Beneficial ownership register (CRBR) – obligations

A Warsaw-based technology company completes its restructuring in spring 2026. Three new shareholders enter the ownership chain. Seven days pass. Then another seven. No one updates the Central Register of Beneficial Owners. By week three, the company is exposed to a financial penalty of up to PLN 1,000,000 – with no warning notice required under Polish law.

Poland's Centralny Rejestr Beneficjentów Rzeczywistych (Central Register of Beneficial Owners, CRBR) requires every covered entity to identify its beneficial owners and submit that information within 14 days of incorporation or any change in ownership structure. Failure to meet this deadline exposes the company – and, in certain cases, its management board – to penalties reaching PLN 1,000,000. The obligation applies to commercial companies, foundations, associations, and a growing range of other legal persons registered in Poland.

This guide covers the step-by-step identification procedure, filing mechanics, the three most common compliance failures, and how three different business scenarios – a Polish manufacturing group, a Warsaw IT startup, and a German investor entering Poland – each navigate CRBR obligations in practice. A checklist and FAQ section close the guide.

What is the CRBR and who must register?

The CRBR is Poland's national anti-money laundering (AML) register, maintained by the Minister of Finance and accessible to the public free of charge via the National Court Register (KRS) portal. It was introduced to implement the EU's Fourth and Fifth Anti-Money Laundering Directives. Every entry is public, searchable, and – critically – carries legal presumption of accuracy until corrected.

The scope of obligated entities is broad. It covers limited liability companies (spółki z ograniczoną odpowiedzialnością), joint-stock companies, partnerships, foundations (fundacje), associations (stowarzyszenia) with legal personality, and trusts with a Polish nexus. Since 2022, the obligation also extends to certain professional partnerships and simple joint-stock companies (prosta spółka akcyjna, PSA). Foreign branches operating in Poland are not covered by CRBR directly – but their Polish subsidiaries are.

The definition of "beneficial owner" follows the AML framework. A natural person who directly or indirectly holds more than 25% of shares or voting rights qualifies. So does anyone who exercises effective control through other means – for example, through contractual rights, veto powers, or board appointment rights. Where no natural person can be identified, the senior managing official (typically the CEO or management board member) is registered as the beneficial owner by default. This fallback rule is frequently misunderstood and leads to outdated entries.

The Polish Financial Supervision Authority (KNF) and the General Inspector of Financial Information (GIIF) both rely on CRBR data during AML supervision. Discrepancies between CRBR entries and actual ownership trigger enhanced due diligence obligations for banks, notaries, and other obligated institutions – creating practical banking problems for non-compliant companies well before any penalty is issued.

How does the step-by-step identification and filing procedure work?

Correct CRBR filing starts with ownership mapping, not with the online form. The company must first trace its entire ownership chain – layer by layer – until it reaches a natural person. This analysis must be documented. Polish AML law requires the company to keep records of the identification process and update them whenever the ownership structure changes. Documentation gaps are the most common audit finding.

Once beneficial owners are identified, the filing is submitted electronically through the Ministry of Finance portal. No paper submission is accepted. The submission must be signed with a qualified electronic signature or a trusted profile (profil zaufany) by a person authorised to represent the company – typically a management board member. Authorised proxies with a specific power of attorney may also file.

The timeline is strict:

Newly incorporated entities: 14 days from entry in the KRS (or other relevant register)
Changes in beneficial ownership: 14 days from the date of the change
Changes in personal data of a registered beneficial owner: 14 days from becoming aware
Entities obligated since 2021 amendments: should already be registered; any update triggers the 14-day clock

We obtained a reversal of a CRBR-related penalty exceeding PLN 200,000 for a manufacturing client in the Mazowieckie region (autumn 2025). The penalty had been issued because a mid-chain holding company had not updated its entry following a share pledge that granted effective control to the pledgee. The case illustrates how indirect control mechanisms – not just direct shareholdings – can trigger filing obligations that boards overlook.

For a tailored strategy on CRBR identification and filing procedure, reach out to info@kordeckipartners.com.

What are the most common mistakes and how do they trigger penalties?

Three failures account for the vast majority of CRBR enforcement cases. First, companies treat CRBR as a one-time registration rather than a living record. Every change in the ownership chain – share transfer, new shareholder agreement, pledge, usufruct, or board reshuffle that affects control – restarts the 14-day clock. Missing a mid-chain change is the single most frequent error.

Second, companies misapply the 25% threshold. The rule is cumulative and looks through intermediate entities. A natural person holding 30% in a holding company that owns 90% of the Polish subsidiary effectively controls 27% of the subsidiary – above the threshold. Many boards calculate only direct ownership and miss indirect beneficial owners entirely. This is particularly problematic in private equity and family-owned group structures.

Third, the fallback rule is misused. Some companies register the CEO as beneficial owner without first genuinely attempting to identify natural persons through the ownership chain. This is not a safe harbour. The GIIF has taken enforcement action against companies that used the fallback incorrectly, treating it as a permanent solution rather than a last resort.

Penalties under Polish AML legislation can reach PLN 1,000,000 per violation. The penalty is administrative – no criminal conviction is required. The enforcement authority does not need to demonstrate actual harm. A late or incorrect filing is sufficient. Personal liability of management board members is possible where the failure results from deliberate action or gross negligence. That consequence is irreversible once the decision becomes final and enforceable.

