Operating a crypto exchange without the correct regulatory authorisation in Poland exposes a business to enforcement action, suspended banking rails and potential criminal liability under Polish anti-money-laundering law. The Polish VASP registration regime – based on the national register of virtual currency activities maintained by the Ministry of Finance – is a mandatory first step for any business accepting Polish clients, holding Polish-resident funds or processing transactions through a Polish entity. With the EU-wide MiCA (Markets in Crypto-Assets Regulation) CASP authorisation regime now in effect, operators face a dual obligation: satisfy the existing national requirements and plan for the transition to the ESMA-overseen CASP (Crypto-Asset Service Provider) authorisation that will govern the full EU perimeter. This page sets out exactly what a business needs to do, in what order, and where the cross-border structure must hold together.
What is the legal basis for crypto exchange regulation in Poland?
Poland regulates virtual currency businesses primarily through its Anti-Money Laundering and Counter-Terrorist Financing Act, which implemented the EU's Fifth Anti-Money Laundering Directive and subsequently aligned with FATF Recommendation 15 on virtual assets. Any entity conducting virtual currency activity in Poland – including exchange between virtual and fiat currencies, exchange between virtual currencies, and the operation of exchange platforms – must register with the Ministry of Finance's dedicated register of virtual asset service providers. Operating without registration is a criminal offence under Polish law, carrying personal liability for the management board in addition to entity-level sanctions.
The national VASP register is administered by the General Inspector of Financial Information (GIIF), Poland's financial intelligence unit, which also functions as the primary AML supervisor for registered VASPs. Poland's AML Act incorporates the Travel Rule – the obligation, sourced from the FATF standards and the EU's Transfer of Funds Regulation, to transmit originator and beneficiary data with each virtual asset transfer above the applicable threshold. Compliance with the Travel Rule is an active supervisory expectation, not a future obligation.
The MiCA regulation, now in force across the EU, introduces a parallel authorisation layer. Operators already registered under the national VASP regime will need to obtain CASP authorisation – either from the Polish Financial Supervision Authority (KNF) or from a faster national competent authority elsewhere in the EU – to continue operating after the national transitional period expires. The passporting logic means that a CASP authorised in any EU member state can service clients across the entire EU/EEA perimeter without a separate local registration in each country. The choice of lead NCA is therefore a strategic decision, not merely an administrative one.
For a scoped assessment of your Poland entry structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis.Who needs a VASP registration for a crypto exchange in Poland?
Any business conducting virtual currency exchange, brokerage or platform services for Polish-resident clients is within scope of the Polish AML Act's VASP registration obligation, regardless of where the entity is incorporated. The territorial reach of the obligation turns on the activity nexus to Poland – soliciting Polish clients, holding zloty-denominated accounts in Poland, marketing in Polish, or processing transactions through a Polish-incorporated entity are all indicators that registration is required. A foreign company operating purely offshore but actively targeting Polish users has been the subject of enforcement attention across EU jurisdictions, and Polish supervisors have the same toolkit.
Businesses that fall outside the registration obligation include those providing only peer-to-peer infrastructure with no intermediary role, pure software providers with no client-facing exchange function, and entities whose only connection to Poland is technical hosting. The boundary is not always clear, and in our cross-border practice we consistently see operators underestimate the territorial reach of the Polish regime – particularly where a white-label exchange platform is deployed through a Polish subsidiary.
A common structural pattern we advise on involves a holding entity in a low-tax jurisdiction – frequently a BVI or Cayman structure – operating the exchange through a Polish-registered subsidiary. That subsidiary triggers the full VASP registration obligation regardless of where the intellectual property or the reserve sits. The GIIF supervises the Polish legal entity; it does not look through to the offshore holding structure for supervision purposes, but it will look through for AML source-of-funds analysis when reviewing significant transactions.
How does the VASP registration process work in Poland?
The Polish VASP registration process proceeds through the Ministry of Finance's online register, with the GIIF acting as the supervising authority once registration is complete. The application requires the business to demonstrate: a fit-and-proper management structure (directors and UBOs must pass a fitness-and-properness test), an AML/CFT policy and programme that meets Polish statutory requirements, internal controls for transaction monitoring, and evidence of the technical and organisational capacity to carry out the stated virtual currency activities.
Key documents in a standard application include the articles of association, UBO declarations, an AML risk assessment tailored to the specific business model, a transaction monitoring and suspicious-transaction-reporting procedure, Travel Rule compliance documentation, and a board resolution authorising the application. The management board bears personal responsibility for the accuracy of the AML programme; a submission that is technically complete but substantively thin will draw GIIF scrutiny at the post-registration inspection stage.
