If your company is an obliged entity, such as a fintech, a cryptocurrency exchange, an accounting firm, or a real estate intermediary, you know the scenario: a prospective client wants to start working with you, but before you can sign a contract, they must provide a stack of documents, answer a dozen questions, and wait days or weeks for your compliance team’s decision. Some clients drop out along the way. Others lose patience and go to a competitor.
The problem is not the law. The Act of March 1, 2018 on Counteracting Money Laundering and the Financing of Terrorism (the AML Act) does not prescribe a specific sequence or timeline for a KYC procedure, or “Know Your Customer.” It also does not require the client to provide data your team can retrieve independently from public registers.
The problem is the process. More specifically, the order in which your organization has designed the collection of information about a client.
This article explains which data needed for an AML risk assessment you can verify without the client, how to sequence checks so compliance runs in the background, and which three onboarding mistakes slow sales without reducing risk. At the end, you will find a checklist: a five-step KYC process that does not require involving the client at the outset.
Key terms to know
Before we continue, let’s clarify the terminology. The AML rules use terms that sound formal but have specific operational meanings.
| Term | Meaning |
|---|---|
| Obliged entity | A company required by the AML Act to apply anti-money laundering procedures, including banks, fintechs, exchanges, accounting firms, and real estate intermediaries. |
| Customer due diligence measures | Four required activities: identifying the client, identifying the beneficial owner, assessing the business relationship, and ongoing monitoring. |
| KYC (Know Your Customer) | The process of identifying and verifying a client’s identity. It includes collecting data, checking documents, and assessing risk. |
| Beneficial owner | A natural person who actually controls the client, for example, a shareholder with more than 25% of the shares or a person exercising effective influence over the entity’s activities. |
| Risk-based approach (RBA) | The principle that the intensity of KYC procedures should be proportionate to the level of risk: lower risk means simplified measures; higher risk means enhanced measures. |
| CRBR | Central Register of Beneficial Owners, a public, free database of people who control Polish entities. |
Why onboarding takes weeks when data is in public registers
Most obliged entities treat client onboarding as a linear process: the client submits an application, sales collects data, compliance verifies it, and then a decision is made. Each stage waits for the previous one. Each requires the client’s involvement.
Yet much of the information needed for an AML risk assessment is publicly available before the client fills out even one form.
Public registers you can use without the client
| Register | What it contains | What you can establish for AML purposes |
|---|---|---|
| KRS (National Court Register) | Company name, NIP, REGON, registered office, PKD activity codes, governing bodies, representation rules, insolvency proceedings | Legal form, industry, time in operation, management structure |
| CEIDG | First and last name, business name, NIP, REGON, address, PKD activity codes, business status, proxies | Business status, industry, registration history |
| CRBR | Beneficial owner’s name, citizenship, country of residence, ownership percentage | Ownership structure, connections to higher-risk jurisdictions |
| VAT whitelist | Active VAT taxpayer status, registration history, bank accounts | Tax credibility, history of removal from and restoration to the register |
| EU/UN sanctions lists | Entities and individuals subject to sanctions | Whether the client or beneficial owner appears on sanctions lists |
KRS data is covered by a presumption of accuracy in relation to third parties acting in good faith. CRBR is public and free. The VAT whitelist provides five years of registration history.
Where delays come from
Onboarding delays have four sources:
- Excessive internal rules. The AML Act uses open-ended terms such as “reasonable measures” and “due diligence.” Afraid of being accused of insufficient diligence, obliged entities expand their procedures beyond the statutory minimum. They ask for a current KRS extract even though the information is available online. They request extra documents “just in case.”
- Organizational silos. Sales, operations, compliance, and legal each handle separate stages in separate systems. Without a consistent workflow, the same data is collected repeatedly.
- No integration with registers. Legacy systems do not communicate with KRS, CEIDG, or CRBR interfaces. Data that could be retrieved automatically is copied by hand.
- Shifting the verification burden to the client. Instead of retrieving register data, the entity asks the client for documents confirming information that is already publicly available.
