AML 2026 Amendment: New CRBR Rules and the SIGIIF System

The Polish financial market is facing a major compliance reform. The draft amendment to the AML Act (project no. UC75) implements EU Directive 2024/1640[1]. The new regulations will fundamentally change the rules for accessing the Central Register of Beneficial Owners (CRBR) and introduce the brand-new SIGIIF (GoAML) IT system. For compliance departments, this means needing to revise internal procedures.

Restrictions on CRBR Transparency – New Access Rules

In response to the CJEU rulings, the draft abolishes the general public access to the register for any citizen:

• Legitimate Interest: Commercial entities and other third parties must now demonstrate a “legitimate interest” in preventing or combating money laundering to obtain access to beneficial ownership data (Art. 68d (1) of the AML Act).
• Access by Operation of Law: Obligated institutions will obtain direct access to register data by operation of law in order to apply customer due diligence (CDD) measures (Art. 68a(1)(2) of the AML Act).

The New SIGIIF (GoAML) System – Registration Deadlines and Reporting Obligations to the GIIF

The SIGIIF system will replace the current paper and electronic forms. Above-threshold transaction reporting to the GIIF will be handled exclusively through this secure and structured channel. The entry into force of these regulations is planned for October 1, 2026. The registration process for existing institutions has been divided into four phases:

• By October 7, 2026: Banks and cooperative savings and credit unions (SKOK).
• From October 8 to October 21, 2026: Domestic payment institutions (KIP), small payment institutions (MIP), and payment service bureaus.
• From October 22 to October 28, 2026: Investment fund managers (TFI), investment funds, and insurance companies.
• From October 29 to November 11, 2026: All other obligated institutions.

Assessment of the Risk of Financing the Proliferation of Weapons of Mass Destruction (WMD)

Under the newly added Art. 27(1a) of the AML Act, obligated institutions must identify and assess risks associated with the financing of the proliferation of weapons of mass destruction (WMD) before launching new products, services, delivery channels, or technologies, in line with the latest FATF standards.

What Do You Need to Do Now?

• Audit your KYC/AML procedures to address proliferation (WMD) financing risks.
• Verify your system integration with the SIGIIF API.
• Review outsourcing agreements to ensure third-party beneficial ownership verification models comply with the new CRBR access rules.

You can follow the legislative process for draft UC75 in real time on the website of the Government Legislation Center. If you need assistance in assessing the impact of the proposed regulations or in implementing new procedures, please contact our FinTech team. We will help prepare your organization for the upcoming legislative changes.