eCommerce & Marketplaces Compliance in Poland

Poland is open to online retail and marketplace businesses, domestic and foreign, without sector licensing. The obligations sit in consumer, platform, tax and product-specific law rather than in a licensing regime: the Office of Competition and Consumer Protection (UOKiK) enforces consumer law and, from November 2026, the marketplace provisions of the DSA; the President of the Office of Electronic Communications (UKE) is the national Digital Services Coordinator; and the Head of the National Revenue Administration (KAS) receives platform seller reports.

The biggest obstacle for a new marketplace is operational rather than legal: it must build a seller onboarding flow that collects and verifies business identity data before listing, stores it securely, feeds annual tax reporting and can suspend sellers quickly, while staying within data protection limits.

1. Who regulates this sector

All licensing and supervision is national; Poland has no regional regimes for online trade.

Local authorities issue alcohol retail permits, and the Trade Inspection carries out product checks; both sit outside the scope of this briefing.

2. Licensing and authorisation

Operating an online shop or marketplace requires no sector licence. A Polish business registers in the ordinary company or sole-trader registers; a foreign marketplace can serve Polish consumers from another EU member state under the country-of-origin rules of the DSA and the e-commerce framework.

Authorisation becomes relevant in four situations:

Medicines

Only pharmacies and pharmacy points may sell non-prescription medicines by mail order, after notifying the provincial pharmaceutical inspector at least 14 days before starting (Pharmaceutical Law, art. 68(3)–(3c)).

Alcohol

Retail sale requires a municipal permit tied to the place named in it; the Sejm passed an amending bill on 8 October 2026 that is still before Parliament [Bill, not enacted].

Tobacco and nicotine

Distance sale, including cross-border distance sale, of tobacco products, e-cigarettes and refill containers and nicotine pouches is prohibited outright, so no online authorisation exists (Tobacco Act, art. 7f).

Payments

A marketplace that holds or transfers buyers' money for sellers may need a payment services authorisation from the financial supervisor; most use a licensed payment provider instead.

Non-EU platform operators that choose Poland for DAC7 purposes must register with the Head of KAS no later than the day they start operating as a platform operator; KAS assigns an operator number within 30 days.

3. AML, KYC and customer due diligence

E-commerce businesses and marketplaces are not obliged institutions under the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing as such. The Act reaches them through a single activity test: an entrepreneur becomes an obliged institution to the extent that it accepts or makes payments for goods in cash of EUR 10,000 or more, whether in one operation or several that appear linked (art. 2(1)(23)). Card, transfer and wallet payments do not meet the test, so a purely online seller is normally outside it.

Where the test is met, the trader must:

• apply customer due diligence to each such cash transaction (art. 35(1)(3)): identify the customer (for an individual: name, citizenship, PESEL number or date and country of birth, identity document series and number) and verify the data against an identity document or another reliable, independent source, including electronic identification means and trust services under eIDAS (arts. 36–37);
• identify beneficial owners of corporate buyers, without relying solely on the Central Register of Beneficial Owners (art. 37(3));
• apply enhanced measures to higher-risk cases, including politically exposed persons and links to high-risk third countries (arts. 43–46);
• report cash received or paid above EUR 15,000 to GIIF within 7 days (art. 72), and report suspicions without delay and no later than 2 business days after confirming them (art. 74);
• keep due diligence records and transaction evidence for 5 years (art. 49).

The Act treats non-face-to-face relationships as a possible higher-risk factor unless the risk is reduced, including by using electronic identification means and trust services (art. 43(2)(7)).

[Adopted, applies 10 Jul 2027] EU Regulation 2024/1624 (the AML Regulation) applies from 10 July 2027 and caps business cash payments at EUR 10,000 across the EU. A government bill amending the Polish AML Act (Sejm print 3163) had its first reading on 9 October 2026 [Bill, not enacted].

