This chapter reflects the law and market developments in Poland as at 9 October 2026.

A market shaped by regulation

Poland has an active retail crypto-asset market, a developer community and home-grown fintech businesses. In 2026, regulation is the main issue shaping market access. For several years the domestic market was built around exchanges, brokers and wallet providers registered locally for anti-money laundering purposes. That registration ceased to provide a basis for services regulated by Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) on 1 July 2026, when its transitional period expired while Poland still lacked the national legislation needed to authorise crypto-asset service providers (CASPs) domestically.

Business activity in virtual currencies has been a regulated activity in Poland since 31 October 2021, when amendments to the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (AML Act) made entry in the Register of Activity in the Field of Virtual Currencies a condition of lawful operation. This register of virtual asset service providers (VASP register) is kept by the Director of the Tax Administration Chamber in Katowice. Registration was an AML gateway only: it did not involve prudential supervision, capital requirements or conduct-of-business rules.

Since the transition ended, access to Polish clients has depended on the relevant MiCA entitlement, including authorisation in another EU member state and completion of the cross-border notification process. Poland therefore remains open to eligible EU providers while lacking a domestic CASP licensing route.

Sectors adopting blockchain and distributed ledger technologies

Adoption of blockchain and other distributed ledger technologies (DLT) is visible in the following areas:

• Financial services: centralised trading and brokerage, custody, crypto payment processing and fiat-to-crypto ‘on-ramp’ services. Polish banks have also used DLT to deliver contractual documents to customers on a durable medium.
• Capital markets infrastructure: the Central Securities Depository of Poland (KDPW) has engaged with market participants on DLT-based post-trade solutions, and a DLT test environment has been made available within the virtual sandbox run by the Office of the Polish Financial Supervision Authority (UKNF).
• Tokenisation: tokenised real-world assets, private credit and revenue-sharing products, typically structured through special purpose vehicles and often issued from other jurisdictions (see Question 8).
• Energy, logistics and supply chain: traceability, certificates of origin and pilot projects in energy trading.
• Culture and entertainment: non-fungible tokens (NFTs) used by cultural institutions, gaming and sports businesses, although commercial NFT activity has slowed considerably since 2022.

Cross-border payment processing, fiat-to-crypto on-ramp services and aggregator models raise particular questions about which entity actually performs each regulated activity. Identifying that entity is important both for the provider’s licensing position and for banks and payment service providers assessing the business.

No blockchain-specific Polish statute

Poland has no general statute regulating blockchain as such. DLT is regulated on a technology-neutral basis, through the rules that govern the activity carried out with it. The framework for crypto-assets is almost entirely EU-derived and, since 30 December 2024, is anchored in MiCA.

Principal legislation

• MiCA: directly applicable; its rules on asset-referenced tokens (ARTs) and e-money tokens (EMTs) have applied since 30 June 2024 and the remaining titles, including CASP authorisation, since 30 December 2024.
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR): the ‘travel rule’ for crypto-asset transfers, applicable since 30 December 2024.
• AML Act: treats virtual-currency businesses as obliged institutions and established the VASP register.
• Regulation (EU) 2022/858 (DLT Pilot Regime): the framework for DLT market infrastructures for tokenised financial instruments.
• Regulation (EU) 2022/2554 on digital operational resilience (DORA): applicable since 17 January 2025, including to CASPs.
• Securities law: the Act of 29 July 2005 on Trading in Financial Instruments and the Act of 29 July 2005 on Public Offering, which apply where a token qualifies as a financial instrument.
• Payment services law: the Act of 19 August 2011 on Payment Services, relevant to fiat payment flows, electronic-money institutions issuing EMTs and certain services involving EMTs.
• Tax law: the personal and corporate income tax acts and the Act of 9 March 2017 on the Exchange of Tax Information with Other States, amended by the Act of 13 February 2026 (Journal of Laws 2026, item 347), implementing the eighth and ninth amendments to the Directive on Administrative Cooperation in taxation (DAC8 and DAC9).

