Understanding KYC Compliance in Poland for 2026

KYC compliance in Poland requires obliged institutions to verify customers, identify beneficial owners and understand business relationships. These rules apply to sectors including banking, fintech, payments, insurance, accounting and corporate services.

A valid ID is only the first step. Polish CDD also requires ownership checks, risk assessment, PEP and sanctions screening, monitoring and enhanced due diligence when needed.

KYC in Poland is an ongoing process, not a one-time check. This guide covers key verification, risk assessment and monitoring requirements under Poland’s AML framework, including the main Poland AML requirements businesses need to understand in 2026.

What Is KYC Compliance in Poland?

KYC compliance in Poland forms part of the AML/CFT framework under the Polish AML Act. It requires obliged institutions to identify and verify customers and beneficial owners, assess risk, screen for PEPs and sanctions, understand the relationship’s purpose, apply enhanced due diligence where needed, and monitor activity on an ongoing basis.

In practice, KYC Poland requirements connect customer identification with broader customer due diligence and anti-money laundering controls. Businesses must establish who the customer is, who ultimately controls a legal entity, why the relationship exists and whether activity remains consistent with the customer’s profile.

Which Law Governs KYC in Poland in 2026?

KYC compliance in Poland is governed primarily by the Polish AML Act, which sets out customer identification, verification, beneficial ownership, risk assessment and ongoing monitoring requirements.

Businesses should also follow relevant GIIF guidance and monitor upcoming EU AML changes, including the AML Regulation scheduled to apply generally from July 2027. Understanding these Poland AML requirements is essential for businesses that onboard Polish customers or operate as obliged institutions in Poland.

The Polish AML/CFT Act

Poland’s core KYC and AML framework is set by the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing, consolidated in Journal of Laws 2025, item 644. It defines obliged institutions and their duties, including customer due diligence, beneficial ownership checks, risk assessment, ongoing monitoring, recordkeeping and suspicious activity reporting.

The Act provides the main legal foundation for KYC Poland processes, including when customer verification is required, what information must be collected and how institutions should respond when they cannot complete required due diligence.

GIIF

The General Inspector of Financial Information (GIIF) is a central authority in Poland’s AML/CFT system. It supports obliged institutions through guidance on customer due diligence, beneficial ownership, risk assessment, transaction monitoring, PEP identification and reporting. GIIF publications help businesses apply Polish KYC requirements, especially when handling higher-risk customers or unusual activity.

GIIF guidance is particularly useful for interpreting practical KYC compliance Poland obligations, such as how to assess new customer information, investigate beneficial ownership discrepancies and determine when enhanced measures are appropriate.

Poland's 2026 AML/CFT Strategy

On 10 February 2026, Poland’s Council of Ministers adopted a new AML/CFT Strategy to strengthen the country’s anti-money laundering framework. Based on Poland’s national risk assessment, it emphasises risk-based compliance, stronger controls, effective supervision, information sharing and professional training. The strategy makes 2026 a key year for businesses to review their KYC, monitoring and AML governance processes.

For businesses operating in Poland, the strategy reinforces the importance of maintaining effective KYC compliance Poland procedures rather than treating customer verification as a one-time administrative task.

When Is KYC Required in Poland?

KYC compliance in Poland is required when an obliged institution establishes a business relationship.

CDD may also be triggered by certain occasional transactions, money transfers, virtual-currency or cash activity, gambling, suspected money laundering or terrorist financing, or doubts about existing customer data. Linked transactions may count toward applicable thresholds.

The €15,000 threshold is not a universal KYC limit. It applies to certain occasional transactions, while ongoing business relationships require CDD from the outset. Additional checks may be needed for lower-value activity if transactions appear suspicious, customer information is inconsistent or linked transactions reach a relevant threshold.

Polish obliged institutions should verify customers and beneficial owners, assess risk, conduct appropriate PEP and sanctions screening and apply enhanced due diligence where necessary. These steps form the core of KYC Poland processes and help institutions meet applicable Poland AML requirements.

What Is the CRBR and How Should Businesses Use It?

The Central Register of Beneficial Owners (CRBR) is Poland’s official UBO database and an important part of KYC Poland processes. However, checking CRBR alone does not complete UBO verification. Obliged institutions must independently identify and verify the person who ultimately owns or controls the customer and review the full ownership structure using reliable sources in line with Poland AML requirements.

If CDD findings conflict with CRBR data, the institution must document and investigate the discrepancy and determine whether it is genuine. Where the inconsistency is confirmed, the institution must report it with supporting evidence to the competent authority.

