between the administrative financial penalty under Article 149 of the AML Act and the offences under Chapter 6 of UC92. Despite objections from the Ministry of Finance, the Ministry of Foreign Affairs kept the solution: for the same violation a company will not pay twice — administratively and criminally.

Sixth, Article 44 (in the version after the Standing Committee, May 2026) places on public contracting authorities an obligation to unilaterally terminate a contract where a national restrictive measure is applied to a contractor. For EU measures, an analogous mechanism already flows from Article 6 of Regulation 269/2014¹ and Article 456 of the Public Procurement Law — this is not a novelty, but it is now in a single act. For companies that regularly bid for tenders, this thread is covered in detail in a separate article on sanctions and public procurement.

Seventh, the bill brings violations of restrictive measures within the scope of the Act of 14 June 2024 on the protection of whistleblowers.⁶ An employee who reports a sanctions violation within their company — internally, to a public authority, or through public disclosure — enjoys the protection provided for by Directive 2019/1937. From the company’s perspective, this changes the detection-risk model: the largest source of information about sanctions non-compliance is rarely the supervisory authority; more often it is the accountant, the warehouse manager or the salesperson who has started to wonder why this particular transfer is “better done without a log”.

The architecture of supervision — the most important part for businesses

General oversight of sanctions compliance by non-financial businesses belongs to the head of the customs and tax office. The procedure is the customs and tax inspection — one of the broadest inspection procedures in Polish law, governed by the Act of 16 November 2016 on the National Revenue Administration.⁷ The legal basis is not new: Article 143c of that act, added by the Act of 13 April 2022, already gives KAS the tools to inspect sanctions compliance today.⁷ UC92 merely codifies this and extends it to all EU regimes, not just the Russia–Belarus one. The procedure and course of such an inspection are covered separately in an article on KAS inspections in sanctions matters.

Crucially, KAS has its own data. Customs declarations, VAT returns, JPK (Standard Audit File) reports — all of this already flows to the tax administration. Risk analysis is conducted on the basis of this data. KAS does not need to ask a company whether it has counterparties on sanctions lists; in many cases it can see this from EORI numbers, commodity codes and countries of origin before any letter to the company is even drafted. The first targeting will go where turnover is linked to high-risk destinations and sensitive product categories — this is not speculation, it is the logic of an analytical system.

The decision to impose an administrative penalty is made by the head of the customs and tax office; the appeal goes to the same authority (no devolution). In a particularly justified case, where the violation is of negligible weight, the head may waive the penalty. This opens a door for a company that has materially breached a prohibition but can demonstrate documented diligence and a one-off occurrence.

A summons to a customs and tax inspection gives a company a few days — not months — to present its documentation. Without a screening history and a log of compliance decisions, there is nothing with which to demonstrate diligence. Backdating is not allowed; an attempt at such a manoeuvre weakens the defence rather than strengthening it.

The proponent’s position — this has to be heard here

In response to the comments of the Coordinator of the Regulatory Impact Assessment — who called for an analysis of the impact on businesses and of compliance costs — the Ministry of Foreign Affairs recorded one sentence twice in the Standing Committee minutes. It reads: “Businesses will have no additional obligations. The provisions are de facto not new for them.”⁴

That quote is worth reading twice. The proponent — the ministry leading the bill — confirms in the legislative file that UC92 creates no substantive obligations for businesses. The obligation flows from directly applicable Council of the EU regulations and has been in force for years. UC92 adds enforcement, not the obligation.

Any reading to the contrary — and there will be plenty in the trade press — contradicts the legislative record. If you see a headline saying “UC92 introduces a sanction-screening obligation for businesses”, the author simply has not read the case file. The obligation already exists. The question is not “do I have to screen”, but “if the head of the customs and tax office turned up with an inspection today, do I have anything to show that I do it systematically”. Who is subject to this obligation, and from when, is described directly in the article on the sanction screening obligation.

Penalties — honestly, not as a scare tactic

Directive 2024/1226 sets minimum thresholds that Member States must reach in national law: for the most serious offences a maximum term of imprisonment of no less than 5 years, and for collective entities fines whose upper limit may not be lower than EUR 40 million or 5 percent of annual worldwide turnover.⁵ The UC92 bill reaches higher: it provides for up to 12 years’ imprisonment and liability of collective entities of up to PLN 200 million. These figures circulate in the media because they are dramatic — and that is precisely why they should not be the main argument in a conversation about UC92.

The upper brackets apply to the most serious, intentional, large-scale violations. This is not the typical scenario for a wholesaler of electronic components or for a travel agency serving a client with a passport from the other side of the world. What actually decides the real risk for a non-financial business lies elsewhere.

The penalisation also covers gross negligence. A company that has materially breached sanctions but has any documented trace of verification — a screening log, an email with a compliance reply, a note in the CRM — can defend itself on the absence of intent. A company with no trace at all falls into the classification of gross negligence. It is the subjective side, not the mere fact of the violation, that decides the legal classification.

From this simple mechanism follows the whole practical conclusion of this article: a documented, repeatable sanction-screening procedure — even an imperfect one — protects against the worst-case scenario. The absence of a procedure, combined with a material violation, pushes the case from an administrative tort towards a criminal offence. A full map of penalties — administrative and criminal — together with the existing Polish track record is set out in the article on penalties for violating sanctions.

The myth of retroactivity

A concern arises that UC92 will reach back — that a company which did not screen its counterparties in 2024 will be punished for it after the act enters into force. That is unfounded. Article 1 of the Criminal Code, Article 42(1) of the Constitution of the Republic of Poland and Article 7 of the European Convention on Human Rights rule out such a construction. An act must be prohibited under threat of penalty at the time it is committed. UC92 will not allow a company to be prosecuted for not screening in 2024 as such.

