Scoring methodology — rule-based, fully explainable.

1. Principles

Deterministic. The score is purely a function of the data collected: the same inputs always produce the same result and the same report text. Data is fetched anew for every order, so two reports on the same company from different days can differ if the registries changed in between.

Source-linked. Every scoring factor is listed in the report under its domain together with its source and its points, e.g. "Revenue down 52% year on year (2024: PLN 408,347 → 2025: PLN 197,897; BizRaport) (+25)". The answer to "why 85 points?" is in the report itself.

Cross-domain. A single finding can raise several domains at once. A beneficial owner on a sanctions list raises both the ownership domain and the sanctions domain, because the same fact carries two kinds of risk (section 4).

Missing data is not absence of risk. A source that did not answer adds no points, but the report marks it as not checked and recommends manual verification. Each domain shows how many of its sources answered.

2. Five assessment domains

The report is built around five domains. Each has its own 0–100 score (0 — no risk factors in the sources checked, 100 — maximum risk) and its own weight in the overall score.

Sanctions carry the largest weight and reputation the smallest, because open sources are noisier than state registries.

3. How the overall score is calculated

3.1. Weighted average

A domain score is the sum of the points of its rules, capped at 100. The overall score is the weighted average of the five domains, rounded to a whole number:

Score = I × 0.15 + II × 0.25 + III × 0.30 + IV × 0.20 + V × 0.10

Example — a company with no findings (sample report GPPL Sp. z o.o.): all domains 0 → 0, low risk.

Example — a company with a financial problem: IV = 55 (revenue drop +25, negative equity +30), V = 15 (1–3 adverse press items), other domains 0 → 11 + 1.5 = 12.5 → 13, low risk. The report shows the domain IV score (55) separately.

3.2. Overriding rules

Some findings cannot be averaged out. When one occurs, the overall score does not fall below a minimum, whatever the other domains say:

Example — sample report BOERNER SYNTHETICS MEMBRANES Sp. z o.o.: I = 0, II = 100, III = 100, IV = 25, V = 0. The weighted average is 25 + 30 + 5 = 60, but the sanctions match lifts the score to 85, critical risk.

3.3. Risk levels

4. Cross-domain rules

A single finding can raise several domains at once, because risk rarely fits in one box:

An owner is a beneficial owner from CRBR, a shareholder from KRS, or a parent company. Points add up within a domain, capped at 100.

5. What generates points in each domain

I. Identification and registry status (weight 15%)

Sources: KRS, CEIDG, GUS REGON, White List of VAT taxpayers, VIES.

• The company is on the White List but in neither KRS nor CEIDG → +60
• Registered less than 90 days ago → +25
• Main activity in a higher-risk industry per the PKD table (money intermediation and exchange offices 64.19, 66.12, 66.19; gambling 92.00; metals and scrap trade 46.72, 46.77; real estate 68.10/68.11/68.12, 68.31; jewellery 47.77; car dealing 45.11; other financial services incl. VASP 64.99; membership organisations 94.99) → +15
• Main activity in an elevated-profile industry (non-specialised wholesale 46.90, road freight 49.41, building construction 41.20, business consultancy 70.22, advertising agencies 73.11, software 62.01/62.10) → +5
• A higher-risk industry code among the secondary PKD codes (when the main one is not) → +5
• Shell-company pattern: higher-risk industry, registered less than 12 months ago and share capital up to PLN 5,000 → +20, overall score at least 61

The PKD table is versioned and dated (first version 2026-10-07); the report records its hash as the configuration version.

EU VAT status (VIES) and GUS data are shown in the report for information, without points.

II. Ownership structure and UBO (weight 25%)

Sources: CRBR, KRS (shareholders), OpenSanctions (every owner is screened).

• Owner on a sanctions list → +80 per owner
• Owner is a PEP → +50 per owner
• The company has not filed its beneficial owners with CRBR although it must → +35 (when CRBR confirmed there is no entry; not applied to companies listed on the Warsaw Stock Exchange)
• Citizenship or country of residence of a beneficial owner or of the CRBR filer on the FATF “Call for action” list (DPRK, Iran, Myanmar; as of 19 June 2026) → +60 per person, overall score at least 85
• …on the EU list of high-risk third countries (Delegated Regulation (EU) 2016/1675, consolidated 29 January 2026, Russia included) → +40 per person, overall score at least 61
• …in a sanctioned-regime country (our own list: Russia, Belarus, Iran, DPRK, Syria, Myanmar, Venezuela) → +40 per person, overall score at least 61
• …on the FATF “Increased monitoring” list (as of 19 June 2026) → +15 per person
• …on the EU list of non-cooperative tax jurisdictions (17 February 2026) → +10 per person; in a tax haven per the Polish Minister of Finance regulation → +10 per person

For a person with several citizenships the worst category counts; each person is counted once. The report says who, which country and which list with its date. An unknown citizenship earns no points — the report notes it as to be established. The same rules apply to the country of registration of a corporate shareholder and of its ultimate parent, as resolved in the GLEIF (LEI) register.

