White-Collar Crime 2026 Comparisons

Under the Polish Criminal Code (CC), a crime may be classified as a felony (a prohibited act penalised with deprivation of liberty for no less than three years, or a more severe penalty) or an offence. A felony may be committed only intentionally, while an offence may also be committed unintentionally if the law so provides. A perpetrator may also be liable for attempting to commit an offence.

Polish law also provides liability for less severe unlawful acts under the Code of Petty Offences, which may be committed intentionally or unintentionally (unless the statute excludes unintentional liability), penalised with a fine exceeding 30 daily rates or PLN5,000, or limitation or deprivation of liberty exceeding one month. Attempting to commit a petty offence is also punishable where the law so provides.

Polish law also classifies tax offences under the Fiscal Criminal Code (FCC). A tax offence is penalised with fines calculated based on daily rates, limitation or deprivation of liberty, while a fiscal petty offence is penalised with a fine of an exact amount and arises where the depleted public debt or value of the act does not exceed five times the minimum remuneration (PLN24,030 in 2026, based on the PLN4,806 minimum wage). Attempting to commit a tax offence is also punishable, with the penalty capped at two-thirds of the maximum statutory penalty for the completed offence.

In the Polish legal system, as a general rule, the burden of proof “rests on who asserts, not on who denies”. Under the criminal procedure, this means the burden of proving the defendant’s guilt lies with the prosecution, and that fact must be established beyond reasonable doubt. The defendant is innocent until proven guilty.

All prerequisites of an offence must be proven beyond reasonable doubt, and any doubts that cannot be dispelled must be resolved in favour of the accused.

In exceptional cases, the criminal procedure provides for a derogation from the need to prove certain facts. In these cases, there is no need to provide evidence of a particular circumstance; however, it does not preclude a counter-proof being provided. The so-called “surrogates of proof” are notoriousness, obviousness, probability, and presumptions, whether factual or legal.

Notoriousness covers facts indisputably known to the authority and the parties; obviousness relates to knowledge that any averagely educated and intelligent person possesses; and probability is a substitute for evidence that provides only likelihood rather than certainty (eg, precautionary measures may be applied where there is a high probability the accused committed a crime). Presumptions, whether factual (independent of the legal system) or legal (provided under criminal procedure), constitute a judgment about a high probability of a fact deduced from other undisputed facts; the most significant legal presumption is that the accused is presumed innocent until guilt is proven and recognised in a final judgment.

Polish law provides for statutes of limitations that vary by offence type. Under the CC, as a general rule, an offence ceases to be punishable after the following number of years from when committed:

• 40 for homicide;
• 20 for another felony;
• 15 if the act constitutes an offence subject to the penalty of deprivation of liberty exceeding five years;
• 10 if the act constitutes an offence subject to the penalty of deprivation of liberty exceeding three years; and
• five for other offences.

Private prosecution offences cease to be punishable one year after the harmed party learns the perpetrator’s identity, but no later than three years after commission, with a further ten-year cap once proceedings are initiated (five years for private prosecutions).

Tax offences cease to be punishable after ten years where penalised by deprivation of liberty exceeding three years, or five years where penalised by a fine, limitation, or deprivation of liberty of up to three years.

A fiscal petty offence has a one-year limitation period, extended by two further years if proceedings are instituted within that period.

In Polish criminal law, there is no special regulation on the extraterritorial jurisdiction to prosecute white-collar offences.

As a general rule, the CC applies to a Polish citizen who commits a crime abroad, and to a foreigner who commits a prohibited act abroad against the interests of the Republic of Poland, a Polish citizen, a Polish legal person or organisational entity, or who commits a crime of a terrorist nature. In each case, liability applies only if the act is also recognised as a crime under the law of the place where it was committed.

Where these conditions are met, Polish authorities may initiate and conduct proceedings, but only on Polish territory; action abroad requires a mutual legal assistance request.

In practice, the principal cross-border tool in white-collar cases is the European Arrest Warrant, alongside Interpol red notices. Poland is a member of the European Public Prosecutor’s Office (competent for offences affecting the EU’s financial interests) and regularly forms joint investigation teams, including with non-EU jurisdictions. Extradition for white-collar offences follows the general regime, with no derogations for this category; transnational organised crime groups active in Poland typically operate in tax offences.

Crimes that Provide for Corporate Liability (ALCE)

The Act on Liability of Collective Entities (ALCE), regulating the quasi-criminal liability of commercial companies, has been in force since 28 November 2003 and applies where a person acting for a company commits a listed offence and the company gained, or could have gained, any benefit.

The list of offences, the commission of which may cause criminal proceedings to begin, includes:

• mismanagement;
• public corruption;
• corruption in business;
• credit and subsidy fraud;
• money laundering;
• crimes related to making repayment of creditors impossible and reducing their satisfaction;
• failure to file a bankruptcy petition on time; and
• insider trading.

Numerous other offences are specified in other pieces of legislation that regulate specific areas of economic activity.

Conditions for Corporate Liability

Proceedings against a company generally require a legally binding and final guilty verdict, a conditional discontinuation, or a discontinuation acknowledging the offence was committed but ruling out punishment, against the person acting in its name. Criminal personal liability always precedes quasi-criminal corporate liability.

From 1 September 2022, there is an exception to the above rule. Collective entities may be held liable for environmental offences committed by their representatives without the prior requirement of a final conviction of the offender.

Liability under ALCE may be imposed if one of the following is proven:

• at least a lack of due diligence in the choice of the person representing the entity, who is at the same time the perpetrator of an offence; or
• the defective organisation of the company which did not ensure avoidance of the commission of an offence when it could have been prevented if the body or representative of the collective entity had applied required due diligence.

