How to Respond to a White‑collar Criminal Investigation in Poland: Step‑by‑step Guide for Boards, Executives & Compliance Teams

When Polish prosecutors open a white‑collar criminal investigation into a company or its officers, the first hours and days define whether the organisation survives the probe with its reputation, assets and leadership intact. Knowing how to respond to a white‑collar investigation in Poland is no longer optional knowledge for boards and compliance teams, it is an operational necessity. This guide sets out the full procedural sequence: who must act, what to preserve, how to run a privileged internal investigation, and how the 2026 legislative reforms alter each obligation. It is written for general counsel, compliance officers, CEOs, CFOs and supervisory board members of companies operating in or connected to Poland.

Overview of the Process and Who It Applies To

A white‑collar criminal investigation in Poland typically proceeds through three broad stages. First, the postępowanie przygotowawcze (pre‑trial investigation), led by the prosecutor (Prokuratura) and conducted with police or specialist agencies, gathers evidence through interviews, document seizures and forensic analysis. Second, if the prosecutor concludes there is sufficient evidence, an indictment (akt oskarżenia) is filed with the competent court. Third, the trial stage determines guilt and, where applicable, sanctions. Throughout each phase, both natural persons (executives, board members, employees) and, under the Act on the Liability of Collective Entities of 28 October 2002, legal persons themselves may face liability.

This article is directed at any company, subsidiary or multinational with Polish operations that becomes aware an investigation has been opened, that a search or document seizure is imminent, or that an internal whistleblower allegation could trigger a referral to prosecutors. It applies equally to management board members, supervisory board members and senior compliance staff.

Key Investigating Authorities

The Prokuratura Krajowa (National Prosecutor’s Office) and regional prosecutor offices direct pre‑trial investigations. They may delegate operational tasks to the Police, the Centralne Biuro Antykorupcyjne (CBA) (Central Anti‑Corruption Bureau) for bribery and public‑corruption matters, the Agencja Bezpieczeństwa Wewnętrznego (ABW) for national‑security‑linked economic offences, or the National Revenue Administration (Krajowa Administracja Skarbowa) for tax‑fraud cases. Understanding which authority leads the investigation determines the procedural rules and negotiation channels available.

Common White‑Collar Offence Types

The Kodeks karny (Penal Code) defines the most frequently charged white‑collar offences: fraud (Article 286), embezzlement and misappropriation (Article 284), bribery of public officials (Articles 228–229), accounting‑record falsification (Article 303), money laundering (Article 299) and breach of fiduciary duty by company officers (Article 296). Tax offences are separately codified in the Kodeks karny skarbowy (Fiscal Penal Code). Each offence carries its own mens rea requirements and sentencing ranges, and a corporate entity may face ancillary liability if the offence was committed in its interest.

Eligibility and Prerequisites: Who Must Act and When

Board vs GC vs Compliance Officer Responsibilities

The management board (zarząd) bears ultimate responsibility for responding to an investigation, because board members carry personal criminal exposure under Article 296 of the Penal Code for failures that cause financial harm to the entity. The general counsel or head of legal should coordinate the immediate operational response, issuing the legal hold, triaging custodians and retaining external counsel. The compliance officer (where one exists) manages whistleblowing channels, preserves internal reports and acts as the point of contact for regulatory notifications. A compliance officer requirement is becoming increasingly important under the 2026 framework discussed below. The supervisory board (rada nadzorcza) should be notified promptly so it can exercise its oversight function and, if necessary, suspend implicated management board members.

When to Engage External Criminal Counsel and Forensic Advisers

External criminal counsel should be retained at the first credible indication that an investigation exists, before any documents are produced, before any employee is interviewed by authorities, and before any cooperation discussions begin. In practice, the trigger is often receipt of a formal request or the appearance of investigators at company premises. A forensic IT firm should be engaged simultaneously to manage evidence preservation and imaging. Delaying either engagement materially increases the risk of waived privilege, lost evidence and avoidable admissions.

