Most common questions about getting a crypto license in Poland

A straightforward registration process, favorable tax regime, and strong support for fintech have made the country an attractive hub for startups and international platforms. However, with the entry into force of the MiCA Regulation, the rules are changing, and entrepreneurs now face a number of new questions. What are VASP and CASP? Who issues a crypto license in Poland, and what are the requirements for applicants? Is re-registration necessary? In this article, we address the most common questions about crypto licensing in Poland and provide clear, legally sound answers.

Who is obliged to obtain a crypto license in Poland?

In Poland, all companies that provide crypto-asset-related services within the country or serve Polish clients are subject to licensing requirements. This applies not only to traditional exchanges but also to a wider range of providers falling under the definition of a Crypto-Asset Service Provider (CASP), as established by Regulation (EU) 2023/1114 (MiCA).

Since 30 June 2024, the initial provisions of MiCA have entered into force, and Polish companies can no longer operate solely under registration in the VASP Register. They must apply for a CASP license if they perform at least one of the following activities:

1. Crypto exchanges and brokers. Companies offering conversion between cryptocurrencies and fiat currencies must be licensed.
2. Custodial providers. Platforms that store crypto-assets and private keys on behalf of clients.
3. Wallet providers and DeFi services. If structured as centralized platforms offering services to EU residents.
4. Issuers of utility tokens and stablecoins. If launching tokens through ICOs, IEOs, or as part of an internal platform economy.
5. NFT and tokenization marketplaces. If they provide infrastructure for buying, storing, and transferring digital assets.

Important! Licensing requirements apply even to companies without a physical presence in Poland if they target or serve Polish residents. Under MiCA, the location of clients is a key factor in determining licensing obligations. This means non-EU entities serving Polish users without EU registration risk being banned from operating and losing access to the European market.

Polish regulators also monitor structured DeFi projects that involve centralized governance. Even if these services are marketed as “decentralized,” they fall under MiCA regulations if there are identifiable controlling persons or a legal entity responsible for the project.

What is the difference between VASP and CASP in Poland?

Before the entry into force of the MiCA Regulation, the Polish crypto service market was governed through the VASP register maintained by the tax and customs authority KAS (Krajowa Administracja Skarbowa).

Companies were simply required to register, confirm the presence of basic AML procedures, and could start operating without undergoing thorough vetting or licensing. This system was considered simplified and did not provide full protection for consumers and investors.

MiCA fundamentally changes this approach. Companies are now required to obtain CASP (Crypto-Asset Service Provider) status through a licensing process overseen by the Polish Financial Supervision Authority (KNF). This entails:

1. Stricter requirements for corporate structure — including the appointment of a compliance officer and AML officer, implementation of internal controls, and risk management systems;
2. Mandatory submission of a license application file — which includes the business model, information on beneficial owners, descriptions of all products, and client protection policies;
3. Ongoing supervision by KNF — with inspections, reporting obligations, and the authority to impose fines or suspend activities;
4. Opportunity to operate under an EU “regulatory passport” — a CASP license is valid throughout the entire European Union, eliminating the need for separate authorizations in other Member States.

The key difference is that CASP status is not a mere formality, but a formal recognition of compliance with EU-wide standards. Effectively, crypto companies are now regulated similarly to financial institutions, including obligations under DORA, AMLD6, and other relevant EU regulations.

What documents do I need to apply for a license?

To obtain a crypto license under the CASP regime, a company must prepare a comprehensive set of documents demonstrating its compliance with regulatory requirements.
The licensing process involves detailed disclosure of the company’s corporate structure, internal control systems, and policies on AML/CFT and cybersecurity.

The core documentation includes:

1. Description of the business model and services, including a list of crypto-asset operations provided and an assessment of associated risks;
2. Detailed AML/CFT procedures, including the KYC methodology, internal manuals, monitoring, and reporting procedures;
3. Organizational structure of the company, list of key personnel including the compliance officer and AML officer, along with their CVs;
4. Information on beneficial owners, including documents confirming the ownership structure;
5. Description of IT systems, including mechanisms for personal data protection, backup procedures, access controls, and incident response protocols;
6. Financial documentation, such as the business plan, sources of funding, and projected profit and loss statements;
7. Consumer protection policy, including complaint handling procedures, risk disclosures, and mechanisms for fund reimbursement.

The regulator may also request additional documents, such as cybersecurity assessments, technical specifications of software solutions, and external audit reports.
An incomplete or improperly prepared documentation package can result in the rejection of the application or significant delays in the licensing process.

How long does it take to get a license?

The time required to obtain a crypto license in Poland depends on multiple factors: the quality of the submitted documentation, the workload of the regulator, the complexity of the business model, and the applicant’s responsiveness.

Before the implementation of MiCA, VASP registration typically took between 14 to 30 days. The process was straightforward: the application was submitted online with basic company information and confirmation of AML compliance. Government oversight was minimal.

