The Act on Counteracting Money Laundering and Terrorist Financing (hereinafter referred to as the AML Act) has required obligated institutions to implement whistleblowing procedures since its entry into force in 2018. The upcoming regulations on the protection of individuals reporting violations of the law will significantly expand the obligations of organizations.
Whistleblowers in the AML Act
All obligated institutions must have internal procedures in place for anonymous reporting of potential or actual violations of AML/CFT regulations. These procedures allow reporting by current employees and other individuals performing activities for the obligated institution, i.e., those collaborating under civil law contracts, such as mandate contracts, B2B contracts, etc. Importantly, these reports do not have to be in any way related to the actual performance of AML/CFT obligations at the obligated institution. The mere existence of a relevant relationship that provides for the performance of work, activities, or services for such an organization is sufficient.
Each obligated institution must define in its internal procedure at least:
1) the person responsible for receiving reports;
2) the method of receiving reports;
3) the method of protecting the employee and co-workers, ensuring at least protection against actions of a repressive nature or those affecting the deterioration of their legal or factual situation, or consisting in making threats;
4) the method of protecting the personal data of the employee or co-worker accused of committing an infringement, in accordance with the provisions on personal data protection;
5) the principles of confidentiality in the event of disclosure of the identity of the employee and co-worker or when their identity can be established;
6) the type and nature of follow-up actions taken after receiving the report;
7) the deadline for the deletion of personal data contained in the reports by the obligated institutions.
The obligated institution should provide the option of submitting an anonymous report, meaning one that does not reveal the whistleblower's identity. Not every report needs to be anonymous, but the reporting person should be able to choose whether or not to disclose their data and use the appropriate channel.
Act on the Protection of Persons Reporting Violations of the Law
On April 6th of this year, another draft bill on whistleblower protection was published, which is intended to implement Directive 2019/1937 of the European Parliament and of the Council in Poland. The requirements imposed by this bill on organizations will apply to all obligated institutions, including the smallest ones, such as accounting firms and currency exchange offices, regardless of the number of people they employ.
Therefore, it is necessary to consider the relationship between the current AML Act and the future Whistleblower Protection Act. The explanatory memorandum to the draft act and recital 20 of Directive 2019/1937 indicate that the new regulations are intended to complement existing ones and ensure a minimum level of protection. Therefore, one interpretation, which also seems quite safe, is that it is necessary to select the provisions of these two acts that will guarantee a greater degree of protection for whistleblowers and allow for broader access to whistleblowing procedures within organizations.
Examples of areas that provide further protection under the proposed act include: the list of people who will be able to submit reports and the scope of whistleblower protection.
In addition to entirely new categories of individuals, such as volunteers, shareholders, and interns, whistleblowers will also be eligible for individuals who terminated their relationship with the obligated institution during the recruitment process, or whose relationship has already expired. This means that former employees, co-workers, and others will also be able to submit reports.
Whistleblower protection has been further clarified by creating a definition of unacceptable retaliatory actions, as well as by creating an open catalog of 21 examples of such actions or omissions. Sanctions for violating the prohibition of retaliatory actions and protection against contractual provisions excluding whistleblowers from reporting have also been introduced.
In turn, an area that is guaranteed further protection by the AML Act is the need to ensure the anonymity of a whistleblower's report on counteracting money laundering and terrorism financing.
Summary
The entry into force of new whistleblower protection regulations will force the vast majority of obligated institutions to review their existing procedures and adapt them to the new reality. It will be necessary to identify the so-called regulatory gap and determine which portion of the procedures in place within the organization do not meet the requirements of the Whistleblower Protection Act or are not specified at all.
Legal status as of May 18, 2022
This article is for informational purposes only and does not constitute legal advice.
