How to Verify Polish Supplier Bank Accounts
Most countries leave it to you to work out whether a supplier's bank account is genuine. Poland does not. The Polish tax administration publishes every active VAT taxpayer's registered business account in a public register, and if you pay an invoice over PLN 15,000 to an account that is not on that register, two things happen automatically: you lose the tax deduction on the expense, and you become jointly liable, with your entire assets, for your supplier's unpaid VAT on that transaction. Verification in Poland is not a fraud-prevention nicety. It is a statutory condition of getting your own tax treatment right.
Sources: Polish VAT Act art. 96b; Tax Ordinance art. 117ba; EBA and ECB joint Payment Fraud Report, December 2025.
What the White List actually is
The Wykaz podatników VAT — universally called the biała lista, the White List — is an electronic register maintained by the Head of the National Revenue Administration (KAS) under article 96b of the Polish VAT Act. It has been running since 1 September 2019, and the sanctions attached to it took effect on 1 January 2020.
It is free, public, and searchable by NIP, REGON, KRS number, company name or bank account number. For each entity it shows the registered name, NIP, REGON and KRS where applicable, the registered address, the VAT registration status — registered as an active VAT payer, exempt, refused registration, or struck off, with the legal basis and date — and, critically, the entity's registered business bank accounts.
Those account numbers are not self-declared to the register. They are drawn automatically from the accounts the taxpayer reported to the tax administration and confirmed through STIR, the clearing house system that links a business entity's tax number to its bank accounts. That is what makes the list worth something: it is a state-verified mapping of NIP to IBAN.
In most of Europe you verify a supplier's bank account by asking a bank whether the name matches. In Poland the government has already published which accounts belong to which tax number. The verification question changes from "does this look right?" to "is this exact account on the list today?"
The list is refreshed once per working day, which has consequences we will come to. It also lets you check a counterparty's status on a chosen past date, going back up to five years — which is how you reconstruct your position if a payment made months ago is later questioned.
What is not on the list, and when that is not a red flag
More legitimate suppliers fail this check than fail it for good reason. Four cases account for most of them.
| Situation | Why it is missing | What it means |
|---|---|---|
| Virtual account | Not a settlement account under the Banking Law, so it is never listed in its own right. | Usually fine. See below — these resolve to a listed master account. |
| Personal account (ROR) | Private accounts are never published, even where a sole trader genuinely uses one for the business. | Not fraud, but the payment is unprotected. Ask for a business account. |
| Supplier is not VAT-registered | The register only covers VAT taxpayers. A non-registered business has no listed account at all. | Out of scope. The sanctions require an active VAT-payer seller. |
| Struck off or refused registration | The entity still appears, with the legal basis and date — but without any account data. | Investigate. This is the case that should stop a payment. |
The virtual account case is the one that causes the most unnecessary alarm, and it is worth understanding properly. Suppliers who invoice at scale — telecoms, utilities, large distributors — assign each customer a unique virtual account number so incoming payments reconcile automatically. These are technical accounts rather than settlement accounts under article 49(1)(1) of the Banking Law, so they are not published in the register and never will be.
They are nonetheless safe to pay, because the money lands on the master settlement account they are attached to, and that account is listed. The tax administration's own search engine handles this: enter a virtual account number and it resolves to the associated taxpayer and master account. The tax rulings authority has confirmed that a payment made to a virtual account remains deductible provided the funds actually reach a settlement account that was on the White List on the day the transfer was instructed.
Treating a virtual account as an unlisted account and filing a protective notification is a common and unnecessary reaction. Search the number in the register first — if it resolves to a listed master account, no notification is needed and no sanction arises.
The two sanctions
Pay a supplier more than PLN 15,000 gross on a single transaction, by transfer, to an account that was not on the White List on the day you instructed the payment, and two separate penalties apply. They come from different statutes and they are cumulative.