Liability under ALCE is non-transferable: it expires on a merger, division, or restructuring of the company, though the court may impose an interim prohibition of such transformations to prevent avoidance of liability.

Polish law does not recognise automatic parent-company or group-wide criminal liability; each legal entity is a separate addressee of criminal and quasi-criminal liability.

In practice, enforcement authorities do not commence proceedings under ALCE in every case where this is possible; Ministry of Justice statistics show only a few dozen such proceedings a year, a low figure given that more than 10,000 people are sentenced annually for business crimes.

Under Article 24 FCC, a legal entity may also be liable, in whole or part, for a fine imposed on a perpetrator of a fiscal offence acting as its proxy, manager or employee, where the entity obtained or could have obtained a financial benefit from the offence.

There is no formal prosecutorial policy favouring a natural person over a collective entity, and none would be workable. Proceedings against a collective entity generally require a prior final conviction of the natural person acting in its name, save for the environmental-offences exception since 1 September 2022. Management-body members remain personally liable under general CC and FCC provisions (eg, mismanagement under Article 296, tax offences, corruption, or money laundering), irrespective of any parallel liability of the collective entity.

Polish law does not recognise “failure to prevent”-style corporate offences, under which liability would follow from the mere absence of adequate prevention procedures.

The court imposes punishment at its own discretion, within statutory limits, ensuring the penalty does not exceed the degree of fault, having regard to social harmfulness, the preventative and educational aims for the sentenced person, and the need to develop wider legal awareness.

The CC’s general sentencing guidelines direct the court to consider, in particular, the perpetrator’s motivation and manner of conduct, the type and degree of violation of duties, the extent of negative consequences, the perpetrator’s characteristics and personal conditions, their way of life before and behaviour after the offence, their efforts to redress the damage or otherwise satisfy the public sense of justice, and the harmed party’s conduct.

The court also considers positive results of mediation or a settlement reached during proceedings, though there are no specific rules on assessing penalties in the event of a deferred prosecution, non-prosecution, or plea agreement.

At sentencing, particular weight is given to the extent of damage redress. Full redress before the initiation of proceedings may, for certain offences (eg, mismanagement under Article 296 Section 5), result in non-punishment. Full redress after initiation but before a final judgment may, at the court’s discretion, also result in non-punishment, while partial redress may result in extraordinary mitigation.

Victims of a white-collar crime may seek compensation under either civil or criminal law, and the choice determines whether a civil or criminal court has jurisdiction.

Under Article 46 Section1 of the CC, on conviction the court may order the offender to remedy the damage or compensate for injury, which is obligatory if requested by the harmed party or prosecutor. The criminal court applies civil law rules to the compensation.

There is no class action in the criminal procedure; a harmed party may join as an auxiliary prosecutor, though the court may limit the number of such prosecutors to secure a proper course of proceedings. Class actions remain possible under civil law.

White-collar crimes are prosecuted by public prosecutors with the support of the police, the Internal Security Agency, the Central Anti-Corruption Bureau, the Central Investigation Bureau, the Border Guard, the Military Police (narrow scope), and the tax and customs authorities.

Enforcement agencies have specialised divisions for particular crime types, including white-collar crime, but prosecutors and courts usually handle all criminal cases, and there are no dedicated white-collar courtrooms.

There are no dedicated civil/administrative enforcement agencies for white-collar crime, though regulators overseeing antitrust, consumer protection, financial institutions, and energy law may examine related conduct under administrative law and may notify the public prosecutor of an offence.

Administrative and criminal enforcement are separate regimes: administrative authorities may impose an administrative sanction and, where applicable, notify the prosecutor of a suspected offence, but only law enforcement authorities may pursue criminal liability, with the public prosecutor’s office acting as sole prosecutor in all criminal cases.

There have been no material institutional changes affecting white-collar enforcement recently; the future shape of the enforcement architecture remains the subject of ongoing public and legislative debate, but no formal reforms have been concluded.

Despite repeated announcements of a separation between the Prosecutor General and the Minister of Justice, the Minister continues to hold both offices, which may affect the assessment of ongoing investigations. The government and President also come from different political camps, and the President’s frequent use of the veto has generated persistent difficulties for justice-sector reforms.

An investigation is initiated where there is justified suspicion an offence was committed, ex officio or upon a third-party notification. The notifying party need not be harmed, though a harmed party has wider procedural rights than a mere notifier.

There are generally no special rules governing the initiation of an investigation, though the Public Prosecutor General may issue guidelines. The Guidelines of 10 August 2017 require VAT fraud and tax evasion cases to be handled by specialist prosecutors jointly with units such as the Internal Security Agency, focusing from the outset on identifying the main perpetrators and securing the state’s fiscal interests.

Enforcement agencies have wide powers to gather information. Under the criminal procedure, any legal person, organisational unit, or individual must assist authorities conducting criminal proceedings by providing requested information.

Public prosecutors may demand the production of documents or other evidence, including the seizure of electronic devices. Refusal may result in a dawn raid. Documentation should generally be surrendered at the request of the court or public prosecutor, or, in urgent cases, the police or another authorised agency, in which case the person surrendering it may request that the seizure be approved by the court or public prosecutor.

Enforcement authorities may summon any person (including a company’s employee, officer, or director) to testify. A formally summoned witness must appear and testify, generally at the summoning authority’s premises, although questioning elsewhere (eg, at a company’s headquarters) is not ruled out.

Digital assets, including crypto-assets, may be traced, frozen, and seized on the same basis as any other property under the Code of Criminal Procedure’s general provisions on securing property, and the general obligation to assist authorities extends to third parties holding relevant information, including crypto-asset service providers.