Under the new MiCA regime, obtaining a CASP license involves a full licensing procedure, comparable in complexity to acquiring a payment institution or investment firm license. The KNF processes applications in several stages:

1. Preliminary review (formal assessment of documents) – up to 20 business days;
2. Substantive examination (compliance with MiCA requirements and evaluation of key personnel) – up to 60 business days;
3. Requests for clarification or additional documentation may add another 30–60 days;
4. Final decision and publication in the CASP register – up to 10 business days.

In total, the average timeline for obtaining a CASP license ranges from 3 to 6 months, assuming the application is complete and well-prepared. If the KNF issues multiple follow-up requests, the process can take up to 9 months.

Which MiCA requirements are the most critical for Polish companies?

The MiCA Regulation introduces comprehensive requirements for crypto companies operating within the EU. For the Polish market, the most challenging aspects involve structural and operational transformations related to the shift from the VASP regime to full CASP licensing. Many of the new obligations go beyond legal status and require deep internal reorganization.

1. Transparent corporate structure. The company must have a clearly defined and documented ultimate beneficial owner (UBO). Anonymous or offshore ownership structures are prohibited. Regulators will assess relationships between stakeholders, including foreign entities.
2. Appointment of key control personnel. It is mandatory to designate a Compliance Officer and an AML Officer, both of whom must meet professional qualification standards. These individuals are subject to approval by the regulator, including reputational and experience checks. It is also recommended to establish an internal control committee or a risk management function.
3. Implementation and enforcement of AML/KYC procedures. Companies must adopt robust procedures for customer identification, transaction monitoring, and detection of suspicious activity. The use of automated systems (for PEP screening and sanctions lists) is considered an advantage. Ongoing AML/CFT training for staff is mandatory.
4. Information and cybersecurity. Firms must ensure the protection of client data, private keys, and IT infrastructure. This includes security policies, incident response plans, and vulnerability assessments. Periodic cybersecurity reports may be requested by KNF or ESMA.
5. Investor protection and disclosure obligations. Companies must inform users about operational risks, fees, and terms. Token issuers (including utility tokens) are required to publish a whitepaper based on a standardized template. Misleading marketing practices or unauthorized fundraising are strictly prohibited.

Organizational and documentation compliance is now critical for crypto firms. Many operators previously functioned without a structured governance model and are now facing, for the first time, the need to formalize internal control mechanisms in a legally compliant manner.

What are the penalties for companies without a license?

Once the transitional period ends, all crypto companies operating in Poland or serving EU clients are required to hold a valid CASP license. The absence of such a license is not merely an administrative oversight—it poses a direct threat to the business's existence and carries serious legal and financial consequences.

1. Prohibition from operating. Any company that fails to obtain a CASP license must cease all crypto-related activities within the EU. Continuing operations without a license is considered illegal.
2. Administrative and criminal penalties. The Polish Financial Supervision Authority (KNF) has the power to impose fines amounting to several million PLN. Company executives may also face personal liability, especially in cases involving non-compliance with AML/CTF requirements.
3. Exclusion from the EU public register. Without CASP status, a company cannot be listed in the EU-wide public registry maintained by ESMA. This effectively blocks it from entering partnerships, banking relationships, and financial networks across the EU.
4. Bank account closures and denial of services. Banks and payment service providers may refuse to service or close the accounts of companies operating without a legal license.
5. Loss of trust from clients and investors. For institutional investors, a license is a fundamental prerequisite for engagement. Increasingly, individual users also prioritize CASP status when choosing platforms to work with.

How can Key2Law help with getting a crypto license in Poland?

Obtaining a CASP license in Poland is a complex process that involves preparing dozens of documents, communicating with regulators, and ensuring compliance with technical and compliance standards. Mistakes at this stage can lead to license rejection, financial penalties, or significant delays. The Key2Law team is here to guide you through the entire process efficiently, transparently, and with minimal risk.

Here’s how we can help:

1. MiCA compliance assessment. We conduct a detailed audit of your business operations, identify risk areas, and develop a tailored licensing strategy.
2. Document preparation. We prepare a complete licensing file, including AML/KYC policies, operational procedures, IT infrastructure descriptions, and governance structure.
3. Regulator communication and representation. We handle all correspondence with the Polish regulator (KNF), prepare responses to official queries, and support you at every stage of the procedure.
4. Company setup support. We assist with company registration, office setup, bank account opening, and recruitment of key personnel, including AML and compliance officers.
5. Post-licensing support. We ensure your ongoing compliance with MiCA obligations, prepare you for regulatory audits, and protect your business in the event of challenges or enforcement actions.

If you’re planning to enter the Polish crypto market or already serve clients in Poland, don’t delay your licensing. Contact Key2Law, and we’ll prepare your company for successful authorization under MiCA, fully aligned with both Polish and EU regulatory requirements.