4. Identity verification and onboarding

In this sector the identity burden falls on sellers, not buyers. Under DSA article 30, a provider of an online platform that lets consumers conclude distance contracts with traders may let a trader promote or offer products to consumers in the EU only after obtaining, where applicable:

• the trader's name, address, telephone number and email address;
• a copy of the trader's identity document or another electronic identification as defined in the eIDAS Regulation;
• the trader's payment account details;
• the trade register and registration number, where the trader is registered;
• a self-certification that the trader will offer only products and services that comply with EU law.

The platform must make best efforts to assess whether the information is reliable and complete before allowing the trader to list, using freely accessible official databases or online interfaces, and must suspend a trader who fails to correct inaccurate data. Data must be stored securely for six months after the relationship ends, and the trader's name and contact details, register details and self-certification must be shown to buyers. Micro and small enterprises are exempt from this section of the DSA unless they are very large platforms.

Polish consumer law adds a status check: before a consumer is bound by a contract on an online marketplace, the operator must tell the consumer whether the third party is a trader, based on that party's declaration, and that consumer law does not apply if it is not (Consumer Rights Act, art. 12a).

Tax law layers a second set of seller data on top. Under DAC7, implemented in Division IIIA of the Act of 9 March 2017 on the Exchange of Tax Information with Other States, the reporting platform operator collects each seller's name, address, tax identification number (such as NIP or PESEL), VAT number, date of birth or business register number, country of residence and payment account identifier, verifies them and determines tax residence. A seller verified through a government electronic identification service must still be reported in full.

No Polish rule specifies a liveness standard, biometric method or identity assurance level for marketplace seller checks. Age verification of buyers is required only where product rules demand it (section 7).

5. Digital channels: what's different

Bottom line: the biggest difference is that a marketplace must verify the identity of every business seller before it can sell to consumers, an obligation with no equivalent for a physical shop or market; age-restricted products are also treated more strictly online.

Seller verification is an online-only duty

DSA article 30 applies only to online platforms allowing consumers to conclude distance contracts with traders. From 6 November 2026 UOKiK enforces it in Poland, with administrative fines of up to 6% of worldwide turnover for breaches, including of article 30 (Act on Providing Services by Electronic Means, art. 22zzn, as amended by Dz.U. 2026 poz. 1296) [Adopted, effective 6 Nov 2026].

Electronic identification is accepted as evidence

DSA article 30 accepts an electronic identification under the eIDAS Regulation in place of a copy of an identity document, and the AML Act lists electronic identification means and trust services among the reliable sources for verification (art. 37(1)). Polish sellers can therefore be onboarded with Polish national electronic identity schemes as an alternative to document capture.

Age-restricted goods

The tobacco and nicotine ban removes the online channel entirely. For alcohol, the prohibition on sale to under-18s applies in every channel (Act on Upbringing in Sobriety, art. 15), but the law does not prescribe a remote age-check method. The amending bill passed by the Sejm on 8 October 2026 addresses alcohol retail and is before the Senate stage [Bill, not enacted]; its final wording on distance sales should be checked once published.

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) applies directly, supplemented by the Act of 10 May 2018 on the Protection of Personal Data and supervised by UODO. For seller onboarding, the legal basis is compliance with a legal obligation: DSA article 30 for trader data and the DAC7 provisions for tax data, which define both what may be collected and, for DSA data, how long it may be kept (six months after the relationship ends). Collecting more than these lists require, such as a selfie, needs its own justification.

Biometric data used to identify a person is special category data under GDPR article 9. A marketplace that adds face matching or liveness checks to seller verification goes beyond what DSA article 30 requires and must therefore rely on an article 9 exception, in practice explicit consent with a non-biometric alternative, and must run a data protection impact assessment. Obliged institutions under the AML Act may process identity document data and make copies of them for due diligence (art. 34(4)) and must inform customers of this processing before the relationship starts (art. 34(5)).

7. Sector-specific obligations

Platform tax reporting (DAC7)

Platform operators that, under a contract, let sellers sell goods, provide personal services or rent property or means of transport must perform due diligence on active sellers and report them to the Head of KAS by the end of the month following the calendar-year reporting period, so by 31 January. Sellers of goods with fewer than 30 sales and no more than EUR 2,000 in consideration in the year are excluded. Classified-advertisement sites that do not know the number and value of transactions, and online shops selling only in their own name, do not report. If a seller withholds data, the operator must first withhold payouts and, if that is not possible, block the seller's further activity. Reporting covers sellers resident in EU member states and in jurisdictions listed annually in the Monitor Polski, and covers activity from 1 January 2023.

