{"id":3885,"date":"2026-08-25T11:28:32","date_gmt":"2026-08-25T11:28:32","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3885"},"modified":"2026-10-23T11:24:07","modified_gmt":"2026-10-23T11:24:07","slug":"aml-kyc-onboarding-process","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/aml-kyc-onboarding-process\/","title":{"rendered":"AML Onboarding Delays Sales? Fix the Data Collection Process"},"content":{"rendered":"

If your company is an obliged entity, such as a fintech, a cryptocurrency exchange<\/a>, an accounting firm, or a real estate intermediary, you know the scenario: a prospective client wants to start working with you, but before you can sign a contract, they must provide a stack of documents, answer a dozen questions, and wait days or weeks for your compliance team\u2019s decision. Some clients drop out along the way. Others lose patience and go to a competitor.<\/p>\n

The problem is not the law. The Act of March 1, 2018 on Counteracting Money Laundering and the Financing of Terrorism<\/strong> (the AML Act) does not prescribe a specific sequence or timeline for a KYC procedure, or \u201cKnow Your Customer.\u201d It also does not require the client to provide data your team can retrieve independently from public registers.<\/p>\n

The problem is the process. More specifically, the order in which your organization has designed the collection of information about a client.<\/p>\n

This article explains which data needed for an AML risk assessment<\/strong><\/a> you can verify without the client, how to sequence checks so compliance runs in the background, and which three onboarding mistakes slow sales without reducing risk. At the end, you will find a checklist: a five-step KYC process that does not require involving the client at the outset.<\/p>\n

Key terms to know<\/h2>\n

Before we continue, let\u2019s clarify the terminology. The AML rules use terms that sound formal but have specific operational meanings.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Obliged entity<\/strong><\/td>\nA company required by the AML Act to apply anti-money laundering procedures, including banks, fintechs, exchanges, accounting firms, and real estate intermediaries.<\/td>\n<\/tr>\n
Customer due diligence measures<\/strong><\/td>\nFour required activities: identifying the client, identifying the beneficial owner, assessing the business relationship, and ongoing monitoring.<\/td>\n<\/tr>\n
KYC (Know Your Customer)<\/strong><\/a><\/td>\nThe process of identifying and verifying a client\u2019s identity. It includes collecting data, checking documents, and assessing risk.<\/td>\n<\/tr>\n
Beneficial owner<\/strong><\/td>\nA natural person who actually controls the client, for example, a shareholder with more than 25% of the shares or a person exercising effective influence over the entity\u2019s activities.<\/td>\n<\/tr>\n
Risk-based approach (RBA)<\/strong><\/td>\nThe principle that the intensity of KYC procedures should be proportionate to the level of risk: lower risk means simplified measures; higher risk means enhanced measures.<\/td>\n<\/tr>\n
CRBR<\/strong><\/td>\nCentral Register of Beneficial Owners<\/a>, a public, free database of people who control Polish entities.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why onboarding takes weeks when data is in public registers<\/h2>\n

Most obliged entities treat client onboarding as a linear process: the client submits an application, sales collects data, compliance verifies it, and then a decision is made. Each stage waits for the previous one. Each requires the client\u2019s involvement.<\/p>\n

Yet much of the information needed for an AML risk assessment is publicly available before the client fills out even one form.<\/p>\n

Public registers you can use without the client<\/h3>\n\n\n\n\n\n\n\n\n\n
Register<\/th>\nWhat it contains<\/th>\nWhat you can establish for AML purposes<\/th>\n<\/tr>\n<\/thead>\n
KRS<\/strong> (National Court Register)<\/td>\nCompany name, NIP, REGON, registered office, PKD activity codes, governing bodies, representation rules, insolvency proceedings<\/td>\nLegal form, industry, time in operation, management structure<\/td>\n<\/tr>\n
CEIDG<\/strong><\/td>\nFirst and last name, business name, NIP, REGON, address, PKD activity codes, business status, proxies<\/td>\nBusiness status, industry, registration history<\/td>\n<\/tr>\n
CRBR<\/strong><\/td>\nBeneficial owner\u2019s name, citizenship, country of residence, ownership percentage<\/td>\nOwnership structure, connections to higher-risk jurisdictions<\/td>\n<\/tr>\n
VAT whitelist<\/strong><\/td>\nActive VAT taxpayer status, registration history, bank accounts<\/td>\nTax credibility, history of removal from and restoration to the register<\/td>\n<\/tr>\n
EU\/UN sanctions lists<\/strong><\/td>\nEntities and individuals subject to sanctions<\/td>\nWhether the client or beneficial owner appears on sanctions lists<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

KRS data is covered by a presumption of accuracy<\/strong> in relation to third parties acting in good faith. CRBR is public and free. The VAT whitelist provides five years of registration history.<\/p>\n

