A business client at an exchange office or crypto exchange — checked in 3 minutes.
A business client at an exchange office or crypto exchange — checked in 3 minutes.
Walk-in and online exchange offices and entities in the VASP register face frequent GIIF inspections and the highest sanctions risk. For business clients enter a NIP: ownership structure, sanctions, PEP, high-risk country, 0–100 score.
- Sanctions: MSWiA, EU, OFAC
- KNF warnings
- Beneficial owners (CRBR)
- Financials and filings
- Bankruptcy, liquidation, KRZ
- VAT status and accounts
- Press coverage
- 0–100 risk score and PDF
Money back if the report cannot be generated
For companies: the first 2 reports free (in Polish)
Exchange offices and VASPs under the AML Act
Businesses running currency exchange (art. 2(1)(11)) and entities providing virtual currency services — exchange, brokerage, custody accounts (art. 2(1)(12)) — are obliged entities. Virtual currency activity requires an entry in the register kept by the Director of the Tax Administration Chamber in Katowice; operating without it carries an administrative fine, and the entry does not replace AML duties — it triggers them.
Both industries share a problem: many one-off clients, high sanctions risk since 2022 and thresholds that a few linked operations easily cross. With business clients there is also an ownership structure that a cashier cannot establish at the counter.
Duties of an exchange office and a VASP.
The art. 35(1) thresholds also count for several operations that appear to be linked.
How it looks today
A natural person is identified from an ID and checked in the MSWiA search. For a business client the cashier takes a KRS extract, sometimes a CRBR filing, and assumes a Polish company is low risk. An owner with citizenship of a FATF-listed country goes unnoticed, because nobody matched the CRBR against the high-risk country list. For a crypto exchange business onboarding is a form and a scanned KRS extract — no shareholder screening.
At a GIIF inspection exchange offices and VASPs most often answer for three things: no proof of sanctions screening, no beneficial owner established for a business client, and no documented risk assessment. How an inspection runs: GIIF inspection.
What the report gives an exchange office or VASP
- Full verification of a business client by NIP — KRS or CEIDG, REGON, VAT status, CRBR, shareholders up to two levels, the parent with its country.
- Sanctions and PEP included — OpenSanctions with the MSWiA list, the EU list, OFAC SDN, KNF warnings for the company, board, proxies, shareholders and owners; PEP and RCA status after the obliged-entity declaration. Date and time of the check in the PDF. More: sanctions and PEP.
- High-risk country — the CRBR owner's citizenship and country of residence matched against the high-risk third country list; points in domain II.
- A 0–100 score and a proposed level of measures (SDD/CDD/EDD) with actions: source of wealth, senior management approval, review frequency. The decision is the institution's.
- Natural persons — no. The report covers companies. You identify an individual client from a document and screen the lists in your own system; we say so plainly so that your procedure does not assume something the report does not do.
An example from an exchange
A business client opens a corporate account at a crypto exchange. A Warsaw sp. z o.o. with two shareholders; the CRBR names an owner with citizenship of a FATF-listed country.
| Domain | Finding | Points |
|---|---|---|
| II Structure and UBO | Owner from a high-risk third country | +25 |
| I Identification | Company registered 7 months ago | +15 |
| III Sanctions and PEP | No name hits | 0 |
| V Reputation | No website or press coverage | +5 |
Score: 45/100, proposed EDD (art. 44 — high-risk third country). Actions: source of the owner's wealth, senior management approval, a turnover limit until the documents are complete. The exchange has a dated, sourced rationale for its decision.
The report versus an AML system with transaction monitoring
The report does not replace a transaction monitoring system or the register of above-threshold transactions — it is a KYB tool at onboarding and at review of a business client. Sanctions lists come from OpenSanctions, which refreshes its sources daily, and from the EU and OFAC files at every report; the PDF shows the retrieval date. Comparison with AML-class systems: SystemAML. An API and monitoring with alerts are planned.
Legal status as of October 2026. Informational material, not legal advice.
The pack of 100 — for an exchange with many business clients.
Registry data is free. The full report with sanctions, PEP, structure and country risk costs PLN 39.36; the pack of 100 — PLN 998.76 (PLN 9.99 a report), no expiry, VAT invoice. Packs: /pakiety.
Questions from exchange offices and VASPs.
Check a business client by NIP.
Ownership structure, sanctions, PEP, country risk and a 0–100 score — one PDF for the client file, in up to 3 minutes.