How to Respond to a White‑Collar Investigation in Poland: Step‑by‑Step Procedure

The following numbered steps represent the operational sequence that boards, general counsel and compliance teams should follow from the moment an investigation is identified. Each step assigns a responsible role and a realistic time frame.

Step 1, Issue an Immediate Legal Hold and Preserve All Potentially Relevant Data

Within 24 to 72 hours of learning that an investigation exists, the general counsel, in coordination with external counsel, must issue a written legal hold notice to every custodian who may possess relevant documents. The notice must direct all recipients to preserve electronic and hard‑copy records, disable automatic deletion policies on email servers and messaging platforms, and refrain from altering, moving or destroying any data.

IT must simultaneously snapshot key servers, cloud environments and backup tapes. Mobile devices of implicated individuals should be collected or forensically imaged. A chain‑of‑custody log must be created from the outset, recording who holds which devices, when images were taken, and the hash values of forensic copies. Under the Kodeks postępowania karnego (Code of Criminal Procedure), the prosecutor has the power to seize documents, electronic data and physical evidence during a search of business premises. Destroying or concealing evidence after learning of an investigation constitutes a separate offence under Article 239 of the Penal Code. Every employee who receives the legal hold must acknowledge it in writing.

Step 2, Notify the Board, Convene a Crisis Team and Retain External Counsel

The management board must be notified within 24 to 48 hours. Where a board member is personally implicated, the supervisory board must be informed instead, and the implicated individual should be recused from all decisions relating to the investigation. The board should formally resolve to establish a crisis response team comprising: the GC or head of legal, the compliance officer, the CFO (for financial‑record preservation), the head of IT, and external criminal counsel.

Selecting external counsel is a critical decision. The firm must have demonstrated experience in Polish criminal defence for executives and entities, familiarity with the relevant investigating authority, and the capacity to manage cross‑border dimensions if the company operates internationally. An independent forensic IT firm should be engaged at the same time, not the company’s regular IT service provider, to ensure the integrity and independence of evidence collection. Where reputational risk is significant, a communications adviser should also join the crisis team to manage media exposure and regulatory messaging.

Step 3, Conduct Forensic Collection and a Privileged Internal Investigation

Once external counsel is retained, they should direct all forensic collection and the internal investigation in Poland to ensure that attorney‑client privilege (to the extent recognised under Polish law) and work‑product protections apply. In Poland, legal professional privilege (tajemnica adwokacka and tajemnica radcowska) attaches to communications between an advocate or legal adviser and their client; however, in‑house counsel communications do not carry the same protection in criminal proceedings. This distinction makes external counsel leadership essential.

The forensic team should image priority systems within the first seven days, focusing on email servers, shared drives, finance systems, ERP data and the devices of key custodians. A data map identifying all repositories, on‑premise, cloud, mobile, personal devices, should be completed in parallel.

The internal investigation itself should follow a structured plan:

1. Define the scope. Identify the suspected conduct, the time period, and the individuals potentially involved.
2. Draft an interview plan. External counsel should conduct all interviews. An experienced investigator or second lawyer should attend as note‑taker. Interviews should be recorded in detailed written memoranda, not audio or video recorded, to preserve work‑product character.
3. Manage privilege rigorously. All investigation memoranda, interview notes and analysis should be labelled “privileged and confidential, prepared at the direction of counsel.” Distribution should be limited to the crisis team.
4. Maintain a privilege log. Any documents withheld from production on privilege grounds must be logged with a description, date, author, recipient and legal basis for the claim.
5. Prepare an interim report. Within three to six weeks, external counsel should provide the board or supervisory board with a preliminary findings report, enabling informed decisions on cooperation, self‑reporting and remediation.

Early indications suggest that Polish prosecutors are placing greater weight on whether a company conducted a genuine, timely internal investigation when assessing cooperation credit. A well‑documented, counsel‑led process therefore serves both a defensive and a mitigating function.

Step 4, Respond to Formal Investigator Requests and Negotiate Scope and Deadlines

When prosecutors or the police issue formal requests for document production, external counsel should review the legal basis cited. Under the Code of Criminal Procedure, the prosecutor may order the surrender of specified documents and items relevant to the investigation. The company is generally obliged to comply, but counsel can, and should, negotiate the scope and timeline of production. A 14‑day response window is common in practice, though the prosecutor may set shorter or longer deadlines depending on urgency.