Consumer information on marketplaces

Besides the trader-status disclosure, the marketplace operator must explain the main parameters that determine the ranking of offers and how obligations under the contract are split between the seller and the platform (Consumer Rights Act, art. 12a). Online shops must state delivery restrictions and accepted payment methods at the start of the ordering process at the latest (art. 18), and the order button must be labelled with an unambiguous phrase such as "zamówienie z obowiązkiem zapłaty" ("order with obligation to pay") or the contract is not concluded (art. 17).

Online sale of medicines

Mail-order pharmacies are entered in the national register of pharmacy permits with their website address, and age-restricted non-prescription products may not be sold by mail order (Pharmaceutical Law, art. 68(3)–(3d)).

8. Risk indicators and red flags

E-commerce is not an AML sector in Poland, so these are fraud and identity-abuse indicators drawn from the seller-verification and reporting duties above.

Marketplace seller risk indicators

• Mismatched payout account: the payment account holder differs from the verified trader.
• Unverifiable register entry: register number absent from, or inconsistent with, the official register.
• Data refusal: seller declines DAC7 data, triggering a mandatory payout hold.
• Private seller at trader scale: a "private" account exceeding 30 sales or EUR 2,000 a year.
• Restricted products: listings of tobacco, e-cigarettes or nicotine pouches, which may not be sold at a distance.
• Unregistered pharmacy: medicines offered by a seller not in the pharmacy register.
• Large cash requests: buyers asking to pay EUR 10,000 or more in cash, bringing AML duties into play.

9. Enforcement and penalties

UOKiK has used its powers against marketplace operators. In decision DOK-3/2022 of 29 December 2022, it found that Allegro had abused its dominant position by favouring its own retail sales on the Allegro.pl marketplace and imposed a fine of PLN 206,169,786. Decisions of the UOKiK President can be appealed to the Court of Competition and Consumer Protection.

10. Recent changes and what to watch

• 8 October 2026, bill on blocking illegal online content (Sejm print 2693) [Bill, not enacted]: passed by the Sejm, Senate position adopted 13 October; it would let authorities order access to illegal content, including illegal sale of goods, to be disabled.
• 8 October 2026, amendment to the Act on Upbringing in Sobriety (Sejm print 2007) [Bill, not enacted]: passed by the Sejm; online alcohol sellers should check its final text on distance sales.
• 9 October 2026, government bill amending the AML Act (Sejm print 3163) [Bill, not enacted]: first reading held; relevant to traders that accept large cash payments.
• 6 October 2026, Act of 4 September 2026 enforcing the DSA (Dz.U. 2026 poz. 1296) [Adopted, effective 6 Nov 2026]: UOKiK gains powers and fines over marketplace seller checks.
• 15 December 2025, KAS guidance on DAC7 updated [In force]: confirms that sellers registered before 2023 must be reported and that payout holds come before account blocking.
• 10 July 2027, EU AML Regulation 2024/1624 [Adopted, applies 10 Jul 2027]: EUR 10,000 cap on business cash payments across the EU.

11. What this means for identity verification

Seller onboarding needs a know-your-business-customer flow that captures the DSA article 30 fields, an identity document copy or an eIDAS electronic identification for the person behind the seller, a payment account and a register number, and checks them against official registers before the first listing. The same record should hold the DAC7 fields (tax identification number, date of birth or register number, residence) so that one verification serves both regimes.

Biometric checks are not required by Polish or EU marketplace rules; if used to strengthen document verification, they need explicit consent and an alternative route. Retention differs by regime: six months after the end of the relationship for DSA data, and five years for AML records where the cash test applies. Re-verification is triggered by inaccurate or incomplete trader data, changes in payout accounts and sellers crossing the DAC7 thresholds. Buyer-side age checks are needed for medicines and alcohol, while tobacco and nicotine products must not be listed at all.