National legislation implementing MiCA and the TFR has not been concluded, having been vetoed three times by the President. Until it enters into force, tracing and freezing digital assets rests on the Code of Criminal Procedure’s general provisions combined with directly applicable EU rules.

Polish law enforcement increasingly uses advanced technology in white-collar investigations: the Central Anti-Corruption Bureau (CBA – Centralne Biuro Antykorupcyjne), the police, and prosecutors employ digital forensics to analyse electronic evidence, and, subject to court authorisation, conduct operational control measures (such as wiretapping) that are valuable in corruption, fraud and money laundering cases. Financial intelligence units, in particular the General Inspector of Financial Information (GIIF – Generalny Inspektor Informacji Finansowej), use data analytics to detect suspicious transactions, and the Polish authorities cooperate with Europol and Interpol to combat transnational white-collar crime.

Law firms have specific expertise in database analysis and AI tools, which complement the work of white-collar crime teams, increasing efficiency and reducing costs, at times helping to prevent proceedings from being initiated.

Enforcement authorities have no established practice of using AI in their own investigative work, and their exposure to AI-assisted evidence is largely limited to materials submitted by parties. There is no dedicated legal framework governing acceptance of AI-assisted internal investigations. Such findings are assessed under the general principle of free evaluation of evidence (Article 7 of the Code of Criminal Procedure), with the reliability and traceability of the methodology being decisive rather than the use of AI itself.

Following the adoption of the Whistle-Blower Protection Act (see 4.4 Whistle-Blower Protection), an internal investigation is one of the possible follow-up actions taken by a company to assess the truthfulness of a whistle-blower’s report, though companies also conduct internal investigations on their own initiative to check the correct operation of important internal processes.

Conducting an internal investigation is generally regarded as fulfilling the duty to safeguard the interests of the enterprise under management. Failure to verify signs of irregularity may give rise to liability for damages and, in extreme cases, criminal liability for mismanagement.

Specific entities (eg, banks, investment funds, insurance and reinsurance companies, brokerage and fiduciary entities) are obliged under special provisions to maintain compliance control or internal audit systems, which serve a similar function to internal investigations. Failure to maintain them may result in administrative sanctions.

The number of internal investigations into private-sector irregularities has increased noticeably in recent years, largely due to companies in Poland being subject to the US Foreign Corrupt Practices Act or the UK Bribery Act.

Commonly, an internal investigation will encompass a review of business e-mail correspondence and electronic files, meetings with employees, and financial and contractual documents. Use of information must comply with generally applicable data protection law (particularly the GDPR), and, while processing personal data (except sensitive data) is generally permitted, obtaining consent from the data subject is recommended.

There is no general obligation on companies to share internal-investigation findings with law enforcement. Specific reporting duties apply only in sectoral contexts (eg, under the AML Act to the GIIF, or under the Whistle-Blower Protection Act); otherwise, sharing findings with the prosecutor is voluntary.

“Legal privilege” is provided through two regimes of professional secrecy under the Code of Criminal Procedure. Defence secrecy (tajemnica obrończa), covering communications made in connection with an accused’s defence, is an absolute evidentiary prohibition under Article 178 and cannot be waived. Attorney’s professional secrecy (tajemnica zawodowa), covering other communications with an advocate or attorney-at-law, is protected under Article 180 Section 2 and may be lifted only by a court, where indispensable for justice and the fact cannot be established otherwise; such decision is appealable. Both regimes extend to in-house lawyers and paralegals supporting counsel, so materials from a counsel-directed internal investigation are, as a rule, equally protected.

Crimes are initiated ex officio or on request of the harmed party. Where the harmed party is the State Treasury, the mode is generally ex officio (eg, insurance fraud, money laundering, or a sham bankruptcy). Requests apply otherwise (eg, frustrating a public tender or non-satisfaction of creditors’ demands) and are filed with the police, prosecutor’s office, or another enforcement authority.

The same rules govern charging and indictment in all matters, including white-collar cases. A justified suspicion suffices to institute proceedings, the prosecution decides whether the evidence supports charges, and the indictment is verified in two-instance court proceedings.

There are no deferred prosecution agreements under Polish law, but Article 335 of the Code of Criminal Procedure lets the prosecutor move for conviction without trial where the accused confesses, gives a consistent account of the case, and their attitude shows the proceedings’ purpose will be met without trial. The court checks that no doubts remain and that this purpose will indeed be achieved.

On the prosecutor’s motion, the court may apply extraordinary mitigation, or even conditionally suspend enforcement, for a perpetrator who has disclosed a crime punishable by five years’ imprisonment and presented its circumstances to an authority previously unaware of them.

If the indictment reaches trial, the accused may still voluntarily submit to punishment under Article 387 of the Code of Criminal Procedure until the end of the first hearing of all the accused, if the offence is punishable by up to 15 years’ imprisonment, by requesting a specific penalty or measure without taking evidence. The court will grant this where the circumstances of the offence and guilt are beyond doubt and the objectives of the proceedings will be achieved despite the absence of a full trial.

Under the CC, an active briber is not subject to penalty if the benefit was accepted by a passive briber and the perpetrator reports this to a law enforcement authority before it learns of the crime through other means.

Under Article 296 of the CC, a person under a legal obligation to manage another’s property or business who abuses their authority or fails to perform their duties and thereby inflicts substantial damage is liable to three months’ to five years’ imprisonment (up to three years for creating only an imminent danger, or for a non-deliberate violation). Where the perpetrator intended to gain a material benefit, the penalty is six months to eight years, rising to one to ten years where the damage exceeds PLN1 million.

