Poland Crypto Licensing (MiCA CASP)

Poland’s Crypto Licensing Position in 2026

Poland is the largest crypto market in Central and Eastern Europe, with roughly 1,300 entities in its legacy register of virtual currency activities, yet it is the EU member state furthest behind on MiCA. As of June 2026 the KNF cannot accept CASP applications because the national Crypto-Asset Market Act is not in force: two drafts were vetoed by President Karol Nawrocki and a third reached him in May 2026. The delay is political, not technical, and the result is an EU member state with no authority able to authorise CASPs while the 1 July 2026 end of the MiCA transitional period approaches.

What We Do For You

Tomberg & Partners is a direct service provider. We do not introduce you to someone who might help. We file the work, deal with the regulator directly, and stand behind the outcome. For a Poland-focused crypto project, we deliver the entire route end to end, in a single accountable engagement, through our own team and in-country specialists we have personally vetted and control.

• We form your company. We incorporate the operating entity in the authorising EU member state, and your Polish spółka z o.o. where you want a domestic presence, with real substance the regulator will accept.
• We file and manage the application. We prepare the full MiCA documentation suite, submit it to an operational EU regulator, and deal with the regulator directly through completeness and substantive review to authorisation.
• We set up the Polish passport. We handle the Article 65 notification so your authorisation passports into Poland, and we keep the route live as your services expand.
• We arrange banking. We secure a credit-institution safeguarding account and operational rails with a licensed EU EMI, sized for passported Polish-market volume, alongside the licence rather than after it.
• We run ongoing compliance. Capital adequacy, AML/CFT, the Travel Rule, DORA, reporting and inspections, handled or supervised by us so the authorisation stays in good standing.
• We stay accountable. Some of this is in-house; the rest is delivered by in-country lawyers, accountants and licensed specialists we work with directly. We never offload you to an unverified third party.

Who This Is Right For

The Poland route suits operators whose priority is reaching Polish and wider EU users with a genuine MiCA authorisation behind them.

• Crypto exchanges and brokers targeting Polish and CEE users that need a Class 2 or Class 3 MiCA authorisation and full passporting.
• Custody and wallet providers that need a Class 2 authorisation and credit-institution safeguarding for client funds.
• Legacy register entrants relying on the Polish transitional regime that need to move to a real MiCA authorisation before 1 July 2026.
• Fintech and payments firms adding crypto-asset services and wanting one accountable firm to handle formation, licensing and banking together.
• Operators building in Poland that want to use its deep developer base while holding the authorisation in a member state with a live regime.
• × US persons. We do not take on US persons as clients. The information here is reference only and is not a service offer to US-based operators.

Regulatory Framework

Crypto-asset service providers are regulated under the EU’s Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, which applies directly but requires each member state to designate a national competent authority and set supervisory fees, sanctions and transitional rules in domestic law. Poland’s instrument is the Crypto-Asset Market Act (ustawa o rynku kryptoaktywów), which names the KNF as that authority. As of June 2026 the Act is not in force, so no Polish authority can authorise CASPs, and AML supervision of the legacy register sits meanwhile with the General Inspector of Financial Information (GIIF) and the Tax Administration Chamber in Katowice. We work with this directly, authorising you under the same MiCA framework in a member state that can grant it. See the category page for the MiCA framework: requirements and timeline →

Poland’s crypto regulation began as an AML registration regime: entry to the register of virtual currency activities (rejestr działalności w zakresie walut wirtualnych) was a notification-and-fit-and-proper process, not a substantive licence. MiCA became applicable to CASPs on 30 December 2024, closing the register to new entries and starting the transitional clock under Article 143(3); the Crypto-Asset Market Act has been the obstacle ever since. A few regime overlaps also matter, and we classify your token set against them before filing: e-money-token services can trigger EMD2/PSD2 dual authorisation, equity-like or market-traded tokens fall under MiFID II rather than MiCA, and register entrants remain subject to the AML Act, GIIF reporting and the EU Transfer of Funds Regulation Recast, which do not lapse on 1 July 2026.

The 1 July 2026 Transitional Deadline

Entities entered in the register before 30 December 2024 may keep providing crypto-asset services until 1 July 2026, or until a CASP application is decided, whichever is earlier, under MiCA Article 143(3). The deadline is fixed by EU law, not by Polish administration, so Poland’s delayed Act does not extend it. Because designation of the KNF runs through the dormant Crypto-Asset Market Act, Polish operators have had no domestic route to a MiCA CASP authorisation throughout the transition, and for most of them the period simply expires. If you hold a legacy register entry, you need a MiCA authorisation in another member state before the date, which we obtain and passport into Poland so you do not lose continuity.