One condition governs both, and it is easy to miss: the sanctions only bite where the supply was made by a supplier registered in Poland as an active VAT taxpayer. That single qualifier decides whether any of this applies to you.
| Sanction | Legal basis | What it costs you |
|---|---|---|
| Loss of deductible cost | Art. 15d CIT Act / art. 22p PIT Act | The expense stops being a tax-deductible cost. You pay income tax on money you have already spent. |
| Joint and several liability for VAT | Art. 117ba § 1 Tax Ordinance | You answer with your entire assets, alongside the supplier, for their unpaid VAT proportionate to that transaction. |
The PLN 15,000 threshold comes from article 19 of the Entrepreneurs' Law and is assessed per transaction, not per transfer. Splitting a PLN 40,000 invoice into three payments does not take it below the threshold; it simply means each payment made to an unlisted account carries the exposure.
The liability under article 117ba is the one that should reach your CFO. It is not capped at the amount you paid incorrectly. It is liability for someone else's tax arrears, triggered by your own payment routing.
When the rule does not apply: foreign suppliers
The White List is a register of Polish taxpayers. It contains no foreign entrepreneurs and no foreign bank accounts, and there is no mechanism — or obligation — to verify an overseas counterparty through it.
So if you are paying a supplier that has no Polish VAT registration, the sanctions in article 15d CIT and article 22p PIT do not reach the payment, because both are drafted around a seller registered in Poland as an active VAT taxpayer. The expense stays deductible and no joint VAT liability arises, whatever account you pay.
There is one edge case, and it is the one that catches international groups:
Many non-Polish companies register for Polish VAT because of where their supplies are treated as made. Once registered as an active VAT payer they fall inside the White List regime like anyone else — but they may hold only a foreign bank account, which cannot appear in the register. The exposure is real, and the harder problem is that a buyer often does not know its counterparty is Polish VAT-registered at all. If a supplier invoices you with a Polish NIP, treat the White List rules as engaged and check.
The three ways out
There are exactly three, and only the first is a control rather than a remedy.
1. Check on the day, and keep the receipt
Liability is assessed against the account's status on the day the transfer is instructed. Because the register refreshes once each working day, a check performed at onboarding, or last week, or even yesterday, does not establish the position on the day you pay.
When you query the register, KAS returns an identyfikator zapytania — a query identifier. That string is your evidence that the check was performed, and on what date. If the tax office later challenges the payment, the identifier is what you produce. It should be captured and stored against the payment record, not glanced at and discarded.
2. File a ZAW-NR notification within 7 days
If the payment has already gone to an unlisted account, you can still escape both sanctions by notifying the tax office on form ZAW-NR. The deadline is 7 days from the day the transfer was instructed, under article 117ba § 3 point 2 of the Tax Ordinance.
Three details make this less forgiving than it sounds. The period runs from the day after the instruction and expires at midnight on the seventh day, counting weekends and public holidays. The notification goes to the tax office competent for the taxpayer making the payment. And the deadline is a substantive deadline that cannot be restored — miss it, and there is no application to make, no discretion to appeal to. It is simply gone.
3. Pay using split payment
A payment made under the split payment mechanism (mechanizm podzielonej płatności, MPP) is protected from the White List sanctions regardless of whether the account is listed. Under MPP the net amount goes to the supplier's ordinary account and the VAT element goes to a dedicated VAT account that the supplier can only use for restricted purposes.
Split payment is compulsory for invoices of PLN 15,000 or more covering goods and services in Annex 15 to the VAT Act — construction, electronics, steel, fuels and similar sectors — and voluntary otherwise. Many buyers use it as a blanket control for Polish payments precisely because it neutralises the White List risk. It is a legitimate strategy, though it changes your supplier's cash position, which they may not welcome.
Polish law effectively requires same-day, per-payment account verification with a retained audit trail, on every B2B payment above PLN 15,000. That is not a workflow a person can perform reliably against a payment run of any size. It is an API and a log, or it is exposure.
Reading a Polish IBAN
Polish IBANs are 28 characters — among the longest in Europe. The domestic account number, the NRB, sits inside it in full.