A judgment of the Regional Administrative Court in Warsaw dated August 10, 2021 (V SA/Wa 2574/21) confirms that identification activities and risk assessments must be proportionate to the nature and size of the obliged entity. A smaller fintech does not have to use procedures at the level of a systemically important bank.
Which AML risk criteria can you verify without the client?
Article 33 of the AML Act requires an obliged entity to identify and assess client risk, taking into account, among other things: the type of client, geographic area, products and services, the value of assets, and the purpose of the business relationship.
You can assess some of these criteria before the client provides any documents. Others require the client’s direct involvement.
What you can check without the client
| Risk assessment criterion | Data source | Notes |
|---|---|---|
| Client’s legal form | KRS / CEIDG | Sp. z o.o., S.A., foundation, sole proprietorship: each form has a different risk profile. |
| Industry (PKD codes) | KRS / CEIDG | Compare it with the 2023 National Risk Assessment (KOR 2023); some sectors carry higher risk. |
| Ownership structure | CRBR + KRS | CRBR identifies beneficial owners; KRS identifies shareholders and governing bodies. |
| Beneficial owner’s country of residence | CRBR | The owner’s citizenship and country of residence inform the geographic risk check. |
| Geographic risk | Basel AML Index, FATF lists, EU lists | Poland scored 4.49 in the 2025 Basel AML Index edition, a medium risk level. |
| VAT tax status | VAT whitelist | Clients repeatedly removed from and restored to the register have a higher risk profile. |
| Sanctions screening | EU, UN, and national sanctions lists | Can be checked entirely without the client if you have identifying data. |
| PEP status (politically exposed person) | PEP databases | Can be checked without the client, although the client’s declaration remains part of the documentation. |
| Time the entity has been operating | KRS / CEIDG | Registration date: newly established entities may require a deeper analysis. |
| Insolvency or restructuring proceedings | KRS | Entries about proceedings are visible in the register. |
What you cannot establish without the client
- Purpose of the business relationship: the client must explain why they are establishing a relationship with your company.
- Source of funds or assets: particularly in higher-risk cases, this requires a statement or documents from the client.
- Expected transaction volume and structure: product-related information that cannot be obtained from registers.
- Actual places of business: these may extend beyond the registered office shown in KRS.
- Full identifying information for a natural person: PESEL, identity document series and number, and residential address.
- Identity verification: requires presentation of a document or video verification.
Note the proportion: of ten criteria, only six require the client’s direct involvement. Even so, most obliged entities start onboarding with a form where the client fills everything out from scratch.
How to sequence checks without blocking sales
The AML Act does not prescribe a detailed sequence of actions. It only requires customer due diligence measures to be applied before establishing a business relationship. It also allows an exception: completing identity verification after the relationship starts if the risk was assessed as low and the client does not transact until verification is complete.
This flexibility lets you design a three-stage process, moving from what you check yourself to what you ask the client at the end.
Stage 1: pre-screening (before contacting the client)
Goal: rule out clients subject to sanctions or entities that do not legally exist. Make an initial assessment of whether the client fits your institution’s profile.
What you do:
- Retrieve data from KRS or CEIDG using the company name or NIP.
- Check CRBR to identify beneficial owners and their citizenship.
- Screen sanctions and PEP status using available identifiers.
- Verify VAT status on the whitelist.
- Assess geographic risk based on the registered office country and the beneficial owner’s residence.
At this stage, you do not involve the client. You do not send forms. You do not request documents.
GDPR limitation: If you obtain personal data from public registers, you must meet the information obligation toward the person whose data it is, no later than your first communication with them or within one month of obtaining the data (GDPR Article 14).
Stage 2: substantive KYC verification (with the client)
Goal: fully identify and verify identity, establish the purpose of the relationship, and assess risk.
What you do:
- Ask for data that cannot be retrieved from registers: the purpose of the relationship, planned transactions, and source of funds if risk is elevated.
- Verify identity using an identity document, video verification, electronic ID, or trusted profile.
- Obtain a declaration about PEP status.
- Compare client-provided information with register data and record discrepancies.