Key Deadlines

What Happens If You Do Nothing

From 1 July 2026, providing crypto-asset services to EU clients without a MiCA authorisation breaches Union law directly. It also exposes you to national criminal penalties under the draft Act (a fine of up to PLN 20 million or imprisonment for up to 8 years) and MiCA administrative fines under Article 111 (up to €5,000,000 or a percentage of turnover) once a Polish authority can enforce them, with wind-down plans expected in the meantime. The realistic options are to authorise in another EU or EEA member state and passport in under Article 65, to relocate, or to wind down. Waiting for Poland is not one: even if the Act enters force, a fresh KNF authorisation takes months the transition does not allow. We run the first route for you, beginning early enough that your authorisation is live before the deadline.

What the Licence Covers

MiCA defines 10 crypto-asset services grouped into 3 classes that set the minimum own-funds requirement under Annex IV: €50,000 for Class 1, €125,000 for Class 2 and €150,000 for Class 3. The taxonomy is EU-wide and identical in every operational MiCA jurisdiction, so when we authorise you elsewhere and passport into Poland you select from exactly these services. Most exchange operators need Class 2 or Class 3, and we scope which classes your model requires before we file.

Covered Activities

Some activity sits outside MiCA entirely: fully decentralised services with no intermediary, CBDCs, deposits and insurance, and genuinely unique NFTs unless issued in large series, fractionalised or functioning as payment or investment instruments. Tokenised securities and real-world assets that meet the financial-instrument test follow MiFID II, the Prospectus Regulation and the EU DLT Pilot Regime, not MiCA; where the structure is a tokenised fund unit, see our fund licensing guide. We scope each route through the regime that actually governs it, so you are never licensed under the wrong one.

Requirements

A MiCA CASP authorisation requires a corporate entity in the authorising state, minimum own-funds of €50,000–€150,000 by service class under MiCA Annex IV, a real place of business, fit-and-proper management and a full compliance documentation suite. The prudential and governance bar is set by MiCA itself, so we meet the identical substance under a regulator that can actually grant the authorisation and passport into Poland, telling you at scoping which pieces you already meet. MiCA does not mandate a specific entity form; the standard Polish vehicle is a spółka z o.o. (private limited) or, for larger operations, a spółka akcyjna (S.A., joint-stock).

Fit-and-Proper, Substance and AML

The competent authority assesses directors, senior managers, qualifying shareholders and key function holders for reputation, financial soundness and the collective knowledge of the management body. The most common failure point across MiCA jurisdictions is the inability to demonstrate the legitimate origin of owners’ capital, so we prepare that evidence carefully, alongside genuine substance the authority can supervise rather than a letterbox. On AML, the EU Transfer of Funds Regulation Recast applies directly: full originator and beneficiary information must accompany every transfer with no de minimis for CASP-to-CASP transfers, and above the €1,000 self-hosted-wallet threshold you must verify control of the address. We build the Travel Rule, sanctions screening and the AML programme into your application.

How We Deliver It

With no operational CASP process in Poland, we file your application with an operational EU regulator on the standard MiCA pathway, then passport into Poland. The stages below are the route we run on your behalf, and they are the same template the KNF will follow once it opens, because the substantive criteria are set by MiCA, not national law. You make decisions, we do the work, filing in your chosen home member state through that regulator’s portal in its required language.

Stage 1 2–6 weeks

We form the entity and deposit capital

We incorporate the legal person in the authorising member state (European company formation →), deposit the minimum own-funds, appoint the management body under MiCA’s four-eyes principle plus compliance and AML officers, and establish a real registered office and effective management there.

Stage 2 6–10 weeks

We prepare the documentation suite

We draft the full pack under MiCA Article 62 and Commission Delegated Regulation (EU) 2025/305: AML/CFT manual, risk assessment, sanctions and transaction monitoring, Travel Rule, KYC/CDD, business continuity, the DORA/ICT framework, cybersecurity, complaints, conflicts and the wind-down plan, each bespoke to your model.

Stage 3 2–4 weeks (parallel)

We arrange banking

We open the corporate account in the authorising state and secure both rails, since MiCA Article 70 requires client funds to sit with a credit institution, not an EMI, in a segregated account by end of next business day.

Stage 4 1–2 weeks (optional)

We engage the regulator early

Where the regulator offers pre-application engagement, we present your model and governance for preliminary feedback before the statutory clock starts. It cuts later requests for information.

Stage 5 1 week

We file the application

We submit the complete application with all annexes required by Article 62 and the implementing RTS, and pay the national application fee.

Stage 6 Up to 25 working days

Completeness check

The authority verifies the file is complete. Poorly prepared applications stall here; ours do not, because we file complete.