In short, CRBR data should support a risk-based beneficial ownership assessment, not replace it. This approach is essential for effective KYC compliance Poland.

Step-by-Step Guide to KYC Compliance in Poland

Follow these key steps to meet KYC and AML requirements in Poland and build an effective KYC compliance Poland programme.

From customer identification and UBO verification to risk assessment, PEP screening and ongoing monitoring, each stage helps support effective KYC compliance and meet relevant Poland AML requirements.

Step 1: Identify the Customer and Collect Required Information

For individual customers, collect required details such as full name, citizenship, PESEL number or birth information, identity-document details and address where available. For business customers, collect the legal name, registered address, registration details, business activity and information about authorised representatives.

This customer identification stage is the foundation of KYC compliance Poland. The information collected supports customer due diligence (CDD), customer risk assessment, AML screening and ongoing monitoring throughout the business relationship.

Step 2: Verify Identity Using Reliable, Independent Sources

Verify customer information against reliable and independent sources, such as official identity documents, government registers, trusted databases or qualifying electronic identification and trust services. Verification should confirm that the information provided is accurate and belongs to the customer being onboarded.

Remote KYC verification may be used in Poland when it reliably establishes identity and addresses impersonation, fraud and other non-face-to-face risks. A document check alone may not be sufficient where the customer presents higher risk or the information appears inconsistent. These controls form a core part of KYC Poland onboarding procedures.

Step 3: Confirm Representatives' Identity and Authority

When an individual acts for a company or another person, verify the representative's identity using reliable and independent sources. Collect relevant identification details and confirm that the person is authorised to act on behalf of the customer.

For business KYC and KYB compliance, check corporate registers, powers of attorney, board resolutions or other appropriate evidence of authority. Record the verification results so the institution can demonstrate how it confirmed the representative's role and authority under applicable Poland AML requirements.

Step 4: Identify and Verify the Beneficial Owner

For corporate customers, identify the natural person or persons who ultimately own or control the entity. More than 25% of shares or voting rights is an important indicator, but beneficial ownership analysis must also consider indirect ownership and other forms of decisive control.

Use the CRBR, company registers, ownership documents and other reliable sources to verify the UBO. CRBR data should support, not replace, independent beneficial owner verification, and any discrepancy should be investigated, documented and handled under Poland's AML requirements. Thorough UBO checks are a central element of KYC compliance Poland.

Step 5: Assess Ownership, Business Activity and Relationship Purpose

For business customers, complete KYB checks to understand the ownership and control structure, identify the ultimate beneficial owner (UBO), and verify representatives. Review company registration details, directors, shareholders, business activity and expected transaction patterns using reliable, independent sources, including the CRBR where relevant.

Establish why the customer wants the relationship, which products or services they need, where funds are expected to come from and what activity is anticipated. This customer due diligence (CDD) information creates the baseline for KYC compliance Poland and helps identify activity that may later require enhanced due diligence.

Step 6: Screen Customers and Beneficial Owners for PEPs, Sanctions and Other Risks

Screen the customer, beneficial owners, directors and relevant representatives for politically exposed person (PEP) status, sanctions exposure and other financial-crime indicators. Depending on the customer's profile, also review high-risk jurisdictions, adverse media and unusual ownership or transaction characteristics.

A PEP match does not automatically require rejection, but it normally triggers enhanced due diligence, including management approval, source-of-wealth and source-of-funds checks, and enhanced ongoing monitoring. Sanctions concerns or unresolved identity and ownership issues should be escalated before the relationship proceeds. These checks are important components of a complete KYC Poland framework.

Step 7: Assess ML/TF Risk and Apply Proportionate Due Diligence

Assess money laundering and terrorist financing (ML/TF) risk using customer, geographic, product, service, transaction and delivery-channel factors. Document the reasoning behind the customer's risk rating and consider whether the profile presents lower, standard or higher risk under Poland's AML framework.

Apply simplified due diligence only where lower risk is properly established, standard CDD for ordinary relationships and enhanced due diligence (EDD) for higher-risk customers. Risk assessment should remain dynamic, so new information, ownership changes or unusual activity can require a revised KYC risk rating and updated KYC compliance Poland controls.

Step 8: Approve, Escalate or Reject the Relationship, Then Monitor Ongoing Activity

Once KYC verification, UBO checks, AML screening and risk assessment are complete, approve the relationship under the organisation's internal AML procedures or escalate it for compliance and senior-management review. If required financial security measures cannot be completed, the institution may need to refuse the relationship, stop the transaction or terminate an existing relationship in accordance with Poland AML requirements.