CRBR–KRS consistency check (art. 61a of the AML act; the report contains a draft discrepancy notification, which the obliged institution sends):

• An individual shareholder with at least 25% per KRS absent from the beneficial owners in CRBR → +40, overall score at least 61
• CRBR names only a senior managing person although KRS shows an individual shareholder with at least 25% → +40, overall score at least 61
• The sole shareholder is a foreign company and CRBR shows no person with indirect ownership rights → +40, overall score at least 61
• A beneficial owner with direct rights per CRBR matches no shareholder in KRS → +20
• The same person's share differs between KRS and CRBR by more than 5 percentage points → +5
• A foreign corporate shareholder with no LEI in GLEIF and no Polish KRS number (opaque chain) → +20
• Three or more levels of parent companies, or circular ownership, per GLEIF → +20

The open KRS API masks natural persons, so a person in KRS and a person in CRBR are matched by the first letter and length of the first and last name; every such finding is marked in the report as requiring verification.

III. Sanctions and warning lists (weight 30%)

Sources: OpenSanctions (a collection of sanctions lists, including the Polish MSWiA list, plus PEP and RCA flags), the consolidated EU sanctions list, the OFAC SDN list, the KNF public warning list. We screen the company as well as its owners and beneficial owners.

• Match on a sanctions list → +100, overall score at least 85
• Entry on the KNF warning list → +80, overall score at least 75
• Link to a sanctioned entity → +60, overall score at least 61
• Entry in criminal or wanted databases → +40, overall score at least 61
• Person of interest, POI (when there is no sanctions match) → +40, overall score at least 61
• PEP → +25; overall score at least 61 when the PEP is an owner, board member, proxy or the CRBR filer, and at least 21 when a minority shareholder
• RCA → +15, overall score at least 21

A hit is a confirmed match: a matching identifier (NIP or KRS number), or an OpenSanctions score of at least 0.85 — for a natural person also with a matching date of birth (at least the year). Matches scoring 0.65–0.85, and strong name matches without a date of birth, are shown as “to verify” (+20, no floor) with the list of candidates; a surname-only resemblance below 0.75 is ignored. A company without an identifier and country is matched at most as “to verify”, unless the name (legal form aside) is identical. Name agreement with the EU or OFAC list is counted at 80% or more. Every person with a disclosed name is also checked in OpenSanctions for PEP and RCA status (the “default” collection), one query per person and at most 25 queries per report; people beyond the limit are listed as unscreened.

IV. Financial profile (weight 20%)

Sources: KRS section 6 (bankruptcy, liquidation, restructuring), BizRaport (financial statement figures, filing dates, MSiG and KRZ notices), e-Sprawozdania (whether a statement was filed), White List of VAT taxpayers, UOKiK decisions, published compulsory administration decisions, Google News.

• Bankruptcy → +60, overall score at least 75
• Liquidation → +40, overall score at least 75
• Restructuring → +40, overall score at least 75
• Compulsory administration (art. 6a of the Polish sanctions act) → +60; after the published term has expired → +30
• KRZ notice while KRS shows no proceeding → +40 (bankruptcy-related) or +30
• Press reports of a prosecutor's investigation or charges → +40
• Revenue more than 1,000 times the share capital → +35
• Negative equity → +30
• UOKiK fine → +30 (within the last two years) or +15 (older)
• VAT status other than "active" or "exempt" → +25
• Revenue down more than 40% year on year → +25
• Financial statement filed more than 90 days after the statutory deadline → +20
• Financial statement missing more than 90 days after the statutory deadline → +20
• Share capital of PLN 5,000 or less → +10

V. Reputation and OSINT (weight 10%)

Sources: Google News (via Serper.dev), RDAP, BDO, PEPPOL.