Two mechanisms are nonetheless real. First: continuing violations — unfrozen assets, an ongoing relationship with a listed entity, an uninterrupted supply of prohibited goods — enter the period of the new criminal law on the day the act comes into force. A violation does not end on the day it begins; it continues for as long as it lasts. Second: the absence of a screening history becomes evidence of the subjective side in a current violation detected after the act has entered into force. Nobody will be punished for the mere absence of a procedure in 2024, but the absence of a procedure in 2026 will meet a current violation and serve as an argument in assessing culpability.

It should also be remembered that the Russia–Belarus regime has been criminally punishable since 16 April 2022 — from the entry into force of the Act of 13 April 2022³ — independently of UC92 and independently of Directive 2024/1226. This regime has its own criminal track and its own enforcer (the Head of KAS for administrative penalties, the ordinary courts for offences).

The dispute in the file — procedural context

Most of the divergences at the Standing Committee concerned the budget, not the substance of sanctions. The dispute between the Ministry of Finance and the Ministry of Foreign Affairs concerned funding for new posts — one at the Ministry of the Interior and Administration, two at the Ministry of Foreign Affairs, two at the Ministry of Development and Technology, and forty-four in the judiciary.⁴ The Ministry of Finance holds that the proponent must indicate a specific source of funding rather than referring to “the current budget act”.

The Government Legislation Centre maintained its reservations about the construction of compulsory administration (Articles 12–33 in the version after the Standing Committee, May 2026) — particularly with respect to natural persons. The matter was moved to the legal drafting committee, which is to resolve the constitutional questions surrounding this solution.

The practical conclusion: the text that goes before the Council of Ministers, and then the Sejm, will differ from today’s. Article numbers, wordings, some of the structural solutions — all of this will still move. What will not move is the direction: a supervisor defined, criminal punishment for violations introduced, the whistleblower protected. The broader context — including how other EU states handled the transposition of the same directive — is in the article on the transposition of Directive 2024/1226 across nine EU countries, and the source itself — the EU directive — in the article on the criminalisation of EU sanctions violations.

What it means for a typical non-financial business

Three practical consequences follow from the above — without scaremongering, without landing-page drama.

First: the absence of a procedure is not in itself punishable, but the absence of documented diligence is exactly what, in the event of a real violation, shifts the classification towards gross negligence. Writing a procedure that nobody follows has limited value. Daily, simple, repeatable screening — with a log of every decision — protects. The specific implementation documents (policy, workstation instruction, hit register) are described in the article on the sanctions policy and document templates.

Second: KAS can target a company from its own data — from customs, VAT, JPK. Targeting will go first to companies whose turnover is linked to high-risk destinations (Russia, Belarus, circumvention countries in the case of dual-use goods) and to sensitive product categories. The logic of inspection risk is analytical, not random. Whether a company falls into the higher-probability targeting group is something you can work out for yourself — a sanctions audit and its checklist helps here.

Third: after a summons a company has a few days, not months. Without a screening history there is nothing with which to demonstrate diligence, and backdating must not be done. Hence the only sensible strategy: start a documented process today, regardless of when the UC92 bill enters into force. What you create today will be your evidence of diligence tomorrow. Not the other way round.

How to build it into your company

The specific steps — sanctions policy, hit register, workstation instruction — have been described earlier. Sanqto is sanction-screening software installed in the client’s network; the data never leaves the company. In the context of UC92 one feature matters: every check leaves a log with a MATCH / POSSIBLE / CLEAR result, a timestamp and an operator identifier. This is exactly the kind of trace that, in the event of a customs and tax inspection, proves diligence and puts the subjective side on the company’s side rather than the head of the customs and tax office’s.

The major sanctions act — when it enters into force — will change nothing in a company’s substantive obligations. It will change whether someone on the other side checks whether you are actually fulfilling that obligation.

Legal basis

• List of legislative and programming work of the Council of Ministers — the UC92 bill; project number in the RCL register: 12399355 — legislacja.rcl.gov.pl/projekt/12399355
• Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures — OJ L 2024/1226, 29.4.2024 — CELEX 32024L1226
• Council Regulation (EU) No 269/2014 of 17 March 2014 — OJ L 78/6, 17.3.2014 — CELEX 32014R0269
• Council Regulation (EU) No 833/2014 of 31 July 2014 — OJ L 229/1, 31.7.2014 — CELEX 32014R0833
• Act of 13 April 2022 on special measures to counteract support for aggression against Ukraine and to protect national security — Journal of Laws (Dz.U.) 2022 item 835, as amended — ISAP
• Act of 16 November 2016 on the National Revenue Administration — Journal of Laws (Dz.U.) 2016 item 1947, as amended, Article 143c — ISAP
• Act of 14 June 2024 on the protection of whistleblowers — Journal of Laws (Dz.U.) 2024 item 928 — ISAP
• Act of 1 March 2018 on counteracting money laundering and terrorist financing — Journal of Laws (Dz.U.) 2018 item 723, as amended — ISAP
• KAS notice on sanctions — gov.pl/web/kas/sankcje-w-zwiazku-z-agresja-na-ukraine

Footnotes

Information, not legal advice. This article is for information and educational purposes only and does not constitute legal advice. The specific legal assessment of an individual case should be carried out with a qualified lawyer specialising in sanctions and export-control law. Legal status: 2026-05-27.

The UC92 article numbers refer to the version of the bill after the Standing Committee of the Council of Ministers of 14 May 2026 and may change in the legal drafting committee, during the work of the Council of Ministers and at the parliamentary stage.