A German-owned holding company sets up a Polish subsidiary, appoints a local management board, and assumes the filing formalities are handled. Six months later, the Central Register of Beneficial Owners flags the entity as non-compliant. The parent company's ultimate beneficial owner was never disclosed. The fine reaches PLN 1,000,000 – and the reputational damage with a Polish banking partner compounds the problem further.
Poland's Central Register of Beneficial Owners (Centralny Rejestr Beneficjentów Rzeczywistych, CRBR) requires every obligated entity to identify and disclose its ultimate beneficial owner within 7 days of incorporation or any ownership change. Failure to meet this obligation exposes the entity – and its management board personally – to a financial penalty of up to PLN 1,000,000. The register is maintained by the Minister of Finance and operates under the Anti-Money Laundering and Counter-Terrorism Financing Act (ustawa o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu, AML Act).
This analysis covers the doctrinal foundations of CRBR, the entities subject to disclosure, the definition of beneficial ownership under Polish law, cross-border complications for foreign investors, and the strategic compliance steps that reduce exposure. Each section addresses a distinct layer of risk that practitioners and in-house teams frequently underestimate.
What is the legal foundation of the CRBR obligation?
Poland's CRBR framework rests on three pillars: EU anti-money laundering directives, the domestic AML Act, and a set of implementing regulations issued by the Minister of Finance. The register became operational in October 2019. Amendments introduced in 2021 significantly extended the category of obligated entities and tightened the definition of beneficial ownership. The National Court Register (Krajowy Rejestr Sądowy, KRS) and the CRBR are separate systems, but they interact: discrepancies between KRS data and CRBR filings trigger compliance alerts within the financial system.
The AML Act defines a beneficial owner as any natural person who exercises – directly or indirectly – decisive control over an entity, or on whose behalf a transaction is conducted. Polish law sets a 25% shareholding threshold as the primary indicator of beneficial ownership. Holding more than 25% of shares, voting rights, or economic interest creates a rebuttable presumption of beneficial ownership status. The presumption may be rebutted only by demonstrating that another natural person exercises effective control through other means.
Where no natural person meets the 25% threshold – or where the ownership structure is too complex to identify one – the AML Act introduces a fallback rule. In that scenario, the senior management officer (typically the management board president) must be disclosed as the beneficial owner. This fallback is not a safe harbour. It signals to obligated institutions (banks, notaries, auditors) that the ownership structure requires enhanced due diligence. Entities that rely on the fallback without genuinely exhausting the identification process risk enforcement action.
The Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF) and the General Inspector of Financial Information (Generalny Inspektor Informacji Finansowej, GIIF) both interact with CRBR data in their supervisory processes. Financial institutions subject to AML obligations are required to cross-reference CRBR disclosures against their own customer due diligence findings. Inconsistencies must be reported. This creates a second layer of scrutiny beyond the register itself.
Which entities must register – and what are the deadlines?
The scope of obligated entities expanded materially in 2021. The current list under the AML Act covers: general partnerships, limited partnerships, limited joint-stock partnerships, limited liability companies, joint-stock companies, simple joint-stock companies, European companies, cooperative societies, associations registered in the KRS, and foundations. Trusts with a Polish nexus are also captured. The 7-day filing deadline runs from the date of entry in the relevant register – typically the KRS – or from the date any disclosed information changes.
Foundations deserve particular attention. Since May 2023, Polish family foundations (fundacja rodzinna) have become a popular succession-planning vehicle. Each family foundation must register its beneficial owners in the CRBR. The beneficiaries of the foundation are not automatically beneficial owners – the analysis turns on who exercises control over the foundation's governing bodies. We secured clarification of a complex foundation structure for a manufacturing client in the Mazowieckie region (autumn 2025), avoiding a potential PLN 500,000 penalty by correcting the disclosed beneficial owner before a KAS audit commenced.
- 7-day deadline from incorporation or change of ownership
- No filing fee – submission is electronic via the Ministry of Finance portal
- The management board (or equivalent governing body) bears personal responsibility for accuracy
- Amendments must be filed within 7 days of any change – not within 7 days of discovery
- Trusts must disclose trustees, protectors, beneficiaries, and settlors
Foreign investors establishing Polish subsidiaries frequently miss the 7-day window. The KRS registration process itself can take several weeks. By the time the KRS number arrives, the CRBR deadline has often already passed. The solution is to prepare the CRBR filing in parallel with the KRS application – not sequentially. For ESOP structures involving Polish companies, the beneficial ownership analysis intersects with employee share ownership schemes; see our guidance on ESOP structuring for Polish startups and tech companies for the interaction between share option plans and CRBR disclosure obligations.
How does beneficial ownership analysis work in complex group structures?