After onboarding, conduct ongoing monitoring to confirm that transactions match the customer's known business, purpose and risk profile. Keep customer information current, reassess risk when circumstances change and report suspected money laundering or terrorist financing to GIIF where the legal reporting criteria are met. Ongoing monitoring ensures that KYC compliance Poland remains effective beyond initial onboarding.

What Are the KYC Requirements for PEPs in Poland?

Under Poland’s AML framework, obliged institutions must screen customers and beneficial owners for PEP status, including family members and known close associates. PEPs are not automatically rejected but require enhanced due diligence, senior-management approval, source-of-wealth and source-of-funds checks, and ongoing monitoring.

These obligations can continue for at least 12 months after the person leaves a prominent public function and may continue longer where the associated risk remains. Effective PEP compliance therefore combines reliable screening, documented risk assessment, management oversight and continuous review rather than treating PEP identification as a one-time database check. This is a key consideration for KYC Poland and broader KYC compliance Poland programmes operating under Poland AML requirements.

Is Remote KYC Allowed in Poland?

Yes, remote KYC is generally permitted in Poland, provided an obliged institution can reliably identify and verify the customer using independent sources and appropriately manage non-face-to-face risks. Digital onboarding may include identity-document verification, biometric checks, liveness detection, qualified electronic identification, trust services and fraud screening. These controls form an important part of effective kyc compliance poland processes and help businesses meet relevant poland aml requirements.

However, remote onboarding can increase money-laundering and impersonation risks where safeguards are inadequate. Businesses should therefore apply a documented, risk-based approach, escalate suspicious cases and avoid treating a successful automated identity check as complete AML compliance. A remote onboarding process should be assessed as part of the wider kyc poland framework, including customer risk assessment, beneficial ownership checks and ongoing monitoring.

What Happens If KYC Cannot Be Completed?

If an obliged institution in Poland cannot complete required KYC or customer due diligence measures, such as verifying the customer’s identity, beneficial owner, source of funds or ownership structure, it should not simply proceed and “fix the file later.”

Under Article 41 of the Polish AML Act, the institution may need to refuse or suspend the business relationship, decline an occasional transaction or bank-account transaction, terminate an existing relationship and assess whether the circumstances require a suspicious activity notification to GIIF. These are important consequences under the country’s poland aml requirements and should be reflected in internal kyc compliance poland procedures.

The decision should be risk-based, documented and supported by a clear audit trail. This is particularly important where the customer provides inconsistent information, CRBR data conflicts with independent findings or the source of assets cannot be reasonably established. A well-designed kyc poland process should record the information reviewed, the unresolved issue, the risk assessment and the final decision.

KYC Compliance Changes to Watch in Poland in 2026

Poland’s KYC and AML compliance landscape is evolving in 2026, with new national priorities, updated GIIF guidance and upcoming EU requirements shaping how obliged institutions manage customer due diligence. These developments are especially relevant to organisations reviewing their kyc compliance poland frameworks and preparing for changes to poland aml requirements.

Businesses should monitor changes to Polish AML regulations, beneficial ownership verification, PEP screening, risk assessments and ongoing transaction monitoring to remain compliant and prepare for the EU AML Regulation’s broader application in 2027. Firms should also ensure that their kyc poland procedures can be updated as legal and supervisory expectations develop.

New Polish AML/CFT Strategy

Poland adopted its new national AML/CFT Strategy on 10 February 2026, strengthening its risk-based approach to combating money laundering and terrorist financing. The strategy prioritises stronger supervision, cooperation, information exchange and responses to emerging risks. 

Obliged institutions should review their AML policies, risk assessments, customer due diligence, beneficial ownership checks, monitoring controls and staff training accordingly. These reviews should include the organisation’s kyc compliance poland controls and confirm that customer onboarding and monitoring remain aligned with current poland aml requirements.

Continued GIIF Compliance Guidance

The General Inspector of Financial Information (GIIF) publishes AML guidance for obliged institutions in Poland. In 2026, Communication No. 114 clarified obligations for certain tax advisers, auditors, bookkeeping firms and related professional-service providers. 

It is not a universal KYC rule for all Polish businesses, so firms should confirm whether it applies to their sector. Where it does apply, businesses should incorporate the relevant guidance into their kyc poland policies, procedures and compliance training.

UC75 Legislative Proposal

UC75 remained a proposed amendment to Poland’s AML Act in 2026, not binding law. Updated to version 3.0 on 1 July 2026, it aims to strengthen AML/CFT rules, including measures on proliferation financing and international alignment. 