At this stage, the client answers specific, targeted questions. They do not fill out a generic 30-field form when you could have completed 20 fields yourself.
Stage 3: completion (before or shortly after signing the contract)
Goal: confirm identity through the chosen channel, sign documents, configure products, and launch monitoring.
At this stage, you no longer collect new data to meet AML requirements. The KYC process is complete.
KNF guidance allows two-stage activation of services: an initial stage with limited functionality and full activation after all verification steps are complete. This means the client can start using some services before the entire process is finished.
Three onboarding mistakes that slow sales without reducing risk
Industry analyses indicate that about 70% of financial institutions experience customer attrition because onboarding procedures are too complicated and time-consuming. Here are the three most common mistakes behind it.
Mistake 1: excessive and duplicated identification steps
Symptom: the client provides the same data several times, once to sales, once to compliance, and once to operations. The institution asks for documents beyond the requirements of Articles 36 and 37 of the AML Act, such as utility bills to confirm an address already shown on the identity document.
Why it does not reduce risk: GIIF explicitly says client identification is a “relatively simple” process and may consist of providing data, for example through an online form. Identity verification should rely on documents or reliable sources, not on maximizing the number of documents. Extra documents do not increase security if they add no new information.
What to do: map which data is collected at each stage. Remove duplication. Set one point of entry for data.
Mistake 2: template KYC instead of a risk-based approach
Symptom: every client goes through the same procedure, whether it is a long-established Polish company with a transparent ownership structure or an entity in a higher-risk jurisdiction with a multi-layer holding structure.
Why it does not reduce risk: the RBA principle under AML Directive IV means not only tightening procedures when risk is higher, but also simplifying them when risk is lower. The commentary to the AML Act explicitly warns that poor implementation of processes may “disproportionately restrict access to products and services.” A template approach wastes resources on low-risk clients and prevents teams from focusing where risk is real.
What to do: calibrate procedures to three risk levels: low, standard, and elevated. For low-risk clients, simplify the form and shorten the path. For elevated-risk clients, expand the analysis and use additional sources.
Mistake 3: split accountability and no system integration
Symptom: sales collects data in a CRM, compliance works in Excel, and legal uses a separate database. No one sees the full picture. The client waits while a request moves between departments.
Why it does not reduce risk: scattered data makes patterns and anomalies harder to detect. Without a central client view, transaction monitoring relies on incomplete information. The European Banking Authority (EBA) confirms that identification and AML risk assessment are “the most accessible from a product and service perspective” for technology solutions, while also warning against excessive reliance on automation without critical review by an analyst.
What to do: integrate data in one system. Set a workflow that automatically passes data to the next stage. Keep risk decisions with a person: automate data retrieval, not decision-making.
Checklist: a five-step KYC process that does not involve the client at the outset
The model below lets you complete four of the five steps before first contacting the client. The fifth step, focused and minimal client involvement, comes only after you have a complete picture of what you know and what is missing.
| Step | What you do | Data source | Client involvement |
|---|---|---|---|
| 1. Automated risk pre-assessment | Retrieve identifying data from KRS/CEIDG. Establish legal form, industry (PKD), business status, and time in operation. Compare the industry with KOR 2023. | KRS, CEIDG, KOR 2023 | None |
| 2. Identify the beneficial owner | Check CRBR. Establish the beneficial owner’s citizenship and country of residence. Assess geographic risk (Basel AML Index, FATF lists). | CRBR, KRS, Basel AML Index | None |
| 3. Sanctions, PEP, and adverse media screening | Search EU, UN, and national sanctions lists. Check PEP databases. Verify VAT status on the whitelist. | Sanctions lists, PEP databases, VAT whitelist | None |
| 4. Preliminary risk profile | Based on steps 1 to 3, assign an initial risk level (low / standard / elevated). Determine what additional information is needed. | Results of steps 1 to 3 | None |
| 5. Focused client involvement | Ask the client only for data that cannot be retrieved from registers: the purpose of the relationship, planned transactions, source of funds when risk is elevated, and identity verification. | Client | Yes, but targeted questions, not a generic form |
Note on GDPR Article 22: if you make an automated refusal decision based on steps 1 to 4, for example rejecting a client because of a sanctions match, a natural person has the right to human intervention, to express their position, and to contest the decision. Definitive decisions rejecting a client for regulatory reasons should be made by a person, not solely by an algorithm.
