KSeF 2026 — how to log in and avoid penalties: a guide for foreign-owned Polish companies

The National e-Invoicing System (KSeF) is already mandatory: receiving invoices through KSeF has applied to every business since 1 February 2026, and issuing them has applied to all remaining companies since 1 April 2026. Penalties for invoices issued outside the system, however, only start on 1 January 2027 — so there is still time to set everything up properly. For a foreign owner the hardest part is not the penalties but the login itself, because a Polish limited company cannot authenticate with Profil Zaufany. The answer is a qualified electronic seal issued against the company’s NIP: it works immediately, with no PESEL and no Polish e-ID. Below we explain the deadlines, the authentication methods, the permissions you grant your accountant and — most importantly for our clients — how a company with a foreign owner and a virtual office address can use KSeF in full.

This article complements our guide to VAT registration with a virtual office: that one covers when the tax office may refuse registration; this one covers how to issue and receive e-invoices correctly once you are registered.

In brief

• Receiving invoices in KSeF has been mandatory for everyone since 1 February 2026 — if you have not configured access, your counterparties’ invoices are already arriving and you are not collecting them
• Issuing in KSeF applies to all remaining companies since 1 April 2026
• Penalties only start on 1 January 2027 — sources not updated since August 2025 wrongly give 1 August 2026; that date is obsolete
• A Sp. z o.o. cannot log in with Profil Zaufany or a personal signature — it needs a qualified electronic seal, a token or a KSeF certificate
• A foreign owner without a PESEL can use KSeF without obstacles — the cleanest route is a qualified seal on the company’s NIP
• A virtual office is not a problem — KSeF verifies the NIP and the invoice structure, and does not check the address at all

---

What KSeF is and when it applies

KSeF is Poland’s National e-Invoicing System — a central, government-run platform through which structured invoices (XML in the FA(3) schema) are issued and received. An invoice is deemed issued and delivered the moment the system accepts it; paper and PDF cease to be the primary form of business-to-business exchange.

The obligation arrives in stages. The table below shows the position in 2026:

The most important conclusion from this table: the obligation to receive invoices covered everyone as early as 1 February 2026 — with no threshold and no transitional period. This means that even a dormant company or a business with minimal turnover must have working KSeF access today, because counterparties are issuing invoices to its NIP inside that system. If you have not configured access, those invoices are sitting there uncollected. It is the most common gap we see in the summer of 2026.

Are foreign owners and companies with a virtual office covered by KSeF?

This is the first question our clients ask, and a good deal of myth surrounds it. The answer is unambiguous: yes, a company with its registered seat in Poland is covered by KSeF, regardless of the owner’s nationality and regardless of whether its address is a traditional or a virtual office.

Exclusions from KSeF relate to the entity — for example a taxpayer with neither a seat nor a fixed establishment in Poland. A Polish Sp. z o.o. with a Warsaw virtual-office address has its seat in Poland and is therefore fully within the system. There is no “loophole for foreigners” — the shareholder’s nationality is irrelevant here.

The good news is that being covered creates no address problem whatsoever — as explained below — and the login itself, while requiring a different method than for a Polish citizen, is entirely achievable without a PESEL.

Virtual office and KSeF — why the address is not a problem

Let us dispel the most common fear directly: KSeF neither checks nor validates the address. When accepting an invoice the system verifies conformity with the XML schema, the NIP checksum, uniqueness, dates and permissions — and nothing beyond that. It does not compare the address against CEIDG, the KRS, the VAT white list or VIES.

The Ministry of Finance confirms this itself: “The system does not check the correctness of the counterparty’s data. If you entered the wrong NIP, the invoice will be accepted.” The only identity anchor KSeF enforces is the NIP. A virtual-office address passes through KSeF in exactly the same way as any other address.

One caveat, in fairness: the fact that KSeF does not examine the address does not remove the general principle that company data should match the public registers. That principle applies independently of KSeF — and a virtual office satisfies it, provided it is the company’s genuine address as registered in the KRS. Address-related risk arises at the VAT registration stage (art. 96(4a) of the VAT Act) and with the white list — we describe it in a separate guide — not in KSeF. This is worth remembering, because online guides frequently confuse the two stages and raise KSeF alarms for no reason. To this day the Ministry of Finance has issued no interpretation dealing specifically with “virtual offices” in the KSeF context — because there is nothing to interpret.

How to log in to KSeF — the methods depend on legal form

Here lies the real challenge and the most common source of error. The login method depends on the company’s legal form — and what works for a sole trader will not work for a limited company.

Two conclusions follow from this table that will save you hours of frustration:

A Sp. z o.o. cannot log in as a company using Profil Zaufany or a personal qualified signature. Those are methods for a natural person. A company authenticates with a qualified electronic seal, a token (transitionally, until the end of 2026) or a KSeF certificate. If you have heard that “Profil Zaufany is enough”, that is advice for sole traders, not for companies.

“Logging in with a NIP” does not exist. The NIP is the authentication context — it tells the system which company you are acting for — but it is never a credential in its own right. Any guide describing “logging in with a NIP number” is simply wrong.

