Operating a virtual asset service provider (VASP) in Poland without credible economic substance is one of the fastest routes to a regulatory challenge. The Polish VASP registration regime is administered by the General Inspector of Financial Information (GIIF), and although entry requirements are comparatively accessible for an EU jurisdiction, regulators and correspondent banks are now scrutinizing whether a registered entity genuinely operates from Polish soil. Businesses that treat the registration as a post-box arrangement face enforcement exposure, banking termination and the broader risk of losing their EU operational base entirely.
This page sets out what economic substance means for a VASP registered in Poland, how the requirement interacts with the EU's MiCA (Markets in Crypto-Assets Regulation) transition, and where cross-border businesses most commonly misjudge the line between a legitimate presence and a paper structure.
What Is Economic Substance for a Poland-Registered VASP?
Economic substance, in the Polish context, means that the business actually manages and controls its VASP activities from Poland – not merely holds a registration number there. The GIIF and, increasingly, the Polish tax authority (Urząd Skarbowy) are asking whether key decisions are made in the country, whether qualified staff are present and whether the entity's operational infrastructure is located there. A registration obtained for its address and then run entirely from another country satisfies none of those tests.
The principle is reinforced from two directions. First, Poland's AML framework – which implements FATF Recommendation 15 and the EU's anti-money-laundering directives – requires the registered entity to carry out effective compliance, customer due diligence and transaction monitoring functions. Those functions require real people, real systems and real oversight. Second, EU state-aid and transfer-pricing rules mean that a VASP generating revenue across multiple member states needs a defensible basis for attributing that revenue to Poland. Without substance, that attribution collapses.
The process above describes the standard path. Your facts – the entity structure, the user base, the banking – change the analysis materially. For a scoped assessment of your Polish presence, contact OBOLUS at info@oboluslaw.com.
Who Needs to Register as a VASP in Poland?
Any business providing virtual asset services to clients in Poland – or operating from a Polish entity – falls within the registration obligation under the applicable VASP provisions of the Polish AML Act. The categories covered include exchange services between virtual and fiat currency, exchange between virtual currencies, transfer services and the operation of virtual currency platforms. Custody, in certain configurations, is also captured.
The obligation applies regardless of whether the beneficial owner is Polish. A foreign-founded company incorporated in Poland and providing services to EU users is fully within scope. Equally, a foreign company that targets Polish users without a Polish entity may face exposure under Polish AML provisions, though that analysis turns on the specific service and delivery model.
Under MiCA, which the EU is implementing on a rolling basis, Poland's existing VASP framework will transition to the CASP (Crypto-Asset Service Provider) authorisation regime supervised by ESMA and the relevant Polish NCA. Businesses registered under the current regime should plan for that migration rather than assume grandfather protection is automatic.
What Does a Credible Polish Presence Look Like?
A credible Polish presence for a VASP has four observable dimensions: governance, personnel, infrastructure and banking. None of these is individually dispositive, but a regulator or bank that finds all four deficient will have grounds to question the registration entirely.
Governance means that board meetings occur in Poland, that minutes are maintained in Polish corporate records, and that the person responsible for AML compliance – the Officer for AML/CFT, a statutory role under Polish law – is reachable and active from within the jurisdiction. A director who appears on paper but has no operational role satisfies the form without the substance.
Personnel requires at least one qualified individual on the ground. In our practice, we regularly advise clients that the compliance officer position is the most scrutinized. An individual who holds the role, operates from Warsaw and can demonstrate a working knowledge of the Polish AML framework is the minimum viable position. Larger operations should expect to staff a broader team locally.
Infrastructure includes a real office address – not a virtual office managed by a third party for hundreds of tenants – and the technical systems used to operate the VASP service accessible and managed from that location. Where the technology is cloud-based, contracts and access logs should reflect Polish management.
Banking is often the decisive test in practice. Polish banks, already cautious about crypto clients, will conduct their own substance assessment before opening or maintaining accounts. A Polish IBAN connected to a real Polish legal entity with a credible compliance function is both a regulatory and commercial necessity. Without it, the business cannot settle with Polish or EU clients.
How Does the MiCA Transition Affect Substance Expectations?
The MiCA transition is raising the bar, not lowering it. Under the prior EU AML-only framework, a VASP registration in Poland was primarily a compliance registration. Under MiCA's CASP authorisation regime, a provider seeking to passport its services across the EU/EEA must demonstrate to the Polish NCA that it meets the prudential, governance and operational requirements the regulation sets out. Those requirements are considerably more detailed than the registration checklist.
Passporting is the central commercial argument for a Polish MiCA authorisation. A CASP authorised in one EU member state may passport across the EU/EEA without obtaining separate authorisation in each country. That benefit is real, but it requires the home-state NCA to be satisfied that the entity is genuinely under its supervision. An entity with no management, no staff and no operational activity in Poland will not obtain or retain that authorisation – and if it does, another member state's NCA may challenge the arrangement.
In our cross-border practice, we have seen businesses attempt to use Poland as a low-cost entry point for an EU passport while centralizing all actual operations elsewhere. The strategy is short-sighted. The MiCA CASP application requires disclosure of governance structures, key function holders and operational plans. Regulators are comparing those disclosures against the physical reality.
How Does the Cross-Border Tax Layer Interact With Substance?
Tax and substance are linked in ways that digital-asset businesses frequently underestimate. A Polish VASP that generates revenue from users across multiple EU countries – but whose management and control sits in another jurisdiction – may be treated as a tax resident of that other jurisdiction under standard permanent-establishment analysis. The Polish registration provides no protection from that assessment.