Before producing any documents, counsel must review the production set for privileged material, personal data subject to GDPR restrictions, and commercially sensitive information unrelated to the investigation. Protective measures, such as redactions, restricted‑access arrangements or confidentiality undertakings, should be requested where appropriate. Every document produced must be logged with a timestamp, custodian identifier and production batch number. Spot‑checks should be performed to ensure no privileged material is inadvertently disclosed.

Step 5, Evaluate Cooperation, Self‑Reporting and Settlement Options

Once the internal investigation has yielded preliminary findings, the board must decide whether to pursue a corporate self‑reporting procedure, actively cooperate with prosecutors beyond the minimum required, or adopt a strictly defensive posture. Polish law does not yet have a formal deferred prosecution agreement (DPA) framework equivalent to those in the United States or the United Kingdom, but prosecutors retain discretion to recommend reduced penalties where a company demonstrates genuine cooperation and effective remediation.

Relevant mitigating factors include: voluntary disclosure of wrongdoing before investigators discover it independently; prompt suspension or dismissal of implicated individuals; restitution of misappropriated assets; and implementation of enhanced compliance controls. If the company decides to cooperate with prosecutors in Poland, external counsel should manage all communications with the prosecutor’s office, ensure that cooperation does not inadvertently waive privilege over work product, and document every step of the cooperation for the court record. Settlement by way of a voluntary submission to penalty (dobrowolne poddanie się karze) under Article 387 of the Code of Criminal Procedure may also be available to individual defendants.

Required Documents and Information to Preserve

The following checklist identifies every category of document that should be preserved and, where applicable, produced during a white‑collar investigation. Failure to preserve documents in Poland can result in separate criminal liability and undermine any cooperation arguments.

The data map deserves particular attention. Companies operating across multiple jurisdictions often store records in cloud environments hosted outside Poland. External counsel and the forensic team must identify every repository, including personal email accounts and messaging apps used for business, and ensure preservation notices reach those systems before auto‑deletion cycles run.

Timeline for a Criminal Investigation in Poland: Key Deadlines and a 90‑Day Action Plan

Polish law does not impose a single fixed statutory deadline on the duration of a pre‑trial investigation, but prosecutorial guidelines and supervisory review mechanisms create practical time pressures. Standard investigations (dochodzenie) should generally be concluded within two months, though extensions are routine. More complex investigations (śledztwo), which cover most white‑collar matters, have no rigid cap but are subject to periodic prosecutorial review. Industry observers expect complex white‑collar probes to last anywhere from six months to several years.

For the company, however, the operational timeline is far shorter. Prosecutors commonly set a 14‑day production deadline when requesting documents, and searches of premises can occur without advance warning. Internal preservation must therefore be immediate, measured in hours, not weeks.

Missing a production deadline does not automatically trigger a contempt finding, but it undermines credibility with the prosecutor and may prompt coercive measures such as compulsory seizure. Where a deadline is genuinely unachievable, counsel should negotiate an extension in writing before the deadline expires, not after.

Costs, Fees and Tax Considerations

White‑collar investigations are expensive. The following table provides indicative cost ranges; actual expenditure varies significantly depending on the complexity of the matter, the volume of data, the number of custodians and the duration of the investigation.

Companies should budget for total external costs of at least €50,000 to €200,000 for a mid‑complexity investigation, with high‑profile or multinational matters exceeding €500,000. Some remediation and legal‑compliance expenditures may be tax‑deductible as ordinary business expenses; however, fines and penalties imposed by courts or prosecutors are generally not deductible. Companies should confirm the tax treatment of each cost category with their local tax adviser before claiming any deduction.

What Changes in 2026: How to Respond to a White‑Collar Investigation Under the New Rules

Two legislative developments in 2026 materially alter how companies must respond to white‑collar investigations in Poland. Both add new procedural obligations that must be integrated into the response steps described above.

