KSeF: granting rights to a foreign person without PESEL and NIP

Recently, as part of our practice, we have encountered a client’s question about how to grant access to the Polish National e-Invoicing System (Pol. KSeF) to a natural person from abroad who does not have a Polish PESEL or NIP number. This is a common situation in international capital groups that want to authorize a foreign employee or co-worker to issue or receive invoices under the National e-Invoicing System. The matter turned out to be more complex than it might seem – that’s why we have prepared a comprehensive guide.

How does the granting process work?

Authorizations to use the KSeF – their assignment, change or withdrawal – are exercised via interface software (API) or the KSeF Taxpayer Application made available by the Ministry of Finance.

Two entities participate in the identification process:

• Taxpayer granting the entitlement – always identified by the NIP number,
• Person receiving the entitlement – identified by one of three elements:
  • PESEL number,
  • NIP number,
  • or a fingerprint of a qualified electronic signature (SHA256).

When is a qualified signature required?

If a natural person does not have a NIP or PESEL number, then the only available method of authentication in the KSeF is a qualified electronic signature.

Such a signature must be issued by a certified trust service provider, e.g.:

• Certum (Asseco),
• EuroCert,
• Sigillum (PWPW).

What is SHA256 fingerprint?

In order for the KSeF to recognize a person’s qualified signature, it is necessary to provide the signature’s “fingerprint”, i.e. the SHA256 cryptographic hash ( thumbprint). This 64-character string uniquely identifies the certificate and the person who holds it.

How to get SHA256 of a qualified signature?

Method 1 – Via Windows:

1. Open the certificate file (with a .cer or .crt extension).
2. Go to the “Details” tab.
3. Look for the “Thumbprint (SHA256)” or “Thumbprint (SHA256)” field.
4. Copy the value by removing all spaces and special characters – leave a clean 64-character string.

Method 2 – Using OpenSSL (for technical users):

Use the command:

openssl x509 -in moj_cert.cer -noout -fingerprint -sha256

As above, you need to remove special characters to get the SHA256 value only.

How to grant permissions in KSeF?

Option 1 – ZAWFA Form

If the taxpayer does not yet use the KSeF Taxpayer Application, you should:

1. Fill out the ZAWFA form and submit it to the relevant tax office.
2. In part D of the form, enter:
   • the date of birth of the natural person,
   • ID number and series + country of issue,
   • SHA256 fingerprint of the signature in field D.1.1.1.

After processing the application, the natural person will be able to use the KSeF.

Option 2 – KSeF Taxpayer Application (online)

If the taxpayer already has access to the KSeF system, it is possible to grant the rights without submitting the form:

1. Log in to the Taxpayer Application.
2. Select: “Grant permission” → “Person using a qualified signature”.
3. Set the ID to “None”.
4. Enter the data:
   • name and surname,
   • date of birth,
   • ID document + country of issue,
   • SHA256 fingerprint.
5. Select the appropriate type of authorization (e.g., to issue and receive invoices) and confirm.

Summary

In the case of granting KSeF entitlements to a natural person from abroad who does not have a PESEL or NIP number, it is necessary to use a qualified electronic signature. The key element of identifying such a person in the system is the SHA256 fingerprint of the qualified certificate (the so-called thumbprint).

Permissions can be granted in two ways:

1. By means of the ZAWFA form – by submitting it to the tax office.
2. Online – via the KSeF Taxpayer Application – faster and without the need to submit paper documents.

In both cases, it is necessary to correctly prepare the identification data, including obtaining and uploading the SHA256 fingerprint of the certificate.