Where delays come from<\/h3>\n

Onboarding delays have four sources:<\/p>\n

    \n
  1. Excessive internal rules.<\/strong> The AML Act uses open-ended terms such as \u201creasonable measures\u201d and \u201cdue diligence.\u201d Afraid of being accused of insufficient diligence, obliged entities expand their procedures beyond the statutory minimum. They ask for a current KRS extract even though the information is available online. They request extra documents \u201cjust in case.\u201d<\/li>\n
  2. Organizational silos.<\/strong> Sales, operations, compliance, and legal each handle separate stages in separate systems. Without a consistent workflow, the same data is collected repeatedly.<\/li>\n
  3. No integration with registers.<\/strong> Legacy systems do not communicate with KRS, CEIDG, or CRBR interfaces. Data that could be retrieved automatically is copied by hand.<\/li>\n
  4. Shifting the verification burden to the client.<\/strong> Instead of retrieving register data, the entity asks the client for documents confirming information that is already publicly available.<\/li>\n<\/ol>\n

    A judgment of the Regional Administrative Court in Warsaw dated August 10, 2021 (V SA\/Wa 2574\/21) confirms that identification activities and risk assessments must be proportionate to the nature and size of the obliged entity<\/strong>. A smaller fintech does not have to use procedures at the level of a systemically important bank.<\/p>\n

    Contact us<\/a><\/p>\n

    Which AML risk criteria can you verify without the client?<\/h2>\n

    Article 33 of the AML Act requires an obliged entity to identify and assess client risk<\/a>, taking into account, among other things: the type of client, geographic area, products and services, the value of assets, and the purpose of the business relationship.<\/p>\n

    You can assess some of these criteria before the client provides any documents. Others require the client\u2019s direct involvement.<\/p>\n

    What you can check without the client<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Risk assessment criterion<\/th>\nData source<\/th>\nNotes<\/th>\n<\/tr>\n<\/thead>\n
    Client\u2019s legal form<\/td>\nKRS \/ CEIDG<\/td>\nSp. z o.o., S.A., foundation, sole proprietorship: each form has a different risk profile.<\/td>\n<\/tr>\n
    Industry (PKD codes)<\/td>\nKRS \/ CEIDG<\/td>\nCompare it with the 2023 National Risk Assessment (KOR 2023); some sectors carry higher risk.<\/td>\n<\/tr>\n
    Ownership structure<\/td>\nCRBR + KRS<\/td>\nCRBR identifies beneficial owners; KRS identifies shareholders and governing bodies.<\/td>\n<\/tr>\n
    Beneficial owner\u2019s country of residence<\/td>\nCRBR<\/td>\nThe owner\u2019s citizenship and country of residence inform the geographic risk check.<\/td>\n<\/tr>\n
    Geographic risk<\/td>\nBasel AML Index, FATF lists, EU lists<\/td>\nPoland scored 4.49<\/strong> in the 2025 Basel AML Index edition, a medium risk level.<\/td>\n<\/tr>\n
    VAT tax status<\/td>\nVAT whitelist<\/td>\nClients repeatedly removed from and restored to the register have a higher risk profile.<\/td>\n<\/tr>\n
    Sanctions screening<\/td>\nEU, UN, and national sanctions lists<\/td>\nCan be checked entirely without the client if you have identifying data.<\/td>\n<\/tr>\n
    PEP status (politically exposed person)<\/td>\nPEP databases<\/td>\nCan be checked without the client, although the client\u2019s declaration remains part of the documentation.<\/td>\n<\/tr>\n
    Time the entity has been operating<\/td>\nKRS \/ CEIDG<\/td>\nRegistration date: newly established entities may require a deeper analysis.<\/td>\n<\/tr>\n
    Insolvency or restructuring proceedings<\/td>\nKRS<\/td>\nEntries about proceedings are visible in the register.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    What you cannot establish without the client<\/h3>\n
      \n
    1. Purpose of the business relationship<\/strong>: the client must explain why they are establishing a relationship with your company.<\/li>\n
    2. Source of funds or assets<\/strong>: particularly in higher-risk cases, this requires a statement or documents from the client.<\/li>\n
    3. Expected transaction volume and structure<\/strong>: product-related information that cannot be obtained from registers.<\/li>\n
    4. Actual places of business<\/strong>: these may extend beyond the registered office shown in KRS.<\/li>\n
    5. Full identifying information for a natural person<\/strong>: PESEL, identity document series and number, and residential address.<\/li>\n
    6. Identity verification<\/strong>: requires presentation of a document or video verification.<\/li>\n<\/ol>\n

      Note the proportion: of ten criteria, only six require the client\u2019s direct involvement. Even so, most obliged entities start onboarding with a form where the client fills everything out from scratch.<\/p>\n

      How to sequence checks without blocking sales<\/h2>\n

      The AML Act does not prescribe a detailed sequence of actions. It only requires customer due diligence measures to be applied before<\/strong> establishing a business relationship. It also allows an exception: completing identity verification after<\/strong> the relationship starts if the risk was assessed as low and the client does not transact until verification is complete.<\/p>\n

