Polish Sanctions Act 2022 – obligations

A Warsaw-based logistics company wins a contract with a new Eastern European supplier. Due diligence looks clean. Then, three months later, the Office of Foreign Assets Control flags a connection to a listed entity. The Polish authorities open an inquiry. The board discovers it never registered with the National Revenue Administration (Krajowa Administracja Skarbowa, KAS) as a reporting institution under the Polish Sanctions Act 2022. Personal liability for directors follows within days.

Poland's Ustawa o szczególnych rozwiązaniach w zakresie przeciwdziałania wspieraniu agresji na Ukrainę (Act on Special Solutions for Counteracting Support for Aggression against Ukraine, the Sanctions Act) entered into force in April 2022. It imposes freezing obligations, reporting duties, and licensing requirements on a broad range of Polish and foreign-connected entities operating in Poland. Failure to comply carries criminal penalties of up to five years' imprisonment for individuals and fines of up to PLN 20 million for legal persons. The Act operates alongside EU Council regulations, creating a layered compliance framework that demands active management, not passive monitoring.

This page sets out the regulatory structure, key obligations, enforcement mechanisms, and cross-border considerations that matter most to businesses operating in Poland. It also identifies the most common compliance failures and explains how to address them before an inspection arrives.

What does the Polish Sanctions Act 2022 actually require?

The Sanctions Act assigns specific duties to a defined category of obligated entities. These include financial institutions, payment service providers, investment firms, and any company that enters into a commercial agreement with a counterparty subject to EU or Polish autonomous sanctions. The scope is wider than many compliance teams assume. A manufacturing company in Silesia supplying industrial components can fall within the Act's reach if a listed person holds a qualifying interest in its customer.

Three core obligations apply. First, obligated entities must freeze assets – including funds, economic resources, and financial instruments – belonging to, owned by, or controlled by a listed person. The freeze takes effect immediately upon designation. There is no grace period. Second, entities must report frozen assets to the Minister of Finance within seven calendar days of the freeze. Third, entities may not make funds or economic resources available to listed persons, directly or indirectly, without a licence issued by the Minister of Finance.

Immediate asset freeze upon designation – no delay is permitted
Seven-day reporting window to the Minister of Finance
Prohibition on making assets available without a licence
Duty to identify beneficial ownership chains to detect indirect exposure
Obligation to maintain records of all sanctions-related actions for five years

The National Court Register (Krajowy Rejestr Sądowy, KRS) and the Central Register of Beneficial Owners (Centralny Rejestr Beneficjentów Rzeczywistych, CRBR) are the two primary data sources for ownership verification. Obligated entities must cross-reference both registers against EU consolidated lists and the Polish national list maintained by the Minister of Internal Affairs and Administration. The verification frequency is not fixed by statute. Regulators expect it to be proportionate to the entity's risk profile – which means at least monthly for high-exposure sectors.

One common misconception is that the Act applies only to banks and financial institutions. It does not. The Ustawa o szczególnych rozwiązaniach explicitly extends to trading companies, real estate intermediaries, and any person concluding a significant commercial agreement. We advised a technology distributor in Mazowieckie (spring 2025) who had processed over PLN 3 million in transactions with an indirectly designated entity before the connection was identified. Remediation required voluntary disclosure, a compliance overhaul, and engagement with the Ministry – all of which could have been avoided with a functioning screening protocol.

How are sanctions violations detected and prosecuted in Poland?

Enforcement sits with multiple authorities. The Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF) supervises financial sector entities. KAS handles customs and trade-related breaches. The Internal Security Agency (Agencja Bezpieczeństwa Wewnętrznego, ABW) investigates strategic violations with national security dimensions. For most commercial entities, the first contact point is KAS, which may refer criminal matters to the public prosecutor's office.

Detection typically follows one of three paths. First, a transaction is flagged through the SWIFT network or a correspondent bank's own screening system, triggering a suspicious transaction report to the General Inspector of Financial Information (Generalny Inspektor Informacji Finansowej, GIIF). Second, a regulatory inspection of a financial institution reveals a downstream commercial counterparty's non-compliance. Third, a whistleblower report is filed under the EU Whistleblower Directive, which Poland transposed in 2024 with a 28-day response deadline for internal reports.