Timeline is one area where qualitative guidance is more useful than a specific figure, because the GIIF's processing capacity and the completeness of the initial submission both affect throughput. In our experience advising operators entering EU markets, the preparatory phase – building the AML programme, drafting the risk assessment, conducting the UBO verification – typically takes longer than the formal submission window. Applicants who treat registration as a paperwork exercise rather than a substantive compliance build consistently face deferred approval or post-registration enforcement findings.
Once registered, a VASP must maintain the AML programme on a current basis, file suspicious activity reports with the GIIF, apply the Travel Rule to qualifying transfers, conduct periodic risk reassessments, and notify the register of material changes to the business. Non-compliance after registration is subject to administrative sanctions including fines and, in serious cases, removal from the register – which is a de-facto licence revocation.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Write to info@oboluslaw.com.How does MiCA change the position for exchanges operating in Poland?
MiCA's CASP authorisation regime fundamentally changes the structure of crypto exchange regulation across the EU, and Poland is no exception. Under MiCA, operating a crypto-asset exchange service – matching orders in crypto-assets against fiat or against other crypto-assets – requires a full CASP authorisation from a national competent authority, not merely registration on a national VASP list. The Polish Financial Supervision Authority (KNF) is the designated NCA for MiCA purposes in Poland; it will authorise Polish-domiciled entities and receive passporting notifications from CASPs authorised in other member states.
MiCA introduces capital and own-funds requirements that vary by the class of CASP activity. It also requires a formal authorisation decision (not merely a registration receipt), a programme of operations, a governance and remuneration policy, ICT risk management, and – for exchanges – pre- and post-trade transparency obligations that are new relative to the national VASP regime. The whitepaper obligation applies where the exchange offers crypto-assets that are not otherwise compliant – meaning an exchange listing novel tokens may itself become responsible for the whitepaper regime even where it is not the issuer.
The transitional period for existing VASPs registered under national law varies by member state. In our practice, operators preparing for MiCA transition need to begin the structural work – governance documentation, capital adequacy modelling, prudential buffer planning – well before the transitional deadline, because the KNF's authorisation process is substantively more demanding than the prior national registration. Operators who wait for the deadline will face a compressed window with a queue of other applicants filing simultaneously.
For a business choosing between applying for CASP authorisation in Poland versus obtaining it in a faster EU jurisdiction and passporting into Poland, the calculus turns on: the location of management and operations, the location of the primary user base, the speed and resource requirements of the relevant NCA's process, and the tax and banking consequences of each structure. Lithuania, Malta and several other EU member states have developed CASP-processing capacity that may offer a faster path for businesses with no operational anchor in Poland, combined with an EU-wide passport that includes Poland as a host state.
What are the banking and tax considerations for a Polish crypto exchange structure?
Banking is consistently the hardest operational layer for crypto exchange operators, and Poland is no different from other EU markets in this regard. Polish commercial banks have applied heightened due diligence to VASP clients since the AML Act's implementation, and several have exited the sector entirely. A registered VASP operating through a Polish entity will typically need to demonstrate the quality of its AML programme – not just its existence – to secure and maintain a fiat account. In our practice, we regularly advise operators to prepare a bank-ready AML summary that goes beyond the statutory minimum, specifically addressing the risk profile of the exchange's user base and transaction types.
The cross-border banking question becomes more complex where the Polish entity is part of a multi-jurisdictional group. A Polish subsidiary banking locally while the group treasury sits in a BVI or Cayman parent creates transfer-pricing and substance questions that the Polish tax authority will examine on a risk-based basis. Poland participates in the OECD's Common Reporting Standard and the EU's DAC6 regime for cross-border tax arrangements; certain intra-group structures involving virtual currency flows and IP licensing will fall within reportable arrangement categories, and non-reporting carries significant penalty exposure.
On corporate taxation, Poland taxes virtual currency gains at a specific flat rate applied to the income derived from crypto exchange activity. The rate and the calculation mechanics have been adjusted by the Polish legislature over recent years, and the current position should always be confirmed against the applicable law at the time of structuring. VAT treatment of exchange services aligns with the Court of Justice of the EU's position that crypto-to-fiat exchange is a VAT-exempt financial service; token issuance and other activities carry different VAT analyses. Operators processing significant transaction volumes should build tax compliance into the operational infrastructure from day one – not retrospectively.
Which operator profile should choose Poland, and which should look elsewhere?
Poland suits a specific operator profile and is not the default choice for every inbound crypto exchange business. Understanding the decision axes before committing to a structure saves considerable time and compliance cost later.
Profile A – EU-anchored operator with Polish management. A business with Polish-resident directors, a Polish development team and an intent to build a primarily Polish and Central European user base has a genuine operational anchor in Poland. For this operator, registration under the current VASP regime followed by CASP authorisation with the KNF is the natural path. The structure is coherent, the management substance is real, and the banking relationship can be built around a legitimate local operation.
