Provides financial services, in Poland

Dz. U. 2024 poz. 731, art. 16 i art. 5 pkt 30 ustawy o zapewnianiu spełniania wymagań dostępności niektórych produktów i usług przez podmioty gospodarcze · Read the law's page

• If you offer or provide to consumers consumer credit or mortgage credit agreements, brokerage activities within Article 69(2) points 1, 2, 4 and 5 and (4) points 1, 2, 5 and 6 of the Act on Trading in Financial Instruments, electronic money services, services linked to a payment account, or payment services, meet the general service requirements of Article 12 (Art. 5 point 30; Art. 3(2) point 4).
• In addition, make the methods of consumer identification, electronic signature, security and payment services perceivable, functional, understandable and compatible (Art. 16 point 1; implements Directive (EU) 2019/882, Annex I, Section IV, point (e)(i)).
• Give information in Polish or, with the consumer's consent, in another language at level B2 of the Council of Europe Common European Framework of Reference for Languages (Art. 16 point 2; Annex I, Section IV, point (e)(ii)).
• The Act does not apply to services offered or provided by microenterprises (Art. 4 point 1).

Dz. U. 2024 poz. 731, art. 38-66 i art. 73 ustawy o zapewnianiu spełniania wymagań dostępności niektórych produktów i usług przez podmioty gospodarcze · Read the law's page

• If an authority starts an inspection of your product or service, hand over the evidence and information it reasonably asks for, make documents available and allow copies, give written and oral explanations, let the inspector enter your premises and buildings used to offer the service, and hand over product samples free of charge; a business holding products or documents that fall within an inspection of another operator must make them available on request (Arts. 44 to 46 and 49).
• Keep the control sample in conditions that do not change its quality until the authority releases it (Art. 47(5)).
• Bear the test fees if the product is found not to meet the accessibility requirements; the State Treasury bears them if it does (Art. 48).
• If an inspection finds that a product does not meet a requirement and you did not make the Article 21(2) assessment, or made it or applied its criteria wrongly, make the assessment and present its results within the period the authority sets, which is not shorter than 60 days; if you do not, the authority opens proceedings (Art. 51(2) and (3)).
• If the authority finds a product non-compliant, take the corrective action needed or withdraw the product and show within the period it sets, not longer than 120 days from receipt of its call, that you did so; if it finds a service non-compliant, take the corrective action or stop offering the service and show that within the same period (Art. 52(1) point 1 and Art. 62(1) point 1).
• If the product or service endangers the health or safety of consumers, notify consumers in the way the authority specifies and show that you did (Art. 52(2) and Art. 62(2)).
• Comply with the decision that orders you to ensure the product or service meets the requirements or to carry out the duties not performed, to withdraw the product, to stop offering the service or not make the product available, or to notify consumers, and inform the authority of its execution in the way and time it sets; a decision may be made immediately enforceable where a consumer's interest requires it (Art. 56 and Art. 65).
• Comply with a ban on making the product available or on offering the service for up to 180 days, which the authority may extend until the proceedings end (Art. 52(1) point 2, Art. 54, Art. 62(1) point 2 and Art. 64).
• Pay a fine within 14 days from the day the decision imposing it becomes final, into the Accessibility Fund (Art. 73(5)).
• Services offered or provided by microenterprises are outside the Act (Art. 4 point 1).

Ustawa z dnia 25 czerwca 2025 r. (Dz.U. 2025 poz. 1069), art. 18za do 18zl ustawy o nadzorze nad rynkiem finansowym i art. 133 ust. 2b Prawa bankowego · Read the law's page

• If you are a financial entity within Article 2(2) of Regulation (EU) 2022/2554 (DORA) and not excluded by Article 2(3), give the Komisja Nadzoru Finansowego the information, documents and explanations it requires within the scope of DORA, and submit to its inspections of your DORA compliance (Articles 18za to 18zc).when it serves a financial business
• Report a major ICT-related incident to the Komisja Nadzoru Finansowego with an initial notification, and submit the reports that DORA Article 19(4) requires (Article 18zg).when it serves a financial business
• Notify the Komisja Nadzoru Finansowego when you join or leave cyber-threat information-sharing arrangements under DORA Article 45 (Article 18zj).when it serves a financial business
• If the Komisja Nadzoru Finansowego designates you by decision to carry out advanced threat-led penetration tests under DORA Article 26, submit your assessment of the functions to be tested to it for approval (Article 18zk).when it serves a financial business
• Tell the Komisja Nadzoru Finansowego how you have taken into account the risk identified in a recommendation to a critical ICT third-party service provider you contract with, in particular any change to the contract (Article 18zl).when it serves a financial business
• If you are an external ICT service provider to which a bank has outsourced functions or activities, provide the information the Komisja Nadzoru Finansowego calls for during an inspection of the bank (Banking Law Article 133(2b)).for a supplier to a financial business

Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.
• Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.
• From 3 April 2027, twelve months after the Act's entry into force on 3 April 2026, Article 8 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform (Załącznik nr 2, Dostawcy usług cyfrowych) among the digital service providers it reaches expressly. Such a provider is an important entity under Article 5(2) point 2 when it meets or exceeds the medium-enterprise size threshold of Article 2(1) of Annex I to Regulation (EU) No 651/2014, and the Act binds it only where Poland is its main place of business or, with no establishment in the European Union, where it has designated a representative in Poland (Article 5a(3), (7) and (9)). The wider sector classes the Załączniki also reach (critical-facility operators, energy, transport, health, finance, telecommunications and digital-infrastructure providers, and public administration) are reached too, by meeting the Article 5 criteria: entry in the register of essential and important entities records that status and does not create it (Article 7d(5)). Banking and financial-market-infrastructure entities are excluded from this Article's system duty, apart from the systematic risk assessment and risk management of Article 8(1) point 1 and the basic cyber-hygiene principles of point 2(j) (Article 8i(1)).