Criminal liability under the Sanctions Act is strict in structure. For an individual – a director, compliance officer, or beneficial owner – the penalty reaches five years' imprisonment. For a legal person, fines reach PLN 20 million or ten percent of annual turnover, whichever is higher. These are not administrative fines subject to negotiation. They are criminal sanctions imposed after a formal prosecution. The distinction matters enormously for directors considering whether to self-report.

Self-reporting does not eliminate liability. It can, however, influence prosecutorial discretion. Polish criminal procedure allows the prosecutor to propose a conditional discontinuance of proceedings where the harm has been remedied and the public interest does not require a conviction. This path closes permanently once an investigation is formally opened against a named suspect. The irreversible consequence of waiting is that the voluntary disclosure option forfeits.

We obtained a suspension of enforcement proceedings for a foreign investor's Polish subsidiary in Lower Silesia (winter 2025) by coordinating simultaneous voluntary disclosure with the Ministry of Finance and a structured asset remediation plan. The subsidiary had inadvertently maintained a commercial relationship with a company in which a listed person held a 28 percent indirect stake. Early engagement – before ABW involvement – was decisive.

What are the cross-border compliance pitfalls for foreign investors?

Foreign investors entering Poland often underestimate the interaction between Polish autonomous sanctions, EU Council regulations, and the domestic implementing framework. The Sanctions Act does not merely implement EU law. It creates additional Polish-specific obligations that go beyond what the EU regulations require. In particular, the Act introduces a national list of persons subject to Polish autonomous measures – distinct from EU consolidated lists – which receives less systematic monitoring from international compliance teams.

The extraterritorial dimension creates further complexity. A German parent company may screen its Polish subsidiary's counterparties against EU lists only. If a counterparty appears on the Polish national list but not the EU list, the subsidiary is in breach of the Sanctions Act while the parent's group compliance system shows no alert. This gap has caused multiple enforcement inquiries in 2024 and 2025. Integrating the Polish national list into group-level screening is not optional – it is a legal requirement for entities operating in Poland.

For cross-border transactions, the licensing regime introduces timing risk. A licence from the Minister of Finance is required before any derogation from the freeze obligation. The application process has no statutory deadline for decision. In practice, responses take between 30 and 90 days. During that period, the transaction is suspended. A foreign investor relying on a tight acquisition timeline – for example, a 60-day exclusivity window – can find that a licensing requirement renders the deal structure unworkable without restructuring.

Verify the Polish national sanctions list separately from EU consolidated lists
Build a 90-day licensing buffer into acquisition timelines where sanctions exposure is possible
Ensure group compliance systems receive Polish-language regulatory updates from the Ministry of Internal Affairs
Appoint a named compliance officer with specific Sanctions Act responsibility within the Polish entity

For arbitration proceedings involving sanctioned counterparties, the interaction between the Sanctions Act and procedural law raises separate questions. Polish arbitration procedure does not automatically suspend where a party becomes designated. However, making an award payment to a listed person without a licence breaches the Act. Parties to arbitration in Poland should obtain legal advice before any payment step in a proceeding where sanctions exposure is possible. Our guide to expert witnesses in Polish court proceedings addresses related evidentiary issues that arise in sanctions-adjacent disputes.

The Krajowa Izba Odwoławcza (National Appeals Chamber, KIO) has jurisdiction over public procurement disputes. Where a contracting authority excludes a tenderer on sanctions grounds, the KIO appeal window is ten days from the exclusion decision. Missing this deadline precludes any challenge to the exclusion. A KIO appeal on sanctions grounds requires specific legal arguments about the proportionality of the exclusion – a KIO appeal without this framing is rarely successful.

How should businesses structure their sanctions compliance programme?

A workable sanctions compliance programme under the Polish Sanctions Act has five components. Each component addresses a specific legal obligation. The programme is not a policy document – it is an operational system with named owners, documented outputs, and tested escalation paths. Regulators distinguish between entities that have a compliance programme and entities that can demonstrate it functioned correctly in a specific instance.