The company layer: three numbers and two registers
Polish entities carry up to three identifiers, and knowing which one you have been given saves a lot of confusion.
| Identifier | What it is | Who has one |
|---|---|---|
| NIP | Ten-digit tax identification number. The key you use for the White List and for VAT. | Every business, including sole traders. |
| REGON | Statistical number issued by the central statistical office. Nine digits for most entities, fourteen for branches. | Every business. |
| KRS | Ten-digit court register number, issued on entry into the National Court Register. | Companies and organisations only. Never sole traders. |
KRS, for companies
The Krajowy Rejestr Sądowy is Poland's national court register, maintained by the registry courts under the Ministry of Justice. It covers commercial companies — spółka z o.o., spółka akcyjna, partnerships — together with foundations and associations. The register of entrepreneurs is divided into six sections, covering identification, the objects of the business, representation and management, financial statements, and any insolvency or enforcement entries.
It is free to search through the Ministry of Justice's court registers portal, by KRS number, NIP, REGON or name, and you can download an extract with the force of an official document. Two fields matter most for supplier verification: the manner of representation — which tells you who can validly bind the company, and whether two signatures are required — and the entries in the insolvency section.
Corporate events are also published in Monitor Sądowy i Gospodarczy, the official court and commercial gazette.
CEIDG, for sole traders
Sole traders (jednoosobowa działalność gospodarcza) and partners in civil partnerships are not in KRS at all. They are registered in CEIDG, the central register of business activity, which is separate, free and searchable by NIP or name. It shows the trading name, NIP, REGON, addresses, business classification codes and — importantly — the status: active, suspended, or struck off.
The suspended status is a specifically Polish trap. A suspended sole trader still exists and still has a valid NIP, but is not currently trading. If you are being invoiced by a supplier whose CEIDG entry shows suspension, that warrants a question before payment, not after.
Financial statements
Companies in KRS must file annual financial statements electronically, and they are published free of charge in the Repository of Financial Documents attached to the register. Non-filing is both an offence and, in practical terms, one of the more reliable early indicators that a counterparty has stopped being run properly.
Insolvency and restructuring
Poland runs a dedicated national register for this: the Krajowy Rejestr Zadłużonych (KRZ), the National Register of Debtors, operated under the Ministry of Justice. It publishes insolvency and restructuring proceedings and related enforcement information, and it is free to search. Because insolvency entries also appear in KRS and in the gazette, a supplier in difficulty is usually visible in more than one place — but KRZ is the direct route.
Beneficial ownership, and a change in progress
Poland's Centralny Rejestr Beneficjentów Rzeczywistych (CRBR), run by the Minister of Finance under the AML Act of 1 March 2018, holds beneficial ownership data for Polish commercial companies. It has historically been fully public and free, with no login and no need to show any interest — one of the most open beneficial ownership registers in the EU.
That is changing, and the position is worth stating carefully because a good deal of published commentary has run ahead of the law.
Following the Court of Justice rulings in C-37/20 and C-601/20 and EU Directive 2024/1640, Poland has drafted an amendment to the AML Act replacing open access with a legitimate-interest model. As at the date of this article that amendment remains a draft at government stage — approved by the Standing Committee of the Council of Ministers, but not yet adopted by the Council of Ministers or passed to parliament. Earlier commentary citing a 1 July 2026 cut-off was reporting a timetable that has since moved; the current draft proposes entry into force later, with the implementing rules on register access later still. Confirm the position at the time you rely on it.
One point in the draft is worth knowing if you buy from Polish suppliers: alongside journalists, NGOs and academics, the legitimate interest is presumed for parties who are likely to enter into a transaction with the registered entity. On the current drafting, a buyer verifying a supplier before paying it should continue to have a route to the data — through an application rather than a search box.
What the White List will not catch
The White List is an excellent control for exactly one thing: confirming that the account you are about to pay is a business account registered to that tax number, today. It is worth using for that alone, and Polish law gives you no choice.
It is not a check on the company. A supplier can be on the White List as an active VAT payer, with a correctly listed account, and still be a company that has not filed financial statements in three years, is subject to restructuring proceedings, changed control last month, or is represented by someone with no authority to bind it. A listed account confirms a tax registration. It says nothing about solvency, governance, ownership or whether the person emailing you can commit the company at all. There are several company red flags a bank account match alone will not catch, and in Poland they sit in registers the White List never touches.