• Adverse press items: 1–3 → +15, 4–9 → +30, 10 or more → +50
• Web domain registered less than 90 days ago → +20
• Alert in the BDO register → +25

Forum and social-media items are listed for manual review, without points. Items in which the company is not the subject of allegations — for example when it reports a crime itself — carry no points either. PEPPOL registration is shown for information.

5a. Proposed level of due diligence and recommended actions

Since 8 October 2026 the report proposes a level of financial security measures — simplified (SDD), standard (CDD) or enhanced (EDD) — and a list of recommended actions. It is a recommendation derived deterministically from the report's findings; the decision rests with the obliged institution, the system approves nothing.

• Default level: CDD.
• Mandatory EDD (AML act art. 43–46) for: a PEP among owners, board, proxies or the CRBR filer; an RCA; citizenship or residence of a related person in a high-risk country (EU list, FATF “Call for action”, sanctioned regime); an unusually complex ownership structure; the shell-company pattern; a link to a sanctioned entity (internal policy).
• Prohibition of business relations and freezing obligation: a confirmed sanctions hit or the 50% rule. The report then recommends notifying GIIF and ABW.
• EDD for accumulated risk: an overall score of at least 50, or at least two high-severity findings.
• SDD only with a score up to 10, no finding of at least medium severity, for a company listed on a regulated market or a company whose beneficial owners are all from PL/EEA, with share capital of at least PLN 100,000 and older than 3 years. A partial report (a source was unavailable) never gets SDD.

Recommended actions carry Polish wording and a legal basis: identity verification of the beneficial owner and the representative, senior management approval for a PEP, establishing the source of wealth and funds (EDD, cash-intensive industries), registry documents of the parent company, the CRBR discrepancy notification (with a draft in the annex), a request for the financial statement, establishing citizenship, repeating checks in unavailable sources, and the re-screening cadence (30 days for EDD, 12 months for CDD, 24 months for SDD).

The buyer may declare being an obliged institution (at checkout or in the account). A report for an obliged institution includes citizenship, country of residence and dates of birth of related persons; a report for other buyers leaves those out and shows names, roles and risk statuses.

6. Data sources — full list

For companies we query 18 sources, for sole traders 12, because some registries cover companies only.

• Registries and authorities (10): KRS · CEIDG · GUS REGON · CRBR · White List of VAT taxpayers · e-Sprawozdania · MSiG / KRS section 6 · BDO · KNF warning list · UOKiK decisions
• EU and international lists (4): VIES · EU sanctions list · OFAC SDN · OpenSanctions
• Data providers and OSINT (4): BizRaport · Google News (Serper.dev) · RDAP · PEPPOL

Registries are queried with every order. Exceptions: the EU and OFAC sanctions lists are downloaded every 12 hours and the KNF warning list once a day. We keep our own copy of CRBR; the report states its as-of date next to the beneficial owners, and when the copy lacks the company or its owners we query CRBR live.

Source descriptions are on the Data Sources page.

7. No artificial intelligence

No language model and no other AI tool takes part in the assessment or in writing the report. The report text is built from fixed templates filled with source data, and the points come from the rules in section 5. Data about the company checked is not sent to any AI model provider.

If an auditor asks "why does this company have 85 points?", the answer is the list of rules printed in the report under each domain — not "because the model decided so".

8. What we record for every report

• the scoring factors: domain, points and a description naming the source,
• the score of each domain and the overall score,
• the status of each source: answered or not checked,
• the date and time the report was generated.

The PDF report contains the same factors under each domain, plus the list of sources checked.

9. What the report is, and what it is not

It is a structured tool supporting due diligence: facts from registries and lists, deterministic scoring and recommended next steps.

It is not a legal opinion or a compliance decision. The decision to establish, decline or continue a relationship rests with the person responsible for compliance, based on all the material available. Verifykator provides facts — it does not replace judgment.

It is not a guarantee of completeness. The data comes from public registries, open sources and data providers (BizRaport, OpenSanctions). We have no access to non-public databases such as the National Criminal Register (KRK).

10. Legal status of the tool

Verifykator is an analytical tool for informational purposes. It does not constitute legal or financial advice. Users are responsible for verifying key information before making binding legal or contractual decisions.

The service is operated by GPPL Sp. z o.o. (NIP 1133084887, KRS 0001017113, ul. Ostrobramska 101A/301, 04-041 Warsaw).

11. Methodology version

The criteria, weights and thresholds described on this page apply from 29 September 2026.