Investigations into illegal alcohol advertising and financial services compliance were prevalent, with many firms added to the KNF’s Public Warnings List. In-house legal teams continued to have to deal with cybersecurity incidents and data leaks.
Looking ahead to 2026, continued scrutiny of state-owned entities, financial services, and tax-related matters will pose significant challenges.
Enforcement approach to state-owned companies and those that have done business with them
Law enforcement agencies in Poland continue to investigate almost 500 state-owned enterprises. The inquiries cover the companies’ internal operations between 2016 and 2023, as well as their dealings with external commercial partners over the same period (including acquisitions, joint ventures, and construction projects). Several of these investigations concern projects worth many millions of dollars. Their number and complexity mean that prosecutors are already operating at full capacity and cannot readily take on further large-scale, systemic cases.
With respect to companies that are not related to state-owned enterprises, or that have no business dealings with them, law enforcement agencies have focused on investigations into business fraud, sanctions compliance, money laundering, and bribery. These have been the main areas in which in-house counsel have had to support management and employees in providing explanations or documents to the authorities.
What were the most important 2025 law reforms that impacted corporate criminal liability or the criminal liability of senior officers?
The Central Anti-Corruption Bureau (Centralne Biuro Antykorupcyjne, CBA) is scheduled to be closed in 2026, with its powers to be transferred to the police. The Central Bureau of Investigation of the Police (Centralne Biuro Śledcze Policji, CBŚP) will be merged with the Police Central Bureau for Combating Cybercrime (Centralne Biuro Zwalczania Cyberprzestępczości Policji, CBZCP). Upon merger it will deal with organized crime, including instances involving corporations and their staff.
These changes have several implications for businesses. First, the CBA was a secret service and, unlike the police, was known for the extensive use of highly advanced yet intrusive forensic systems and operational techniques when investigating business actors. The police have always been more balanced and prudent in this respect. Second, following the merger of CBŚP and CBZCP, clients might expect greater efficiency in dealing with fraud to their detriment, such as ransomware, various online scams, blackmail, and other cyber incidents of a criminal nature, including concerning crypto assets.
Two offices of the European Public Prosecutor’s Office (EPPO) have been opened in Poland, which officially joined the EPPO in 2024. The EPPO will conduct investigations into offenses against the financial interests of the European Union, such as corruption, money laundering, and tax fraud. One of the first major investigations the EPPO initiated this year in Poland concerned the potential misappropriation of a large amount of EU funds (approximately EUR250 million) from the so‑called National Recovery and Resilience Plan (KPO) by the hotel, restaurant, and catering industry. It transpired that a significant portion of these funds was spent inappropriately, e.g., on luxury boats, rather than on strengthening resilience to future pandemics and other disruptive events.
Internal investigations
Common challenges that arise in an internal investigation in Poland include:
- Many organizations do not have transparent and unambiguous IT policies concerning an employee’s personal use of mobile devices and other IT equipment (including company email accounts). Where there has been dual use (personal and professional) it is always a challenge to separate personal data from business-related communications.
- Whistleblowers frequently present recordings (concerning their superiors or coworkers) which must always be assessed as to their validity.
- Increasingly more staff and employees use instant messaging apps, like WhatsApp, Signal, Telegram, or Messenger, for investigation-relevant communication. These present significant challenges for data preservation and review.
- Governance can be an issue if senior leadership is implicated—and this may not always be evident at the point when the investigation is being structured. Insulating the integrity of an investigation at the outset is crucial. Often the solution lies in ad hoc corporate arrangements or proper setting of proxies.
- How to communicate the outcome of an investigation is challenging. Relevant considerations include privilege, the impact on employee/HR-related processes, and self-reporting obligations.
- Protecting and evaluating the credibility of information sources is an issue that concerns not only the protection of whistleblowers (now strictly required by law) but also making arrangements with individuals willing to provide information on an anonymous basis.
Sectors targeted in 2025
We expect proceedings concerning state‑owned companies and their counterparties to continue. All companies that have had dealings with state‑owned entities can expect scrutiny of those interactions.
Law enforcement continues to investigate companies and prosecute employees for the alleged illegal advertising of alcoholic beverages. This is impacting producers, advertising agencies, and retained influencers.
Financial and FX brokers, alternative investment vehicles, and online betting and gambling services have been frequently targeted for, inter alia, anti‑money laundering compliance, licensing breaches, and reporting failures. Those affected have frequently been added to the Polish Financial Supervision Authority (KNF)’s List of Public Warnings, which is tantamount to a criminal investigation being opened against the entity’s management.
Predictions for 2026 and beyond
We expect greater scrutiny of sanctions compliance, tax avoidance, and crypto asset compliance. As Poland is considering introducing a digital tax affecting various media platforms in 2026, we expect investigations into their compliance with the new fiscal regulations.
Investigations into state‑owned entities will continue into 2026, with more private businesses coming under scrutiny, including alcoholic beverages producers.
In‑house legal teams will continue to deal with cybersecurity incidents and data breaches.
Beyond 2026, the new EU anti-corruption directive is expected to bring significant changes when it is implemented. The directive introduces new offenses, including trading in influence and abuse of functions, and proposes corporate liability. At present, corporate criminal liability is virtually non-existent in Poland. Under the directive, in-scope businesses will need to implement new ABAC policies and procedures and will face decisions regarding self-reporting. Many of these issues will be familiar to multinationals that have aligned their ABAC compliance programs with jurisdictions that have more developed corporate criminal liability regimes, such as the U.S., the UK, and France. The directive is still under discussion in the European Parliament, with the European Commission recently urging Parliament to accelerate their work.
Directory quotes
- “The team is regularly instructed on high-value matters related to fraud schemes, international investigations, illegal marketing and irregularities within public tenders. Adam Kowalczyk leads and is well versed in corporate fraud-related matters.” – The Legal 500 / 2024 / White-collar crime
- “Adam Kowalczyk is also a key name at the firm, leading the white-collar crime department – (…) very experienced partner in all litigation fields. The most important quality of Adam is his extensive, multi-disciplinary knowledge, which is very supportive while deciding on all strategic aspects of upcoming litigation.” – The Legal 500/ 2025 / Dispute Resolution
This article is part of the A&O Shearman Cross-border white-collar crime and investigations review 2026.
