Key takeaways from the GIFI’s training for VASPs: obligations, risks and best practices

On 31 October 2024, the General Inspector of Financial Information (GIFI) conducted a training session dedicated to entities operating in the virtual asset service provider (VASP) sector.

The event covered key topics such as:

• quarterly reporting obligations,
• the application of financial security measures,
• risk assessment methods,
• marketing communication practices,
• compliance with AML regulations.

This article presents the most important conclusions from the training and their practical implications for obligated institutions.

Could the Polish Office of Competition and Consumer Protection look into VASPs?

During the training, the GIFI highlighted the importance of content published on websites by entities operating in the virtual currency sector. The Inspector referenced Communication No. 77 from 14th February 2024, regarding commercial information.

According to the GIFI, VASPs cannot state in their promotional materials or on their websites that they hold a “VASP license,” as such activity is neither licensed nor supervised by the GIFI.

The appropriate form is to indicate the holding of an entry in the VASP register, e.g. by indicating the number in the register (RDWW). The GIFI emphasized that publishing false or misleading information could attract the attention of the Office of Competition and Consumer Protection (UOKiK).

Reporting Suspicious Transactions – alarming data from the GIFI

GIFI statistics reveal that, as of Q3 2024, no obligated institution has submitted a suspicious transaction report, as required under Article 86 of the AML Act. The GIFI expressed concern over this and reminded institutions that failure to meet this obligation may result in the application of Article 156 of the AML Act, which provides penalties of imprisonment ranging from 3 months to 5 years.

To mitigate the risk of irregularities during potential GIFI inspections, obligated institutions should:

• diligently collect client information, and
• conduct precisely analyses of the origin of funds.

These measures are essential to ensure compliance with legal obligations.

Virtual Offices as a high-risk factor

When preparing risk assessment procedures, obligated institutions should pay special attention to the use of virtual office addresses. According to GIFI, entities using such solutions often tend to disappear quickly from the market. Therefore, the use of a virtual office should be treated as a high-risk indicator in the risk assessment.

When is a VASP obligated to submit quarterly reports?

The GIFI clarified that the lack of actual activity in the virtual currency sector or even the temporary suspension of operations does not exempt entities from the obligation to submit quarterly reports. This obligation ceases only when the entity is removed from the VASP register.

Ensure full compliance with AML regulations

The GIFI training highlighted the key challenges for VASPs, including compliance with reporting obligations, clear communication, and client risk assessment. Transparency and addressing risks associated with virtual offices were emphasized as crucial. Adhering to these principles is fundamental to ensuring compliance with AML regulations.

Looking for expert guidance on AML compliance or VASP regulations? We are at your disposal! Contact our law firm and benefit from our expertise in the area of AML and regulation for VASP.