Multi-tier corporate groups present the most demanding CRBR scenarios. Polish law requires the analysis to pierce every intermediate holding layer until a natural person is identified. A Luxembourg holding company owning 100% of a Polish subsidiary does not satisfy the disclosure obligation by naming the Luxembourg entity. The analysis must continue upward – through the Luxembourg company, through any further intermediate vehicles – until it reaches natural persons holding more than 25% or exercising effective control. This "look-through" obligation has no jurisdictional limit.
Private equity and venture capital structures add further complexity. A fund manager may argue that the fund's limited partners are passive investors with no control rights. Polish law does not automatically accept this characterisation. The GIIF has issued guidance indicating that general partners and fund managers who exercise investment discretion may qualify as beneficial owners of portfolio companies. Where a fund holds more than 25% of a Polish entity, the fund's own beneficial ownership chain must be traced.
We obtained a formal compliance clearance for a German investor's multi-tier holding structure in Lower Silesia (spring 2026), after mapping seven intermediate entities across four EU jurisdictions. The process took six weeks and required coordinated legal opinions from Polish, Luxembourg, and Dutch counsel. The lesson: CRBR analysis for complex groups is not a one-time exercise. It must be repeated whenever the group's ownership structure changes – including internal reorganisations that do not affect the Polish entity's direct shareholder.
Nominee arrangements are treated with particular scepticism under Polish AML law. A nominee shareholder does not displace the beneficial ownership of the economic owner. Where nominee arrangements exist – even if documented under foreign law – the economic owner behind the nominee must be disclosed. Failure to do so constitutes a false filing, which carries criminal exposure under the AML Act in addition to the civil penalty regime.
What penalties apply for non-compliance, and who bears personal liability?
The AML Act establishes a two-track penalty regime. Administrative financial penalties apply to the entity itself, up to PLN 1,000,000 per violation. Personal liability applies to management board members who, through intentional action or culpable negligence, fail to ensure timely and accurate filing. The personal liability track is not contingent on the entity's insolvency – it runs in parallel. A board member cannot escape liability by arguing that the compliance function was delegated to an external provider.
The GIIF enforces the penalty regime. Enforcement actions have increased since 2022, coinciding with the expansion of obligated entities and the introduction of automated cross-referencing between CRBR data and KRS filings. Penalties are published in the GIIF's public register of sanctions. Publication itself constitutes a reputational sanction – particularly damaging for entities seeking bank financing or participating in public procurement. The 30-day window for challenging a penalty decision before the administrative court (Wojewódzki Sąd Administracyjny, WSA) is short. Missing it forfeits the right to judicial review entirely.
Three categories of violation trigger the highest penalty exposure. First: failure to file within the 7-day deadline. Second: filing inaccurate information – for example, disclosing a 24.9% shareholder while a 26% shareholder exists but was overlooked. Third: failure to update the register after an ownership change. The third category is the most common source of enforcement action in practice, because ownership changes in complex groups often go unnoticed at the Polish subsidiary level. Implementing an internal change-of-control notification protocol – flowing from the parent to the Polish entity's management board – is the most effective mitigation.
What are the cross-border and ESG compliance dimensions?
CRBR obligations do not exist in isolation. They intersect with several other regulatory frameworks that foreign investors and Polish companies with international operations must manage simultaneously. The AML framework underpins the broader ESG and compliance architecture: accurate beneficial ownership disclosure is a precondition for meeting anti-corruption, sanctions-screening, and supply-chain due diligence requirements that are increasingly embedded in ESG reporting frameworks. CSRD Poland obligations, for example, require companies to map their governance structures – and CRBR data feeds directly into that mapping.
Whistleblower compliance is a related pressure point. Poland's whistleblower protection law, transposing the EU Whistleblowing Directive, creates internal reporting channels through which employees may report CRBR non-compliance. A company that has filed inaccurate beneficial ownership data is exposed not only to GIIF enforcement but also to internal whistleblower reports that trigger mandatory investigation obligations. The intersection of AML, ESG reporting, and whistleblower compliance creates a compliance architecture that requires coordinated management – not siloed responses.
For subsidiaries of foreign groups operating in Poland, the compliance programme design must account for CRBR requirements from the outset. Our analysis of compliance programme design for France subsidiaries in Poland – available at compliance programme design for France subsidiaries in Poland – addresses how CRBR obligations integrate into a broader subsidiary compliance framework. The same integration logic applies to other jurisdictions; see also our guidance on compliance programme design for Hungary subsidiaries in Poland for a comparative perspective on how different parent-country regulatory cultures affect CRBR implementation.