      This flexibility lets you design a three-stage process, moving from what you check yourself to what you ask the client at the end.<\/p>\n

      Stage 1: pre-screening (before contacting the client)<\/h3>\n

      Goal: rule out clients subject to sanctions or entities that do not legally exist. Make an initial assessment of whether the client fits your institution\u2019s profile.<\/p>\n

      What you do:<\/p>\n

        \n
      1. Retrieve data from KRS or CEIDG using the company name or NIP.<\/li>\n
      2. Check CRBR to identify beneficial owners and their citizenship.<\/li>\n
      3. Screen sanctions and PEP status using available identifiers.<\/li>\n
      4. Verify VAT status on the whitelist.<\/li>\n
      5. Assess geographic risk based on the registered office country and the beneficial owner\u2019s residence.<\/li>\n<\/ol>\n

        At this stage, you do not involve the client. You do not send forms. You do not request documents.<\/p>\n

        GDPR limitation:<\/strong> If you obtain personal data from public registers, you must meet the information obligation toward the person whose data it is, no later than your first communication with them or within one month of obtaining the data (GDPR Article 14).<\/p>\n

        Stage 2: substantive KYC verification (with the client)<\/h3>\n

        Goal: fully identify and verify identity, establish the purpose of the relationship, and assess risk.<\/p>\n

        What you do:<\/p>\n

          \n
        1. Ask for data that cannot be retrieved from registers: the purpose of the relationship, planned transactions, and source of funds if risk is elevated.<\/li>\n
        2. Verify identity using an identity document, video verification, electronic ID, or trusted profile.<\/li>\n
        3. Obtain a declaration about PEP status.<\/li>\n
        4. Compare client-provided information with register data and record discrepancies.<\/li>\n<\/ol>\n

          At this stage, the client answers specific, targeted questions<\/strong>. They do not fill out a generic 30-field form when you could have completed 20 fields yourself.<\/p>\n

          Stage 3: completion (before or shortly after signing the contract)<\/h3>\n

          Goal: confirm identity through the chosen channel, sign documents, configure products, and launch monitoring.<\/p>\n

          At this stage, you no longer collect new data to meet AML requirements. The KYC process is complete.<\/p>\n

          KNF guidance allows two-stage activation of services<\/strong>: an initial stage with limited functionality and full activation after all verification steps are complete. This means the client can start using some services before the entire process is finished.<\/p>\n

          Three onboarding mistakes that slow sales without reducing risk<\/h2>\n

          Industry analyses indicate that about 70% of financial institutions<\/strong> experience customer attrition because onboarding procedures are too complicated and time-consuming. Here are the three most common mistakes behind it.<\/p>\n

          Mistake 1: excessive and duplicated identification steps<\/h3>\n

          Symptom: the client provides the same data several times, once to sales, once to compliance, and once to operations. The institution asks for documents beyond the requirements of Articles 36 and 37 of the AML Act, such as utility bills to confirm an address already shown on the identity document.<\/p>\n

          Why it does not reduce risk: GIIF explicitly says client identification is a \u201crelatively simple\u201d process and may consist of providing data, for example through an online form. Identity verification should rely on documents or reliable sources, not on maximizing the number of documents. Extra documents do not increase security if they add no new information.<\/p>\n

          What to do: map which data is collected at each stage. Remove duplication. Set one point of entry for data.<\/p>\n

          Mistake 2: template KYC instead of a risk-based approach<\/h3>\n

          Symptom: every client goes through the same procedure, whether it is a long-established Polish company with a transparent ownership structure or an entity in a higher-risk jurisdiction with a multi-layer holding structure.<\/p>\n

          Why it does not reduce risk: the RBA principle under AML Directive IV means not only tightening procedures when risk is higher, but also simplifying them when risk is lower<\/strong>. The commentary to the AML Act explicitly warns that poor implementation of processes may \u201cdisproportionately restrict access to products and services.\u201d A template approach wastes resources on low-risk clients and prevents teams from focusing where risk is real.<\/p>\n

          What to do: calibrate procedures to three risk levels: low, standard, and elevated. For low-risk clients, simplify the form and shorten the path. For elevated-risk clients, expand the analysis and use additional sources.<\/p>\n

          Mistake 3: split accountability and no system integration<\/h3>\n

          Symptom: sales collects data in a CRM, compliance works in Excel, and legal uses a separate database. No one sees the full picture. The client waits while a request moves between departments.<\/p>\n

          Why it does not reduce risk: scattered data makes patterns and anomalies harder to detect. Without a central client view, transaction monitoring relies on incomplete information. The European Banking Authority (EBA) confirms that identification and AML risk assessment are \u201cthe most accessible from a product and service perspective\u201d for technology solutions, while also warning against excessive reliance on automation without critical review by an analyst.<\/p>\n

          What to do: integrate data in one system. Set a workflow that automatically passes data to the next stage. Keep risk decisions with a person: automate data retrieval, not decision-making.<\/p>\n