iGaming & Gambling Compliance in Poland

Poland is open to licensed online sports betting and closed to private online casinos, poker and slots. The Gambling Act reserves online gambling, other than mutual betting and promotional lotteries, to a state monopoly. Licensed bookmakers can operate online, on a Polish domain, with servers in the EU or the European Economic Area (EEA).

The Minister of Finance grants permits and approves each operator's rules. The National Revenue Administration enforces the Gambling Act and runs the register of blocked domains. The General Inspector of Financial Information supervises AML compliance.

The biggest obstacle for a new entrant is the licence itself. It requires a Polish legal presence, substantial capital and security, fit-and-proper vetting by state security and AML authorities, and a decision period of up to six months. All of this buys a market limited to betting.

1. Who regulates this sector

The state monopoly is exercised by the minister responsible for state assets through wholly state-owned companies (Gambling Act, art. 5(2)).

2. Licensing and authorisation

Gambling in Poland is legal only under a concession, a permit or a notification (Ustawa o grach hazardowych [Gambling Act] of 19 November 2009, consolidated text Dz.U. 2025 poz. 595, art. 3). Online gambling, except mutual betting and promotional lotteries, is a state monopoly (art. 5(1b)). The only online route for a private operator is a permit for mutual betting: totalisator betting and bookmaking on sports and other events, including virtual sports (art. 2(2); Ministry of Finance permit guidance, January 2026).

Online betting permit

Who can apply

A joint-stock company or limited liability company with its seat in Poland. An EU/EEA company may operate through a branch or a Polish-resident representative (art. 6(5), 7a).

Capital and security

Share capital of at least PLN 2,000,000 (art. 10(1)). Online betting also requires a PLN 480,000 financial security, as a bank or insurance guarantee or a cash deposit (art. 63(2a), 63(3)).

Term and timing

Six years, renewable once for six years (art. 49(2), 49(5)). The Minister decides within six months of the application (art. 40(1)).

Fees

Set as percentages of a statutory "base amount" linked to average pay: 2,000% for the permit, a further 2,000% for online betting, and 5,000% for each website (art. 69(1)(3), 70).

The application must include the website address and technical documentation, the planned age-verification rules, an expert opinion on the security of betting records, and documents showing the lawful source of capital and AML compliance (art. 36). Shareholders with 10% or more, board members and beneficial owners must have a clean record, and the Minister may consult the GIIF and security services (art. 11(2), 12). Each permit lists the specific websites the operator may use (art. 41(3), 43(1)(4)).

Land-based contrast

Casinos need a separate six-year concession for each venue, with share capital of at least PLN 4,000,000 and a PLN 1,200,000 security. Numbers are capped by population (art. 10(1), 15, 49(1), 63(1)). Betting shops sit under the same permit as websites.

3. AML, KYC and customer due diligence

Entities organising games of chance, mutual betting, card games and slot games are obliged institutions (Ustawa o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu [AML Act] of 1 March 2018, consolidated text Dz.U. 2025 poz. 644, art. 2(1)(20)).

When due diligence applies

Customer due diligence (CDD) applies when a business relationship is established (art. 35(1)(1)). The Act defines a business relationship as one that shows durability when it is established (art. 2(2)(20)). Outside a relationship, CDD applies when stakes are placed or winnings collected of EUR 2,000 or more, including linked operations (art. 35(1)(4)). It also applies on any suspicion of money laundering or doubt about earlier identification data (art. 35(1)(5)-(6)). Operators should document whether a player account is a business relationship, since that decides whether full CDD runs at account opening or at the EUR 2,000 trigger.

What due diligence includes

• Identification data: name, citizenship, PESEL number (or date and country of birth), the series and number of the identity document, and address where held (art. 36(1)).
• Verification: against an identity document, or other documents or information from a reliable and independent source, including electronic identification means and eIDAS trust services where available (art. 37(1)). It must be completed before the relationship or transaction (art. 39(1)), unless the risk is low and delay is needed for business continuity (art. 39(2)).
• Beneficial owners, purpose and monitoring, including source-of-funds checks where circumstances justify them (art. 34(1)).
• Enhanced due diligence in higher-risk cases (art. 43). Listed risk factors include non-face-to-face relationships not mitigated by electronic identification or trust services, and new delivery channels or technologies (art. 43(2)(7), (9)).

If CDD cannot be completed, the operator must refuse the relationship or transaction or end it, and consider a report (art. 41).

