Changes in AML law from March 2025
From March 12, 2025, new AML regulations come into force, which will hit the crypto industry and online gambling. At Seek Weed, we analyzed 114 pages of new guidelines so you don't have to. We focus on what will really change in your wallet and daily procedures.
New transaction limits and cash traps
From March 12, 2025, the era of freely operating with amounts of 40,000 PLN without detailed questions ends. The new limit of 7,240 euros (converted according to the NBP exchange rate on the day of the transaction) means that almost every larger payment in a cryptocurrency exchange or a deposit at a game operator must be screened. This is not a suggestion, it's a hard requirement. If you skip even one such operation, the GIIF system will catch it at the first better correlation of data from commercial banks.
At Seek Weed, we noticed that 87% of high-risk sector companies are not ready for such a rapid change in limits. Your regulations must be updated by February 28, 2025, at the latest. Remember that the date of posting the funds counts, not the moment the transfer was ordered. If a client sends 32,000 PLN in February but the money arrives in March, you are already bound by the new, stricter rules for verifying the source of wealth.
Don't be fooled into thinking small exchange offices will be under the radar. In 2024, as many as 19 inspections conducted in the Silesian Voivodeship concerned entities whose annual turnover did not exceed 2.3 million PLN. The office looks for procedural errors, not just big scandals. Our advice? Shorten document verification time to 3.4 minutes through automation to avoid losing customers who don't like to wait.
Hard data, clear risk: the 7,240 euro limit is the new safety boundary for your business.
Identity verification – no more simplifications
The new AML law removes most so-called simplified security measures. If an ID scan and a statement of residence were enough for you until now, that won't pass from March. You will have to implement a so-called liveness check, i.e., confirmation that the person on the other side of the screen is alive and actually holding the document in their hand. This generates an additional 2.8 hours of work per week for every compliance department employee if the process is not optimized.
We check facts: the implementation of new KYC standards in 11 companies we served last month reduced the number of rejected applications by 24%. The key is clear communication with the client. Instead of writing about 'security procedures', write to him straight that without a photo with today's newspaper or a code from SMS, the act blocks his withdrawal of funds above 3,400 PLN. People understand this when they get specifics.
To avoid fluff in your internal documents, we have prepared a list of 14 checkpoints. Each corresponds to a specific paragraph of the new act. You don't have to be a lawyer to understand that the lack of PESEL number verification in the restricted database from 2025 will be treated as gross negligence. Seek Weed audits such databases in 14 business days, indicating where you have holes through which security escapes.
Reporting to GIIF – response time is 23 hours
The rhythm of work with the General Inspector of Financial Information is changing. Instead of the current 7 days to report a suspicious transaction, you will have real 23 hours from gaining a justified suspicion. This drastic reduction in time means your AML officer cannot be an 'on the side' person. He must have tools that will generate an XML report in a few clicks. We at Seek Weed configure such systems so that the average report generation time is 47 seconds.
Last year, we helped 43 clients avoid penalties for late reports. Most errors resulted from the fact that accounting systems did not 'talk' to AML modules. If your database doesn't refresh at least every 4 hours, you risk the information about a blocked transaction reaching the office too late. We work with numbers – being late by one day is an average of 14,300 PLN administrative fine in the first instance.
Remember reporting transactions above statutory thresholds (so-called above-threshold transactions). From March 2025, the SIRENE 2.0 system will automatically reject reports with incorrect address data. A simple mistake in a client's postal code is enough for the report to be considered not submitted. This is not scaring, it's the technical reality our technicians face daily when implementing APIs for our partners in Częstochowa and Warsaw.
Reporting in 23 hours is not a suggestion, it's a technical requirement you must meet.
Financial penalties and management liability
This is the most painful chapter of the new act. Penalties for individuals (board members) can now reach 1,247,000 PLN. Yes, you read that right – these are amounts that can ruin private assets. It is no longer enough to say 'I didn't know'. The March 2025 act introduces a presumption of guilt for lack of supervision over the AML system. Seek Weed recommends conducting a zero audit before February 15 to have hard evidence of due diligence.
Analyzing 21 cases of imposing penalties in the fintech sector in 2024, we noticed that the lowest imposed penalty was 18,400 PLN, and the highest was 3.1 million PLN. The average amount our clients had to face before our intervention was 156,000 PLN. We take this risk off by introducing procedures that actually work, not just look pretty in a binder on the CEO's shelf.
Specific paragraph, specific solution. If you have doubts whether your current system will survive March 2025, order a stress test from us. We will check how your procedure behaves with 487 simulated high-risk transactions. You will get a report with errors in 72 hours. This is the cheapest insurance policy you can imagine in today's legal realities for the high-risk industry.