Why this is harder than it looks at scale
Poland does not just publish the register — it publishes the tooling. The Ministry of Finance provides a free API with a simplified check method: send a tax number, an account number and a date, and it returns a yes or no together with an electronic key confirming what was asked and on what day. That key is your audit evidence, generated for you.
If you pay a handful of Polish invoices a month, that is the entire answer. Use it. Nothing in this section argues otherwise.
Two things change as volume rises.
The API is rate-limited. The Ministry states plainly that its use is capped, and integrators hit the quota quickly. It is designed for checking counterparties, not for pre-flighting a payment file of several thousand lines on the morning it goes out.
Above that limit, you are running a data pipeline. For bulk verification the Ministry publishes a flat file every night at midnight containing the complete set of tax-number-to-account pairs, secured with one-way hash functions so that only someone already holding a correct pair can confirm it exists. It is an elegant piece of design and it accounts for virtual accounts. It is also a nightly download, a hashing implementation, a matching routine and a monitoring job that somebody on your team now owns and maintains.
None of this is a criticism of the Polish system. It is among the best pieces of public payment infrastructure in Europe, and if Poland is your only foreign market, build against it directly. The difficulty is not Poland. The difficulty is the second country.
Because the moment you add one, none of it transfers. Spanish account ownership data sits behind participating banks and is reached through a banking relationship, not a download. Germany, France, Italy and the Netherlands answer at the moment of payment through Verification of Payee, in a different shape again — and Poland itself joins them in July 2027, which will add a second mechanism rather than replace this one. On the company side, the authoritative record is a court register in Poland, provincial registries in Spain, chambers of commerce in Italy.
Each of those is free or inexpensive on its own. Each has its own format, refresh cadence, identifier scheme and failure modes. Ten of them is not ten times the work of one — it is ten integrations to build and then maintain permanently, in a function that is not your product and that fails silently when a format changes.
One integration, instead of one per country
MonitorPay provides account verification and registry-sourced company intelligence across 49+ markets through a single API — payee name matching against the account holder, plus registered legal name, national identifiers, status, directors, shareholders, beneficial ownership and group structure from over 200 government registries. Available as bulk file checks, REST API or the online platform, with every check logged for audit and continuous monitoring on the suppliers you have already onboarded. MonitorPay does not initiate or hold funds, and it does not replace a national register where one already serves you well — it removes the need to build and maintain a separate pipeline for every market you pay into.
What changes in July 2027
Poland does not use the euro, which is why Verification of Payee has not yet reached Polish payers. Under the EU Instant Payments Regulation, Regulation (EU) 2024/886, payment service providers in euro-area countries had to offer the payee name check from October 2025. Providers in non-euro member states, Poland included, come into scope in July 2027.
When it arrives, Polish buyers will have something no other EU market has: a name-matching check at the moment of payment, sitting on top of a state-published register of which accounts belong to which tax number. That combination is genuinely strong at the account layer — and it will make the gap at the company layer more visible, not less.
The context for both is unchanged. The EBA and ECB joint payment fraud report published in December 2025 put total payment fraud across the European Economic Area at €4.2 billion in 2024, up from €3.5 billion the year before. For credit transfers, payment service users bore roughly 85% of total fraud losses, overwhelmingly through scams in which they were manipulated into initiating the transfer themselves. Authentication stops an attacker transacting as you. It does nothing when you authorise the payment yourself, believing the instruction is genuine.
A request to change an existing supplier's bank details is where most business payment fraud succeeds — and in Poland it carries a second cost, because the new account will not be on the White List unless the supplier has registered it. Treat every change request as a re-verification event: check the new account against the register on the day you pay it, and re-confirm the company in KRS before the change is approved in your ERP.
A practical verification workflow
For a new Polish supplier, or a change to an existing one, a defensible sequence looks like this:
- Validate the IBAN. Confirm the 28-character structure and identify the bank. Free, instant, and it catches transcription errors before anything else.
- Establish the entity type. A KRS number means a company; no KRS means a sole trader in CEIDG. The verification path differs from here.
- Check the White List on the day of payment. Confirm the NIP is an active VAT payer and the exact account is listed. Capture the query identifier against the payment record.
