Sign up

Compliance · Poland

KYB for Poland under MiCA & AMLR — what teams need before 1 July 2026

Poland has the sharpest near-term compliance catalyst in the EU. Here's the regulatory stack, who it hits, and how to verify Polish counterparties — KRS registry, NIP, and sanctions — in one API before the deadline.

Updated 8 October 2026

The deadline: 1 July 2026 — the MiCA CASP authorisation cut-off. Poland's national implementing law was vetoed, leaving ~1,300 registered VASPs with no domestic licensing route. From 2 July, any Polish VASP without a MiCA authorisation (domestic or passported) must cease operating or redomicile.

The regulatory stack pressing on Polish KYB

  • MiCA CASP authorisation — 1 July 2026. Poland is the only member state whose national MiCA implementing law has stalled (presidential veto). Polish crypto firms must passport in from another EU state (Lithuania, Estonia) or wind down. The redomiciliation wave triggers KYB on newly incorporated SPVs and re-screening of every counterparty.
  • EBA sanctions-screening guidelines — in force 30 December 2025. Every EU/UK PSP and CASP must screen entities, directors and beneficial owners against sanctions lists with documented, systematic processes.
  • EU AMLR (Reg. 2024/1624) — applies 10 July 2027. Harmonised KYB/CDD across all obliged entities; the beneficial-ownership threshold moves from "more than 25%" to "25% or more", forcing re-screening of existing counterparty books. AMLA publishes its technical standards through 2026.
  • DORA — applied 17 January 2025. Third-party ICT risk registers and vendor due diligence are now in scope, including the data vendors in your KYB stack.

Who has to act

  • Polish CASPs / VASPs passporting to Lithuania or Estonia — they must re-KYB their Polish counterparties under the new home-state regime.
  • EU and UK PSPs, EMIs and lenders that onboard Polish business counterparties — entity verification plus sanctions screening on each.
  • RegTech / KYC-orchestration platforms that need a Polish company-data layer behind their workflow.

All of these are English-speaking, developer-led teams that already buy data APIs self-serve — exactly where a single multi-country REST endpoint fits.

How to verify a Polish counterparty

Two API calls cover the company leg of a Polish KYB check:

  1. Registry resolution. GET /companies/search?country=PL&name=… (or company_number=<KRS>) confirms the company is in the KRS register and returns its NIP, REGON, legal form, PKD activity code, address and share capital.
  2. Sanctions screening (beta). GET /sanctions/screen?name=… screens the company name against EU consolidated, UN, OFAC and UK lists with scored fuzzy matching.

Both run in well under a second, behind a single Bearer key that also covers every other registry the API covers — so a fintech onboarding counterparties across Europe uses one integration, not one per registry.

The three-register reality — what's live and what isn't

Honest scope, because it matters for a compliance programme:

  • KRS (company registry) — live. Company-level records: name, KRS number, NIP, REGON, legal form, PKD, address, capital. This is the core of the company leg.
  • KRZ (insolvency / debtors register) — not yet. There is no free public API for KRZ; insolvency status is not currently included.
  • CRBR (beneficial ownership) — not yet. Polish UBO access is moving to a legitimate-interest model; it is not provided. Collect UBO via self-declaration and verify against documents during onboarding.

Sole traders (CEIDG) are a separate register and are not included in the KRS dataset.

Why move now

This is a time-boxed, compulsory demand window, not a diffuse trend. The MiCA deadline is fixed at 1 July 2026; the EBA screening guidelines are already enforceable; AMLR procurement cycles are running today. Teams that have their Polish counterparty-verification path in place before the deadline avoid the late-June scramble.

Related

This guide is general information, not legal advice. Confirm your obligations with qualified counsel.

Frequently asked questions

What happens to Polish crypto firms on 1 July 2026?
Under MiCA, crypto-asset service providers (CASPs) need an authorisation to operate in the EU. Poland has not enacted its national MiCA implementing law (the bill was vetoed), so Polish VASPs have no domestic authorisation route. From 1 July 2026 a Polish VASP without a MiCA authorisation — domestic or passported from another member state — must cease operating or redomicile. This triggers fresh KYB on newly incorporated structures and re-screening of counterparties.
Are EU/UK firms affected by the Polish MiCA situation?
Yes — any PSP, EMI or CASP that onboards or transacts with Polish crypto/payment counterparties must verify the entity, screen it against sanctions lists, and re-assess as those counterparties passport, redomicile or wind down. The EBA sanctions-screening guidelines (in force 30 December 2025) make programmatic screening of the entity, its directors and owners a baseline expectation.
When does the EU AML Regulation (AMLR) apply in Poland?
The EU AML Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027, with AMLA technical standards arriving through 2026. Because procurement and tooling decisions run 12–18 months ahead of the deadline, Polish obliged entities are selecting KYB/CDD vendors now.