Businesses should monitor its progress but apply only requirements currently in force. This distinction is important when maintaining kyc compliance poland documentation and communicating applicable poland aml requirements to internal teams and customers.

How the New EU AML Regulation Affects Poland

Regulation (EU) 2024/1624, known as the EU AML Regulation or AMLR, will harmonise AML/CFT rules across the EU, including Poland. It generally will not apply to Polish businesses in 2026. Most provisions apply from 10 July 2027, with certain requirements for specified entities starting on 10 July 2029.

For now, Polish obliged institutions must continue following the Polish AML Act while using 2026 as a preparation year. They should review KYC and KYB procedures, beneficial ownership checks, PEP and sanctions screening, customer risk assessments, transaction monitoring, recordkeeping and compliance technology. This preparation should strengthen existing kyc compliance poland controls without replacing the poland aml requirements currently in force.

Preparing early can help organisations transition smoothly to the future EU AML framework without incorrectly treating upcoming AMLR obligations as current Polish law. Businesses should continue applying their kyc poland procedures under the applicable Polish framework while documenting any planned changes needed for the future EU regime.

How KYC Software Can Support Compliance in Poland

KYC software can help Polish obliged institutions manage KYC compliance Poland requirements through a consistent, auditable workflow. Useful features include identity and document verification, business and UBO checks, ownership mapping, PEP and sanctions screening, risk scoring, enhanced due diligence, ongoing monitoring, alerts, case management, reporting and secure audit trails.

A standalone identity-verification tool may confirm who a person is. A broader KYC Poland and AML platform can also identify business ownership, assess risk, determine required checks and track changes after onboarding. Platforms such as Binderr support this end-to-end approach by connecting KYC, KYB, AML screening, risk assessment and ongoing compliance workflows.

By centralising these processes, organisations can reduce manual reviews, apply controls more consistently and maintain documented, risk-based decisions that are easier to review during internal audits or regulatory inspections. This can also help businesses operationalise Poland AML requirements across onboarding and ongoing monitoring.

Common KYC Compliance Mistakes in Poland

Avoiding common KYC errors helps Polish obliged institutions meet Poland AML requirements, reduce financial-crime risk and maintain accurate customer records.

The following mistakes can lead to weak due diligence, regulatory exposure and ineffective ongoing monitoring:

Assuming the €15,000 threshold applies to all customer onboarding - The €15,000 threshold applies to certain occasional transactions, not every KYC Poland process. Under Poland’s AML framework, due diligence is generally required when establishing a business relationship, regardless of transaction value. Suspicion of money laundering or terrorist financing, or doubts about customer information, can also trigger checks without a minimum threshold.

Relying exclusively on CRBR for UBO verification - The Central Register of Beneficial Owners (CRBR) is a useful source of ownership information, but it does not replace independent UBO verification. Obliged institutions should compare CRBR data with company records and other reliable sources, investigate discrepancies and document their findings as part of their KYC compliance Poland procedures.

Stopping ownership analysis at a corporate shareholder - Identifying a corporate shareholder is only one step in KYB. Businesses should trace direct and indirect ownership through the structure to identify the natural person or persons who ultimately own or control the customer. If ownership is unclear, other forms of decisive control must also be considered under applicable Poland AML requirements.

Using the same due diligence level for every customer - Poland’s AML framework is risk-based. Standard due diligence applies to ordinary-risk customers, while higher-risk relationships may require enhanced checks, source-of-funds or source-of-wealth verification, management approval and closer monitoring. Lower-risk customers may qualify for simplified measures, but KYC compliance Poland obligations still apply.

Completing KYC once and never updating it - KYC compliance is an ongoing process, not a one-time onboarding task. Obliged institutions should update customer information, beneficial ownership records and risk assessments when relevant circumstances change. Ongoing monitoring confirms whether customer activity still matches the established profile and continues to satisfy Poland AML requirements.

Bottom Line

KYC compliance Poland is an ongoing, risk-based process. Obliged institutions must verify customers and beneficial owners, assess risk, screen for PEPs and sanctions, understand the relationship’s purpose and monitor activity over time.

Businesses should not rely solely on CRBR data or fixed thresholds. They must update customer information, apply enhanced due diligence where needed and refuse or terminate relationships when required checks cannot be completed under Poland AML requirements.

In 2026, organisations should follow Poland’s current AML framework while preparing for the EU AML Regulation’s broader application from 10 July 2027.

Binderr Services helps businesses streamline identity verification, KYB, UBO checks, AML screening and ongoing compliance workflows in one platform.

FAQs - KYC Compliance in Poland