Regulators

• Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF): supervises banks, investment firms, payment and electronic-money institutions and is the intended competent authority under MiCA. UKNF has confirmed that Poland still lacks a MiCA competent authority, except in relation to EMT issuers.
• General Inspector of Financial Information (GIIF): the Polish financial intelligence unit and AML supervisor.
• Director of the Tax Administration Chamber in Katowice: keeper of the VASP register.
• President of the Office of Competition and Consumer Protection (UOKiK): consumer protection and misleading marketing.
• President of the Personal Data Protection Office (UODO): data protection.
• National Bank of Poland (NBP): monetary policy and payment-system oversight, with no supervisory mandate over crypto-asset firms.
• Prosecution service and the Central Cybercrime Bureau (CBZC): criminal enforcement.

Status of Polish implementing legislation

Poland has not yet enacted the national legislation designating a MiCA competent authority for CASPs and ART issuers and establishing the accompanying supervisory and sanctions framework. Successive government-backed acts have been vetoed by the President of the Republic, and Parliament has not overridden those vetoes.

A further presidential bill was submitted on 8 September 2026. Legislative discussions remain ongoing, and the timetable for a domestic authorisation route is uncertain.

The main points of disagreement concern supervisory fees, powers to block websites and accounts, procedural safeguards and the severity of sanctions. These are proposed national measures; their final scope will depend on the legislation enacted.

The legislative proposals envisage KNF as the competent authority for CASPs and ART issuers. Businesses should distinguish that proposed role from the powers the authority currently holds.

Government and presidential positions

There is broad political agreement that MiCA must be made operational in Poland. The disagreement concerns how intrusive the domestic supervisory toolkit should be. The government has argued for strong supervisory and enforcement powers, an argument that gained force after the problems at the Zondacrypto exchange became public in April 2026 (see Question 14). The President has argued that the government’s bills over-regulate the market and risk pushing Polish businesses abroad.

Since 1 July 2026, CASPs authorised elsewhere in the EU may continue to serve Polish clients through the MiCA cross-border procedure, as confirmed by UKNF. Domestic operators relying only on VASP registration no longer have that basis for providing MiCA-regulated services, while a Polish authorisation route remains unavailable.

The supervisor’s stance

KNF has traditionally taken a cautious approach to retail crypto-asset investment. It has issued repeated investor warnings and maintains a public warning list of entities suspected of carrying on regulated activity without authorisation, which includes crypto-related entities. At the same time, UKNF supports innovation through its Innovation Hub programme, which offers non-binding regulatory dialogue, and a technical testing environment. Poland does not operate a regulatory sandbox in the sense of a regime allowing selective waivers of regulatory requirements.

Blockchain outside the crypto-asset perimeter

Outside crypto-assets, the authorities generally assess DLT through the rules applicable to the activity concerned. Sector-specific requirements on outsourcing, information and communication technology (ICT) risk, digital operational resilience and data protection apply to DLT solutions in the same way as to other technology.

No Polish CBDC project

The National Bank of Poland (NBP) has not announced a decision to issue a retail central bank digital currency (CBDC) or to launch a digital zloty pilot. Its published 2021 position was that domestic circumstances did not justify pilot tests, while reserving the right to reassess that conclusion in light of subsequent developments.

For market participants, the practical position is that a digital zloty is not available and no domestic launch timetable has been announced.

The digital euro and stablecoins

Poland is not a member of the euro area, so the digital euro being developed by the European Central Bank (ECB) would not be legal tender in Poland. Polish businesses with euro-area operations and Polish payment service providers should nonetheless follow the digital euro legislative process, in particular its rules on distribution and on use by residents of non-euro member states.

For Poland, stablecoins referenced to foreign currencies also raise monetary-sovereignty questions. MiCA provides monitoring and, in certain circumstances, issuance restrictions for ARTs used as a means of exchange, with relevant rules also applying to EMTs denominated in a non-EU currency.

