Poland Crypto Licence Requirements in 2026
Poland crypto licence requirements for 2026: the full MiCA CASP checklist — EU company, real substance, qualified management, MLRO, DORA and class capital.
Contents
A Poland crypto licence carries the standard MiCA CASP requirements: an EU-registered company with genuine substance, class-based capital of €50,000, €125,000 or €150,000, and fit-and-proper management. If you search “Poland crypto licence requirements” expecting a tidy checklist you can file with the regulator this month, the answer is more useful than the tidy one. The requirements themselves are clear — they are the MiCA Crypto-Asset Service Provider (CASP) requirements, identical to those in every EU state. What is not clear yet is the Polish door: the national law needed to open domestic applications has stalled, so meeting the requirements and reaching the Polish market are, for now, two different exercises.
The operators who stumble on Poland do it by assembling a perfect CASP requirements file and then discovering there is nowhere domestic to submit it. This guide gives you both halves: the full MiCA CASP requirements you must satisfy, and the status of the Polish route — plus the passport path that lets you meet those requirements and serve Polish users lawfully today.
- The requirements for a Poland crypto licence are the MiCA CASP requirements: an EU company with real substance, class capital, qualified management, an MLRO, AML/CFT and a DORA ICT framework.
- CASP capital is fixed EU-wide at €50,000 (Class 1), €125,000 (Class 2 custody/exchange) or €150,000 (Class 3 trading platform), and it is funded and evidenced rather than paid as a fee.
- The catch: Poland’s national Crypto-Assets Market Act was vetoed three times and a September 2026 override vote failed, so a domestic KNF procedure is not operational.
- You satisfy the same requirements by authorising a CASP in Lithuania or Estonia and passporting it into Poland under MiCA Article 65 — lawful now, EU-27 wide.
What “Poland crypto licence requirements” means in 2026
Start with the point that reframes everything. There is no separate “Polish” set of crypto requirements distinct from the EU rulebook. Poland regulates crypto under the Markets in Crypto-Assets Regulation (MiCA), the same directly applicable EU law that governs every member state, and the Polish Financial Supervision Authority (KNF) is confirmed as the competent authority. So the requirements you must meet are the MiCA CASP requirements and nothing more.
The complication is purely procedural. The national Crypto-Assets Market Act, the domestic statute that fully empowers the KNF and opens the CASP application window, was vetoed three times (December 2025, February and June 2026), and a September 2026 override vote failed, so it is still not in force. Meeting the requirements is entirely possible; submitting them to a live Polish procedure is not, because the enabling machinery isn’t switched on. That is why the reliable way to satisfy “Poland requirements” today is to authorise a CASP in an EU state with a working regime and passport it in, a route covered in depth in our Poland CASP passporting guide and in the flagship Poland crypto licence overview. The rest of this article lays out the requirements themselves, because they are what you actually have to build.
The EU company, substance and capital by class
Every MiCA CASP authorisation starts with a genuine EU legal entity, and an offshore shell applying from elsewhere does not qualify. For the passport route, that means a Lithuanian UAB or an Estonian OÜ with real substance: a registered office, a management presence, and the core functions genuinely carried out in the licensing state. Substance is a condition of authorisation and the first thing a thin file fails on.
Capital is the requirement most operators price wrong, because MiCA, rather than the individual country, sets the floor, and it scales with what you actually do. There is no “cheaper capital” in Poland than in Lithuania; the number is the same everywhere in the EU.
| CASP class | Minimum capital | Typical services |
|---|---|---|
| Class 1 | €50,000 | Reception/transmission of orders, advice, execution, placement |
| Class 2 | €125,000 | Custody and administration, exchange of crypto for fiat or crypto |
| Class 3 | €150,000 | Operating a crypto-asset trading platform |
You must evidence the safeguards and keep them in place, as own funds that stay on your balance sheet, an insurance policy or a mix, and a quarter of last year’s fixed overheads applies if that is higher. It is also rarely the largest cost. Beyond it sit substance, the compliance build and banking, and for the full year-one economics of the passport route our Poland crypto licence cost guide models the all-in figure rather than a sticker price.
Management, MLRO and the AML/CFT programme
MiCA is a full financial-services regime, so it vets the people behind the business along with the paperwork. The requirements here are the ones that take the longest to satisfy, and the ones worth starting on day one.
Fit-and-proper management. The board and senior management must be assessed as fit and proper by the licensing regulator — relevant financial or crypto experience, clean records, and no disqualifying convictions or sanctions exposure. Ultimate beneficial owners and significant shareholders clear the same bar, including source-of-funds and source-of-wealth checks. Undocumented wealth is the single most common reason a file stalls.
A dedicated AML/MLRO function. A Money Laundering Reporting Officer is mandatory, accountable for the AML programme, transaction monitoring and reporting. This cannot be a title with no substance behind it; the regulator expects a real, resourced function.
An operable AML/CFT programme. Your customer due diligence, ongoing monitoring, screening and reporting policies must align to the EU 5th and 6th anti-money-laundering directives, and your transfers must carry originator and beneficiary data under the Travel Rule (the EU Transfer of Funds Regulation). These have to be working documents the MLRO actually runs — the same standard we cover in our iGaming AML and KYC primer, applied to crypto flows. Template filler assembled for the application will not pass review.
The DORA ICT resilience framework
Technology requirements under MiCA run through the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025 and is now a hard part of any CASP file. A crypto business cannot treat resilience as an afterthought; it is assessed as part of authorisation.
