AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Canada
- China
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- Uganda
- Ukraine
- UK
- USA
- Vietnam
POLAND KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Poland
Verify Polish customers and businesses through the notified Polish eID, e-dowód NFC chip reading, QES, identity documents, biometrics and KYB. Reduce manual review, maintain consistent audit evidence and run one connected workflow designed to support the Polish AML Act today and AMLR from 10 July 2027.
Operational Performance for Poland KYC
Our Numbers Speak Volumes
99.23%
First-pass
verification rate
< 10 sec
Median
verification time
7+
Polish ID methods
supported
Poland IDV/KYC Challenges
The Notified eID Is Not the One People Carry
Poland notified Profil Zaufany and the personal profile inside the e-dowód. The mObywatel app and the mDowód sit outside that notification, yet obliged institutions have had to accept the mDowód since 1 September 2023.
Polish Surnames Change Shape with the Person
Adjectival surnames inflect for gender, so Kowalski and Kowalska belong to one family. The nine Polish diacritics are then stripped in the machine-readable zone, so Łącki reaches sanctions screening as LACKI.
A CRBR Lookup Is a Starting Point, Not an Answer
Article 37(3) of the Polish AML Act says you cannot rely on the CRBR alone to identify a beneficial owner. Article 61a then requires you to record any discrepancy and report the confirmed ones to the registry authority.
Two National Sanctions Lists Sit Under the EU Ones
Poland runs national sanctions measures alongside the EU and UN regimes. The MSWiA keeps one list and the GIIF keeps the other. Screening the EU consolidated list alone leaves a Polish gap.
Regulatory Update
What AMLR Changes for Identity Verification in Poland
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Poland from 10 July 2027, with no transposition period. It sets the due diligence rules the Polish AML Act of 1 March 2018 will operate under, with AMLA, the new EU-level supervisor, established in Frankfurt.
Timeline
- End of 2026 EU Digital Identity Wallet availability target
- December 2026 Poland plans an EU Digital Identity Wallet pilot delivered through mObywatel
- 10 July 2027 AMLR applies, no transposition
- December 2027 Private relying parties using strong user authentication, excluding micro and small enterprises, must accept EU Digital Identity Wallets on a user’s voluntary request. eIDAS 2.0, Article 5f(2).
- 2028 AMLA direct supervision begins
eIDAS Becomes an Explicit Route
Article 22(6) gives two equal means: an identity document with reliable independent sources, or eIDAS electronic ID at substantial or high with qualified trust services under Article 22(6)(b). Poland notified at both levels, so that route is open, while the mDowód sits outside it.
The Ownership Test Tightens
AMLR sets the test at 25% or more under Article 52 and requires control to be assessed in parallel, which can arise below that line.
Existing Customers Get Re-Checked
AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.
Accountability Stays With You
Article 18 keeps due diligence with the obliged entity even when outsourced. The UKNF positions likewise place the assessment of any remote method on the institution.
FOR KNF-SUPERVISED BUSINESSES
Streamline KNF-Supervised Onboarding in Poland
Connect identity verification, QES, Penny Drop and compliance evidence in one configurable workflow for businesses operating within the supervisory remit of the KNF. Reduce customer drop-off and manual handovers while giving compliance teams a review-ready record of every decision.
1. Verify the customer
Verify identity using the configured route, such as the notified Polish eID scheme, NFC chip reading of the e-dowód or passport, attended video identification or document and biometric checks.
2. Complete qualified signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together.
3. Confirm the payment account
Penny Drop confirms the account belongs to the customer. UKNF treats this as a supplementary measure, never a primary or sole one.
Shufti’s IDV/KYC Solutions for Poland
KYC Solutions
Clear onboarding for Polish customers under the Polish AML Act, with age and address checked in the same flow as identity, each check completing in seconds.
Explore More
Identity Verification
Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ actively processed document types.
.
Face Verification
Face verification binds the live person to the document with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness, stopping spoofs, masks and deepfakes.
.
Age Verification
Age estimation with document verification where more assurance is needed, and date of birth checked against the PESEL on the e-dowód and karta pobytu. Polish gambling age procedures sit under Article 15i.
.