Classification follows MiCA

The EU Markets in Crypto-assets Regulation (MiCA) provides the main regulatory framework for crypto-assets in Poland. Its principal categories are:

• E-money tokens (EMTs): tokens that purport to maintain a stable value by referencing a single official currency, whose issuers must generally be authorised credit institutions or electronic-money institutions.
• Asset-referenced tokens (ARTs): tokens other than EMTs that purport to maintain a stable value by referencing another value or right or a combination of them, whose issuers generally require authorisation, subject to statutory exemptions and a separate route for credit institutions.
• Other crypto-assets: a residual category covering most utility tokens and unbacked crypto-assets.

Crypto-assets that qualify as financial instruments fall outside MiCA and are governed by securities and investment-services law. Classification turns on substance, informed by the European Securities and Markets Authority (ESMA) guidelines on the qualification of crypto-assets as financial instruments. MiCA also excludes genuinely unique and non-fungible crypto-assets; labelling a token an NFT does not by itself establish that exclusion.

The authorisation gap after 1 July 2026

Providing crypto-asset services professionally in the EU generally requires CASP authorisation. Certain already-regulated financial institutions can instead use the notification route under Article 60 of MiCA for eligible services. Without a designated authority for CASPs, however, Poland has no domestic CASP authorisation route. Entry in the VASP register is not a MiCA authorisation and, since 1 July 2026, no longer provides a basis for carrying on MiCA-regulated services.

Polish operators have therefore faced a choice between:

• obtaining authorisation in another member state, with a registered office there, effective management in the EU and genuine local substance;
• restructuring their business so that regulated services are provided by an EU-authorised CASP, with the Polish entity limited to activities outside the MiCA perimeter; or
• suspending or winding down regulated activity until a Polish licensing route exists.

The absence of national legislation also means that Poland has not yet adopted the administrative sanctions regime that MiCA requires member states to put in place. The successive implementing bills would introduce substantial administrative fines and criminal liability for, among other things, providing crypto-asset services without authorisation. In the meantime, unauthorised operators remain exposed to AML, consumer-protection and general criminal-law liability, as well as to enforcement by other member states’ authorities.

Decentralised finance

Under recital 22 of MiCA, crypto-asset services provided in a fully decentralised manner without any intermediary fall outside its scope, while services provided only partly in a decentralised manner do not. The assessment depends on how the arrangement operates: control over a front-end, administrative keys, upgrades or fees can be relevant to identifying a service provider. Centralised finance (CeFi) firms that route client activity through DeFi protocols remain responsible for the regulated services they provide.

Retail and professional clients

MiCA does not reproduce the retail and professional client framework of the second Markets in Financial Instruments Directive (MiFID II). It nevertheless includes retail-specific protections, including a 14-day withdrawal right for certain public offers, subject to exclusions, and white-paper exemptions for qualifying offers restricted to qualified investors. Suitability requirements also apply to crypto-asset advice and portfolio management.

AML framework

Virtual-currency businesses are obliged institutions under the AML Act. They must apply customer due diligence, ongoing transaction monitoring, enhanced measures for higher-risk relationships, record-keeping and suspicious activity reporting to GIIF. Entry in the VASP register required, among other things, that the persons managing the business had no relevant criminal record and had appropriate knowledge or experience.

Since 30 December 2024, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR) has required specified originator and beneficiary information to accompany crypto-asset transfers involving CASPs, without a minimum transfer threshold. Each provider must perform the verification required for its role; compliant prior customer verification need not be repeated for every transfer. For transfers exceeding EUR 1,000 to or from a self-hosted address, the provider must also assess whether the address is owned or controlled by its customer. Proposed Polish provisions on enforcement form part of the stalled implementing legislation.

Who supervises crypto flows to Polish clients now?

