Client verification for an accounting firm — compliant with the AML Act, with no extra work.
Client verification for an accounting firm — compliant with the AML Act, with no extra work.
Every accounting firm is an obliged entity, whatever its size. Before you sign the engagement you must identify the client, establish the beneficial owner, screen sanctions and PEP lists and assess risk. Enter a NIP — you get all of it in one report, ready for the client file.
- Sanctions: MSWiA, EU, OFAC
- KNF warnings
- Beneficial owners (CRBR)
- Financials and filings
- Bankruptcy, liquidation, KRZ
- VAT status and accounts
- Press coverage
- 0–100 risk score and PDF
Money back if the report cannot be generated
For companies: the first 2 reports free (in Polish)
Why an accounting firm is covered by the AML Act
The Polish Act of 1 March 2018 on counteracting money laundering and terrorist financing lists among obliged entities businesses that keep accounting books as a service (art. 2(1)(17)) and, since 2021, businesses whose main activity is keeping tax books, preparing returns and advising on them. There is no size threshold: a one-person firm with twenty clients has the same duties as a chain with several offices. The full list of categories is on the obliged entities page.
For the GIIF (Poland's financial intelligence unit) the question is not whether the firm "sees" suspicious transactions, but whether it has a procedure, applies customer due diligence and can document it.
Four duties that apply to every firm.
Due diligence measures are applied before establishing a business relationship (art. 35(1)(1)) — before the bookkeeping engagement is signed.
Manual verification of a new client, step by step.
KRS or CEIDG
A KRS extract or CEIDG entry: name, address, board, shareholders. Printed for the file.
CRBR
Look up the beneficial-owner filing. Compare with the KRS shareholder list — usually by eye.
White list and VIES
VAT status and bank accounts. For EU clients also the EU VAT number.
Sanctions lists
The MSWiA list, the EU list, OFAC — separately for the company, every board member, shareholder and owner.
Risk assessment card
An Excel sheet, a risk level, a signature. No proof of which list version was checked, or when.
That process takes 20–40 minutes per client and ends in a pile of printouts with no common identifier. At a GIIF inspection the first question is: on what basis was the risk level assigned, and how was the list screening documented.
What the report gives an accounting firm
- 18 sources in one run — KRS or CEIDG, REGON, the VAT white list, VIES, CRBR, sanctions lists (OpenSanctions incl. the MSWiA list, the EU list, OFAC SDN), KNF warnings, e-Sprawozdania financial statements, MSiG and KRZ, UOKiK, BDO, press, domain age. The report is usually ready in a minute, at most three.
- Every person screened — board, proxies, shareholders and owners from the CRBR. After the obliged-entity declaration at checkout the report also shows PEP and RCA status.
- CRBR owners and KRS shareholders side by side, with discrepancies marked and a draft discrepancy notice to the CRBR.
- A 0–100 score in five domains (identification, structure and UBO, sanctions and PEP, financials, reputation), every finding with its points and source. The rules are deterministic — the same NIP gives the same result, no AI. Details: methodology.
- A proposed level of due diligence (SDD/CDD/EDD) with reasoning and a list of recommended actions — a ready draft for the risk card. The decision and the signature are the firm's; the report is evidence, not a decision.
- A PDF with an identifier and a timestamp, confirmable on the /verify page. For the client file and for an inspection.
An example from an accounting practice
A new client: a construction sp. z o.o., registered four months ago, share capital PLN 5,000, one shareholder with non-EU citizenship.
| Domain | Finding | Points |
|---|---|---|
| I Identification | Registered under 4 months ago, minimum capital | +25 |
| II Structure and UBO | Shareholder and owner from a higher-risk country | +20 |
| III Sanctions and PEP | No hits on the lists | 0 |
| IV Financials | No statements — company too young | 0 |
| V Reputation | Domain registered a month ago | +5 |
Score: 50/100, proposed level EDD. Recommended actions: establish the source of wealth, senior management approval of the relationship, more frequent review. The firm has exactly what an inspector will ask for — after three minutes, not half an hour. The assessment pattern is described on the client risk assessment page.
Reviewing the existing portfolio
Due diligence also applies to clients the firm already serves — when circumstances change and as part of ongoing monitoring (art. 34(1)(4)). A pack of 20 or 100 reports with no expiry lets you review the whole portfolio in a day and schedule re-checks by risk level. Alerts on registry changes are planned; today a re-check is another report from the pack.
Legal status as of October 2026. Informational material, not legal advice.
The pack of 20 — for a firm with a few dozen clients.
The free check shows registry data. Owners, sanctions, PEP, financials and the score are in the AMLA dossier — PLN 39.36 for one, PLN 14.94 a report in the pack of 20 (PLN 298.89), no expiry. VAT invoice to the firm. Packs: /pakiety.
Questions from accounting firms.
Check a new client before you sign the engagement.
KRS, CRBR, sanctions, PEP, financials and a risk score — one PDF for the client file, in up to 3 minutes. The first 2 reports for companies are free.