A few words on tokens and certificates, because this is a frequent trap:

• A token carries permissions but works only transitionally — until 31 December 2026. Importantly, tokens from KSeF 1.0 (the voluntary period) are inactive in KSeF 2.0 and had to be generated afresh. “I have a token from last year” does not mean it works.
• A KSeF certificate serves authentication only and confers no permissions by itself — you must already hold them. A certificate is issued only after logging in with one of the primary methods (seal, signature, Profil Zaufany), is valid for a maximum of two years, and is what will replace tokens after 2026.

A foreign owner without a PESEL — the concrete route

This is the section this article was written for. All the “national eID node” methods (Profil Zaufany, mObywatel, e-Dowód, electronic banking) require a PESEL number and a Polish e-ID. A foreign founder usually has neither — and this is where panic sets in, entirely unnecessarily. A working route exists, and on the recommended one the absence of a Polish e-ID is irrelevant, because the company authenticates itself as an entity.

Here are the routes, starting with the simplest:

1. Best: the company buys a Polish qualified electronic seal containing the company’s NIP. Authentication works immediately and grants the full set of owner permissions attached to the NIP — without filing any additional documents with the tax office and without anyone’s PESEL. This is what we recommend: the owner needs neither Profil Zaufany nor a Polish ID card. Once logged in via the seal, you issue certificates and permissions to employees and to your accounting firm.
2. An EU qualified seal without a Polish NIP — works the same way, but you must first report its “fingerprint” (a unique SHA-256 identifier) to the tax office using form ZAW-FA.
3. The owner holds an EU qualified electronic signature (eIDAS) — this is accepted; if the signature contains neither a NIP nor a PESEL, its fingerprint is likewise reported via ZAW-FA.
4. No seal and no signature — the company designates, via ZAW-FA, any natural person (for example a resident proxy, an accountant or an employee) as the first authorised person; that person then grants all remaining permissions electronically.

The Ministry of Finance expressly anticipated the foreign-taxpayer situation: the fingerprint procedure “will most often concern foreign taxpayers holding a qualified signature or qualified seal issued in another country (without a NIP and PESEL)”. Form ZAW-FA(3) has explicit fields for non-residents (date of birth, type and number of identity document, country of issue).

One more argument for a seal on the company’s NIP: the certificate quota. An entity authenticated with a NIP-bearing seal may issue up to 100 active and 100 new certificates; an entity without a NIP and PESEL (the fingerprint route) only 2 active and 2 new. For a business that wants to give access to an accountant and a few staff, that is a real difference.

Mind the timing. The Ministry of Finance has not published a guaranteed processing time for ZAW-FA at the tax office. If your route requires this form, do not leave it to the last week before your first invoice.

ZAW-FA — who can be the authorised person

Form ZAW-FA (current version: ZAW-FA(3)) is used to designate the first authorised person in a company or to report the fingerprint of a seal or signature. A few facts worth knowing:

• The first authorised person may be any natural person — they need not be a board member or appear in the KRS. This is the most useful fact for a company with a foreign board: permissions can be entrusted to a trusted resident or to the accountant. The form itself, however, must be signed by the company’s representatives in the required number.
• Only one person takes the owner permission via ZAW-FA; that person then grants everyone else their permissions electronically.
• Filing channels: on paper, via the e-Tax Office (as an attachment to a general letter) or via e-Doręczenia. Note: ePUAP has not worked for this purpose since 1 January 2026 — a filing through ePUAP will not be treated as effectively delivered. Some older guides (and even outdated passages of the Ministry’s own manual) still point to ePUAP — do not repeat that error.

Permissions for your accountant and accounting firm

Most businesses want their accounting firm to handle invoices. KSeF allows this, but on its own terms:

• “Access to invoices” is all-or-nothing. The permission covers every invoice — both sales and purchase. You cannot restrict an accountant to a chosen subset.
• Granting and revoking permissions is a single, indivisible permission — you cannot give someone the right to grant without the right to revoke.
• An accounting firm can be authorised as an entity (so-called indirect permissions): you grant permissions to the firm’s NIP, the firm authenticates in its own context and then assigns access to its own staff. Staff authorised this way may only issue invoices and access them — they cannot pass permissions on further.

Penalties and transitional periods — no scaremongering, no wrong dates

Most of the misinformation circulates around penalties. Let us set out the facts:

Penalties for invoices outside KSeF take effect on 1 January 2027. That date shifted twice (originally 1 January 2025 → 1 August 2026 → finally 1 January 2027 under the act of 5 August 2025). Every source not updated since August 2025 gives 1 August 2026 — that date is obsolete. As of today, in mid-2026, no financial penalty for KSeF can be imposed on anyone. You therefore have time to set your process up calmly by the end of 2026.

Once penalties do arrive, their level (art. 106ni of the VAT Act) represents upper limits set by decision of the tax office:

• up to 100% of the tax amount shown on an invoice issued outside KSeF,
• and where the invoice shows no tax — up to 18.7% of the total amount due.