For services supplied by passporting CASPs, the home-state framework and the way the firm operates in Poland are relevant to AML supervision. GIIF retains responsibility for Polish obliged institutions, including banks and payment institutions assessing exposure to crypto-asset counterparties. Cross-border authorisation does not remove the need to assess any local establishment and its obligations. Polish banks continue to apply their own risk-based approach to crypto-related customers.

The new EU AML package

Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR) will apply from 10 July 2027 and introduce a directly applicable EU rulebook. CASPs will be obliged entities and will be prohibited from maintaining anonymous accounts or accounts allowing the anonymisation of customers, including through anonymity-enhancing coins. The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) will directly supervise selected high-risk cross-border entities, potentially including CASPs, from 2028.

Sanctions

EU restrictive measures apply to crypto-assets as well as to traditional funds and economic resources. Council Regulation (EU) No 833/2014 prohibits crypto-asset services to specified Russian persons and entities, subject to applicable exemptions, including for certain EU, European Economic Area and Swiss citizens and residents. Separate restrictions apply under the Belarus sanctions regime. Asset-freeze measures must be assessed independently, including screening counterparties and relevant ownership or control links.

At national level, the Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security provides for a domestic sanctions list and freezing measures. In 2022 KNF also called on supervised entities to take a risk-based approach to cooperation with virtual-currency businesses, including enhanced measures and, where risks could not be mitigated, termination of the relationship.

DeFi

Fully decentralised arrangements without an identifiable intermediary are not obliged entities under the current or the incoming EU AML framework. AML obligations attach instead to intermediaries whose activities fall within the applicable AML rules, including custodians, on-ramps and off-ramps and, depending on their functions, front-end operators. Blockchain analytics can help identify exposure to mixers, sanctioned addresses and high-risk protocols.

Practical compliance risks

Onboarding assessments for acquirers and payment service providers should identify the actual service provider, check that customer verification takes place when required and detect ‘licence borrowing’ through white-label arrangements. Contractual labels should be checked against transaction flows and the allocation of regulated functions.

Personal income tax

Since 1 January 2019, income from the paid disposal of virtual currency has been taxed separately within the capital-income category at a flat personal income tax rate of 19%. Paid disposal includes exchanging virtual currency for legal tender, goods, services or other property rights, and using it to settle obligations. Exchanges between virtual currencies are tax-neutral. A 4% solidarity levy may also apply to the excess over PLN 1 million of the individual’s aggregate income included in the statutory levy base.

Deductible costs comprise documented expenditure directly incurred on acquiring virtual currency and costs connected with its disposal. Excess eligible costs are carried forward to subsequent years. Virtual-currency income is not combined with other capital income, and the transaction income and eligible costs are reported in the annual PIT-38 return.

Corporate income tax

Companies are subject to a broadly parallel regime. Income from disposing of virtual currency generally falls within the capital gains basket, with an exception for specified professional virtual-currency businesses covered by the AML Act, whose relevant income falls outside that basket. Timing, valuation and the tax treatment of particular tokens depend on the activity and the asset concerned.

VAT and tax on civil-law transactions

Following the judgment of the Court of Justice of the European Union in Skatteverket v David Hedqvist (Case C-264/14, ECLI:EU:C:2015:718), exchanging virtual currency for traditional currency is treated as an exempt financial service for value added tax (VAT) purposes. The sale or exchange of virtual currency is exempt from Polish tax on civil-law transactions.

Main uncertainties

• Yield-generating activity: staking, lending, liquidity provision and yield farming.
• Airdrops, hard forks and mining: the timing and source of income.
• NFTs, utility tokens and tokenised real-world assets: whether they fall within the tax concept of virtual currency at all.
• A definitional mismatch: Polish tax law still relies on the AML-based concept of ‘virtual currency’, while the regulatory framework now uses MiCA’s broader concept of ‘crypto-assets’. Changes to the AML definitions in the implementing legislation could therefore have tax consequences.