Sanctions screening adds another dimension. The EU and Polish sanctions regimes require obligated institutions to screen against beneficial ownership data. An entity whose CRBR filing is inaccurate may inadvertently obscure a sanctions nexus – exposing the entity, its bank, and its auditor to secondary sanctions risk. The compliance lawyer's role in Warsaw-based cross-border structures increasingly involves coordinating CRBR accuracy with sanctions compliance teams at the group level.
What is the strategic outlook for CRBR enforcement and regulatory development?
The regulatory trajectory points firmly toward stricter enforcement and broader scope. The EU's sixth Anti-Money Laundering Directive (AMLD6) and the proposed EU AML Authority (AMLA) will further harmonise beneficial ownership registers across member states. Once AMLA becomes operational – expected from 2026 – cross-border data sharing between national registers will intensify. Discrepancies between CRBR data and equivalent registers in Luxembourg, the Netherlands, or Cyprus will be systematically flagged. Polish entities with foreign ownership chains that have relied on the complexity of their structure to avoid scrutiny face a narrowing window for voluntary correction.
The Polish legislature is expected to introduce further amendments aligning CRBR with AMLA requirements. These are likely to include: shorter filing deadlines (potentially reduced from 7 to 3 days), mandatory periodic re-confirmation of disclosed data (annually or on a rolling basis), and expanded categories of obligated entities (potentially capturing certain contractual arrangements and civil-law partnerships). Companies that treat CRBR as a one-time registration task – rather than an ongoing compliance obligation – are building structural risk into their operations.
The practical implication for compliance lawyers and in-house counsel is clear. CRBR management requires an ownership-monitoring protocol embedded in the group's corporate governance calendar. Every change in indirect ownership – a share transfer at the grandparent level, a restructuring of an intermediate holding vehicle, a new investor entering the fund that holds the Polish entity – must trigger a CRBR review within 7 days. The cost of that review is negligible. The cost of missing it can reach PLN 1,000,000 per entity, plus personal liability for the management board, plus reputational consequences that cannot be quantified in advance.
AML enforcement in Poland is becoming more sophisticated. The GIIF is investing in analytical tools that cross-reference CRBR data with KRS filings, tax identification data, and financial intelligence. The era of low-enforcement tolerance for CRBR inaccuracies is ending. Entities that correct voluntary errors now – before an audit commences – benefit from a significantly more favourable enforcement posture than those discovered through the GIIF's own detection processes.
Your company's specific CRBR position may carry exposure that is not visible from the filed data alone. A gap between the disclosed structure and the economic reality of control creates irreversible consequences once an enforcement process begins – the ability to correct voluntarily closes the moment the GIIF opens a formal inquiry.
To receive an expert assessment of your beneficial ownership disclosure obligations – including a review of multi-tier group structures and cross-border compliance gaps – contact info@kordeckipartners.com.
Frequently asked questions
Q: Does a foreign company owning a Polish subsidiary need to disclose its own shareholders in the CRBR?
A: Yes. The CRBR obligation requires disclosure of the ultimate natural person beneficial owner, regardless of how many intermediate entities sit between that person and the Polish company. The foreign parent company is not the endpoint of the analysis. The look-through obligation applies to every layer of the ownership chain, including entities incorporated outside Poland and outside the EU. The management board of the Polish subsidiary bears personal responsibility for ensuring that the full chain has been traced correctly.
Q: How long does a CRBR update typically take, and what does it cost?
A: The electronic filing itself takes approximately 30 minutes once the data is prepared and the qualified electronic signature is available. There is no filing fee. However, the preparatory work – identifying the correct beneficial owner, obtaining necessary documentation from foreign entities in the chain, and conducting the legal analysis – can take from one day to several weeks in complex group structures. The 7-day deadline runs from the triggering event, not from when the management board becomes aware of it. Building an internal alert mechanism for ownership changes is therefore more cost-effective than managing deadline pressure reactively.
Q: Is it true that disclosing a management board member as beneficial owner satisfies the CRBR obligation in all cases?
A: This is a common misconception. Disclosing a senior manager as beneficial owner is only permitted as a last resort – where the identification process has been genuinely exhausted and no natural person meeting the ownership or control thresholds can be found. It is not a shortcut available whenever the ownership structure is complex or inconvenient to document. Filing a management board member as beneficial owner when a natural person shareholder holding more than 25% exists constitutes an inaccurate filing. The GIIF treats this as a substantive violation, not a technical one, and the penalty exposure is the same as for a complete failure to file.
KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to ESG compliance, AML obligations, and beneficial ownership analysis. We work with Polish entrepreneurs, foreign investors, and in-house legal teams navigating CRBR disclosure requirements across complex multi-tier group structures. To discuss your situation, contact info@kordeckipartners.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. KORDECKI & Partners assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.