Five registries, one prompt: Polish accounting firm's AML/KYC checks - KRS, CEIDG, CRBR, and sanctions screening - in one prompt.

Prune — Thu, 27 Aug 2026 20:00:00 +0000

How an AI assistant can check a client against Poland's company register, VAT list, beneficial-owner registry, and sanctions lists - and hand you a ready-to-file compliance document before your coffee gets cold.


5	registries and lists to check by hand for every new client
~60–90 min	what a thorough manual check of one company usually takes
1	prompt to an AI assistant to get a finished risk card

An obligation nobody enjoys

Under Polish AML law, an accounting firm is an "obligated institution" - the same legal category as banks and notaries, just a lot smaller - regardless of whether it serves a one-person business or a company with foreign shareholders.

In practice that means mandatory customer due diligence before you can even start working with a client: identify the entity, establish its beneficial owner, screen it against sanctions and PEP lists, and produce a documented risk assessment.

Done by hand, that looks like: one tab for the court register (KRS), a second for the VAT payer list, a third for the beneficial-owners registry - which happens to sit behind a CAPTCHA — a fourth for some sanctions list, and a fifth: a blank document where all of it has to be stitched into something coherent. At ten new clients a month, that's realistically a full day of work that is neither bookkeeping nor advisory — it's just copying data between
systems.

And if the regulator's audit turns up a missing or incomplete file, the Act allows administrative fines of up to EUR 1,000,000. In practice, small firms typically see something closer to PLN 15,000–25,000 (roughly EUR 3,500–6,000) - plus something that stings more than the fine itself: the firm's name published in the public register of violations.

One conversation instead of five tabs

AML Poland MCP connects an AI assistant — Claude, for instance — directly to the registries you already have to use. Instead of clicking through pages, you just ask.

Under the hood, it's an implementation of MCP (Model Context Protocol), the open standard that lets a language model reach for real data instead of guessing. This particular server gives an assistant four concrete tools:

Tool	What it does
`verify_company_basic`	Registry status (court register or sole-trader register), legal form, address, board members, VAT payer status, and reported bank accounts.
`fetch_crbr_beneficiaries`	Beneficial owners from Poland's Central Register of Beneficial Owners — name, citizenship, and the nature of their control.
`screen_sanctions_and_pep`	Screens a person against EU/UN/OFAC sanctions lists and the Polish national list, plus PEP (politically exposed person) status.
`generate_aml_risk_card`	Ties all of the above together, computes the risk level and required procedure (standard or enhanced diligence), and generates the finished document — Markdown or PDF.

In a conversation, it looks roughly like this:

> Check client NIP 7740001454 for AML and generate a risk card.

Checking the court register, the VAT list, the beneficial-owners
registry, and sanctions lists. Here's the summary:

  Name              ORLEN SPÓŁKA AKCYJNA
  Registry status   Active
  VAT status        Active payer
  Beneficial owners manual check required (CAPTCHA)

  Risk level        Medium
  Procedure         Standard
  Document          risk_card.pdf

That's not a made-up example - it's the exact result the server returns for a real NIP, checked live against the public registries while this tool was being tested.

What happens under the hood

No database of its own, no middleman that could go stale. Every query goes straight to the official source.

Accounting firm
      │
      ▼
AI assistant  (Claude + MCP)
      │
      ▼
KRS / CEIDG · VAT White List · CRBR (UBO) · Sanctions & PEP
      │
      ▼
Risk card  (PDF / Markdown)

Four tools reach into five official sources — the Ministry of Justice (the KRS company register), the Ministry of Finance (the VAT White List and the CRBR beneficial-owners registry), Poland's Ministry of Interior (its national sanctions list), and the OpenSanctions aggregator (EU/UN/OFAC sanctions plus global PEP data) - and a risk engine combines the results into one assessment, following the Act's own thresholds: any sanctions or PEP hit automatically raises the risk to high and triggers enhanced due diligence.

What this tool does not pretend to do

Public registries have real limitations - and we'd rather the tool say so plainly than quietly skip a step.

CRBR — The public beneficial-owners search is protected by an invisible Google CAPTCHA. This tool does not attempt to bypass it - instead it clearly reports that a given entity needs manual verification, with a link to the official search UI.
KRS — The public company-register API masks board members' personal data (e.g. J*****). Full identification still has to rest on the representative's ID document anyway — the tool flags this itself instead of falsely reporting "all clear."
CEIDG — The sole-trader register requires its own API token (free after registration). Without it, company checks work normally and the sole-trader check is simply skipped — with a clear note explaining why.

A finished document, not raw data

Every check ends in a Client AML Risk Assessment Card - the exact document a firm has to keep on file anyway, just already written.

Markdown - to paste into an internal system, edit further, or feed into your own automation. Plain text, no locked-in format.
PDF - to sign, print, and send to the client. Full Polish diacritics render correctly - even inside the bank-account table.

The document defaults to Polish, since that's the language a Polish firm's records are kept in, but every tool takes a language parameter - switch it to English with a single word if a client or auditor needs that. The server itself stores nothing: no client database, no query history beyond your own environment. The five-year retention duty stays exactly where it should: with the firm.

Who this is for

An independent accounting firm - install it once in Claude Desktop or Claude Code, and from then on every new client is one prompt, not thirty minutes of clicking through registries.
An accounting-software vendor - the code is open (MIT license) and embeddable as an integration inside a platform like Comarch Optima, inFakt, or wFirma - an AML module as a built-in feature, not one more browser tab.

Five registries. One prompt. The rest is coffee.

The source is fully open on GitHub — browse it, run it locally, or self-host it so client data never leaves your own infrastructure except for calls to the official registries.

→ View the repository on GitHub

MIT License · Python + FastMCP · data from KRS, CEIDG, the Finance Ministry's White List, CRBR, OpenSanctions, and the MSWiA list.

AML Poland MCP is an open tool for accounting firms. It does not replace the judgment of a designated AML/compliance officer.

DEV Community: Prune