Profile B – EU-inbound operator choosing a lead NCA. A business entering the EU market with no pre-existing Polish tie, seeking a CASP authorisation to passport across the EU, should compare the KNF's authorisation process against those of Lithuania, Malta, and other active NCAs. The choice turns on the NCA's processing speed, resource requirements, supervisory posture and the operator's ability to demonstrate local substance. For this profile, Poland is a viable choice but not necessarily the fastest route.
Profile C – Non-EU operator serving Polish clients from offshore. A business domiciled outside the EU but actively marketing to Polish users faces both the Polish AML Act's VASP registration obligation and – once MiCA is fully in force – a prohibition on providing CASP services into the EU without authorisation. The offshore licence is not a substitute. In our practice, we have seen operators in this position face enforcement notices from EU regulators for exactly this misunderstanding. The answer is either to obtain EU authorisation or to geo-restrict and enforce that restriction credibly.
In a recent cross-border licensing matter, a payments-adjacent business with a Polish subsidiary and a Cayman-domiciled group structure was preparing to launch exchange services across three EU member states. We mapped the licence, substance, banking and tax obligations across each layer before the operator committed capital to the build; the analysis identified a structural gap in the Polish entity's governance documentation that would have caused a VASP registration delay. The gap was remediated and the registration proceeded on a clean first submission.
What are the most common mistakes businesses make when setting up a crypto exchange in Poland?
The most damaging mistakes we see are structural, not operational. They are made before the first transaction is processed, and they compound over time.
The first is treating VASP registration as a one-time filing rather than a continuous compliance obligation. The GIIF conducts post-registration inspections, and an AML programme that was adequate at registration but has not been updated to reflect the growth of the business or changes in the risk environment will fail inspection. Operators who file and forget are routinely caught by this.
The second is the single-offshore-licence assumption: the belief that a registration in the BVI, Cayman Islands or another offshore jurisdiction is sufficient to operate a service for EU clients, including Polish clients. MiCA's third-country operator provisions and Poland's own AML Act's territorial reach mean this assumption is incorrect. An offshore VASP registration does not create a right to serve Polish clients; it creates a paper structure that provides no real protection when a Polish or EU regulator investigates.
The third is deferring the banking strategy until after registration. Polish banks conduct their own VASP due diligence, and a business that obtains VASP registration but cannot open a fiat account has a licence it cannot use. Banking should be addressed in parallel with the registration process, not sequentially.
The fourth is failing to plan the MiCA transition before the transitional deadline arrives. Operators who built their structure around the lighter national VASP registration will face a significantly more demanding CASP authorisation process under MiCA. Businesses that begin that preparation early – reviewing governance, capital adequacy and operational documentation now – will be positioned to file a credible CASP application when the window opens.
Related Practices at OBOLUS
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – end-to-end licensing strategy across 70+ jurisdictions for exchanges, custodians and issuers.
- CASP Authorisation Under MiCA: Practical Lessons for Boards – what boards need to know before filing for MiCA authorisation with a national competent authority.
- Regulator AML Audit Defence in the Bahamas – managing supervisory AML audits and enforcement engagement across offshore financial centres.
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction, licence type and the completeness of the application. A Polish VASP registration under the current national regime is procedurally simpler than a full CASP authorisation under MiCA, but the preparatory work – building a credible AML programme, conducting UBO verification, drafting risk assessments – typically takes several weeks before submission. MiCA CASP authorisations are substantively more demanding and involve longer NCA review periods. In our practice, operators who invest in preparation consistently achieve faster formal approvals than those who file thin applications.
Which jurisdiction is best for licensing my crypto business?
There is no single answer; the right jurisdiction depends on where your management sits, where your users are, what services you offer, and what your banking and tax constraints are. For EU market access, MiCA means the choice of lead NCA determines your passport perimeter. For operations with no EU anchor, the ADGM, VARA, MAS and other non-EU regimes each suit different business models. A common mistake is choosing a jurisdiction for speed or cost alone without analysing whether the resulting structure can be used to serve the intended client base. We map the full decision matrix before you commit.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets is a discrete CASP activity requiring specific authorisation. An exchange licence does not automatically cover the custody function. Where an exchange holds client assets – even temporarily during settlement – the custody permissions need to be explicitly addressed in the CASP authorisation. Under Poland's current national VASP regime, custody is addressed within the broader virtual currency activities registration, but the MiCA distinction will apply once CASP authorisation supersedes the national regime. Operators should ensure their authorisation scope matches every activity they actually perform.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance obligations that sit around them. We map the licence, banking and tax stack across operating, custody and payment layers before you commit to a structure. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and cross-border VASP and CASP authorisation strategies for crypto exchange and custody operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.