Whistleblowing and Compliance Officer Obligations (2026)

Poland’s Act on the Protection of Whistleblowers, implementing EU Directive 2019/1937, entered into force in 2024 and has been supplemented by 2026 implementing regulations. Entities with 50 or more employees must maintain internal reporting channels, designate a person or unit responsible for receiving and following up on reports, and ensure that whistleblowers are protected from retaliation. The 2026 rules tighten the compliance officer requirement by clarifying that the designated person must have sufficient authority and independence to handle reports without interference from management. During an investigation, the compliance officer must preserve all whistleblower reports and handling records, because prosecutors routinely request these to assess whether the company had prior notice of wrongdoing and how it responded.

Failure to maintain adequate whistleblowing channels now carries administrative penalties.

Corporate Liability Proposals and Practical Effects (2026)

Proposals to strengthen the corporate liability regime in Poland have been under discussion since 2022. As of mid‑2026, a draft act on the liability of collective entities for acts prohibited under penalty is at an advanced legislative stage. The likely practical effect will be to broaden the circumstances under which a company can be held directly liable, increase available financial penalties, and introduce a compliance defence, whereby a company that maintained an effective compliance programme may mitigate or avoid liability. Early indications suggest that the compliance defence will require the company to demonstrate that it had a functioning compliance officer, documented policies, and an active internal reporting mechanism at the time of the offence.

Even before the act is formally enacted, industry observers expect prosecutors to give weight to the presence or absence of these elements when exercising discretion. Boards should treat these proposals as operationally binding now and ensure that every element of the anticipated compliance defence is in place.

Common Pitfalls and How to Avoid Them

The following pitfalls recur in white‑collar investigations across Poland. Each is avoidable with advance planning and disciplined execution.

• Destroying or altering evidence. Never instruct employees to delete emails, wipe devices or shred documents after learning of an investigation. This constitutes a separate criminal offence and eliminates any cooperation credit.
• Delaying the legal hold. A legal hold issued days or weeks late allows auto‑deletion cycles to erase critical evidence. Issue the hold within 24 hours and confirm receipt in writing.
• Using in‑house counsel to lead the internal investigation. In‑house communications lack the same privilege protections as external counsel communications in Polish criminal proceedings. Always appoint external counsel as investigation lead.
• Producing privileged material to prosecutors. Inadequate privilege review before production can result in irreversible waiver. Conduct a document‑by‑document review for privilege before any production.
• Failing to maintain a chain‑of‑custody log. Without contemporaneous hash‑value documentation and transfer records, the evidentiary integrity of forensic images can be challenged at trial.
• Conducting employee interviews without ground rules. Interviews must include a clear Upjohn‑style warning (adapted to Polish law) that counsel represents the company, not the interviewee. Failure to set this boundary creates conflict‑of‑interest risks.
• Over‑sharing with the prosecutor before strategy is agreed. Premature admissions or voluntary disclosures made without board authorisation and counsel oversight can be devastating. All communications with the prosecutor must be channelled through external counsel.
• Neglecting the supervisory board. If management board members are implicated, the supervisory board must be notified immediately so it can take independent oversight measures. Failing to do so exposes the company to governance failures.
• Ignoring cross‑border dimensions. Companies with operations outside Poland must consider mutual legal assistance obligations, data‑transfer restrictions under GDPR, and foreign anti‑bribery statutes (FCPA, UK Bribery Act) that may apply in parallel.
• Treating remediation as optional. Prosecutors and courts assess whether the company has taken genuine steps to prevent recurrence. Cosmetic fixes are insufficient, remediation must be documented, measurable and sustained.

Sources

1. Kodeks karny (Polish Penal Code), ISAP (Internetowy System Aktów Prawnych)
2. Kodeks postępowania karnego (Code of Criminal Procedure), ISAP
3. Prokuratura Krajowa (National Prosecutor’s Office), Official Website
4. Ministry of Justice of the Republic of Poland, Official Website
5. Act on the Protection of Whistleblowers (Ustawa o ochronie sygnalistów), ISAP
6. Sąd Najwyższy (Polish Supreme Court), Official Website