Corporate fraud may also be classified as an offence of misappropriation. Under Article 284 of the CC, anyone who misappropriates movable property entrusted to them is liable to imprisonment for between three months and five years.

The CC also provides for criminal liability for corruption in business (see 3.2 Bribery, Influence Peddling and Related Offences).

Article 306b of the CC also introduced aggravated forms of offences against business transactions (eg, acting to the detriment of the company or money laundering): punishable by three to 20 years’ imprisonment where the value or damage exceeds PLN5 million, and five to 25 years where it exceeds PLN10 million, meaning some financial crimes can be felonies (see 1.1 Criminal Offences).

Article 23 of the Combating of Unfair Competition Act (CUCA) criminalises disclosing or using a business secret in breach of an obligation towards the entrepreneur, or illegally obtaining and disclosing or using such secret, causing serious damage. Both are punishable by a standard fine, restriction of liberty, or up to two years’ imprisonment.

Article 24 CUCA criminalises causing serious damage to an entrepreneur by reproducing or copying their products in a manner that might mislead customers as to the identity of the manufacturer, and Article 305 of the Industrial Property Law (IPL) similarly criminalises marking products with counterfeit trademarks to introduce them to trading, or trading in such counterfeit products (without requiring damage to another entrepreneur). Both offences carry a standard fine, restriction of liberty, or imprisonment of up to two years, rising from six months to five years for perpetrators dealing with counterfeit goods of significant value or making such activity a permanent source of income.

The CC penalises both the person accepting and the person offering a bribe across all bribery offences. Separate provisions govern liability for official, international, and business corruption.

The subject of a bribe may be a material or personal benefit, for oneself or another. Criminal conduct may consist in giving, accepting, demanding or promising such benefit.

Criminal liability for handling or promising a bribe may be imposed on each individual. However, liability varies according to the function performed by the person accepting the bribe.

In “public corruption”, the bribe recipient is a person performing a public function – broader than “public official” – defined under Article 115 Section19 of the CC as public officers, self-government members, persons employed using public funds (unless purely service duties), and others whose public duties are established by statute or international agreement, including those acting for a foreign state or international organisation.

Polish law does not define a minimum value of material benefit, understood as any gain to the person accepting the bribe. Money, hospitality, gifts, promotional expenditures, or facilitation payments of considerable value are always classified as material benefits.

Criminal law also penalises corrupt conduct in business relations: corrupting a manager or employee in exchange for abuse of power or non-performance of duty, causing material damage or unfair competition, is punishable, with a more severe penalty where the resulting damage exceeds PLN200,000.

Legal Framework for Offences – International Conventions

Poland has been party to numerous anti-bribery conventions such as the Council of Europe’s Criminal Law Convention on Corruption since 1 April 2003 and its Additional Protocol since 1 August 2014; the UN Convention against Corruption since 15 September 2006; and the OECD Anti-Bribery Convention since 7 November 2000. As an EU member, Poland has also implemented various EU anti-corruption acts.

National Legislation

The main national legislation in the area of anti-bribery and anti-corruption is the CC which provides for most offences relating to corruption. In particular, the CC’s provisions regulate issues related to liability for official, international, and business corruption. However, some offences related to bribery and corruption are laid down in separate regulations, eg, liability for corruption in sport is covered under the Act on Sport.

Corrupt conduct may be prevented by restrictions imposed on persons holding public functions linked to participation in a business activity.

Under the Act on Limiting the Conduct of Business Activity by Persons Holding Public Functions, such persons may not be members of governing bodies in commercial companies, hold more than 10% of shares in them, or conduct their own business activity where this calls their objectivity into question, and must submit asset declarations. There is currently no legal obligation on business entities to implement compliance programmes, though many do so voluntarily. An amendment to the CC in force since 1 October 2023 introduced fundamental changes, including increased penalties for certain offences.

For example, the penalty for corruption offences where the financial benefit exceeds PLN200,000 increased from up to 12 years’ to up to 15 years’ imprisonment, and, where it exceeds PLN1 million, from up to 15 years to up to 20 years (see 3.1 Criminal Company Law and Corporate Fraud).

There is no general obligation on private entities to report suspected bribery to law enforcement. Article 304 Section 1 of the Code of Criminal Procedure imposes only a social duty on any person aware of a publicly prosecuted offence to notify the police or prosecutor. A stricter, legally binding duty under Article 304 Section 2 applies to state and local-government institutions, non-compliance with which may amount to abuse of powers under Article 231 of the CC. Article 240 of the CC, imposing a criminal duty to report certain serious offences, does not extend to bribery. Suspicious-transaction reporting duties under the AML Act apply to obliged institutions such as banks, investment firms, and lawyers.

Under Article 181 of the Act on Trading in Financial Instruments, using inside information contrary to Article 14(a) of the EU Market Abuse Regulation (MAR) is punishable by a fine of up to PLN5 million or imprisonment of three months to five years, or both. Article 14(a) MAR prohibits:

• engaging or attempting to engage in insider dealing;
• recommending that another person engages in insider dealing or inducing another person to engage in insider dealing; or
• unlawfully disclosing inside information.

As mentioned in 1.1 Criminal Offences, tax offences are described under a separate legal act, the FCC.

Polish law imposes an obligation to prevent tax evasion; failing to do so is a criminal offence. A tax offence occurs where a taxpayer exposes a tax to depletion by submitting an untrue or truth-concealing tax return.

The most popular tax offence, VAT fraud, usually involves fake or unreliable invoices under Articles 270a and 277a of the CC. Forging, tampering with, or using a fake invoice affecting tax or a refund is punishable by six months’ to eight years’ imprisonment, rising to a felony of at least three years where invoices exceeded PLN5 million or formed a permanent income source, and to five to 25 years where the value exceeded PLN10 million.