How we can help your company organize its legal support for AML
Redesigning the KYC process requires two things: knowledge of the rules and knowledge of your business model. Off-the-shelf procedures are not enough. In Communication No. 36, GIIF expressly warns against mechanically using publicly available risk assessment templates without tailoring them.
Our AML support covers three areas:
- Audit and risk map. We analyze your current onboarding process, from first contact with a client to launching monitoring. We identify where you collect data that you could retrieve from registers, as well as duplicated steps and excessive document requirements.
- AML system implementation. We design procedures for your business model and organizational scale. We combine legal advice with AMLtrack, a tool that guides your team through each step, from pre-screening to ongoing monitoring.
- Ongoing support and obligation monitoring. We track changes in regulations, GIIF interpretations, and case law. We update procedures so you do not have to keep checking whether your process still complies with the law.
We treat AML as an operational process, not a set of procedures for a drawer. We remove unnecessary steps and focus on actions proportionate to your company’s risk and business model.
Legal support for AML: what to remember
The AML rules do not require onboarding to take weeks. Nor do they require clients to provide data you can retrieve yourself from KRS, CEIDG, CRBR, or the VAT whitelist. They do require your process to be proportionate to risk and documented.
If your onboarding is slowing sales, check three things: whether you are duplicating identification steps, whether you use a risk-based approach rather than template KYC, and whether your systems are integrated.
Redesigning a KYC process requires combining legal knowledge with business context.
Frequently asked questions
Can I retrieve a client’s data from KRS and CEIDG for AML purposes without their consent?
Yes. The AML Act requires obliged entities to identify clients and assess risk, which provides the legal basis for processing the data. KRS and CEIDG are public registers. Remember the information obligation under GDPR Article 14: you must inform the person whose data you retrieved from a register no later than your first communication with them or within one month of obtaining the data.
Is CRBR data enough to identify the beneficial owner?
Not always. CRBR contains information reported by the entities themselves, and its reliability depends on the reporting party’s diligence. The AML Act requires “reasonable measures” to verify the beneficial owner; a CRBR entry alone does not remove the need for that assessment. In structures involving foreign entities, the register may not show the full picture of the relationships. Treat CRBR as a starting point, not the only source.
Does a smaller obliged entity have to use the same KYC procedures as a bank?
No. The Regional Administrative Court judgment of August 10, 2021 (V SA/Wa 2574/21) confirms that customer due diligence measures must be proportionate to the nature and size of the entity. A sp. z o.o. that provides online loans does not have to use procedures as detailed as those of a systemically important bank. The RBA principle allows procedures to be simplified when risk is lower.
Can I automatically reject a client based on pre-screening results?
Subject to limitations. GDPR Article 22 gives a natural person the right not to be subject to decisions based solely on automated processing when the decision produces legal effects. If your system automatically rejects a client, for example because of a sanctions match, you must provide an opportunity for human intervention. Automate data retrieval; leave refusal decisions to an analyst.
How often should I update a client’s risk assessment?
GIIF Communication No. 45 states that a risk assessment should be updated during the relationship as new data is obtained. The institution’s overall risk assessment (Article 27 of the AML Act) should be updated at least every two years and approved by the management board. If an individual client’s risk rating increases, you must expand the customer due diligence measures applied.
What does it cost not to optimize the KYC process?
Costs are both direct, such as lost clients and longer time to revenue, and indirect, such as excess compliance resources and the risk of sanctions for inadequate procedures. Industry analyses indicate that about 70% of financial institutions experience customer attrition because onboarding is too complicated. On the other hand, administrative sanctions for AML violations can reach the low tens of millions of zlotys. Process optimization does not mean lowering standards. It means removing unnecessary steps and focusing resources where risk is real.