The first component is counterparty screening. Every new counterparty must be screened against EU consolidated lists, the Polish national list, and UN Security Council lists before the relationship commences. Screening must be repeated at least monthly for existing relationships in high-risk categories. The screening must extend to beneficial owners at every level of the ownership chain – a 25 percent ownership threshold under anti-money laundering rules does not apply here. The Sanctions Act requires assessment of control, not just ownership.

The second component is a freeze and reporting protocol. The protocol must define who has authority to freeze assets, how the seven-day reporting window is tracked, and who signs the report to the Minister of Finance. A protocol that exists only in writing – but has never been tested – will not satisfy a regulator. Annual simulation exercises are advisable for entities with material sanctions exposure.

The third component is licensing management. Where a transaction requires a derogation licence, the application must be prepared before the transaction is entered into. A licence application submitted after a prohibited transaction has occurred does not retroactively cure the breach. The application must identify the legal basis for the derogation, the specific assets involved, and the intended use of the funds.

The fourth component is record-keeping. The Sanctions Act requires entities to retain documentation of all sanctions-related actions for five years. This includes screening records, freeze notifications, licence applications, and internal escalation communications. In an enforcement context, the absence of records is treated as evidence of non-compliance, not merely an administrative gap.

The fifth component is training. Key personnel – including board members, procurement officers, and treasury staff – must receive documented training on the Sanctions Act at least annually. For entities in high-exposure sectors, training should also cover the interaction between the Act and EU regulations, and the specific risks arising from indirect exposure through ownership chains.

For context on how enforcement disputes can escalate into formal proceedings, our overview of insolvency proceedings timelines illustrates the speed at which financial consequences can become irreversible once enforcement is underway.

A specific issue arises for companies involved in cross-border enforcement of foreign judgments. Where a judgment debtor becomes designated after the judgment is obtained, enforcement steps – including attachment of accounts – may require a licence. Our step-by-step guide on enforcing a French judgment in Poland covers the procedural framework that applies in these situations.

What are the penalties for non-compliance, and how are they assessed?

The Sanctions Act penalty framework operates on two tracks. Criminal penalties apply to individuals and legal persons for substantive breaches – making funds available to a listed person, failing to freeze assets, or providing false information to a regulator. Administrative penalties apply for procedural failures – late reporting, inadequate record-keeping, or failure to maintain a compliant screening system. Both tracks can run simultaneously. An entity can face a PLN 20 million criminal fine and a separate administrative penalty for the same underlying failure.

For individuals, the criminal penalty scale runs from a fine (no minimum specified in the Act) to five years' imprisonment for the most serious violations. The key aggravating factors are: prior knowledge of the designation, the value of assets involved, and whether the breach was systematic rather than isolated. A director who receives a screening alert, disregards it, and proceeds with a transaction faces a materially worse outcome than a director who acted on incomplete information in good faith.

For legal persons, the fine reaches PLN 20 million or ten percent of annual turnover. The turnover calculation uses the preceding financial year. For a Polish subsidiary of a large international group, the turnover base may be the subsidiary's standalone turnover – but prosecutors have sought to argue for group-level turnover in cases involving coordinated breaches across multiple entities. This argument has not been definitively resolved by Polish courts, creating additional uncertainty for group structures.

Administrative penalties for procedural breaches are assessed by the relevant supervisory authority – KNF for financial entities, KAS for trading entities. The penalty amounts are lower, but the reputational consequences of a published enforcement decision can exceed the financial impact. KNF publishes enforcement decisions on its website. A listed enforcement decision affects relationships with correspondent banks, insurance providers, and public procurement eligibility.

The interaction between the Sanctions Act and public procurement law deserves particular attention. A company subject to a sanctions-related enforcement decision may be excluded from public procurement procedures for up to three years under the Prawo zamówień publicznych (Public Procurement Law, PZP). This exclusion is mandatory, not discretionary. For companies with significant public sector revenue, a sanctions enforcement action can therefore trigger business losses far exceeding the nominal penalty amount.

