Remote VASP serving residents in Poland
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Poland with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with GIIF (Minister of Finance) under the Polish AML Act (Ustawa z dnia 1 marca 2018 r. o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu).
- Appoint a designated AML Officer responsible for AML/CTF compliance.
- Implement Customer Due Diligence (CDD) procedures including identification of beneficial owners and sanctions screening.
- Conduct ongoing monitoring of client relationships and transactions.
- Implement transaction monitoring systems to detect unusual patterns or threshold breaches.
- Report suspicious transactions and activities to GIIF.
- Maintain records of client identification data and transactions for at least 5 years.
- Provide regular AML/CTF training for relevant employees.
- Develop and implement internal AML/CTF procedures including a business-specific risk assessment.
- Management board members and beneficial owners must meet fit-and-proper criteria (no criminal record for intentional financial crimes).
- Proof of knowledge and experience in the field of virtual currencies is required for registration.
Key Restrictions
- The operator must be a Polish legal entity (e.g., sp. z o.o. or S.A.) — a foreign-incorporated entity cannot directly register.
- At least one management board member must have residence in Poland or Polish citizenship.
- The registration regime is AML-only — no prudential supervision or capital requirements currently, but MiCA will introduce authorization by KNF with capital requirements (€50k–€150k) from December 2024.
- Under MiCA, CASPs must segregate client crypto-assets and funds and enter into custody agreements with clients.
- No minimum capital requirement for current VASP registration, but MiCA will impose capital thresholds.
Key Risks
- Operating without registration as a Polish entity constitutes unlicensed VASP activity, exposing the operator to enforcement action by GIIF and potential criminal liability under the AML Act.
- The transition from AML registration under GIIF to MiCA authorization under KNF creates regulatory uncertainty and potential dual regime burden.
- No specific client asset segregation requirement currently — creates ambiguity on custodial standards and potential exposure under commercial law.
- Foreign operators serving Polish residents without a local entity and registration face material enforcement risk, as demonstrated by EU-wide actions against unregistered VASPs (e.g., Binance).
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Poland's AML Act is the Act of 1 March 2018 on counteracting money laundering and terrorist financing (Dz.U. 2018 poz. 723), in force since 13 July 2018; its latest consolidated text is Dz.U. 2025 poz. 644, as later amended.
GIIF (Ministry of Finance page regarding Virtual Currencies - in Polish): https://www.gov.pl/web/finanse/dzialalnosc-w-zakresie-walut-wirtualnych (This page provides information on the register and requirements).
Poland's pre-MiCA regime is the register of virtual-currency activity under Arts 129m–129z of the AML Act of 1 March 2018, kept for the Minister of Finance by the Director of IAS Katowice (not GIIF); it has accepted no new entries since 30 December 2024, and since 1 July 2026 an entry confers no right to provide crypto-asset services.
Evidence fact pl.licensing.legal-entity-local-presence not found (may have been renamed).
Virtual-currency activity under the AML Act of 1 March 2018 may be carried on by a natural person, a legal person or an organisational unit without legal personality (Art 129n(1)); a Polish company is not required, although the register has accepted no new entries since 30 December 2024.
At least one individual from the management board of the Polish legal entity must have their residence in Poland or possess a Polish citizenship.
AML Officer: Appoint a designated individual responsible for AML/CTF compliance (AML Officer or Compliance Officer).
Customer Due Diligence (CDD): Implement procedures for identifying and verifying the identity of clients, including beneficial owners, and understanding the purpose and nature of business relationships. This involves collecting identity documents, verifying data, and screening against sanctions lists.
Ongoing Monitoring: Conduct ongoing monitoring of client relationships and transactions to detect suspicious activities.
Transaction Monitoring: Implement systems to monitor transactions for unusual patterns or thresholds.
Reporting: Report suspicious transactions and activities to GIIF.
Record-keeping: Maintain records of client identification data and transactions for at least 5 years.
Training: Provide regular AML/CTF training for relevant employees.