- Confirm the company. Pull the KRS extract or the CEIDG entry. Check the registered name, status, address, and — for companies — the manner of representation and who can sign.
- Check the accounts are filed. Review the financial statements in the repository. A multi-year gap is a material finding.
- Check for insolvency. Search KRZ, and read the insolvency section of the KRS extract.
- Check ownership. Review shareholders and beneficial owners, and note recent incorporation, a sole owner, or a recent change of control.
- Decide your fallback. If an account cannot be verified and the payment cannot wait, split payment protects you where ZAW-NR would otherwise be needed.
- Monitor. Re-verify on every bank-detail change request, and monitor status and ownership across the supplier base rather than treating onboarding as a one-time event.
Bulk, API, or the online platform
Company verification and ownership data on Polish and international suppliers is available through whichever access method fits your team: bulk file checks for onboarding runs and supplier-base reviews, the REST API for verification inside your existing payment workflow, or the online platform for one-off checks with full audit logs.
Frequently asked questions
How do I verify a Polish supplier's bank account?
Check the account against the White List (Wykaz podatników VAT), the register maintained by the Head of the National Revenue Administration under article 96b of the VAT Act. It is free and public, and shows each active VAT taxpayer's registered business accounts alongside their NIP, REGON, KRS and VAT status.
For payments over PLN 15,000 this is not optional — the account must be on the list on the day you instruct the transfer. Pair it with a company check in KRS, or CEIDG for sole traders, because a listed account confirms a tax registration and nothing more.
What is the Polish White List of VAT taxpayers?
The biała lista is an electronic register of Polish VAT taxpayers run by the Head of KAS, live since 1 September 2019. It is searchable free by NIP, REGON, KRS, company name or bank account number, and shows the registered name and address, VAT status — active, exempt, refused or struck off, with the reason and date — and the entity's registered business bank accounts.
The account data is drawn from the tax administration's own records and confirmed through STIR, the system linking business tax numbers to bank accounts, which is what makes it a state-verified mapping rather than a self-declaration.
What happens if I pay a Polish supplier on an account not on the White List?
For a transaction over PLN 15,000 paid by transfer, two sanctions apply together. Under article 15d of the CIT Act or article 22p of the PIT Act, the expense ceases to be a tax-deductible cost. Under article 117ba § 1 of the Tax Ordinance, you become jointly and severally liable with your entire assets for the supplier's unpaid VAT proportionate to that transaction.
Both can be avoided by filing a ZAW-NR notification within 7 days, or by making the payment under the split payment mechanism.
My Polish supplier's account is not on the White List. Is that a red flag?
Often not. Four innocent explanations cover most cases. The account may be a virtual account, which is a technical account rather than a settlement account and is never listed in its own right. It may be a personal account, which is never published. The supplier may not be VAT-registered, in which case the register does not cover them and the sanctions do not apply. Or the supplier may be foreign with no Polish VAT registration, which puts the payment outside the regime entirely.
The case that should stop a payment is different: an entity that appears in the register with a struck-off or refused VAT registration, shown with the legal basis and date but no account data. That is worth investigating before you pay.
Can I pay a Polish supplier on a virtual account?
Yes. Suppliers that invoice at scale assign each customer a unique virtual account number so payments reconcile automatically. These are technical accounts, not settlement accounts under article 49(1)(1) of the Banking Law, so they are not published in the register and never will be.
They are still safe to pay, because the funds land on the master settlement account they are attached to, and that account is listed. The tax administration's search engine resolves a virtual account number to the associated taxpayer and master account, and the tax rulings authority has confirmed such payments remain deductible provided the money reaches an account that was on the White List on the day of the transfer. Filing a protective ZAW-NR in this situation is unnecessary.
Does the White List apply when I pay a foreign supplier?
Only if that supplier is registered in Poland as an active VAT taxpayer. The register contains Polish taxpayers alone — no foreign entrepreneurs and no foreign bank accounts — and there is no obligation to verify an overseas counterparty through it. Where the supplier has no Polish VAT registration, neither the loss of deduction nor the joint VAT liability can arise.
