A new counterparty lands in the ERP in 30 seconds — someone types the tax ID, adds the name from memory, pastes the address from an email and hits save. Two months later it turns out the company was struck from the court registry six months earlier, the tax ID had a typo, and the counterparty has been on the EU sanctions list for five months. All of these things could have been checked automatically — and it's worth doing before the first invoice goes out.
Counterparty verification in a typical Polish SME usually comes down to two things: someone, somewhere, checks the tax ID against the Ministry of Finance "white list" (on a good day), and glances at CEIDG to see if the company still exists. Everything else — status in the KRS court registry, VAT-UE registration in VIES, presence on sanctions lists, consistency between the name/address and what the official REGON registry holds — falls through the cracks. It surfaces later, at an audit, a tax inspection, or a payment that never arrives.
What you can actually check automatically
Most public registries in Poland and the EU now expose an API — free, or at a price that's irrelevant to an SME. Pulling them into your ERP at the moment a counterparty record is created gives you five things in one move:
- REGON registry (GUS API) — official name, registered address, business classification, active/inactive status. Pre-fill by tax ID eliminates address typos that come back for years as "parcel undeliverable".
- White list of VAT taxpayers (MF API) — VAT status (active / exempt / unregistered) and the bank accounts the company has officially reported. Mandatory for transfers of PLN 15 000 or more. We covered this in a separate post on the white list.
- VIES (EC API) — whether an EU counterparty is actually registered for intra-EU VAT. Without an active VAT-UE number, 0% WDT sales are hard to defend.
- KRS court registry (MS API) — legal form, status (active / in liquidation / struck off), representation. Being struck from KRS is not always visible in CEIDG.
- Sanctions lists — the EU Consolidated List, the Polish MSWiA list, and often the US OFAC SDN list. Companies and people tied to Russia, Belarus, Iran and a few other regimes end up on them. A single bad hit is a real criminal risk, not just a reputational one.
None of these sources is hard to wire in. The hard part is maintaining the discipline that "it happens on every new record, no exceptions".
Why pre-fill by tax ID is more than a convenience
The cheapest and fastest-paying part of this puzzle is pulling data from the REGON registry automatically after someone types the tax ID. The counterparty form looks almost identical in Comarch Optima, enova365, Subiekt GT and Microsoft Dynamics — the fields are the same, only the order differs. Most Polish ERPs already have REGON integration built in; some need a plugin, some a bit of custom automation.
The effect is threefold. First, typos in names and addresses disappear — and they are responsible for most undelivered parcels, postal returns and JPK reporting problems. Second, it becomes much harder to create two records for the same counterparty under two slightly different names (the classic "ABC Sp. z o.o." vs "ABC Spółka z o.o."). Third, the "full name" field matches what the white list of VAT taxpayers holds — which means that comparing the bank account against the MF list even starts to make sense.
At one of our clients — a 25-person wholesaler of building materials in Lower Silesia, running on Comarch Optima — creating a new counterparty record took an average of 4 minutes and generated roughly one error per 15 records (usually a street-name typo or "sp. z o.o." vs "sp.z o.o."). After we switched on pre-fill from REGON and automatic checks against VIES, KRS and sanctions lists, the time dropped to 20 seconds and the number of record corrections in a quarter fell from 42 to 3. One of the checks caught a company that had been struck from KRS three months earlier — the deal was supposed to go out on PLN 47 000 of trade credit. It went out on prepayment instead.
When to verify: not just on creation
A one-off check at record creation is the bare minimum, and it's not enough. Public registries are living data — companies go bankrupt, VAT-UE numbers expire, sanctions lists are updated every few weeks. A pragmatic cadence looks like this:
- At record creation — the full pack (REGON, white list, VIES if EU, KRS, sanctions). If something doesn't line up, block the save, or require an explicit override with a note on who allowed it and why.
- At the first invoice above a threshold (say PLN 10 000 gross) — re-verify. Especially the white list, because the account status may have changed between the record being created and the invoice being issued.
- Monthly batch — against all active counterparties. Mainly sanctions lists and KRS status. Run it overnight; the result lands as an alert in a "counterparties to review" inbox.
- On every transfer of PLN 15 000 or more — white list check. This is a legal obligation, not a best practice.
That split spreads the API cost over time and still catches most changes early enough to react.
Pitfalls that will definitely happen
None of this works unthinkingly. Three things worth knowing up front:
- Registry data lags. REGON refreshes in a cycle of several days; KRS can take weeks to publish entries. Automatic verification doesn't replace common sense when something feels off.
- API limits are real. The REGON API needs a key and has a daily request limit; VIES can be unavailable for hours at a time (especially around month-end). You need a fallback — queueing the request and retrying — rather than a hard block that stops user work.
- Sanctions lists produce false positives. "Ivanov" is a common surname. You need a manual-override path for hits that are obviously the same name but a different person. Without it, the team learns to click "ignore" on everything within a week, and the whole verification quietly stops meaning anything.
How to start this week
You don't need to do everything at once. A practical order, by payback speed:
- Step 1 — turn on REGON pre-fill in the ERP if you don't have it yet. In most Polish ERPs that's a config checkbox and an API key. One day of work.
- Step 2 — plug the white list into your transfer flow. If your bank integrates with the ERP via a file, add validation on the export step. If not — validate at invoice approval.
- Step 3 — add VIES for EU counterparties and KRS for limited-liability companies. Both APIs are free.
- Step 4 — add sanctions lists. If you don't have in-house capacity, buy a ready-made service; maintaining list currency yourself is tedious and easy to forget.
- Step 5 — set up the monthly batch (overnight) and a procedure for handling the alerts. Without the procedure, nobody will read the alerts anyway.
The whole thing fits into 2–4 weeks of work, depending on the ERP and how much custom code lives around the counterparty record. Payback — measured in time saved on record creation and in one bad transaction avoided per year — is usually around six months.
A new counterparty record in your ERP is the last moment when verification is cheap. After that there's an invoice, a transfer, and a problem.