Concretely, DORA requires a documented ICT risk-management framework, a scheme for classifying and reporting ICT-related incidents, regular resilience and security testing, and oversight of critical third-party technology providers — cloud, custody tooling and the rest of the stack. For a CASP it folds together with the MiCA conduct obligations that surround client assets: secure key management and wallet architecture, segregation of client crypto from company assets, encryption and access control, and full GDPR compliance on personal and transaction data. Together these form the operational backbone, and the regulator expects to see it running; a policy PDF written the week before filing will not pass.
The requirements at a glance — and the caveat
Pulled together, here is the MiCA CASP requirements set you build toward, whichever EU state issues the licence you passport into Poland.
| Requirement | What it means | Notes |
|---|---|---|
| EU company + substance | A real LT UAB or EE OÜ, office and management on the ground | Not an offshore shell |
| Class capital | €50k / €125k / €150k by service class | Own funds or insurance; ¼ of fixed overheads if higher |
| Fit-and-proper people | Vetted board, UBOs and shareholders | Source of funds and wealth |
| MLRO + AML/CFT | Dedicated officer, operable programme | 5th/6th directives + Travel Rule |
| DORA ICT framework | Risk management, incident reporting, testing | Applies since 17 Jan 2025 |
| Programme of operations | Business plan, projections, custody and complaints procedures | MiCA white paper where tokens are issued |
You can build a complete MiCA CASP requirements file today. What you cannot do reliably is submit it to a domestic Polish procedure, because the national law that opens KNF applications was vetoed three times and is still not in force. The compliant answer is to authorise the CASP in Lithuania or Estonia and passport it into Poland — the same requirements, a live regime, and Poland reached lawfully now. See how the route works on the Poland crypto licence service page.
Assembling the Poland file in the right order
Requirements are one thing; sequence is what avoids rework. The order that works is: incorporate the EU licensing entity and stand up substance first; fund the class-based capital for your intended services; assemble every fit-and-proper file (source of funds and wealth on each UBO) in parallel, because they take longest; draft the AML/CFT programme against your actual operating model and appoint the MLRO; then build the DORA ICT framework, custody and key-management controls ahead of technical review. Only with all of that in place does the CASP application go in, followed by a passport notification into Poland and any other host states.
The advantage of running this through a mature regime like Lithuania or Estonia is that the path is known and the review predictable — the opposite of Poland’s current domestic uncertainty. You meet the identical MiCA requirements, obtain a licence that passports across all 27 member states under Article 65, and structure the whole thing so a direct KNF filing is straightforward the moment the national window opens. Nothing is wasted, and the Polish goal stays on the plan as a later step.
Poland is one of the EU’s largest crypto audiences, and its national CASP procedure is not yet operational. If you want the requirements mapped against your real product, with a clear plan to satisfy them through a live regime and file with the KNF when it opens, book a free consultation and we will price the path to the Polish market.
Frequently asked questions
What are the requirements for a crypto licence in Poland?
The underlying requirements are the MiCA CASP requirements: an EU-registered company with genuine substance, class-based capital of €50,000, €125,000 or €150,000, fit-and-proper management, a dedicated AML/MLRO function, an AML/CFT programme to EU standards, and a DORA-compliant ICT framework. The catch is that Poland's national law to open domestic KNF applications is not yet in force, so today these requirements are met through an EU CASP passported into Poland.
Can I meet the requirements and apply directly to the KNF today?
Not reliably. The KNF is Poland's confirmed competent authority, but the national Crypto-Assets Market Act that empowers it to open CASP applications was vetoed three times (December 2025, February and June 2026); a September 2026 override vote failed, so the law is still not in force. Until it is, there is no dependable domestic filing window. You satisfy the same MiCA requirements by licensing in Lithuania or Estonia and passporting into Poland.
How much capital does a Poland crypto licence require?
The MiCA tiers apply wherever the CASP licence is issued, so Poland matches every EU state: €50,000 for Class 1 (advice, reception and execution of orders), €125,000 for Class 2 (custody and exchange), and €150,000 for Class 3 (operating a trading platform). You hold the higher of that tier or a quarter of last year's fixed overheads, as own funds or an insurance policy, and it is rarely the largest line in the budget.
Is an MLRO and an AML programme mandatory?
Yes. A dedicated AML/MLRO function is a condition of any MiCA CASP authorisation, backed by an operable AML/CFT programme aligned to the EU 5th and 6th directives and the Travel Rule under the Transfer of Funds Regulation. The regulator also runs fit-and-proper and source-of-funds checks on shareholders and ultimate beneficial owners. Template policies assembled for the file will not survive review — the function is expected to actually run them.
What is DORA and do I need it?
The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 and is a hard requirement for CASPs. You must evidence ICT risk management, incident classification and reporting, resilience testing, and oversight of critical third-party technology providers. For a crypto business it also folds in secure key management, wallet architecture and client-asset segregation. It is assessed as part of the authorisation itself.
Do I need a Polish company to serve Polish users?
No. Because MiCA is an EU regulation with a built-in passport, a CASP authorised in Lithuania or Estonia lawfully serves Polish users on a notification basis under Article 65. A Polish operating company, staff or marketing can sit alongside the passported licence, but they are not a licensing prerequisite. When Poland's domestic regime opens, we structure the setup so a direct KNF filing follows without unwinding the passport.
Sources
This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.
We'll map the fastest route to a licensed, banked, live operation.
Book a free consultation →Recommended reading.
Stay ahead of the rules.
Licence fees, rules and deadlines change through the year. Subscribe and we'll email you Vantegris licensing updates.
Licence, done right.
300+ operators licensed across 40+ jurisdictions. Book a free consultation.
Book a free consultation