Address Verification
Shufti verifies Polish address-bearing documents, including electricity and gas invoices, telecom bills and bank statements from major Polish issuers.
.
Document Verification
Verification of the dowód osobisty in its e-dowód form, the Polish passport, the karta pobytu and the Polish driving licence, including NFC chip reading on the e-dowód and the biometric passport.
.KYB Solutions
Under the Polish AML Act, every business you onboard needs the same scrutiny as the people behind it. Shufti checks KRS and CEIDG records, beneficial ownership and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.
Explore More
Business Verification
Automated validation of KRS and CEIDG records, the NIP, the REGON number, the PL-prefixed VAT number and the managing board.
.
Enhanced Due Diligence (EDD)
Structured risk profiling for complex ownership chains, cross-border entities and higher-risk sectors, designed to support the enhanced measures in the AML Act.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to Polish financial flows flags anomalies against AML rules, supporting the controls expected by the KNF and the GIIF.
.Supported Verification Methods for Poland
Every Verification Route Poland Uses, in One Platform
Shufti supports the full range of remote verification routes used in Poland, from the EU Digital Identity Wallet to the notified Polish eID scheme, NFC chip reading and attended video identification. Each method below shows what is live today and what is ready for the 2027 rollout.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22(6)(b) points to electronic identification at eIDAS substantial or high levels. The Ministry of Digital Affairs plans a pilot through mObywatel in December 2026. Shufti is built to accept wallet-based verification as it goes live.
Notified eID
LiveeIDAS Substantial and HighPoland notified its Polish Public Electronic Identification System on 19 April 2023 at eIDAS substantial and high, covering Profil Zaufany and the personal profile in the e-dowód. Shufti verifies these today, alongside mojeID, the bank-issued eID operated by KIR.
Docless Database eIDV
LiveDatabase-driven verification confirms identity in seconds for low-risk onboarding, with no document upload. Shufti confirms which sources are available for Poland at scoping, then escalates as risk rises.
NFC Chip Verification
LiveShufti reads the secure chip in the e-dowód, the karta pobytu and the Polish biometric passport. Every dowód osobisty issued since 4 March 2019 carries that electronic layer, so chip reading is the strongest capture route where no eID session is available.
Document and Face Biometric
LiveA route permitted under AMLR Article 22(6)(a). Document authentication of the dowód osobisty, the Polish passport, the karta pobytu and the driving licence, with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness confirming a live person.
Video Identification
LiveThe UKNF positions of 5 June 2019, 3 March 2022 and 29 September 2023 set out good practices for video and remote identification, the last per EBA/GL/2022/15. Insufficient material quality must stop the process or move it in-person. Shufti runs this route with document checks and biometric comparison.
Qualified Electronic Signature
LiveArticle 37(1) of the Polish AML Act accepts trust services under Regulation 910/2014 for verifying identity. Shufti runs eIDAS-qualified signing powered by Evrotrust, an EU qualified trust service provider, producing PAdES-LTV signatures. For Poland the signing identity check runs through NFC and face biometrics.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Evidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti verifies 18+ Polish document types.
View All Supported DocumentsDowód Osobisty (National ID Card)
Primary identity document for Polish citizens under the Act of 6 August 2010. Every card issued since 4 March 2019 is an e-dowód.
Paszport (Passport)
Polish biometric passport, issued under the Act of 27 January 2022 since 13 November 2022. Its chip holds the facial image, so Shufti reads the chip.
Prawo Jazdy (Driver's Licence)
EU-format photocard licence. It is not a statutory identity document in Poland, so onboarding treats it as supporting evidence for name and date of birth.
Karta Pobytu (Residence Permit)
Residence card for foreign nationals. Article 242 of the Act on Foreigners says it confirms the holder's identity during their stay in Poland.
Karta Czasowego Pobytu (Temporary Residence Card)
Residence card issued on a temporary-stay permit and valid for that permit period. Shufti date-stamps the validity window so a lapse is caught at refresh.
Permit-Based Residence Cards (Including EU Blue Card)
Residence cards issued on specific permit routes, including highly qualified employment. Shufti captures the annotation printed on the card as evidence.
mDowód (mObywatel Digital ID)
Digital ID document in the mObywatel app. Article 7(4) of the Act of 26 May 2023 deems an identity check met on it; obliged institutions from 1 Sept 2023.
