Banking & Digital Banking Compliance in Poland

Poland is open to digital banking. Digital-only banks operate on the same licence as branch banks, and EU-authorised banks can enter through a passported branch or cross-border services. The rulebook is national law built on EU directives, supplemented by detailed supervisory positions from the KNF on remote onboarding.

The KNF licenses and supervises banks, including for anti-money laundering compliance. The General Inspector of Financial Information (GIIF), part of the Ministry of Finance, receives reports and also inspects. The Bank Guarantee Fund (BFG) runs deposit insurance.

The biggest obstacle for a new entrant is the licence itself: at least EUR 5 million in founders' capital, a three-year business plan, fit and proper management and, for a remote-first model, an onboarding process that meets the KNF's documented expectations for video, biometric and electronic-ID verification.

1. Who regulates this sector

2. Licensing and authorisation

Under the Banking Law (Prawo bankowe, Act of 29 August 1997, consolidated text Dz.U. 2026 poz. 38), a domestic bank needs two KNF decisions: a permit to establish the bank (Art. 30 and 34) and a permit to start operating (Art. 36). App-only banks use the same permits.

Capital

Founders' capital of at least the złoty equivalent of EUR 5 million, or EUR 1 million for a cooperative bank joining an association, paid in cash in złoty before registration (Art. 32).

People and plan

Fit and proper founders and board members and a business plan covering at least three years (Art. 30(1)); certain board members must know Polish unless the KNF waives it.

EU passport

A branch of a credit institution authorised in another EU state may start business two months after the KNF receives the home supervisor's notification (Art. 48l).

Non-EU banks

A new KNF authorisation regime for branches of non-EU banks, with class 1 and class 2 branches, applies from 11 January 2027 [Adopted, effective 11 Jan 2027] (Act of 31 July 2026, Dz.U. 2026 poz. 1206).

Taking deposits without a permit, or using the words "bank" or "kasa" in a business name in breach of the Act, is a criminal offence punishable by a fine of up to PLN 20,000,000 and imprisonment of up to five years (Art. 171). Deposits at Polish banks are guaranteed by the BFG up to the złoty equivalent of EUR 100,000 per depositor per bank (Act of 10 June 2016 on the BFG, Art. 24, consolidated text Dz.U. 2026 poz. 620).

3. AML, KYC and customer due diligence

Domestic banks, branches of EU credit institutions and branches of foreign banks are obliged institutions under Art. 2(1)(1) of the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (the AML Act, consolidated text Dz.U. 2025 poz. 644). Every bank must document a business-wide risk assessment and apply customer due diligence (CDD) in proportion to the risk it identifies (Art. 27 and 33).

When CDD applies

CDD is required when a business relationship is established; for an occasional transaction of EUR 15,000 or more (single or linked); for a transfer of funds above EUR 1,000; whenever money laundering or terrorist financing is suspected; and whenever the bank doubts previously obtained identification data (Art. 35(1)). It must be reapplied when a customer's circumstances or beneficial owners change (Art. 35(2)).

What CDD consists of

CDD covers verifying the customer and any representative; identifying beneficial owners and the ownership structure; understanding the purpose of the relationship; and ongoing monitoring, including source of funds where justified (Art. 34). If CDD cannot be completed, the bank must not open the relationship, must not execute transactions through the account and must terminate an existing relationship, then consider whether to report (Art. 41).

Enhanced due diligence

Enhanced measures apply in higher-risk cases, including private banking, products that favour anonymity, links to high-risk third countries and onboarding without the customer being physically present unless that risk is mitigated through electronic identification or trust services under the eIDAS Regulation (Art. 43(2)). Politically exposed persons (Art. 46) and cross-border correspondent relationships with respondents from outside the EU (Art. 45) always require enhanced measures.

Beneficial ownership

When onboarding an entity required to register beneficial owners, the bank must obtain confirmation of registration or an extract from the CRBR or the equivalent register of another EU state (Art. 39(1a)), but must not rely solely on the register (Art. 37(3)).

Reporting and retention

Banks must freeze assets of persons on GIIF's terrorism-related lists (Art. 117 and 118); EU sanctions apply directly.

4. Identity verification and onboarding

For an individual, the bank must record the full name, citizenship, PESEL national identification number (or date and country of birth where no PESEL exists), the series and number of the identity document, the residential address where known, and business name, tax number (NIP) and address for sole traders (AML Act, Art. 36(1)). Verification means confirming those data against an identity document, an up-to-date register extract, or other reliable and independent documents, data or information, including electronic identification means and trust services under the eIDAS Regulation where available (Art. 37(1)). Verification precedes the relationship, but may finish during onboarding where risk is low (Art. 39).

