Poland -- Travel Rule Implementation Regulatory Overview

Poland has fully adopted the FATF Travel Rule, primarily through amendments to its national Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) legislation. As an EU member state, Poland's framework aligns with the requirements of the 5th Anti-Money Laundering Directive (AMLD5) and implicitly with the principles of the FATF Recommendations.

Here's a breakdown:

Legal Basis and Adoption

1. Legislation: The primary legislation is the Ustawa z dnia 1 marca 2018 r. o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu (Act of March 1, 2018, on counteracting money laundering and terrorist financing).

   • This Act was significantly amended to transpose AMLD5, which notably brought Virtual Asset Service Providers (VASPs) under its scope.
   • URL (consolidated text): https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20180000723 (This is the Polish Parliament's legal information system, usually the most reliable for consolidated acts).

2. Effective Date: The key amendments that incorporated virtual asset service providers (VASPs) as "obliged institutions" (instytucje obowiązane) under the AML Act became effective on March 31, 2020. This is when the FATF Travel Rule requirements, through the lens of EU AML directives, became legally binding for Polish VASPs.

Threshold Amounts

For transfers of virtual assets, the Polish AML Act, by extending the scope of the EU's Wire Transfer Regulation (Regulation (EU) 2015/847) to virtual assets, essentially applies a zero threshold for VASP-to-VASP transactions when it comes to the requirement to collect and transmit originator and beneficiary information.

• For transfers between obliged institutions (VASPs) within the EU/EEA: Full originator and beneficiary information must be collected and transmitted, regardless of the amount.
• For transfers originating or ending outside the EU/EEA:
  • For transfers up to EUR 1,000, only basic originator (name, account number/unique transaction identifier) and beneficiary (name, account number/unique transaction identifier) information is required.
  • For transfers over EUR 1,000, full originator (name, address, official personal document number, customer identification number, date and place of birth, or national ID number) and beneficiary (name, account number/unique transaction identifier) information is required.

However, the general FATF Travel Rule guidance emphasizes that for all VASP-to-VASP transfers, the necessary information should be exchanged to allow for proper risk assessment. Polish law mandates these obligations for VASPs.

Which VASPs Are Covered

The Polish AML Act defines "virtual currency services" (usługi w zakresie walut wirtualnych) and entities providing them are classified as "obliged institutions." This includes:

• Exchange services between virtual currencies and fiat currencies.
• Exchange services between one or more forms of virtual currencies.
• Intermediation in the exchange services mentioned above.
• Maintenance of virtual currency accounts (custodian wallet providers). This includes keeping of virtual currencies and providing instruments enabling their access.

These entities must register in the Register of Activities in the Scope of Virtual Currencies maintained by the Director of the Tax Administration Chamber in Katowice (Dyrektor Izby Administracji Skarbowej w Katowicach). URL for Register info: https://www.gov.pl/web/kas/rejestr-dzialalnosci-w-zakresie-walut-wirtualnych

Technical Implementation Requirements

Polish legislation, similar to most jurisdictions adopting the Travel Rule, does not mandate a specific technical solution or protocol (e.g., TRISA, OpenVASP, Sygna). Instead, it sets out the requirements for the data to be collected and transmitted and leaves the technical implementation to the obliged institutions.

VASPs operating in Poland must:

• Have internal procedures and IT systems in place to collect, verify, store, and transmit the required originator and beneficiary information securely and accurately.
• Ensure the integrity and confidentiality of the data.
• Be able to respond to requests for information from the General Inspector of Financial Information (GIIF – Generalny Inspektor Informacji Finansowej), which is Poland's Financial Intelligence Unit (FIU), and other competent authorities.
• Comply with data retention requirements (typically 5 years after the end of the customer relationship or transaction).

Penalties for Non-Compliance

Non-compliance with AML/CTF obligations, including those related to the Travel Rule, can result in severe penalties, both administrative and criminal. The General Inspector of Financial Information (GIIF) is the primary authority responsible for supervising and enforcing AML/CTF compliance in Poland.

Administrative Penalties (imposed by GIIF):

For obliged institutions (VASPs):

• Financial penalties: Up to PLN 5,000,000 (approx. EUR 1,150,000) or up to double the amount of the benefit gained from the infringement, if this amount can be determined.
• Prohibition on performing duties for individuals responsible for the infringement.
• Public statement regarding the infringement.
• Temporary or permanent withdrawal of the license or permit to operate.
• Withdrawal from the register of activities in the scope of virtual currencies.

For management or employees responsible for the infringement:

• Financial penalties: Up to PLN 1,000,000 (approx. EUR 230,000).

Criminal Penalties:

Serious breaches of AML/CTF regulations, particularly those related to money laundering or terrorist financing itself, can lead to criminal charges with potential imprisonment and substantial fines. For example, individuals who fail to comply with certain obligations of the Act may be subject to fines, restriction of liberty, or imprisonment for up to 3 years.

Reference for GIIF:

• GIIF website (Polish): https://www.gov.pl/web/giif

In summary, Poland has robustly implemented the FATF Travel Rule through its AML Act, bringing VASPs under comprehensive regulatory oversight with clear obligations for information collection and transmission, backed by significant penalties for non-compliance.