Business entities must keep financial records, and commercial companies’ financial records and statements are subject to mandatory examination by an independent certified auditor.

Keeping inaccurate financial records (ie, false entries) is a fiscal crime. A management board member may be held liable for fiscal crimes in the company’s operations even where record-keeping was not their responsibility or the offence was committed before they held that position.

Cartels and other competition offences are defined under administrative law, in particular the Act on Competition and Consumer Protection (ACCP), and are subject to fines. The CC also penalises hindering a public tender for material benefit, punishable by up to three years’ imprisonment.

Since 1 October 2023, this protection extends to all kinds of tenders (previously only public tenders), with an aggravated penalty of six months to eight years where committed to gain financial or material benefit.

Under the CC, whoever intercedes in settling a matter for a benefit by claiming influence in a domestic or foreign entity using public funds, or inducing belief in such influence, is liable to six months’ to eight years’ imprisonment.

The Office of Competition and Consumer Protection (OCCP) considers it illegal to co-fix wages (agreements on minimum, maximum or fixed wage levels, bonuses or other remuneration components), to enter into “no-poaching agreements” restricting solicitation of competitors’ employees, or to jointly agree other employment terms, such as remote-working days, affecting the attractiveness of job offers.

This is a new approach for the OCCP, which, alongside its traditional scope, has initiated several investigations into entities engaged in such agreements.

The financial consequences can be severe:

• up to 10% of turnover; and
• up to PLN2 million for the managers responsible for collusion.

The ACCP prohibits practices harmful to consumers’ collective interests. The OCCP President may impose a fine of up to 10% of the entrepreneur’s prior-year turnover for concluding agreements with illicit contractual provisions, proposing unsuitable financial services, breaching information obligations, or engaging in unfair market practices.

These are administrative offences; the ACCP’s sole petty offence (Article 114) penalises failure to provide explanations or respond to the consumer ombudsman with a fine of at least PLN2,000.

Classification of Cybercrimes

Under Article 287, computer fraud (unauthorised influence on data collection, processing or transfer, or altering, deleting, or creating electronic records to gain material benefit or cause damage) is punishable by three months’ to five years’ imprisonment, as is unauthorised use of another’s software for material benefit under Article 278 Section2 and significant interruption of a computer system or IT network (eg, DDoS attacks) or restricting data access (eg, ransomware) under Article 269a.

Unauthorised deletion, destruction, or restriction of data access (eg, via ransomware) is punishable by up to three years under Article 268a (three months to five years if significant damage results). Corrupting or deleting data or hardware of significance for national defence, transport security, or government operation is punishable by six months to eight years under Article 269, as is preparing or selling devices or codes enabling such offences under Article 269b.

Exemptions

Persons performing authorised penetration tests (controlled attacks, testing exploits, or spoof emails to check cybersecurity awareness) are exempt from criminal liability.

Bug bounty programmes are also decriminalised where the person causes no damage and promptly informs the system administrator of the identified vulnerability.

Cybercrime Related to Payment Instruments

Cybercrimes involving payment instruments (eg, payment cards) remain a major challenge for prosecutors. Besides being classified as computer fraud, they may be treated as regular fraud or even burglary (up to ten years’ imprisonment) as Polish payment-services regulation contains no specific cybersecurity offences.

National Cybersecurity Framework (NIS 2 Implementation)

The framework governing cybersecurity obligations for businesses operating critical or important services is the Act of 5 July 2018 on the National Cybersecurity System (Ustawa o Krajowym Systemie Cyberbezpieczeństwa, NCSA), which has been substantially amended to implement Directive (EU) 2022/2555 (NIS 2). The amending act was passed on 23 January 2026 and signed by the President on 19 February 2026. The President referred the amending act to the Constitutional Tribunal for post-enactment review, though this does not suspend its application.

The amendment extends the categories of entities within the national cybersecurity system to new sectors, including waste-water discharge, postal services, space, and the production and distribution of chemicals and food, and introduces a formal distinction between key entities (podmioty kluczowe) and important entities (podmioty ważne) active in strategic sectors such as energy, transport, banking, and water supply. Affected entities are subject to obligations to apply proportionate technical and organisational measures to strengthen the security of information systems, together with a distinct regime of personal responsibility for managers over the performance of cybersecurity tasks. New sector-specific CSIRT teams will support incident handling, and incident reporting will be streamlined through a dedicated ICT reporting system.

Financial, trade and customs sanctions are described, in particular under the FCC.

The main offences in relation to the aforementioned sanctions are tax fraud, unreliable books and records, the import or export of goods without presentation to customs or without customs declaration, misrepresentation of the customs control authority, a change in the purpose of the goods or another condition to exempt the goods from customs duty.

EU financial and trade sanctions apply directly in Poland as EU regulations, but criminal liability for breaches may only be established by Polish statute, since EU regulations do not themselves create criminal offences. The Act of 13 April 2022 on Specific Measures for Counteracting the Support of Aggression against Ukraine (the Sanctions Act) introduced a national sanctions list, additional restrictive measures, and criminal-liability provisions for breaches of both EU and national sanctions.

A breach of sanctions may attract either criminal or administrative liability, depending on which prohibition has been violated. The two regimes are separate, covering different conduct rather than different levels of gravity. Under Article 15 of the Sanctions Act, violating the listed prohibitions (including making funds available to designated persons) is a criminal offence punishable by up to 30 years’ imprisonment, with a lesser variant of three months to five years; other breaches attract only an administrative pecuniary penalty. A revision of these provisions is currently under legislative consideration.

Because sanctions-breach offences concern the security of the Republic of Poland, they may apply extraterritorially, including to conduct by a foreigner abroad, regardless of whether that conduct is criminalised where it was committed.