Stage 7 40–60 working days

Assessment and decision

The authority assesses against MiCA’s criteria, with information requests extending it by up to 20 working days. We deal with the regulator directly throughout. Authorisation is published in the national and ESMA registers, after which we set up the Article 65 passport into Poland.

Required Documents

MiCA CASP documentation follows Article 62 and Commission Delegated Regulation (EU) 2025/305, which standardise the application form and annexes across the EU. We prepare the full pack bespoke to your model, because generic templates adapted from other jurisdictions are a common cause of delay, and the work transfers cleanly to a Polish filing if and when the KNF opens.

• Corporate: certificate of incorporation, articles of association, shareholder register, proof of own-funds deposit, LEI and proof of registered office.
• Personal (directors, officers and 10%+ shareholders): ID, CV, criminal-record certificates for each country of residence over the past 10 years, declarations of good repute, evidence of qualifications, and, for qualifying shareholders, source-of-funds and source-of-wealth documentation, the most scrutinised element of any MiCA application.
• Compliance suite: AML/CFT policy manual, enterprise-wide risk assessment, sanctions screening, transaction monitoring, Travel Rule implementation, SAR/STR procedures, KYC/KYB onboarding, complaints handling and conflicts of interest, each built around your actual risk profile.
• Business plan: programme of operations, three-year financial projections, and a description of governance and internal controls.
• Technology and ICT: IT architecture, cybersecurity policy and penetration tests, hot/cold wallet and key management (for custody), business continuity and disaster recovery, third-party ICT register and incident response, all aligned to the five DORA pillars.

Timeline

This 4–8 month timeline runs through an operational EU regime, with complex applications extending to 9–12 months. We manage it actively, starting early enough that your authorisation is live before the 1 July 2026 deadline.

Taxation

Poland applies 19% corporate income tax, with a reduced 9% rate for small taxpayers (prior-year revenue under the PLN equivalent of €2 million, excluding capital-gains income), and a flat 19% individual rate on crypto-to-fiat gains. Crypto-asset exchange is VAT-exempt under the CJEU Hedqvist ruling. Where you hold the authorisation abroad and operate into Poland, we structure the tax position across both states with you.

Reporting and Structuring Points

Corporate crypto income sits in a separate CIT capital-gains basket, so losses there cannot offset operating income, and for individuals only crypto-to-fiat disposals are taxable, not crypto-to-crypto swaps. Poland’s Estonian-style lump-sum regime (CIT estoński) defers tax until distribution, though its interaction with a CASP’s capital obligations needs case-specific analysis we run with you. Poland has transposed DAC8, so CASPs report user data from 2026 data; Pillar Two’s 15% minimum bites only on groups above €750 million in revenue, rarely a standalone CASP.

Ongoing Compliance

The authorisation is indefinite, with no renewal, but supervision is continuous and the obligations apply identically to a Polish CASP and to one passporting in from another member state. CASPs file audited financial statements, capital-adequacy and activity reports to their competent authority, plus AML/CFT reporting to the national FIU (in Poland, the GIIF) and DAC8 tax reporting, and pay an annual supervisory contribution rather than a renewal fee. Authorities run scheduled and unscheduled inspections of AML/CFT, client-asset segregation, cybersecurity and governance, and enforcement is real: Article 111 fines, public censure, management bans and withdrawal of authorisation. Marketing must be fair, clear and not misleading, and major advertising platforms have required a valid CASP authorisation for EU crypto advertising since April 2025. We run or supervise all of it so the authorisation stays in good standing.

ICT Risk Management & Operational Resilience

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to every MiCA CASP and has done since 17 January 2025, binding directly regardless of Poland’s national legislation and enforced by the authority of the authorising state. It sets five pillars: ICT risk management, incident reporting, resilience testing, third-party ICT risk and information sharing. All CASPs comply regardless of size, though threat-led penetration testing applies only to entities designated as significant, and custody operators must run segregated hot and cold wallet architecture with multi-signature controls and documented key management. We build the framework into your application and keep it current afterwards.

Incident Reporting

Major ICT-related incidents must be reported to the competent authority within strict deadlines:

Banking

Banking is one of our core services, and a crypto authorisation without working banking is of little use, so we arrange it alongside the licence. The structure is two-tier: an operational account with a licensed EU EMI for day-to-day flows, and a credit-institution account for client-fund safeguarding, which MiCA Article 70 requires to sit with a credit institution (not an EMI) in a segregated account by end of next business day. The credit-institution relationship is the harder of the two and typically takes 2–4 months, so we begin during application preparation and confirm feasibility before we file. We set it up in the member state where we authorise you, and you serve Polish clients by passporting. See banking for licensed crypto operators for how it fits the wider engagement.