Entity Identity
KRS Extract
Court-maintained extract from the Krajowy Rejestr Sądowy. It confirms legal name, KRS number, legal form, registered office, board and representation rules.
CEIDG Record
Official record for sole traders. It confirms business identity, the NIP, the trading address and whether the activity is active, suspended or resumed.
Articles Or Constitutional Documents
The umowa spółki or statut behind the registry entry. Shufti uses it to reconcile share capital, governance structure and signing authority in higher-risk reviews.
Tax Identity
NIP Certificate
Core tax identifier assigned by the head of the tax office. It supports entity validation and becomes the PL-prefixed VAT number for intra-Community trade.
VAT Status Evidence
Current standing from the wykaz podatników VAT, the white list the Head of KAS keeps under Article 96b of the VAT Act. Re-checked at refresh.
REGON Evidence
Statistical business identifier from the register kept by Statistics Poland. It links records across Polish databases where NIP and KRS leave gaps.
Ownership & Control (UBO)
CRBR Record
Beneficial ownership entry in the CRBR, with the Minister of Finance responsible under Article 56. Article 37(3) says it cannot be the only source.
Director And Shareholder Evidence
Board and shareholder records showing who controls the entity. Shufti reconciles them across the KRS, the CRBR and the onboarding file.
Self-Declaration Or Supporting Ownership Pack
Ownership evidence gathered where register data stops short. It documents indirect holdings and the rationale behind a higher-risk KYB decision.
Languages We Cover
Document Text Handling
Polish uses nine diacritics and the machine-readable zone drops them. Shufti keeps both forms, across 150+ supported languages.
Name Matching Controls
Adjectival surnames inflect for gender, so Kowalski and Kowalska are one family. Matching also covers Cyrillic transliteration for Ukrainian residents.
Evidence Consistency
Document checks, face verification and screening outputs sit in one case record, so a GIIF request or a KNF inspection is answered from a single file.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer avoidable re-submissions
Capture tuned to the dowód osobisty designs in circulation, plus NFC chip reading of the e-dowód, cuts avoidable re-uploads and manual review.
Cleaner audit trails
Structured logs aligned to the five-year retention rule in Article 49 and to GIIF reporting keep decisions ready for inspection.
Better name matching outcomes
Matching handles the nine Polish diacritics and the gendered surname endings, reducing false positives and manual review on Polish records.
One workflow, one back office
KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.
National ID-first flow design
Flows lead with the dowód osobisty and the mDowód, then fall back to the karta pobytu and home-country documents.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to the record-keeping standard in Article 49 of the Polish AML Act, so the file is organised for supervisory review.
Perpetual KYC
pKYCKeeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.
Perpetual KYB
pKYBMonitors CRBR entries and KRS filings for shareholding and control changes, so a shift past 25% or a change in control is caught between reviews and any discrepancy is logged for Article 61a reporting.
Built To Fit Poland's Compliance Landscape
Generalny Inspektor Informacji Finansowej (GIIF)
Poland’s financial intelligence unit, inside the Ministry of Finance. It receives Article 72 reports above EUR 15,000 within 7 days, and suspicion reports without delay and no later than 2 working days under Article 74. Decision audit trails support that reporting.
Narodowy Bank Polski (NBP)
Poland’s central bank, covering monetary policy, currency issuance and payment-system oversight. Its President also controls currency-exchange bureaux for AML, so kantor onboarding evidence meets that standard.
Ministerstwo Spraw Wewnętrznych i Administracji (MSWiA)
Ministry of Interior and Administration, which owns the identity document framework and maintains the Polish sanctions list. Shufti screens it alongside EU, UN and the separate GIIF list.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. It begins direct supervision of selected high-risk cross-border entities from 2028 and shapes technical standards under AMLR.
Deployment Option
Cloud in EU and Polish regions such as Warsaw, or on-premises, keeps Polish customer data in-region and supports GDPR accountability.
Regulatory Alignment
Aligned with Polish AML due diligence, UBO verification and record-keeping duties, as well as GDPR principles and AMLR requirements applying from July 2027.