The KNF has set out how it expects this to work remotely in two positions. Its video verification position of 5 June 2019 treats eIDAS electronic identification and qualified electronic signatures as the most reliable remote tools. Where a bank uses video calls instead, it expects:

• at least partial involvement of a bank employee;
• the identity card shown to the camera from several angles;
• checks against the registers of lost and stolen documents, the PESEL register and sanctions lists;
• a one-time SMS code read back during the call;
• archiving of the full recording;
• as an additional measure, a first transfer from the customer's account at another obliged institution, used only as supporting evidence.

The KNF's remote onboarding position of 29 September 2023 applies to all supervised institutions and incorporates the European Banking Authority's remote onboarding guidelines (EBA/GL/2022/15). For unassisted flows it expects:

• photos and video captured during the live session;
• a liveness check, either active (the customer performs an action) or passive;
• strong and reliable algorithms matching the face to the document photo;
• use of identity card chip data where the device and access allow it;
• checks of document security features;
• controls against spoofed IP addresses and VPNs.

An eIDAS-notified electronic ID at substantial or high assurance, or qualified trust services, is treated as meeting these expectations. Where data quality is insufficient, the bank should restart or move the customer to in-person verification.

A bank may rely on CDD performed by another obliged institution or an equivalent supervised entity elsewhere, provided it can obtain the documents on request, but it remains responsible (Art. 47). It may also outsource CDD under a written agreement to an agent treated as part of the bank, again without shifting liability (Art. 48). Under the Banking Law, a bank's liability to customers for an outsourced provider's failures cannot be excluded or limited (Art. 6b(2)).

5. Digital channels: what's different

Bottom line: the legal CDD duties are the same online and in a branch, but remote onboarding is a statutory higher-risk factor unless the bank uses EU-recognised electronic ID or trust services, and the KNF expects specific liveness, recording and anti-spoofing controls when it does not.

Electronic ID lowers the risk classification

Art. 43(2)(7) of the AML Act lists non-face-to-face onboarding as a higher-risk indicator only where the risk is not otherwise mitigated, naming eIDAS electronic identification and trust services as the mitigants. Both KNF positions say that where these are not used, the bank should consider enhanced measures and treat the remote channel as a distribution-channel risk factor in its business-wide assessment.

Assisted video sessions

For staff-assisted video, the 2023 KNF position expects trained staff following a call script, a random sequence of customer actions and random assignment of the employee to prevent collusion; the 2019 position adds checks for coercion, intoxication or a third person in the room.

Strong customer authentication after onboarding

Once the account is open, the Payment Services Act (Dz.U. 2026 poz. 623, Art. 32i) requires strong customer authentication when the customer accesses the account online, initiates an electronic payment, or performs any remote action that may carry a fraud risk. Remote payments must use authentication dynamically linked to the amount and payee.

What is changing

The EU Anti-Money Laundering Regulation (EU) 2024/1624 [Adopted, applies from 10 Jul 2027] states in its recitals that eIDAS electronic identification should be accepted and can lower risk to standard or low.

6. Data protection and biometrics

The GDPR applies directly, supplemented by the Polish Act of 10 May 2018 on the Protection of Personal Data. For onboarding, the AML Act provides the legal basis for processing information from identity documents and making copies of them (Art. 34(4)), and requires the bank to inform the customer about this processing before the relationship begins (Art. 34(5)).

Biometric data is treated differently. In a statement published on 30 April 2024, the President of UODO took the view that existing sector law does not provide a legal basis for financial institutions to process biometric data, so explicit consent under Art. 9(2)(a) GDPR is the only available basis. UODO also said that:

• biometric verification should not be the primary or only method of verifying identity;
• an alternative method must be offered to customers who refuse consent;
• the purpose must be stated at the point of consent;
• a data protection impact assessment should precede deployment.

UODO reached this view on behavioural biometrics but stated it for biometric verification by financial institutions generally, so a face-match flow needs explicit consent plus a non-biometric route.

The KNF expects vendors storing onboarding images and videos to keep only necessary data, for no longer than the AML retention period, with logged access.

7. Sector-specific obligations

Banking secrecy

Everything a bank learns about a banking transaction during negotiation, conclusion and performance of the contract is covered by banking secrecy (Banking Law, Art. 104). Unauthorised disclosure is punishable by a fine of up to PLN 1,000,000 and imprisonment (Art. 171(5)).

Outsourcing and third parties

Banks may entrust intermediaries with activities such as concluding account agreements under a written contract (Art. 6a). They must notify the KNF before outsourcing to providers outside the EU (Art. 6d). For onboarding vendors, the KNF also expects a documented risk assessment, a clear contractual split of duties and monitoring by the AML compliance officer.