It is worth knowing that for KSeF penalties the “warning first” principle has been switched off (art. 21a of the Entrepreneurs’ Law) — so there is no statutory guarantee of a warning instead of a penalty on a first breach for micro and small businesses. All the more reason to set the process up in advance.

A few mechanisms soften the transition — and are frequently described incorrectly:

• The “up to PLN 10 000” relief covers issuing only. Until the end of 2026 the smallest businesses may issue invoices outside KSeF provided their combined value does not exceed PLN 10 000 gross per month (this is a running monthly total of invoices issued outside the system, not a per-invoice cap). The obligation to receive invoices in KSeF continues regardless of this relief — it has applied to everyone since 1 February 2026. Beware also the myth that links this limit to the PLN 450 figure — those are two different provisions.
• The offline24 mode is a permanent solution, not a transitional one. It lets you issue an invoice outside the system and send it to KSeF by the next business day at the latest. It has no end date and no preconditions — any taxpayer may use it by choice; it requires only an issuer certificate. Do not believe sources claiming offline24 “works until 31 December 2026” — that is untrue.

The Ministry of Finance’s free tools

You do not need to buy commercial invoicing software to use KSeF:

• Aplikacja Podatnika KSeF 2.0 (ap.ksef.mf.gov.pl) — a free web tool for issuing, receiving and browsing invoices and corrections, downloading XML/PDF, QR codes, and managing permissions, tokens and certificates. The Ministry of Finance calls it “a full-fledged alternative to any commercial invoicing program”. For most of our clients this tool is sufficient.
• e-mikrofirma — note: it is intended solely for sole traders. A Sp. z o.o. cannot use it. This is one of the most common errors in online guides — do not follow it if you run a company.

Frequently asked questions (FAQ)

From when is KSeF mandatory for my company? Receiving invoices through KSeF has been mandatory for all taxpayers since 1 February 2026, and issuing — for companies with 2024 sales up to PLN 200 million (in practice all small and medium businesses) — since 1 April 2026.

When do penalties for invoices outside KSeF start? On 1 January 2027. The earlier date of 1 August 2026 was postponed in the meantime and is obsolete. Until the end of 2026 a penalty-free period applies.

How does a Sp. z o.o. with a foreign owner and no PESEL log in to KSeF? Most simply with a qualified electronic seal issued against the company’s NIP — it works immediately, without a PESEL and without a Polish e-ID. Alternatively you can designate an authorised person (any natural person) using form ZAW-FA, or use an EU signature or seal after reporting its fingerprint.

Can a Sp. z o.o. log in with Profil Zaufany? No. Profil Zaufany and a personal qualified signature are methods for a natural person (sole trader). A company authenticates with a qualified seal, a token or a KSeF certificate.

Does a virtual-office address cause problems in KSeF? No. KSeF verifies the NIP and the invoice structure, and does not check the address at all or compare it against any register. A virtual-office address passes just like any other.

Is a foreign founder covered by KSeF at all? Yes. What matters is the company’s seat, not the owner’s nationality. A Polish Sp. z o.o. with an address in Poland is fully covered — there is no “loophole for foreigners”.

Can I give my accountant or accounting firm access to KSeF? Yes. You can authorise a specific person or an entire firm as an entity (indirect permissions). Remember that “access to invoices” covers every invoice — sales and purchase — with no possibility of narrowing it to a subset.

Do I have to buy invoicing software? No. The free Aplikacja Podatnika KSeF 2.0 lets you issue and receive invoices and manage permissions. Note: the free e-mikrofirma is for sole traders only — a Sp. z o.o. cannot use it.

Will my old KSeF token work? Tokens from KSeF 1.0 are inactive in KSeF 2.0 — they had to be generated afresh. All tokens stop working on 31 December 2026; certificates take their place.

Next steps

If you run a Sp. z o.o. — especially one with a foreign owner — set KSeF up in this order:

1. Check that you are receiving invoices. Receiving has been mandatory since 1 February 2026; make sure your access is configured and that uncollected invoices are not piling up.
2. Choose your login method. For a company the cleanest is a qualified electronic seal on the company’s NIP — no PESEL and no extra paperwork at the tax office.
3. If you need ZAW-FA (an EU seal or signature without a NIP, or designating an authorised person), file it via the e-Tax Office or e-Doręczenia — not through ePUAP — and do not leave it to the last minute.
4. Grant permissions to your accountant or accounting firm; consider authorising the firm as an entity.
5. Start issuing through the free Aplikacja Podatnika KSeF 2.0 or your accounting software, using the penalty-free period to the end of 2026 to refine the process.

At Henry Estates we support foreign founders’ companies end to end — from registration, through an address with genuine correspondence handling, to help setting up KSeF and working with your accountants. We serve clients in five languages.

Book a consultation with Henry Estates →

---

This article is informational in nature and does not constitute tax or legal advice. KSeF rules and the practice of applying them can change; specific decisions should be taken after consulting a Polish tax adviser or legal counsel. Legal position: July 2026.