DeFi arrangements require analysis under these general rules, with particular care over the nature of the token and the return earned. An individual tax ruling can protect a taxpayer who acts in accordance with it, subject to statutory conditions and correspondence between the actual circumstances and those described in the application.

DAC8

Poland implemented DAC8 through the Act of 13 February 2026 amending the Act on the Exchange of Tax Information with Other States. Reporting crypto-asset service providers must collect and verify customer identity and tax-residence data and report covered exchanges and transfers. The first reporting cycle in 2027 covers data for 2026; reports to the Polish tax authority are due by 30 June 2027.

Substance over technology

Poland has no dedicated tokenisation statute. A token is regulated according to the rights it represents. A token equivalent to a share, bond or fund unit is subject to the relevant financial-instrument rules. A token referencing a currency or basket of assets may be an EMT or ART. Other tokens require assessment against MiCA’s scope and exclusions. Recording an asset on a ledger does not change its legal nature, transfer formalities or the rules that apply to it.

Retail tokenisation

Retail projects in Poland have mainly involved tokenised real estate, private credit and revenue-sharing products, generally structured through special purpose vehicles. The main regulatory touchpoints are:

• Prospectus rules: Regulation (EU) 2017/1129 and the Act on Public Offering, where tokens are transferable securities offered to the public.
• Crowdfunding: Regulation (EU) 2020/1503 on European crowdfunding service providers, which KNF already supervises.
• Collective investment rules: where the structure amounts to an alternative investment fund.
• MiCA: for tokens outside the financial-instrument perimeter. Without a designated authority for Title II notifications, a Polish-based offeror cannot currently notify a white paper at home (see Question 10).

A key risk is the mis-labelling of investment-type tokens as utility tokens. The rights attached to the token and the structure of the arrangement require analysis; an expectation of profit alone does not determine classification as a financial instrument.

Wholesale tokenisation

The DLT Pilot Regime provides a framework for specified market infrastructures trading and settling tokenised financial instruments. It allows DLT multilateral trading facilities, settlement systems and combined trading and settlement systems to operate with targeted exemptions. Poland adapted its financial-market legislation through the Act of 16 August 2023. No Polish DLT market infrastructure appears on ESMA’s published list of authorised infrastructures at the date of this chapter, although KDPW has engaged with the technology.

Wholesale DLT settlement initiatives are particularly relevant to Polish institutions with euro-denominated business. Tokenisation projects still need to establish a legally effective settlement asset and comply with the rules applicable to the underlying instrument.

No prohibition on holding or trading

Polish law does not prohibit individuals or companies from buying, holding, selling or mining crypto-assets, or from agreeing to accept them as payment. Crypto-assets are not legal tender, which in Poland is the zloty.

Restrictions in practice

The restrictions that matter are regulatory consequences of how an activity is carried out:

• providing crypto-asset services without the required MiCA entitlement, including reliance solely on former VASP registration after 1 July 2026;
• issuing ARTs or EMTs without satisfying the applicable issuer requirements; offering by another person is subject to MiCA’s conditions, including the issuer’s written consent;
• offering or making available ARTs and EMTs that do not comply with MiCA on CASP platforms, in line with ESMA’s statements on non-compliant tokens;
• dealing with persons and entities subject to EU or Polish sanctions (see Question 6).

How common is trading?

Crypto-asset trading is established among Polish retail investors. MiCA-authorised CASPs from other member states, including EU entities of international groups, can serve Polish clients through the cross-border notification procedure. A third-country licence alone does not confer an EU passport. Institutional participation remains constrained by bank risk policies and the absence of a domestic licensing route.

A limited ICO history

Poland saw a modest number of initial coin offerings during the 2017–2018 boom. KNF responded with warnings that tokens offered in ICOs could constitute financial instruments, triggering prospectus and licensing requirements, and that investors faced a high risk of losing their funds. In December 2020 KNF published a more detailed position on the issuance and trading of crypto-assets, setting out how it would distinguish financial instruments from other tokens.