Self-assessment checklist: is your Polish sanctions compliance adequate?

The following checklist is designed for compliance officers, in-house counsel, and board members assessing whether their organisation's current programme meets the requirements of the Sanctions Act. A "no" answer to any item indicates a gap that should be addressed before the next regulatory inspection or counterparty audit.

Does your screening system include the Polish national sanctions list, updated at least monthly?
Does your beneficial ownership verification extend beyond the 25 percent threshold to capture control relationships?
Is there a named individual responsible for freeze notifications with a documented seven-day tracking mechanism?
Have all relevant personnel received documented Sanctions Act training within the past 12 months?
Are sanctions-related records retained in a format that can be produced within 48 hours of a regulatory request?

If your organisation operates in a high-exposure sector – financial services, logistics, energy, or defence supply chains – a gap in any of these areas warrants immediate remediation. The consequences of a finding during an ABW or KAS inspection are not limited to the penalty itself. They include the reputational damage of a published decision, potential exclusion from public procurement, and personal criminal exposure for directors. Each of these consequences is effectively irreversible once enforcement proceedings are formally commenced.

The compliance programme must also address the scenario in which a counterparty is designated after the relationship begins. This is the most common enforcement scenario. Most breaches arise not from deliberately prohibited transactions but from failure to detect a mid-relationship designation and act within the required timeframe. A screening system that operates only at onboarding – and not on an ongoing basis – does not satisfy the Act's requirements.

Specific attention is warranted for entities involved in arbitration or litigation in Poland. Where a dispute involves assets or parties with potential sanctions exposure, procedural steps – including the appointment of expert witnesses, the enforcement of interim measures, and the payment of arbitral awards – may intersect with sanctions obligations. Identifying these intersections early avoids the situation in which a procedural step becomes a substantive breach.

Frequently asked questions

Q: Does the Polish Sanctions Act 2022 apply to foreign companies with no Polish registration?

A: The Act applies to any entity conducting business activity in Poland, regardless of registration. A foreign company supplying goods or services to Polish customers, or holding assets in Poland, falls within scope if it meets the threshold for obligated entities. Foreign investors operating through Polish branches are subject to the same obligations as locally incorporated companies. The absence of Polish registration does not create an exemption.

Q: How long does the Ministry of Finance take to process a derogation licence application?

A: There is no statutory deadline for the Ministry of Finance to decide on a licence application. In practice, decisions have taken between 30 and 90 days depending on the complexity of the case and the completeness of the application. Incomplete applications are returned without decision, restarting the clock. Entities planning transactions that may require a licence should submit applications at least 90 days before the transaction is scheduled to close. Proceeding without a licence – even if an application is pending – constitutes a breach of the Act.

Q: Can a company avoid criminal liability by demonstrating it relied on a third-party screening provider?

A: Reliance on a third-party screening provider does not transfer legal responsibility. The obligation to screen, freeze, and report rests with the obligated entity. A third-party provider's failure to flag a designation may be relevant to assessing the good faith of the entity's conduct, and may support a civil claim against the provider, but it does not constitute a legal defence to criminal prosecution. Entities using third-party providers must verify that the provider's data sources include the Polish national list and that updates are applied without delay. Contractual warranties from providers should be reviewed and, where inadequate, renegotiated.

A specific situation requiring immediate legal review arises where your organisation has received a regulatory inquiry, identified a potential breach, or is considering voluntary disclosure. The decision to self-report must be made with full knowledge of the procedural consequences – including the effect on the criminal timeline and the scope of information that must be disclosed. Proceeding without legal advice at this stage forfeits options that cannot be recovered later.

To receive an expert assessment of your organisation's exposure under the Polish Sanctions Act 2022, contact info@kordeckipartners.com.

KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to sanctions compliance, commercial litigation, and cross-border enforcement. We work with Polish entrepreneurs, foreign investors, and in-house legal teams navigating the obligations imposed by the Polish Sanctions Act 2022 and related EU regulatory frameworks. To discuss your situation, contact info@kordeckipartners.com.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. KORDECKI & Partners assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.