Retention Controls
Article 49 of the Polish AML Act sets a five-year retention period, counted from the day the business relationship ends or the occasional transaction is carried out. Before it expires, GIIF may require up to five more years after a necessity assessment. From 10 July 2027, AMLR Article 77 governs retention on the same five-year baseline. Competent authorities may require up to five further years, case by case.
Encryption & Security
Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR obligations, under our ISO 27001 certification.
Scope of Our Role
Shufti acts as a data processor and provides verification technology, not legal or regulatory advice. Responsibility for customer due diligence and for the choice of verification method remains with the obliged entity, documented in its own risk assessment.
Data and Privacy Controls in Poland
Poland AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Poland and globally. A few of them are:
Generalny Inspektor Informacji Finansowej (GIIF)
Ministerstwo Finansów
Centralny Rejestr Beneficjentów Rzeczywistych (CRBR)
Krajowy Rejestr Sądowy (KRS)
Ministerstwo Spraw Wewnętrznych i Administracji (MSWiA), sanctions list
Narodowy Bank Polski (NBP)
GIIF list under Article 120(1) of the AML Act
Financial Action Task Force (FATF)
EU Consolidated Financial Sanctions List
UN Security Council Consolidated List
European Banking Authority (EBA)
EU Authority for Anti-Money Laundering (AMLA)
Egmont Group of Financial Intelligence Units
SEE SHUFTI IN YOUR POLAND WORKFLOW
Turn Poland Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
Frequently Asked Questions
Which identity documents can be used for KYC in Poland?
Customers can use the dowód osobisty, including the e-dowód issued since 4 March 2019, the Polish passport and the karta pobytu. The UKNF position of 5 June 2019 names all three for remote verification. Shufti supports document, eID, NFC and biometric checks in one workflow.
How does Shufti support KNF-supervised businesses in Poland?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. This helps businesses within the KNF’s supervisory remit standardise compliance records and prepare clearer evidence for internal audit and supervisory review.
What documents are required for KYB in Poland?
Typically a KRS or CEIDG record, the NIP, VAT status and the CRBR beneficial ownership details. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.
How are Polish name variants and diacritics handled in screening?
Matching accounts for the nine Polish diacritics and for gendered surname endings, so Kowalski and Kowalska resolve to one family and false positives on Polish names stay low.
How long must AML records be retained in Poland?
Five years. Article 49 of the Polish AML Act counts the period from the day the business relationship ends or the occasional transaction is carried out. Before that period expires, GIIF may require a further period of up to five years after a necessity and proportionality assessment.
Is EU-region data hosting available for Polish customer data?
Yes. Shufti offers EU-based cloud regions, including Poland, so Polish customer data stays in-region under GDPR and UODO oversight. On-premise deployment is available where residency requirements are stricter.
What changes for Poland under AMLR from July 2027?
AMLR applies directly, so no Polish transposition law is needed. Article 22(6) gives two equal means: eIDAS electronic identification with qualified trust services, or an identity document with reliable independent sources. Article 52 sets the test at 25% or more, with control assessed in parallel.
Can mObywatel and mDowód be used for remote KYC in Poland?
Yes for the mDowód. Article 7(4) of the mObywatel Act deems an identity check met when made on it, and obliged institutions have applied it since 1 September 2023. It is not a travel document or eIDAS-notified.
Is remote video identification allowed in Poland?
Yes. The Polish AML Act is technology-neutral, and three UKNF positions of 5 June 2019, 3 March 2022 and 29 September 2023 set out good practices for video and remote identification, the last per EBA/GL/2022/15. All three stand as supervisory good practice, not a statutory regime. AMLR does not remove this route. For clients connected to politically exposed persons, the 2022 position expects exclusion from the video route and referral to in-person onboarding.
When will the EU Digital Identity Wallet be usable for onboarding in Poland?
Under eIDAS 2.0, member states target wallet availability from the end of 2026, and private relying parties that use strong customer authentication accept wallets after that. The Ministry of Digital Affairs has said the Polish pilot is delivered through mObywatel in December 2026. Shufti is built to accept it as it goes live.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
10 July, 2026
Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
Product Guide