Requirements under MiCA

Public offers of crypto-assets other than ARTs and EMTs are now governed by Title II of MiCA. The key requirements for an offeror are:

• being a legal person;
• drawing up a crypto-asset white paper containing the information prescribed by MiCA, including on the project, the rights attached to the token, the underlying technology, the risks and the environmental impact of the consensus mechanism;
• notifying the white paper to the competent authority of the home member state at least 20 working days before publication, and providing marketing communications to that authority on request;
• ensuring that marketing communications are fair, clear and not misleading and consistent with the white paper;
• providing the statutory 14-day withdrawal right where applicable; this is subject to exclusions, including for crypto-assets already admitted to trading;
• accepting liability for information in the white paper.

White-paper exemptions include qualifying offers to fewer than 150 persons per member state, offers with total consideration not exceeding EUR 1 million over 12 months, and offers solely to qualified investors where the crypto-assets may only be held by such investors. Each exemption has conditions and does not necessarily remove other obligations. ART issuers generally need prior authorisation, subject to exemptions and the credit-institution route; EMT issuers must meet the applicable credit or electronic-money institution requirements.

White-paper notification in Poland

Without a designated competent authority for Title II notifications, an offeror with its registered office in Poland cannot complete a domestic white-paper notification. A Polish-led project must therefore assess whether a valid exemption applies or whether a genuine structure in another member state is appropriate. The absence of a Polish authority also affects domestic ART authorisation applications.

Legal nature

The Polish Civil Code distinguishes tangible things from property rights and other intangible assets, and does not expressly classify crypto-assets. They are not things, so the owner’s vindication claim does not apply directly. They are generally treated as transferable assets with economic value, a view supported by their recognition in tax and AML legislation and, now, by MiCA’s definition of a crypto-asset.

Transfer of title

The legal transfer mechanism depends on the rights represented by the crypto-asset. An on-chain transaction transfers technical control but does not necessarily satisfy every applicable legal formality. In custody arrangements, contractual terms and the custodian’s records are important, alongside MiCA’s requirement to legally segregate client crypto-assets from the custodian’s estate. Disputes may involve contractual, restitutionary or other civil claims, supported where appropriate by interim measures addressed to exchanges or custodians.

Security over crypto-assets

Polish law has no dedicated security regime for crypto-assets. A civil-law or registered pledge may be available where the collateral constitutes an identifiable transferable right, but this cannot be assumed for every type of crypto-asset. Identification, creation and enforcement of the security require assessment. The financial-collateral regime may be relevant where a token falls within an eligible category, such as a financial instrument.

Control arrangements, such as lender-controlled or multi-signature wallets and tri-party custody, can support contractual enforcement. Control of private keys alone does not establish the legal effectiveness or insolvency priority of a security interest.

Smart contracts under general contract law

Poland has no general domestic smart-contract regime. Whether a smart contract creates a legally binding agreement depends on the Civil Code, including capacity, intention, agreed terms and any required form. Code may express agreement or automate performance of an existing contract. Separately, the directly applicable EU Data Act defines smart contracts and imposes specific requirements on those used to execute data-sharing agreements; these rules do not apply indiscriminately to every blockchain contract.

The Civil Code recognises documentary form where the content of a declaration can be accessed and its maker identified. Some code-based declarations may meet this standard. Code or an ordinary blockchain signature alone does not satisfy written form, although a qualifying declaration bearing a qualified electronic signature is equivalent to written form. Transactions requiring a notarial deed, such as real-estate transfers, remain subject to that formality.