The exception matters for international groups. A non-Polish company that has registered for Polish VAT falls inside the regime, but may hold only a foreign bank account that cannot appear in the register. If a supplier invoices you using a Polish NIP, assume the rules are engaged and check.
What is ZAW-NR and how long do I have to file it?
ZAW-NR is the notification you file with the tax office when you have paid an invoice to an account outside the White List. Filing it releases you from both the loss of deductible cost and the joint VAT liability.
The deadline is 7 days from the day the transfer was instructed, under article 117ba § 3 point 2 of the Tax Ordinance. The period starts the following day, expires at midnight on the seventh day, and counts weekends and holidays. It is a substantive deadline and cannot be restored, so a missed filing cannot be remedied.
Does split payment protect me from the White List sanctions?
Yes. A payment made under the split payment mechanism is protected regardless of whether the account appears on the register. The net amount goes to the supplier's ordinary account and the VAT element to a restricted VAT account.
Split payment is mandatory for invoices of PLN 15,000 or more covering goods and services listed in Annex 15 to the VAT Act, and voluntary otherwise. Some buyers apply it as a blanket control on Polish payments for exactly this reason, though it does affect the supplier's cash position.
Is there an API for the Polish White List?
Yes, and it is free. The Ministry of Finance publishes an API for the register, including a simplified check method: submit a tax identification number, a bank account number and a date, and it returns confirmation of whether that account was assigned to that entity on that day, together with an electronic key recording what was asked and when. That key is the evidence to retain against the payment.
Use of the API is rate-limited, so for high-volume verification the Ministry also publishes a flat file each night containing the full set of tax-number-to-account pairs, protected with one-way hash functions so that only a party already holding a correct pair can confirm it. The flat file supports virtual accounts linked to settlement accounts. Both routes are free; the cost is the engineering and maintenance around them.
How often is the White List updated?
Once per working day. Because liability is assessed against the account's status on the day the transfer is instructed, a check performed at onboarding or even the previous day does not establish your position.
When you query the register, KAS returns a query identifier confirming the check and its date. Retain it against the payment record — it is the evidence you produce if the payment is later challenged.
What is the difference between NIP, REGON and KRS?
NIP is the ten-digit tax identification number, and it is the key you use for the White List and for VAT. REGON is the statistical number issued by the central statistical office, nine digits for most entities and fourteen for branches. KRS is the ten-digit number issued on entry into the National Court Register.
Every business has a NIP and a REGON. Only companies and organisations have a KRS number — sole traders never do, because they are registered in CEIDG instead.
How do I check whether a Polish company is registered and active?
For companies, search the KRS through the Ministry of Justice court registers portal by KRS number, NIP, REGON or name. The extract shows the registered name, address, share capital, management board, the manner of representation, financial statements filed, and any insolvency entries. Corporate events are also published in Monitor Sądowy i Gospodarczy.
For sole traders, search CEIDG instead. Pay attention to the status field: a suspended sole trader still holds a valid NIP but is not currently trading, which is worth querying before you pay an invoice.
Can I look up the beneficial owners of a Polish company?
Poland's Central Register of Beneficial Owners (CRBR), run by the Minister of Finance under the AML Act of 1 March 2018, has historically been fully public and free to search with no login and no need to demonstrate any interest.
Following the Court of Justice rulings in C-37/20 and C-601/20 and EU Directive 2024/1640, Poland has drafted an amendment replacing open access with a legitimate-interest model. As at publication that amendment is still a draft at government stage rather than law, and several published timetables have already moved, so confirm the current position before relying on it. Notably, the draft presumes a legitimate interest for parties likely to transact with the registered entity — which should cover a buyer verifying a supplier.
Does Verification of Payee apply in Poland?
Not yet. Under the EU Instant Payments Regulation, Regulation (EU) 2024/886, payment service providers in euro-area countries had to offer the payee name check from October 2025. Poland does not use the euro, and providers in non-euro member states come into scope in July 2027.
Until then, the account-level control available to Polish payers is the White List — which answers a different and in some ways stronger question, since it matches an account to a tax number rather than to a name.