Reporting and records

Gambling operators must report to the GIIF every receipt or payout of funds, and every funds transfer, above EUR 15,000, within 7 days (art. 72(1), (5)). Suspicious activity reports are due without delay, and no later than 2 business days after the suspicion is confirmed (art. 74). A suspect transaction must be held for up to 24 hours after notification (art. 86). CDD records and transaction evidence are kept for 5 years from the end of the relationship or the occasional transaction (art. 49).

4. Identity verification and onboarding

Online: player account and age verification

Every online operator must adopt responsible-gaming rules, approved by the Minister of Finance. The rules must include a procedure to verify that players are 18 or over, and registration on a player account (or temporary player account) as a condition of starting and continuing play (Gambling Act, art. 15i(1)-(2)). The betting permit itself records the operator's age-verification rules (art. 43(1)(4)(b)). Only adults may take part in gambling (art. 27(2)). The Act prescribes no verification technology; the method is set in each operator's approved procedure and must meet the AML Act's reliability standard where CDD applies.

Identity data the operator must hold

Online operators archive, in real time, the data needed to identify each participant (art. 15d(3)). For betting, the Minister's regulation lists first name(s) and surname, residential and email address, login, pseudonym, connection data and the player's betting profile from account opening (Regulation of 18 May 2017 on archiving data of online gambling, Dz.U. 2017 poz. 1018, § 5(3)). Archives must be hash-chained and tamper-evident for 5 years (§ 2-3).

Land-based contrast

Casinos and bingo halls register every guest on entry. Staff check an identity document and record the name, document type and number, PESEL number (or date of birth), address and citizenship, kept for 3 years (art. 15a). Betting-shop staff may demand identification only when a bettor's age is in doubt (art. 27(4)).

An operator may rely on another obliged institution or outsource CDD under contract, but remains liable (AML Act, art. 47-48).

5. Digital channels: what's different

Bottom line: online, only betting can be licensed, every player must hold a verified 18+ account before play, and the operator must use a .pl domain, EU/EEA servers and regulated payment providers. Land-based venues instead check identity at the door.

Domain, server and data access rules

An online operator may use only a website whose national top-level domain is assigned to Polish websites. Its data-processing and archiving equipment must sit in the EU or EEA, and KAS must have remote read and copy access to the archive (Gambling Act, art. 15d(1)-(5)). The law contains no explicit geolocation duty. Market access is instead controlled by the domain rule and by blocking unlicensed sites.

Payments only through regulated providers

Licensed online operators must route all game-related payment transactions through payment service providers listed in the Payment Services Act, such as banks, payment institutions and e-money institutions (art. 15e).

Remote onboarding as a risk factor

The AML Act does not forbid remote onboarding. It lists non-face-to-face relationships as a higher-risk factor where the risk is not otherwise mitigated, naming electronic identification means and eIDAS trust services as mitigants (art. 43(2)(7)). Verification may draw on electronic identification where available (art. 37(1)).

Pending changes

The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027 [Adopted, applies 10 Jul 2027]. A government bill amending the AML Act (Sejm print 3163) passed first reading on 9 October 2026 [Bill, not enacted].

6. Data protection and biometrics

The EU General Data Protection Regulation (GDPR) applies directly and is supervised by the UODO. For onboarding, the key rule is that processing biometric data to uniquely identify a person is prohibited unless an Article 9(2) exception applies, for example explicit consent for specified purposes (Regulation (EU) 2016/679, art. 9, text published by UODO). Operators using face match should record the exception relied on.

The AML Act allows obliged institutions to process the information in customers' identity documents and to copy them for CDD (art. 34(4)). Customers must be told about this processing before the relationship begins (art. 34(5)). Retention is set by sector law: 5 years for AML records (art. 49) and archived online gaming data (Gambling Act, art. 15d(7)), after which archived data must be deleted.

7. Sector-specific obligations

Blocking of unlicensed operators

The Minister of Finance keeps a public Register of Domains Used to Offer Gambling Contrary to the Act, covering domains used to offer or promote illegal gambling to users in Poland (Gambling Act, art. 15f). Internet access providers must block listed domains within 48 hours and redirect users to a Ministry warning page. Payment service providers may not provide payment services on listed websites and must stop within 30 days of the entry (art. 15g). By December 2025 nearly 52,000 domains had been entered (Ministry of Finance reply to interpellation 14042, 29 December 2025).

Responsible gaming and advertising

Approved responsible-gaming rules must provide tools for players to control their activity and must prevent play once the account balance is exhausted (art. 15i(1)(4)-(5)). The Act does not establish a national self-exclusion register. Advertising is permitted only for licensed betting and is restricted. It may not target or feature minors. It may not run on television or radio between 6:00 and 22:00, outside sponsored sports broadcasts. It must carry warnings about illegal gambling and gambling risk (art. 29b).