Under the CC, obstructing criminal proceedings by assisting a perpetrator to evade liability, or assisting in concealing property obtained by a prohibited act, is punishable by three months’ to five years’ imprisonment (up to two years if unintentional); concealment of financial instruments or property may also amount to money laundering, punishable by six months to eight years. A person who merely conceals cannot be liable for both the predicate offence and concealment within one act.

Not only the offender, but also anyone who induces, orders, or facilitates the commission of a crime, is liable within the limits of the penalty for the offence itself, though the court may apply extraordinary mitigation in cases of aiding.

The CC provides that anyone who receives, transfers or transports abroad, or assists in transferring title or possession of legal tender, securities, foreign currency valuables, property rights, or real or movable property obtained from offences committed by others, or takes any action to prevent or hinder the determination of their criminal origin or location, or their detection or forfeiture, is liable to imprisonment for six months to eight years, rising to up to 20 years where the material benefit exceeds PLN5 million and up to 25 years where it exceeds PLN10 million.

The Anti-Money Laundering Act imposes obligations on obliged institutions (eg, banks, payment institutions, and lawyers). Failure to notify the general inspector of suspected money laundering or terrorist financing, or of a reasonable suspicion linking a transaction to such conduct, is subject to three months’ to five years’ imprisonment, as is preventing public control over AML compliance.

ESG-related offences are an emerging area of concern in Poland, though specific criminal provisions directly addressing environmental, social and governance violations in the corporate context remain limited. The CC penalises environmental damage, including illegal waste disposal and pollution, with potential liability for companies and their officers. False or misleading statements about a company’s environmental credentials may constitute fraud or unfair competition where they affect investors or consumers. Violations of labour rights, including exploitation of workers or unsafe working conditions, can result in criminal liability under the Labour Code and CC.

Polish authorities are increasingly scrutinising ESG-related compliance in light of EU developments such as the Corporate Sustainability Reporting Directive and the EU Taxonomy Regulation.

At EU level, Directive (EU) 2024/1203 of 11 April 2024 on the protection of the environment through criminal law, replacing Directives 2008/99/EC and 2009/123/EC, significantly expands the scope of criminal liability for environmental offences, introducing around 20 categories of conduct to be criminalised (including some currently treated in Poland as administrative or petty offences), mandatory liability of legal persons, and materially higher maximum penalties, including for qualified forms causing death or serious ecosystem damage. Member states were required to transpose the directive into national law by 21 May 2026.

Poland has not met this deadline. Transposition is being carried out through a draft act amending the Criminal Code and several other statutes (including the Act on Liability of Collective Entities, the Environmental Protection Law, the Nature Conservation Act and the Water Law), sponsored by the Minister of Justice (legislative work register No UC148). As at the date of this chapter, the draft has completed the inter-ministerial coordination, public consultation and opinion-gathering stages, but has not yet been considered by any Council of Ministers committee, adopted by the Council of Ministers, or submitted to the Sejm; its status on the government’s official legislative register is “open”. The draft would, among other things, extend criminal liability for collective entities to environmental offences, introduce new offences such as unlawful ship recycling and unpermitted operation or closure of installations posing a risk to human health or the environment, and raise penalties for existing environmental offences under Articles 181–184 of the CC.

Modern slavery and human trafficking are criminalised under Article 189a of the CC, which penalises trafficking in human beings with imprisonment of no less than three years. Related conduct may be prosecuted under Article 189 of the CC (unlawful deprivation of liberty), Article 191 of the CC (compelling another person to specified conduct) and Articles 218–221 of the CC (offences against the rights of persons performing paid work).

The misuse of artificial intelligence and automation presents novel challenges for Polish criminal law, which is gradually adapting to address them. AI-powered fraud, such as deepfake-based identity theft or automated market manipulation, falls within existing fraud provisions, although prosecution may face evidentiary challenges; unlawful automated processing of personal data in breach of GDPR can trigger administrative and, in serious cases, criminal liability; the use of AI to manipulate financial markets or facilitate anti-competitive practices may constitute offences under competition and market abuse law; and AI-enabled cyberattacks, including phishing and ransomware, are prosecuted under existing cybercrime provisions.

Courts and prosecutors have very limited experience applying AI tools, and the legal framework for their use in the justice system remains narrow, though such tools are already used by law firms and further legislative reform may be needed to close this gap.

The legal framework governing crypto-assets in Poland rests on directly applicable EU rules – the Markets in Crypto-Assets Regulation (MiCA) and the Transfer of Funds Regulation (TFR) – combined with generally applicable Polish criminal, fiscal criminal, and anti-money laundering provisions. Complementary national legislation aligning the domestic framework with MiCA has not entered into force: three successive draft acts have been vetoed by the President, and the MiCA implementation deadline has been exceeded.

Polish law does not provide a bespoke classification of crypto-assets as securities, commodities or property. Instead, classification follows the general civil-law and financial-instruments framework on a case-by-case basis, which in turn determines the applicable enforcement regime (eg, securities-law offences under the Act on Trading in Financial Instruments apply only where a given crypto-asset qualifies as a financial instrument). Virtual currency exchanges and wallet providers are obliged institutions under the Anti-Money Laundering and Counter-Terrorist Financing Act (implementing the EU’s Fifth and Sixth AML Directives), subject to customer due diligence, suspicious transaction reporting to the GIIF, and record-keeping. Once national MiCA-implementing legislation enters into force, crypto-asset service providers will also require authorisation from a designated competent supervisor and will be subject to a dedicated licensing and sanctions regime; non-compliance with which may result in administrative penalties or withdrawal of authorisation.