Internal AML/CTF Procedures: Develop and implement robust internal anti-money laundering and counter-terrorist financing procedures, including a risk assessment specific to the business and its clients.
Evidence fact pl.licensing.fit-proper-criteria-managementowners not found (may have been renamed).
Individuals intending to perform activities in the field of virtual currencies, as well as members of the management board and beneficial owners, must:
The AML Act of 1 March 2018 sets no minimum capital requirement for entry in the virtual-currency register: Arts 129n–129o require only a clean criminal record and knowledge or experience; the register has accepted no new entries since 30 December 2024.
Future MiCA Impact: MiCA will introduce capital requirements for Crypto-Asset Service Providers (CASPs), ranging from €50,000 to €150,000 depending on the type of services provided.
Under Art 2(1) pkt 12 of Poland's AML Act of 1 March 2018 (consolidated Dz.U. 2025 poz. 644), businesses providing virtual-currency exchange, intermediation or account-keeping (custody) services are obliged institutions, and Art 129m makes that activity conditional on entry in the register of virtual-currency activity; the register has accepted no new entries since 30 December 2024.
Evidence fact pl.aml.conditions-for-registration not found (may have been renamed).
Under Art 129n(1) of Poland's AML Act (consolidated Dz.U. 2025 poz. 644), virtual-currency activity may be carried on by a natural person, a legal person or an organisational unit without legal personality.
Art 129n of Poland's AML Act (consolidated Dz.U. 2025 poz. 644) bars from virtual-currency activity anyone finally convicted of listed offences (incl. offences against property, economic trading and money circulation, or intentional fiscal offences); the clean-record rule extends to partners, management-board members, persons directing the activity and beneficial owners.
Under Art 129o of Poland's AML Act (consolidated Dz.U. 2025 poz. 644), natural persons carrying on virtual-currency activity must have knowledge or experience in it, deemed met by completing a training course on its legal or practical aspects or by at least one year of documented work in that activity.
The competent organ for Poland's register of virtual-currency activity is the minister responsible for public finance (AML Act Art 129p), who by ordinance of 25 October 2021 (Dz.U. 2021 poz. 1964) designated the Director of the Revenue Administration Regional Office (IAS) in Katowice to keep the register.
Entry in Poland's register of virtual-currency activity (AML Act Arts 129m–129z) is a regulated-activity entry, not a prudential licence: its statutory conditions are a clean criminal record (Art 129n) and knowledge or experience (Art 129o), the register has taken no new entries since 30 December 2024, and IAS Katowice states that entry does not authorise acting as a MiCA crypto-asset service provider.
Poland's AML Act of 1 March 2018 (consolidated Dz.U. 2025 poz. 644) contains no client-asset segregation rule for virtual-currency custodians; segregation is required of crypto-asset service providers by MiCA Art 75(7), applicable since 30 December 2024, but no CASP is authorised in Poland (ESMA interim register, last update 31 Aug 2026), so the rule reaches Polish clients only through CASPs authorised in other member states.
Requirement: Under MiCA, entities wishing to provide custody and administration of crypto-assets will need to obtain an authorization from their competent national authority (likely the Polish Financial Supervision Authority – KNF). This authorization will be passportable across the EU.
Requirement: MiCA explicitly mandates the segregation of client crypto-assets and funds. Article 67 specifies that CASPs providing custody services must:
Having a minimum initial capital (Article 60).
The KNF was to be Poland's MiCA competent authority under the Act on the crypto-asset market, but that act was vetoed three times (1 Dec 2025, 12 Feb 2026, 11 Jun 2026) and as of 14 October 2026 no Polish authority is designated for crypto-asset service providers; the KNF is competent only for e-money-token issuers (KNF communiqué updated 23 Jun 2026).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP may serve Polish residents only by incorporating as a Polish legal entity, registering with GIIF under the AML Act, and complying with AML/CTF obligations; direct cross-border service without local presence is not permitted, and MiCA will introduce a full prudential licensing regime under KNF by end of 2024.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?