Poland Crypto Licence Requirements in 2026

A Poland crypto licence carries the standard MiCA CASP requirements: an EU-registered company with genuine substance, class-based capital of €50,000, €125,000 or €150,000, and fit-and-proper management. If you search “Poland crypto licence requirements” expecting a tidy checklist you can file with the regulator this month, the honest answer is more useful than the tidy one. The requirements themselves are clear — they are the MiCA Crypto-Asset Service Provider (CASP) requirements, identical to those in every EU state. What is not clear yet is the Polish door: the national law needed to open domestic applications has stalled, so meeting the requirements and reaching the Polish market are, for now, two different exercises.

In our practice building EU crypto structures, the operators who stumble on Poland do it by assembling a perfect CASP requirements file and then discovering there is nowhere domestic to submit it. This guide gives you both halves: the full MiCA CASP requirements you must satisfy, and the honest status of the Polish route — plus the passport path that lets you meet those requirements and serve Polish users lawfully today.

What “Poland crypto licence requirements” means in 2026

Start with the point that reframes everything. There is no separate “Polish” set of crypto requirements distinct from the EU rulebook. Poland regulates crypto under the Markets in Crypto-Assets Regulation (MiCA), the same directly applicable EU law that governs every member state, and the Polish Financial Supervision Authority (KNF) is confirmed as the competent authority. So the requirements you must meet are the MiCA CASP requirements — full stop.

The complication is procedural, not substantive. The national Crypto-Assets Market Act — the domestic statute that fully empowers the KNF and opens the CASP application window — was vetoed twice, first in December 2025 and again in February 2026, and is not in force as of mid-2026. Meeting the requirements is entirely possible; submitting them to a live Polish procedure is not, because the enabling machinery isn’t switched on. That is why the reliable way to satisfy “Poland requirements” today is to authorise a CASP in an EU state with a working regime and passport it in — a route covered in depth in our Poland CASP passporting guide and in the flagship Poland crypto licence overview. The rest of this article lays out the requirements themselves, because they are what you actually have to build.

The EU company, substance and capital by class

Every MiCA CASP authorisation starts with a genuine EU legal entity — not an offshore shell that applies from elsewhere. For the passport route, that means a Lithuanian UAB or an Estonian OÜ with real substance: a registered office, a management presence, and the core functions genuinely carried out in the licensing state. Substance is not a formality the regulator waves through; it is a condition of authorisation and the first thing a thin file fails on.

Capital is the requirement most operators price wrong, because MiCA — not the individual country — sets the floor, and it scales with what you actually do. There is no “cheaper capital” in Poland than in Lithuania; the number is the same everywhere in the EU.

This is issued, funded capital you must evidence and keep in the business as working capital, held in an EEA bank or e-money account — not a fee you write off. It is also rarely the largest cost. Beyond it sit substance, the compliance build and banking, and for the full year-one economics of the passport route our Poland crypto licence cost guide models the all-in figure rather than a sticker price.

Management, MLRO and the AML/CFT programme

MiCA is a full financial-services regime, so it vets the people behind the business, not just the paperwork. The requirements here are the ones that take the longest to satisfy, and the ones worth starting on day one.

Fit-and-proper management. The board and senior management must be assessed as fit and proper by the licensing regulator — relevant financial or crypto experience, clean records, and no disqualifying convictions or sanctions exposure. Ultimate beneficial owners and significant shareholders clear the same bar, including source-of-funds and source-of-wealth checks. Undocumented wealth is the single most common reason a file stalls.

A dedicated AML/MLRO function. A Money Laundering Reporting Officer is mandatory, accountable for the AML programme, transaction monitoring and reporting. This cannot be a title with no substance behind it; the regulator expects a real, resourced function.

An operable AML/CFT programme. Your customer due diligence, ongoing monitoring, screening and reporting policies must align to the EU 5th and 6th anti-money-laundering directives, and your transfers must carry originator and beneficiary data under the Travel Rule (the EU Transfer of Funds Regulation). These have to be working documents the MLRO actually runs — the same standard we cover in our iGaming AML and KYC primer, applied to crypto flows. Template filler assembled for the application will not pass review.

The DORA ICT resilience framework

Technology requirements under MiCA run through the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025 and is now a hard part of any CASP file. A crypto business cannot treat resilience as an afterthought; it is assessed as part of authorisation.

Concretely, DORA requires a documented ICT risk-management framework, a scheme for classifying and reporting ICT-related incidents, regular resilience and security testing, and oversight of critical third-party technology providers — cloud, custody tooling and the rest of the stack. For a CASP it folds together with the MiCA conduct obligations that surround client assets: secure key management and wallet architecture, segregation of client crypto from company assets, encryption and access control, and full GDPR compliance on personal and transaction data. Together these are the operational backbone the regulator expects to see running, not a policy PDF written the week before filing.

The requirements at a glance — and the honest caveat

Pulled together, here is the MiCA CASP requirements set you build toward, whichever EU state issues the licence you passport into Poland.

Assembling the file in the right order

Requirements are one thing; sequence is what avoids rework. The order that works is: incorporate the EU licensing entity and stand up substance first; fund the class-based capital for your intended services; assemble every fit-and-proper file — source of funds and wealth on each UBO — in parallel, because they take longest; draft the AML/CFT programme against your actual operating model and appoint the MLRO; then build the DORA ICT framework, custody and key-management controls ahead of technical review. Only with all of that in place does the CASP application go in, followed by a passport notification into Poland and any other host states.

The advantage of running this through a mature regime like Lithuania or Estonia is that the path is known and the review predictable — the opposite of Poland’s current domestic uncertainty. You meet the identical MiCA requirements, obtain a licence that passports across all 27 member states under Article 65, and structure the whole thing so a direct KNF filing is straightforward the moment the national window opens. Nothing is wasted; the Polish goal is sequenced, not abandoned.

Poland is worth reaching — one of the EU’s largest crypto audiences — and it rewards doing this properly rather than chasing a domestic procedure that isn’t operational. If you want the requirements mapped against your real product, with a clear plan to satisfy them through a live regime and file with the KNF when it opens, book a free consultation and we will price the honest path to the Polish market.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.