Corporate income tax in Poland applies to entities managed and controlled from Poland. Where the effective place of management is genuinely Polish, that analysis is clean. Where the company is Polish on paper but directed from, say, the UAE or Singapore, the Polish tax authority may dispute the entity's residency and, separately, the GIIF may question whether the AML compliance program is genuinely operated from Poland.
For businesses with a VARA (Virtual Assets Regulatory Authority) licence in Dubai or a MAS-regulated presence in Singapore that also hold a Polish VASP registration, the critical question is which entity is the principal operating entity and where that entity's key decisions are made. Conflating the two – running a Dubai-licensed exchange through a Polish entity for EU passporting purposes, without adequate Polish substance – creates both AML and tax exposure simultaneously.
The Travel Rule adds a further cross-border dimension. Under FATF Recommendation 15 and applicable EU provisions, VASPs are required to pass originator and beneficiary information with virtual asset transfers above the applicable threshold. The Polish entity must have the systems and personnel to implement that obligation – not rely on a system operated from a foreign affiliate.
If a prior application stalled, or a banking relationship was closed after a substance review, a second read can surface the structural issue and the route back. Write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.
What Does the Application and Ongoing Supervision Process Look Like?
The VASP registration process in Poland is administered by the GIIF and follows a defined procedural path. At the application stage, the business must file documentation covering its legal structure, beneficial ownership, AML/CFT policy and the identity of the responsible AML officer. The timeline from a complete filing to registration confirmation is typically a matter of weeks, though the actual duration varies with filing completeness and the regulator's current workload.
Ongoing supervision involves periodic AML audits and the obligation to file suspicious transaction reports with the GIIF. The entity must maintain up-to-date beneficial ownership records in the Central Register of Beneficial Owners (CRBR), the Polish register that implements EU beneficial ownership transparency requirements. Failure to file or update CRBR entries can result in significant administrative fines.
Under MiCA, the CASP authorisation process will involve a more structured assessment by the NCA, including review of a business plan, governance arrangements and technical systems. Operators planning ahead should treat the current registration as a baseline and begin structuring their Polish presence to meet the CASP standard – rather than waiting for the transition deadline to trigger a reactive rebuild.
In a recent matter, a payments company with an existing Polish VASP registration sought to expand into exchange and custody services across three EU markets. We mapped the substance gaps against the draft MiCA CASP requirements, identified the governance and personnel changes needed to support a passportable authorisation, and structured an operating model that satisfied both the Polish NCA's expectations and the transfer-pricing position required for the group's tax consolidation. The result was a credible Polish hub rather than a registration in name only.
Which Operator Profiles Are Best Suited to a Polish Presence?
Not every digital-asset business should anchor its EU operations in Poland. The right fit depends on the business model, the desired regulatory footprint and the operator's capacity to build genuine local substance.
Profile A – the EU-passport seeker. A non-EU exchange or payment business that wants MiCA CASP coverage across the EU and can commit to a real Warsaw presence – compliance officer, local banking, governance activity in Poland – will find the GIIF an accessible NCA relative to some of its EU peers. The timeline to a functioning authorisation is manageable, and the Polish legal environment is common-law-adjacent in commercial matters, which eases contract and operating documentation. The key risk is underinvestment in substance relative to the passport benefit sought.
Profile B – the dual-hub operator. A business already licensed in the UAE under VARA, or in Singapore under the MAS Payment Services Act, that needs an EU entry point may use Poland as a secondary licensing hub. The challenge is demonstrating genuine operational independence between the two entities. Regulators in both jurisdictions may request information about the group structure. Transfer pricing and beneficial ownership transparency obligations apply in both directions.
Profile C – the emerging-market tech build. A crypto-native company building a product for Central and Eastern European markets, with a founding team already based in Poland, has the most natural substance case. The local talent pool in Warsaw and Kraków for compliance and technology roles is credible. The risk is the opposite of Profile A – substance is genuine but documentation of that substance for regulatory and banking purposes is often inadequate.
A common assumption is that a single offshore VASP registration – in the BVI, Cayman or an early-mover EU jurisdiction – is sufficient to serve clients across the EU and beyond. That assumption is no longer defensible. MiCA imposes market-access requirements for EU users that a non-EU entity cannot satisfy through a registration elsewhere. Operators relying on that model are not protected by the prior registration; they are exposed by it.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how we structure the licence, banking and compliance stack across jurisdictions
- Digital-asset licensing in Panama – what inbound operators need to know about the Panamanian regime
- VASP business risk assessment in the United States – mapping federal and state MTL exposure before you enter the US market
FAQ
How long does a crypto licence take to obtain?
In Poland, a VASP registration with the GIIF typically completes within a matter of weeks from a complete filing, though the timeline varies with document quality and the regulator's workload. Under MiCA, a full CASP authorisation will take longer and requires a more detailed submission. In other jurisdictions – Singapore, the UAE, Hong Kong – timelines vary by licence category and application complexity. We map the realistic timeline as part of the initial scoping exercise.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice depends on where the business operates, where its users are located, where it can bank and what the regulatory obligations are in each market. A VARA licence in Dubai suits a business with real UAE operations and a Gulf client base. A MiCA CASP authorisation suits a business that needs EU-wide access. Poland is a credible EU entry point for operators who can build genuine local substance. We map the full licence stack before a client commits.
Do I need a separate custody licence?
In most flagship regulatory regimes, custody of virtual assets is a regulated activity that requires its own authorisation or is a separately defined condition within a broader licence. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service category. Under VARA in Dubai and the MAS Payment Services Act in Singapore, similar distinctions apply. Whether a single licence covers custody depends on the specific regime and the scope of services. We assess the full service footprint before advising on structure.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before a client commits to a structure – and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications when disputes arise. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in EU CASP authorisation pathways, VASP registration structuring and cross-border substance analysis for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.