Internal AML procedures

The KNF's position of 19 March 2026 sets out what internal AML procedures must cover and requires senior management approval of each version; procedure deficiencies made up 19.39% of AML irregularities the KNF found in 2024.

8. Risk indicators and red flags

Banking and remote onboarding red flags (AML Act, KNF, GIIF)

• Straw-person accounts: account opened remotely for someone unaware of its purpose, or under a third party's direction (KNF 2019).
• Coached applicant: another person present or prompting during video verification, or the session paused so the customer leaves the camera.
• Location masking: device location hidden behind a VPN or spoofed IP address during onboarding (KNF 2023).
• Unexplained third-party funding: transactions for the customer's benefit ordered by unknown or unconnected third parties (AML Act, Art. 43(2)(8)).
• Shell company chains: companies with nominee owners from other countries, accounts abroad, and generic consulting or marketing payment descriptions (GIIF 2025 report).
• Fictitious loans and invoices: repeated transfers between related companies labelled as loans or invoice payments with no economic rationale (GIIF 2025 report).
• Fraud proceeds: fraud, including investment fraud, phishing and impersonation, was the most common predicate offence in foreign requests to GIIF in 2025 (GIIF 2025 report).

9. Enforcement and penalties

The KNF imposes AML penalties on the banks it supervises; GIIF inspects and can also impose penalties (AML Act, Art. 151). Available sanctions include publication of the breach, an order to cease specific activities, withdrawal of the licence, a ban of up to one year on the responsible manager, and fines (Art. 150(1)).

Fines reflect the gravity and duration of the breach, financial capacity, gains, third-party losses, cooperation and previous breaches (Art. 150(4)); GIIF publishes final decisions.

In a decision published on 13 June 2025, the KNF fined Credit Agricole Bank Polska S.A. PLN 1,000,000 in total for:

• an inadequate business-wide risk assessment;
• failing to establish the ownership and control structure of corporate customers;
• failing to monitor transactions against the customer's profile;
• failing to keep CDD information up to date.

In a decision published in October 2025, the KNF fined mBank S.A. (brokerage unit) PLN 1,390,000 for, among other breaches, not recording customers' PESEL numbers and countries of birth, failing to identify beneficial owners, and not documenting CDD.

10. Recent changes and what to watch

• 10 July 2027: EU Anti-Money Laundering Regulation (EU) 2024/1624 [Adopted, applies from 10 Jul 2027]. It replaces most of the national CDD rulebook with directly applicable EU rules; onboarding flows built on the AML Act will need to be mapped to it.
• 29 September 2026: Act of 31 July 2026 amending the Banking Law (Dz.U. 2026 poz. 1206), implementing the EU's Capital Requirements Directive VI [Partly in force]. It raises fines for unauthorised acquisitions of bank shares (now up to 10% of annual net turnover for companies) and introduces the non-EU branch regime from 11 January 2027.
• 28 September 2026: government bill amending the AML Act (Sejm print no. 3163) [Bill, not enacted]. It would: require banks to register on GIIF's new reporting system by 14 January 2027, with reports moving to it from April 2027; require new products and channels to be risk-assessed before launch; require banks to document their attempts to apply CDD and any failure to complete it; limit public access to the beneficial ownership register to people with a legitimate interest. Its proposed main start date is 1 January 2027.
• 19 March 2026: KNF position on internal AML procedures [In force]. Banks should review their procedures against it now; the KNF says it may check implementation in inspections.
• 29 November 2025: Act of 25 July 2025 amending the Banking Law (Dz.U. 2025 poz. 1191) [In force]. Banks must check the PESEL register to confirm whether the holder is alive 5 years after the last instruction on an account.

11. What this means for identity verification

• Documents and data: capture the full Art. 36 data set, including PESEL (or date and country of birth) and the document series and number; missing PESEL data has already led to a KNF fine.
• Remote methods: offer eIDAS-notified electronic ID or qualified trust services where available, because these remove the statutory higher-risk factor.
• Document-and-selfie flows: build in liveness, strong face-matching, chip reading where possible and anti-spoofing controls.
• Biometrics: treat biometric verification as consent-based and optional, with a non-biometric route such as staff-assisted video or electronic ID.
• Evidence: keep images, video and audio, time-stamped and readable for later review, for 5 years after the relationship ends.
• Re-verification: repeat CDD on changes in customer or ownership data, doubts or suspicion.
• Business customers: verify beneficial owners independently of the CRBR extract, and record any discrepancies.