Enforceability issues specific to smart contracts

• Interpretation: Polish courts interpret contracts by reference to the parties’ intention and the purpose of the contract, not code alone. Where the code’s output departs from what the parties agreed, a transfer made without legal basis may be reclaimed as unjust enrichment.
• Validity and remedies: mistake or fraud may affect a declaration of intent, while an extraordinary change of circumstances may justify judicial adjustment under a separate doctrine. Technical reversal depends on the system; restitution or a compensating transaction may be needed to give effect to a legal remedy.
• Consumer protection: information duties, the right of withdrawal from distance contracts and the prohibition of unfair terms cannot be excluded by code.
• Identification and jurisdiction: pseudonymous counterparties and cross-border deployment complicate service of process, choice of law and enforcement.

A natural-language agreement accompanying the code can clarify the parties’ rights, the relationship between contractual terms and software, the allocation of coding risks and the remedies available if execution goes wrong.

No legal recognition

DAOs are not recognised as legal entities under Polish law and have no dedicated legal form. A ‘pure’ DAO, existing only as smart contracts, has no legal personality, cannot hold assets in its own name, enter into contracts or sue or be sued.

Liability risk for participants

Participants may incur personal liability depending on the arrangement and their role. A court could consider whether an agreement to pursue a common economic purpose meets the conditions for a civil-law partnership (spółka cywilna), whose partners are jointly and severally liable for its obligations. Token ownership or voting alone does not establish a partnership. Developers, front-end operators and others exercising control may also face liability for their own conduct.

Legal wrappers

Polish-led projects that need legal capacity, for example to contract with service providers, hold intellectual property or a treasury, or deal with regulated counterparties, typically use a wrapper. This may be a Polish limited liability company, a foundation or a foreign vehicle such as a foundation or purpose trust. The choice depends on the wrapper’s role, the governance model, tax considerations and investor expectations.

Using a DAO structure does not take regulated activity outside the regulatory perimeter. If an identifiable person provides crypto-asset services, offers tokens to the public or operates a trading venue, the applicable requirements under MiCA, AML or securities law continue to apply to that person regardless of how governance decisions are taken.

AML and tax enforcement

Before MiCA, regulatory enforcement in the crypto-asset sector was carried out mainly by GIIF and the tax administration. GIIF inspected compliance with AML obligations, and administrative penalties were available for carrying on virtual-currency activity without entry in the VASP register as well as for AML breaches. KNF, which had no supervisory mandate over the sector, relied on its public warning list and on notifications to prosecutors where it suspected unauthorised regulated activity.

Criminal enforcement

Polish prosecutors pursue cases involving crypto-assets in connection with suspected investment fraud, money laundering and other financial crime. Securing and recovering assets can depend on access to private keys and cooperation from exchanges, custodians and foreign authorities.

The Zondacrypto investigation

The Zondacrypto investigation concerns an exchange that served Polish clients through its Estonian operator, BB Trade Estonia OÜ. The Regional Prosecutor’s Office in Katowice opened an investigation in April 2026 into suspected fraud and possible money laundering. The operator was declared bankrupt in Estonia on 27 August 2026. The investigation has since been taken over by a dedicated team of prosecutors at the National Prosecutor’s Office. The proceedings are ongoing, and any charges brought do not establish guilt, which is a matter for the courts.

The case has influenced the debate on Polish supervisory legislation and illustrates the practical difficulties of tracing and recovering client assets across borders.

Enforcement after 1 July 2026

Pending designation of a Polish competent authority for CASPs, KNF does not have the corresponding MiCA supervisory and sanctions powers envisaged by the implementing legislation. Existing AML, consumer-protection and criminal-law powers remain relevant, alongside cooperation with foreign authorities. Businesses should not treat the legislative gap as permission to provide regulated services without the required entitlement.

Data protection

The General Data Protection Regulation (GDPR) applies to blockchain-based services. Immutability can complicate rectification and erasure, while responsibilities must be allocated among the participants in a distributed network. The European Data Protection Board (EDPB), in the final version of Guidelines 02/2025 adopted on 7 July 2026, addresses these issues. Practical priorities include keeping personal data off-chain where possible, assessing whether blockchain is appropriate for the processing, and conducting a data protection impact assessment where processing is likely to create a high risk.