Gaming tax and winnings tax

Betting operators pay gaming tax of 12% of stakes, or 2.5% for animal-racing-only permits. Casino-type games are taxed at 50% of gross gaming revenue. Tax is settled monthly (art. 73-75). Operators must keep a register of paid winnings of PLN 2,280 or more, with the winner's identity data, for 5 years (art. 20(5)-(7)). For players, betting winnings above PLN 2,280 per win are subject to 10% flat income tax (Personal Income Tax Act, consolidated text Dz.U. 2026 poz. 592, art. 21(1)(6a), 30(1)(2)).

8. Risk indicators and red flags

The GIIF's 2023 national risk assessment rates mutual betting as a high money laundering threat and online gambling as a medium threat (National Risk Assessment 2023, Annex 2, section 9). It describes these typologies:

Gambling typologies identified by the GIIF

• Synthetic or stolen identities: accounts opened with false or stolen data, or taken over from another person.
• Stolen card funding: deposits from compromised payment cards, played through and withdrawn.
• Low-risk play: illicit funds wagered on low-volatility bets, then withdrawn as "winnings".
• Chip dumping: deliberately losing to a linked player to move value between accounts.
• Mixed funding rails: deposits via crypto-assets, anonymous prepaid cards or money transfers.
• Winnings as legitimacy: winning bet records used to explain criminal proceeds, sometimes with manipulated events.
• Purchase of winning tickets: buying others' winning coupons with illicit cash.
• Exit to crypto: "winnings" withdrawn by transfer or exchanged for virtual currency.

9. Enforcement and penalties

Gambling Act fines are imposed by heads of customs and tax offices (art. 89-90):

Organising gambling contrary to the Act is also a fiscal offence, punishable by a fine of up to 720 daily rates, up to 3 years' imprisonment, or both. Taking part in foreign gambling in Poland is punishable by a fine of up to 120 daily rates (Fiscal Penal Code, consolidated text Dz.U. 2025 poz. 633, art. 107). The Minister must revoke a permit for gross breaches or failure to demonstrate AML compliance (Gambling Act, art. 59(1)).

Under the AML Act, gambling operators face publication of the breach, cease orders, licence revocation, management bans and fines. Fines reach up to twice the benefit gained or loss avoided, or up to the equivalent of EUR 1,000,000 where that cannot be established (art. 150(1)-(2)). In a December 2025 reply to Parliament, the Ministry of Finance confirmed that the stake.com domain has been in the register since 30 March 2020. It also confirmed that KAS is pursuing proceedings against streamers who promoted that casino (interpellation 14042).

10. Recent changes and what to watch

• 10 July 2027 [Adopted, applies 10 Jul 2027]: EU Regulation 2024/1624 on AML becomes directly applicable, replacing parts of the national CDD rulebook.
• 18 February 2027 [Adopted, effective 18 Feb 2027]: Dz.U. 2026 poz. 176 repeals the requirement that gambling joint-stock companies issue only registered shares. Changes crossing each 10% ownership step must still be notified to the Minister within 7 days of court registration (art. 52).
• 11 January 2027 [Adopted, effective 11 Jan 2027]: Dz.U. 2026 poz. 1206 updates who may guarantee an operator's financial security, referring to third-country bank branches.
• 9 October 2026 [Bill, not enacted]: the government's AML Act amendment (Sejm print 3163) passed first reading. It proposes electronic reporting changes, wider GIIF control powers and new Central Register of Beneficial Owners access rules, mostly from 1 January 2027 if enacted.
• 15 January 2026 [In force]: amended casino tender regulation (Dz.U. 2025 poz. 1892), relevant only to land-based concessions.
• 4 December 2025 [Bill, not enacted]: an MPs' bill (Sejm print 2356) would add games for virtual goods bought with money to the definition of games of chance.

11. What this means for identity verification

• Verify before play, not before payout. A player account and a passed 18+ check are conditions of starting play online, so age assurance belongs at registration.
• Capture PESEL-ready data. AML identification uses PESEL (or date and country of birth for foreigners) plus identity-document series and number. The winnings register needs the same data for payouts of PLN 2,280 or more.
• Choose remote methods that reduce risk. Electronic identification and eIDAS trust services are named mitigants for non-face-to-face risk. Selfie flows need a GDPR Article 9 basis.
• Track the EUR 2,000 trigger across linked bets. Aggregate stakes and winnings so that linked operations trigger full CDD, and flag payments above EUR 15,000 for 7-day reporting.
• Keep evidence tamper-evident for 5 years. Online archives must be hash-chained and remotely accessible to KAS. CDD copies, including eID results, are kept 5 years after the relationship ends.