MF White List · VAT

Unlimited White List VAT verification. One API.

Verify Polish VAT bank accounts at payment-run scale, with reproducible audit evidence for every check — past the official API's daily caps (100 search queries or 5,000 subjects per day).

Join the beta how it works →

POST /v1/verify/vat-whitelist

nip 3766956617

account 34102012221314181237774212

date 2026-07-02

on_list_active source: flat_file

checked_date: 2026-07-02
matched_via: direct
file_generated_at: 2026-07-02
evidence.file_checksum: ac2fe966…733ce3

If you pay a business more than 15,000 PLN, the account has to be on the list.

Since September 2019, Poland keeps a public register — the White List of VAT taxpayers (Wykaz podatników VAT), run by the head of the National Revenue Administration. It lists every active and exempt VAT payer and the bank accounts they've declared.

The obligation that makes it matter: when you pay another business and the one-off transaction value exceeds 15,000 PLN, the payment has to go to an account on the White List. (The threshold is a strict over 15,000; the “gross value” reading is the tax authorities' interpretation, not the literal statute.)

Pay a >15,000 PLN transaction to an account that isn't on the list, and:

You lose the tax-deductible cost — the amount can't be counted as a cost of earning revenue.
You become jointly liable — with the seller, with your whole estate — for the VAT on that supply.

There's an escape hatch: file a ZAW-NR notice to your own tax office (the payer's) within 7 days of ordering the transfer, and both consequences fall away — once per account since July 2020, not per payment.

The catch at scale. The official API is capped at 100 search queries a day (30 subjects each) or 5,000 subjects a day. Exceed either limit and MF can block you until midnight — and the block takes down the browser-based checker on podatki.gov.pl too, so your accountants go dark mid-payment-run. Every check still has to be provable at audit.

Not legal advice — a developer's summary of public rules. Sources at the foot of the page.

Three fields in. A definitive answer, with proof, out.

01 · ask

Send a NIP, a 26-digit bank account (NRB), and the date you want checked.

02 · resolve

We recompute MF's own hash over the day's official flat file — masks included — or call the MF API for the official identifier.

03 · file it

Get one of five definitive states, plus evidence you can store: file checksum + date, or the MF search identifier.

curl -X POST https://api.wekyb.io/v1/verify/vat-whitelist \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"nip":"3766956617","account":"34102012221314181237774212","date":"2026-07-02"}'

{
  "status": "on_list_active",
  "account_on_list": true,
  "matched_via": "direct",
  "checked_nip": "3766956617",
  "checked_account": "34102012221314181237774212",
  "checked_date": "2026-07-02",
  "file_generated_at": "2026-07-02",
  "stale_as_of": null,
  "source": "flat_file",
  "evidence": {
    "file_checksum": "ac2fe966…733ce3",
    "file_bronze_ref": "gs://…/2026-07-02.7z",
    "request_id": null
  }
}

the five states

on_list_active active VAT payer, this account is on the list
on_list_exempt exempt payer, this account is on the list
account_not_on_list_nip_active payer is active, but this account is not on the list — the split-payment red flag
account_not_on_list_nip_exempt same, for an exempt payer
not_found the NIP isn't on the list at all

Two grades of proof. We tell you which one you're holding.

A “yes” is worthless at audit if you can't show what the official list said, on what day. wekyb returns proof, not just a verdict — in one of two honestly different grades.

Grade 1 — reproducible (flat-file)

Computed from MF's official daily file with MF's published algorithm. The result carries the file's generation date, its checksum, and a pointer to the raw file we stored unaltered. Anyone can re-run the hash and match the checksum. Unlimited, and dated to that day's file.

Grade 2 — official identifier (API)

A live MF API call returns the official search identifier (identyfikator wyszukiwania) — the key MF itself issues to document a check. The strongest evidence there is, and rate-limited by MF, so it's for the transactions where you want that identifier on record.

Neither grade is real-time truth about a bank account — both are proof of what the official White List stated. The result's source field says which grade you hold (flat_file or api); request_id appears only on the API path. We never reconstruct evidence after the fact.

POST /v1/verify/vat-whitelist

nip 3766956617

account 34102012221314181237774212

date 2026-07-02

on_list_active source: flat_file

checked_date: 2026-07-02
matched_via: direct
file_generated_at: 2026-07-02
evidence.file_checksum: ac2fe966…733ce3

POST /v1/verify/vat-whitelist

nip 5272617898

account 34102012221314181237774299

date 2026-06-30

account_not_on_list · nip_active source: api

checked_date: 2026-06-30
evidence.request_id: d2n10-84df1a1

White List first, done properly. Then, adjacent depth.

Each ships when it meets the same bar as the White List check: official source, reproducible evidence. Not before.

KRS company data, in English

coming soon

The Polish company register (KRS) by NIP or KRS number, with fields translated — not a raw dump.

VIES validation

coming soon

EU VAT-number checks with retries and a stated SLA.

Sanctions screening

coming soon

EU / UN / OFAC lists, with the same evidence-first treatment.

Webhooks

coming soon

Get told when a counterparty changes — e.g. an account drops off the list — instead of re-polling.

MCP server

coming soon

Let an AI agent verify a counterparty directly, over the Model Context Protocol.

Free while we're in beta.

Unlimited White List checks, no card, during the beta. Pricing will be usage-based and we'll publish it — with notice to beta users — before it starts. It's a beta: there's no formal uptime SLA yet, and we'd rather earn the paid relationship than surprise you into one.

Join the beta the one-field signup form lands shortly

Questions

Is this the official White List? +

No. The official register is the Wykaz podatników VAT, run by Szef KAS. wekyb mirrors that official file and calls MF's official API; your evidence references the official file (by checksum) or MF's own search identifier. We're the fast, provable way to use the official source — not a replacement for it.

How fresh is the data? +

MF publishes the flat file once per business day, and flat-file checks reflect that day's file (we show you file_generated_at). When you need an identifier issued now, use the API path.

Can I check a past date? +

Yes. The check takes a date; recent days answer from the stored daily files, and older dates route through the official-confirmation (API) path. The official register supports a 5-year lookback — which is exactly what audit season is about.

Does a check give me legal protection? +

The MF API's search identifier is the officially recognized confirmation of a check. A flat-file check gives you reproducible evidence — the file's checksum and the ability to re-run MF's own hash — of exactly what the list said that day. We surface both so you can choose. (This isn't legal advice.)

What exactly is the 15,000 PLN rule? +

For a B2B transaction whose one-off value exceeds 15,000 PLN, payment must go to a White-List account, or you lose the tax-deductible cost and take on joint liability for the seller's VAT. See the sources at the foot of the page.

What if I already paid to an off-list account? +

File a ZAW-NR notice to your tax office within 7 days of the transfer — that restores the deduction and clears the joint liability. Since July 2020 it's once per account, not per payment.

Can I really check at payment-run scale? +

Yes — that's the point. Flat-file checks aren't bound by the MF API's daily caps (100 search queries or 5,000 subjects per day), so a payment run of any size is fine.

Do you handle virtual (masked) accounts? +

Yes. The White List publishes virtual-account masks for some payers; wekyb resolves them, so a virtual account that maps to a listed payer is matched correctly rather than reported as “not on the list”.

Where is my data, and what do you store? +

In the EU. Analytics are cookieless — no tracking cookies, no consent banner. For the beta we store your email and an optional monthly-volume answer, nothing more.