Insolvency

There is no special insolvency or resolution regime for crypto-asset firms, and the general bankruptcy and restructuring laws apply. Three issues dominate:

• Segregation: assets belonging to clients should be distinguished from the firm’s estate. MiCA requires legal segregation of crypto-assets held in custody, including protection from the custodian’s creditors in insolvency. The client’s position still depends on the arrangement, identification of the assets and compliance in practice.
• Control: the trustee’s ability to secure assets depends on access to private keys and on cooperation from custodians and exchanges.
• Valuation: Polish bankruptcy law generally converts non-monetary obligations into monetary obligations and values non-monetary claims at the date of bankruptcy. Applying those rules requires identifying the nature of the client’s claim; this is distinct from valuing assets for a later sale.

MiCA’s safeguarding and orderly wind-down requirements are intended to reduce these risks. Their effectiveness depends on compliance and the applicable insolvency framework; clients of unauthorised or non-compliant firms may face substantial recovery difficulties.

Consumer protection

Polish rules on distance contracts, unfair contract terms and unfair commercial practices apply alongside MiCA. UOKiK has made the labelling of influencer marketing an enforcement priority, which is particularly relevant to crypto-asset promotion. Consumer-facing documentation may also need to be provided in Polish.

Operational resilience and intellectual property

DORA applies to CASPs and to regulated institutions using DLT, and imposes requirements on ICT risk management, incident reporting and oversight of third-party providers. Intellectual property law applies on technology-neutral terms. NFT-related questions, such as the scope of rights acquired with a token, are resolved under general copyright and contract principles.

Choosing a home member state

For a Polish-led business seeking CASP authorisation, the current practical route is another EU member state while no Polish route is available. The choice requires consideration of genuine establishment, governance, tax, banking access and business plans. A MiCA passport does not remove home-state substance requirements. Reverse solicitation under Article 61 of MiCA is narrowly construed and cannot support active marketing to Polish clients.

Verifying counterparties

Since 1 July 2026, entry in the Polish VASP register has not been evidence of entitlement to provide MiCA-regulated crypto-asset services. Banks, payment institutions, acquirers and investors should check the ESMA and relevant home-state registers, including any applicable notification status. The check must cover the particular entity and services involved, especially in aggregator and white-label structures.

Banking access

Access to banking remains one of the most significant operational constraints for crypto-asset businesses connected with Poland. Polish banks are not prohibited from servicing them, but many apply restrictive risk policies. MiCA authorisation does not guarantee banking access; each bank makes its own risk assessment.

Operational compliance

The main EU compliance requirements already follow from MiCA, the TFR, technical standards and DORA. Firms preparing for Polish authorisation can work on governance, prudential safeguards, client-asset protection, conflicts of interest, AML and travel-rule procedures, ICT risk and orderly wind-down arrangements while the domestic legislative process continues.

Onboarding flows should apply the stated due-diligence rules, and the entity identified in the customer terms should match the allocation of regulated functions. For services involving EMTs, the interaction with the second Payment Services Directive (PSD2) is already relevant: certain services may also require a payment-services authorisation or another applicable entitlement, alongside MiCA status.

Issues to watch in the next 12 months

• the outcome of the presidential and government bills and the designation of KNF as competent authority for CASPs and ART issuers;
• the course of the Zondacrypto proceedings and their influence on supervisory expectations;
• the application of the AMLR from 10 July 2027 and AMLA’s selection process in 2027, ahead of direct supervision from 2028;
• the first DAC8 reporting cycle in 2027;
• the European Commission’s review of MiCA, including possible coverage of DeFi, crypto-asset lending and staking; and
• the proposed third Payment Services Directive (PSD3) and Payment Services Regulation, including their interaction with stablecoin-based payments.