DeFi protocol frontend in Poland
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Poland with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Register as a VASP with GIIF (Ministry of Finance) under the Polish AML Act before commencing operations.
- Implement Customer Due Diligence (CDD) procedures — identify and verify identity of clients, beneficial owners, and understand purpose of business relationships.
- Conduct ongoing monitoring of client relationships and transactions to detect suspicious activities.
- Implement transaction monitoring systems to screen for unusual patterns or threshold-based triggers.
- Report suspicious transactions and activities to GIIF (General Inspector of Financial Information).
- Maintain records of client identification data and transactions for at least 5 years.
- Appoint a designated AML Officer (Compliance Officer) responsible for AML/CTF compliance.
- Develop and implement internal AML/CTF procedures and a risk assessment specific to the business.
- Provide regular AML/CTF training for relevant employees.
- Screen clients and beneficial owners against sanctions lists.
- If fee-taking is involved, the frontend likely constitutes a 'virtual currency exchange service' (exchanging one virtual currency for another) or an intermediary in such activity, triggering full VASP registration and AML obligations.
Key Restrictions
- Must be a Polish legal entity (e.g., sp. z o.o. or S.A.) to register as a VASP.
- At least one management board member must reside in Poland or hold Polish citizenship.
- Management board members and beneficial owners must meet fit-and-proper criteria (no criminal record for intentional financial crimes).
- Proof of knowledge and experience in virtual currencies is required for registration.
- Geofencing (region restriction) and/or KYC screening likely required — the Polish AML Act's CDD obligations apply to VASPs, which this frontend likely constitutes if it takes fees or intermediates transactions.
- Under MiCA (from Dec 30, 2024), a full CASP license from KNF will replace the current registration, with capital requirements of €50k–€150k depending on services.
Key Risks
- Regulatory ambiguity: A purely non-custodial frontend that does not take fees and merely provides UI to permissionless contracts may argue it is not a VASP — but Polish AML definitions are broad and this position has not been tested in enforcement.
- Fee-taking (e.g., swap fees, frontend fees) strongly shifts classification toward 'virtual currency exchange service' under Polish law, triggering mandatory registration.
- MiCA transition risk: After Dec 30, 2024, current AML registration may be insufficient; a full KNF authorization with capital requirements will be needed, potentially disrupting operations.
- Enforcement risk: GIIF or KNF could classify non-compliant frontends as unregistered VASPs, leading to fines or criminal liability.
- Sanctions screening obligations apply; failure to restrict sanctioned jurisdictions (e.g., RF/irredentist regions) could result in EU sanctions enforcement.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Poland's AML Act is the Act of 1 March 2018 on counteracting money laundering and terrorist financing (Dz.U. 2018 poz. 723), in force since 13 July 2018; its latest consolidated text is Dz.U. 2025 poz. 644, as later amended.
GIIF (Ministry of Finance page regarding Virtual Currencies - in Polish): https://www.gov.pl/web/finanse/dzialalnosc-w-zakresie-walut-wirtualnych (This page provides information on the register and requirements).
Under Art 2(1) pkt 12 of the AML Act of 1 March 2018 (Dz.U. 2025 poz. 644), obliged institutions include businesses providing exchange between virtual currencies and means of payment, exchange between virtual currencies, and intermediation in either exchange.
Poland's pre-MiCA regime is the register of virtual-currency activity under Arts 129m–129z of the AML Act of 1 March 2018, kept for the Minister of Finance by the Director of IAS Katowice (not GIIF); it has accepted no new entries since 30 December 2024, and since 1 July 2026 an entry confers no right to provide crypto-asset services.
Virtual-currency activity under the AML Act of 1 March 2018 may be carried on by a natural person, a legal person or an organisational unit without legal personality (Art 129n(1)); a Polish company is not required, although the register has accepted no new entries since 30 December 2024.
At least one individual from the management board of the Polish legal entity must have their residence in Poland or possess a Polish citizenship.
AML Officer: Appoint a designated individual responsible for AML/CTF compliance (AML Officer or Compliance Officer).
Customer Due Diligence (CDD): Implement procedures for identifying and verifying the identity of clients, including beneficial owners, and understanding the purpose and nature of business relationships. This involves collecting identity documents, verifying data, and screening against sanctions lists.
Ongoing Monitoring: Conduct ongoing monitoring of client relationships and transactions to detect suspicious activities.
Transaction Monitoring: Implement systems to monitor transactions for unusual patterns or thresholds.
Reporting: Report suspicious transactions and activities to GIIF.
Record-keeping: Maintain records of client identification data and transactions for at least 5 years.
Training: Provide regular AML/CTF training for relevant employees.
Internal AML/CTF Procedures: Develop and implement robust internal anti-money laundering and counter-terrorist financing procedures, including a risk assessment specific to the business and its clients.
Evidence fact pl.licensing.fit-proper-criteria-managementowners not found (may have been renamed).
Individuals intending to perform activities in the field of virtual currencies, as well as members of the management board and beneficial owners, must:
Under Art 2(1) pkt 12 of Poland's AML Act of 1 March 2018 (consolidated Dz.U. 2025 poz. 644), businesses providing virtual-currency exchange, intermediation or account-keeping (custody) services are obliged institutions, and Art 129m makes that activity conditional on entry in the register of virtual-currency activity; the register has accepted no new entries since 30 December 2024.
Evidence fact pl.aml.conditions-for-registration not found (may have been renamed).
Art 129n of Poland's AML Act (consolidated Dz.U. 2025 poz. 644) bars from virtual-currency activity anyone finally convicted of listed offences (incl. offences against property, economic trading and money circulation, or intentional fiscal offences); the clean-record rule extends to partners, management-board members, persons directing the activity and beneficial owners.
Under Art 129o of Poland's AML Act (consolidated Dz.U. 2025 poz. 644), natural persons carrying on virtual-currency activity must have knowledge or experience in it, deemed met by completing a training course on its legal or practical aspects or by at least one year of documented work in that activity.
The competent organ for Poland's register of virtual-currency activity is the minister responsible for public finance (AML Act Art 129p), who by ordinance of 25 October 2021 (Dz.U. 2021 poz. 1964) designated the Director of the Revenue Administration Regional Office (IAS) in Katowice to keep the register.
Poland's AML Act of 1 March 2018 (consolidated Dz.U. 2025 poz. 644) contains no client-asset segregation rule for virtual-currency custodians; segregation is required of crypto-asset service providers by MiCA Art 75(7), applicable since 30 December 2024, but no CASP is authorised in Poland (ESMA interim register, last update 31 Aug 2026), so the rule reaches Polish clients only through CASPs authorised in other member states.
Requirement: MiCA explicitly mandates the segregation of client crypto-assets and funds. Article 67 specifies that CASPs providing custody services must:
Titles II, V-XII (covering other crypto-assets and crypto-asset service providers, including custody) apply from 30 December 2024.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi protocol frontend that takes fees or intermediates virtual currency transactions likely constitutes a Virtual Asset Service Provider (VASP) under Polish AML law, requiring registration with GIIF, a local Polish legal entity, and comprehensive AML/KYC obligations; purely non-custodial UI-only frontends with no fee-taking face regulatory ambiguity, and full MiCA licensing (with capital requirements) will apply from December 2024.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?