Fraudulent cryptocurrency schemes (eg, Ponzi schemes or fake ICOs) are prosecuted under general fraud provisions (Article 286 of the CC) and forgery provisions (Article 270 of the CC). Dedicated crypto-specific offences are envisaged in pending MiCA-implementing legislation but have not yet entered into force. Failure to declare cryptocurrency gains is tax evasion under fiscal criminal law, as such gains are subject to income tax and must be disclosed in annual returns. Cryptocurrency-facilitated cybercrime and ransomware are prosecuted under the general cybercrime provisions discussed in 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets, together with fraud and money-laundering provisions, where applicable. Tracing crypto transactions relies on specialised technical expertise and international co-operation, including existing GIIF information-exchange channels with European counterparts. Polish authorities continue to invest in blockchain analysis tools and training.

Polish law does not require self-reporting or internal investigations, but many companies implement compliance programmes as a defence argument, particularly with foreign capital or in the financial sector. Such programmes are helpful where the absence of clear internal procedures would otherwise make it difficult to show the guilty party’s actions or omissions.

The Whistle-Blower Protection Act (see 4.4 Whistle-Blower Protection) is expected to change managers’ approach to passive or disregarded reports, since a poor reaction may negatively affect their assessment, while proper compliance should carry weight in any subsequent investigation and defence.

Polish law does not provide a codified “adequate procedures” defence. An effective compliance programme is nevertheless relevant: it may rebut the statutory conditions of collective-entity liability, in particular the “defective organisation” basis under ALCE (though case law here is limited), and in proceedings against individuals a well-documented compliance framework may help disprove intent or negligence in cases of mismanagement, corruption, money laundering or fiscal offences, albeit as a sentencing factor rather than an independent defence.

Polish criminal law provides for some exceptions from bearing criminal liability in general. Some of them may be applicable to white-collar crimes.

A person acting to perform a well-founded economic experiment expected to produce significant cognitive or economic value does not commit a crime.

A person acting to avert an immediate danger to a legally protected interest, where the danger cannot otherwise be avoided and the sacrificed interest is of lower value than the interest saved, also does not commit a crime.

Moreover, if the perpetrator of a white-collar crime has voluntarily redressed the full damage, the court may apply extraordinary mitigation of the penalty or even waive its imposition.

Fiscal offences are subject to a mechanism of “active repentance”, ie, a perpetrator who notifies enforcement authorities of relevant circumstances (particularly persons who assisted in the offence) before the authorities become aware of it does not become liable for a fiscal crime or petty offence if the public debt has been fully repaid.

Perpetrators of the abuse-of-trust offence who voluntarily redress the full inflicted damage before proceedings are instituted are not subject to a penalty.

Polish criminal law provides no general industry- or sector-specific exemptions from white-collar liability. The above exceptions apply generally, with no industries falling outside the criminal or fiscal criminal framework.

No special “credit” is generally granted for voluntary disclosure, though for some offences (eg, active bribery, see 4.2 De Minimis) disclosing all substantive circumstances can result in non-punishment.

There are several possibilities to avoid a criminal trial; however, there are no deferred prosecution agreements under Polish law (see 2.7 Deferred Prosecution).

For fiscal crimes, liability may be avoided only through the “active repentance” described above or by adjusting a tax return. The FCC sets specific requirements that must be met for these to be effective.

In the last quarter of 2023, a new norm was introduced to the Polish CC, which states that the perpetrator of the crime of obstructing or thwarting a public tender, who notified the authority responsible for prosecuting crimes or the competition protection authority of a European Union member state or the European Commission of the fact of its commission, and disclosed all relevant circumstances, may not be punished.

Directive (EU) 2019/1937 required implementation by 17 December 2021. Poland passed the Whistle-blower Protection Act in June 2024, in force since 25 September 2024, establishing protection mechanisms for whistle-blowers in the public and private sectors.

Every company employing more than 50 people must establish an internal reporting procedure, following appropriate consultation with trade unions or, if absent, elected employee representatives.

A whistle-blower is protected against retaliation from the moment of reporting if they had reasonable grounds to believe the reported information was true and concerned a violation of the law.

A violation of the law is an act or omission that is unlawful or intended to circumvent the law, relating to:

• corruption;
• public procurement;
• financial services, products, and markets;
• counteracting money laundering and terrorism financing;
• product safety and compliance with requirements;
• transport safety;
• environmental protection;
• radiological protection and nuclear safety;
• food and feed safety;
• animal health and welfare;
• public health;
• consumer protection;
• protection of privacy and personal data;
• security of IT networks and systems;
• the financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
• the internal market of the European Union, including public law rules of competition and state aid and taxation of legal persons; and
• constitutional freedoms and rights of humans and citizens.

However, companies may additionally provide the possibility of reporting other information about violations of internal regulations or ethical standards applicable in the company as part of the internal reporting procedure.

A company that fails to establish an internal reporting channel in accordance with the Act, or does so in a way that significantly breaches it, may face a fine of up to PLN5,000 (approximately EUR1,200); preventing or seriously hindering a whistle-blower’s report may result in a fine of PLN500 to PLN1,080,000 (approximately EUR120 to EUR260,000), restriction of liberty, or imprisonment, depending on severity.

Experience to date under the Act has shown many reports filed and internal channels widely used and viewed as effective, allowing entities to conduct internal investigations without state reporting or public disclosure, and mitigating criminal, tax and competition law risk.

External advisors also enhance the integrity of internal investigations by increasing stakeholder trust and confidentiality, and are often essential for complex compliance issues affecting an organisation’s fundamental operations or governance.

