Poland

The General Inspector of Financial Information (GIIF), part of the Ministry of Finance, is the financial intelligence unit: it receives threshold and suspicious activity reports and can inspect any obliged institution. The Polish Financial Supervision Authority (KNF) inspects and penalises the banks, payment firms and life insurers it supervises, and the National Revenue Administration controls gambling operators. The EU Anti-Money Laundering Regulation applies directly from 10 July 2027.

Yes. The AML Act permits remote onboarding but treats a customer who is not physically present as higher risk unless the firm uses electronic identification or an eIDAS trust service. Where neither is used, the KNF expects document authenticity checks, face matching and, without a human agent, liveness detection. Telecom operators instead choose from six statutory electronic routes, and telehealth providers may confirm identity from data the patient sends.

Not as of October 2026. Poland has not passed the law designating a competent authority under the EU MiCA Regulation, so no Polish crypto-asset service licence can be issued. Since 2 July 2026, an entry in the old virtual currency register no longer allows a firm to provide crypto services. Polish customers can be served by providers authorised in another EU country that have notified their home regulator.

For financial institutions, yes. In April 2024 the Personal Data Protection Office (UODO) said financial sector law gives no legal basis for biometric verification, so explicit consent is the only basis. Biometrics should not be the only method, customers who refuse need an alternative route, and an impact assessment should come first. In every sector, face matching processes special-category data under GDPR Article 9.

Telecom operators, healthcare providers, hotels, tour operators, public bodies and non-life insurers are not obliged institutions. Online shops and marketplaces fall in only if they accept or make cash payments for goods of EUR 10,000 or more, and currency exchange is covered. Their identity duties come from sector law instead, such as subscriber registration, patient eligibility rules and marketplace seller checks under the EU Digital Services Act.