FATF Status & International Standing

Poland does not appear on any FATF list and has never been grey- or black-listed; as an EU member state it is outside the EU list of high-risk third countries, and its AML framework is assessed by MONEYVAL. The reputational risk is not its standing on these measures but being the only EU member state unable to authorise CASPs at the end of the transitional period, which is why we move clients onto a real authorisation well ahead of the date.

MiCA Passporting and EU Market Access

Passporting is the mechanism that lets you serve the Polish market despite the absence of a Polish authorisation, and it is the core of what we set up. Under Article 65, a CASP authorised in any EU or EEA member state notifies its home regulator, which passes the notification to host NCAs (including the KNF) and ESMA; no separate authorisation, capital or waiting period is required, and both cross-border services and branch establishment are covered. The passport spans the full EEA, with Iceland, Liechtenstein and Norway inside it. The United Kingdom, Switzerland and Gibraltar sit outside it and need local authorisation for local clients; reverse solicitation is a narrow third-country exception, not a route for serving Polish clients, who are reached under Article 65. See our reverse solicitation guide for the third-country pattern.

Advantages and Limitations

We are candid about what Poland is and is not: a large, crypto-literate market to serve, but not yet a jurisdiction to be licensed in. We serve it by authorising you elsewhere and passporting in.

• Largest CEE crypto market. A population near 38 million with high adoption and roughly 1,300 register entrants, a high-value target for passported CASPs.
• Reachable today via passporting. A CASP authorised elsewhere serves Polish clients under MiCA Article 65 with no separate Polish authorisation.
• Settled, moderate tax regime. Unaffected by the licensing delay: 19% CIT, 9% for small taxpayers, a flat 19% individual rate on crypto-to-fiat gains.
• Deep developer base. One of the EU’s largest pools of software and fintech engineers, attractive for building the operating entity even when it is licensed elsewhere.
• Clean international standing. Not FATF-listed and never grey- or black-listed.
• × No operational CASP regime. The decisive limitation; we authorise you in a live EU regime and passport in.
• × Expiring transitional clock. Legacy register rights end on 1 July 2026, and a MiCA application takes 4–8 months, so re-authorisation must begin now.
• × Legislative uncertainty. Two vetoes show the outcome is not assured, so we treat passporting as the base case, not Polish enactment.
• × Severe penalties for unlicensed activity. Fines up to PLN 20 million or up to 8 years’ imprisonment, on top of breaching EU law after the deadline.
• × Banking tightening for register-only entities. Banks are wary of crypto firms lacking a MiCA authorisation, so we pair re-authorisation with a credit-institution safeguarding account.

How Poland Compares

Because Poland cannot currently authorise CASPs, the meaningful comparison is where a Poland-focused operator should authorise instead. The natural alternatives are the Czech Republic and Estonia, with Lithuania as a Baltic peer and Germany as the large-economy option, each offering the Article 65 passport back into Poland.

Compare every crypto jurisdiction side by side →

The key difference is: Poland is the only column without a usable timeline, cost or passport, because its regime is not operational. For a Poland-focused operator, Lithuania is a strong fit; the Czech Republic offers a cost-competitive CNB regime in the same CEE market, Estonia adds the 0% retained-profit tax advantage, and Germany suits operators prioritising market weight over speed. We deliver crypto licensing directly in Lithuania with Article 65 passporting into Poland, obtained, filed and stood behind through our own team and in-country specialists we control.

Common Mistakes With the Polish Position

The damaging errors around Poland are not application errors, because no Polish application can be filed; they are planning errors, and steering clients clear of them is part of what we do.

• Assuming the deadline depends on Polish law. It does not. The 1 July 2026 deadline is set by MiCA and confirmed by ESMA; Poland’s delayed Act cannot extend it, and planning around a hoped-for national extension is the costliest mistake.
• Treating the legacy register as a MiCA licence. It is an AML registration with no capital test and no passport, conferring only a transitional right that ends on the deadline and cannot be converted into a CASP authorisation.
• Waiting for the KNF to open before acting. Even if the Act enters force in mid-2026, a fresh KNF authorisation cannot complete before the deadline, so re-authorisation abroad must begin well in advance.
• Underestimating banking fallout. Banks increasingly decline crypto firms holding only a register entry with no MiCA path, so leaving banking late risks losing accounts at the worst moment.
• Conflating Polish tax with Polish licensing. A favourable, settled tax position does not create a licensing route: the two are governed by entirely separate instruments.

Frequently Asked Questions

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related Services

• Lithuania CASP Licensing: a live MiCA regime we deliver, with passporting into Poland
• Crypto Licensing Overview: MiCA CASP authorisation across our serviced jurisdictions
• European Company Formation: EU and EEA entity formation for crypto and fintech businesses
• Reverse Solicitation: the narrow third-country exception and its limits
• Banking for Crypto Operators: credit-institution safeguarding and EMI operational rails