Moreover, according to the Polish Anti-Money Laundering Act, banks or other financial entities are obliged to create an anonymous whistle-blowing procedure for reporting irregularities within the scope of money laundering.

Polish law provides no financial incentives or bounty-type rewards for whistle-blowers; the regime is purely defensive, shielding the reporter from retaliation rather than rewarding disclosure.

The Whistle-Blower Protection Act also provides external reporting channels: the Commissioner for Human Rights is the central body, complemented by sector-specific channels at the Polish Financial Supervision Authority, the OCCP, and the GIIF. Anonymous reporting is admissible both internally and externally, and the Act’s protective regime continues to apply even if an initially anonymous whistle-blower’s identity is later disclosed.

White-collar investigations and prosecutions in Poland increasingly involve cross-border elements, requiring defence strategies that account for multiple jurisdictions and international co-operation mechanisms.

Poland participates in the European Arrest Warrant (EAW) system which facilitates extradition between EU member states. Defence counsel must scrutinise EAW requests for compliance with procedural requirements, including double criminality and proportionality. Grounds for refusing execution include violations of ne bis in idem and risks to fundamental rights.

Poland participates in the European Public Prosecutor’s Office (EPPO) which has jurisdiction over offences affecting the EU’s financial interests, including fraud, corruption, and money laundering involving EU funds. The European Delegated Prosecutor may conduct investigations across multiple member states, requiring defence counsel to navigate jurisdictional determinations and cross-border co-ordination.

Cross-border evidence gathering through mutual legal assistance requests requires careful scrutiny, in particular as to the admissibility of evidence where procedural requirements were not met and conflicts between different jurisdictions’ procedural protections.

Defendants may face simultaneous investigations or prosecutions in multiple jurisdictions, raising issues of co-ordinated representation, disclosure, and privilege in multiple forums, and the invocation of ne bis in idem to prevent multiple prosecutions for the same conduct.

Cross-border asset freezing and confiscation proceedings require prompt defensive action. Poland implements EU instruments including the European Investigation Order and mutual recognition of freezing and confiscation orders, and defence strategies include challenging the legal basis for freezing and demonstrating legitimate ownership or third-party rights.

Poland also maintains mutual legal assistance treaties with numerous non-EU countries. Defence counsel must understand the specific requirements of applicable treaties, including dual criminality, specialty principles, and human rights refusal grounds.

GDPR compliance is also relevant in cross-border investigations, in particular as to the lawfulness of cross-border personal data transfers.

Several major legislative developments have shaped, or will continue to shape, the Polish white-collar landscape during 2026 and into 2027 – eg, the entry into force of the NIS 2-implementing amendment to the National Cybersecurity System Act, a new comprehensive Sanctions Act, a wholesale reform of the Public Prosecutor’s Office, an anticipated further attempt at legislation implementing the Markets in Crypto-Assets Regulation, and a reform of collective-entity criminal liability.

• The National Cybersecurity System Act (NIS 2): The amendment to the National Cybersecurity System Act implementing Directive (EU) 2022/2555 (NIS 2) was passed on 23 January 2026 and signed by the President on 19 February 2026, who simultaneously referred it to the Constitutional Tribunal for post-enactment review (see 3.9 Cybercrimes, Computer Fraud and Protection of Company Secrets). Affected key and important entities, now extending to additional sectors, eg, waste-water discharge, postal services, space, and the production and distribution of chemicals and food, will become subject to new risk-management, incident-reporting, and registration obligations, with sector-specific CSIRTs and enhanced supervisory powers. Administrative fines for non-compliance may be imposed for the first time only after a two-year grace period from the Act’s entry into force.
• The draft Act on Restrictive Measures (UC92): Adopted on 4 August 2026 by the Council of Ministers, this implements Directive (EU) 2024/1226 and consolidates the fragmented EU, UN, and national sanctions framework into a single instrument. The draft provides for administrative fines of up to PLN20 million and criminal penalties of up to 12 years’ imprisonment for trade-related violations involving military-list or dual-use items, and extends the Act on Liability of Collective Entities to sanctions offences (fines from PLN10,000 up to PLN200 million, or 5% of turnover), allowing a collective entity to be held liable independently of any prior conviction of a natural person.
• The Codification Commission for the System of Courts and the Public Prosecutor’s Office: This is active since April 2024 and continues its work on prosecution reform.
• The Crypto-Assets Market Act: The work on the Polish act implementing MiCA has not been concluded, and Polish crypto-asset service providers continue to operate without a national implementing act designating the competent supervisor and setting out the licensing and sanctions regime.
• A separate Ministry of Justice draft bill: This aims to fix Poland’s largely unenforceable corporate criminal liability regime and adoption by the Council of Ministers is planned for Q4 2026. Under current law, holding a collective entity liable requires proving all three of the following: a prior final conviction of its representative, the representative’s underlying offence, and fault in selection, supervision, or organisation by the entity. In practice, this makes the law inoperative and pushes liability onto individual managers instead. The draft bill’s key changes to the Act on Liability of Collective Entities include:
1. a new Article 43a which would allow a collective entity to be held liable and voluntarily submit to punishment without first requiring a final conviction of its representative, subject to full judicial review, with a final submission by the entity correspondingly mitigating the representative’s own liability for the same act;
2. a new Article 9a enabling compensatory measures to be ordered against the entity; and
3. Articles 14, 26, 42 and 43, extending limitation rules, asset-freezing options, and related provisions to cover the obligation to compensate damage/harm.

Corresponding changes to the National Criminal Register Act would expand the data catalogue to include the new compensatory measures. Overall, the reform’s core effect is to enable direct corporate liability independent of any prior individual conviction, rationalising manager liability and making the currently dormant collective-entity liability regime enforceable in practice.