Our team secured removal of a CRBR suspension flag for a fintech client in Pomerania (spring 2026). The flag had been raised by the company's bank following a discrepancy between the CRBR entry and the shareholder register. The discrepancy arose from a share transfer that had been notarised but not yet reflected in the CRBR. Even a brief gap – less than 14 days – was enough to trigger enhanced due diligence and a temporary account restriction.

How do three business scenarios illustrate CRBR obligations in practice?

Understanding CRBR obligations in the abstract is useful. Seeing them applied to concrete structures is more useful still. Three scenarios capture the most common compliance challenges.

Scenario 1 – Polish manufacturing group. A family-owned group operates through four Polish entities. The founding shareholder holds stakes through a personal holding company. Under AML rules, the natural person at the top of the chain is the beneficial owner of all four entities. Each entity must file separately. When the founder transfers 30% of the holding company to a sibling, all four downstream CRBR entries must be updated within 14 days. Missing even one triggers a separate penalty exposure. ESG reporting obligations under CSRD Poland are also increasingly linked to ownership transparency, so accurate CRBR data feeds directly into ESG reporting frameworks.

Scenario 2 – Warsaw IT startup. An IT company is incorporated with three co-founders, each holding equal shares. All three qualify as beneficial owners. Two years later, a venture capital fund acquires a 35% stake. The fund is a foreign entity. The beneficial owners of the fund – the natural persons who control it – must now be traced and registered. If the fund's structure prevents identification (for example, because it is a listed entity or an exempt category), specific AML rules apply. The company's compliance lawyer in Warsaw should review the structure before the investment closes, not after.

Scenario 3 – German investor entering Poland. A German GmbH establishes a Polish spółka z ograniczoną odpowiedzialnością (limited liability company). The German parent's beneficial owners – as identified under German AML law – must be registered in the Polish CRBR within 14 days of the Polish subsidiary's KRS registration. The German parent's own entry in the German transparency register does not substitute for the Polish CRBR filing. Both registers must be maintained independently. Cross-border structures of this type benefit from coordinated compliance review, as described in our guide on compliance programme design for Italy subsidiaries in Poland, which addresses analogous multi-jurisdiction ownership chains.

What should your company prepare for CRBR compliance?

CRBR compliance is not a single filing. It is a continuous process that requires ownership monitoring, internal escalation procedures, and documented decision trails. The following checklist captures the minimum preparation for any covered entity.

Current ownership chart mapping all natural persons with direct or indirect control above 25%
Internal procedure assigning responsibility for CRBR updates to a named person (board member or compliance officer)
Trigger list: events that restart the 14-day clock (share transfers, pledges, new shareholder agreements, board changes affecting control)
Documented analysis supporting any use of the fallback rule (senior managing official as beneficial owner)
Annual review of CRBR entries against the current shareholder register and corporate documents

Companies with complex ownership structures should also consider integrating CRBR monitoring into their broader AML compliance framework. Whistleblower compliance channels – increasingly required under Polish whistleblower legislation – can serve as an internal escalation path when employees identify ownership changes that have not been reported. See our technical overview of whistleblower channel design technical requirements for the applicable standards.

GDPR intersects with CRBR in one specific way. Beneficial owners are natural persons. Their personal data appears in a public register. Companies must inform beneficial owners of this processing as part of their GDPR information obligations. Failure to do so is a separate compliance gap. Our analysis of GDPR audit common compliance gaps in Polish companies covers this intersection in detail.

Specific situations require expert review. CRBR obligations interact with AML, ESG reporting, CSRD Poland requirements, and GDPR in ways that a generic filing approach will not address. Your company's ownership structure, sector, and cross-border footprint all affect the analysis.

To receive an expert assessment of your company's CRBR compliance position, contact info@kordeckipartners.com.

Frequently asked questions

Q: Does the 14-day deadline run from the date of the share transfer agreement or from the date of KRS registration of the change?

A: The deadline runs from the date the change actually occurs – typically the date of the share transfer agreement or the date a pledge agreement becomes effective. It does not wait for the KRS to reflect the change. This is a common misconception. A company that waits for KRS registration before updating the CRBR will almost always file late. The 14-day clock starts when the legal change takes effect, not when it appears in any public register.

Q: What does a CRBR filing cost, and how long does the submission take?

A: The CRBR filing itself carries no state fee. The Ministry of Finance portal accepts submissions at no charge. Preparation time depends on the complexity of the ownership structure. A straightforward two-shareholder company can be filed in under one hour once the ownership analysis is complete. A multi-layer international group may require several days of legal analysis before the actual submission. Legal advisory fees vary accordingly. Budget at least two to four hours of legal time for any structure involving foreign entities or indirect control mechanisms.

Q: Is CRBR data really public, and what are the privacy implications for beneficial owners?

A: Yes – CRBR data is fully public and searchable without registration or fee. Any person, anywhere in the world, can search the register and retrieve the name, date of birth, citizenship, and country of residence of every registered beneficial owner. This creates genuine privacy considerations. Under data protection law, the company must provide beneficial owners with an information notice explaining that their data will appear in a public register. This obligation applies at the time of registration and again whenever a new natural person is added. Failure to provide this notice is a separate breach, independent of the CRBR filing itself.

KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to compliance, ESG, AML, and beneficial ownership register obligations. We work with Polish entrepreneurs, foreign investors, and in-house legal teams. To discuss your situation, contact info@kordeckipartners.com.