Chapter | Legal 500 | 2026
We explained blockchain law in Poland for The Legal 500, as at 9 October 2026: from the CASP licensing gap that opened when the MiCA transitional period ended on 1 July 2026, through AML, tax and DAC8, to tokenisation, smart contracts and DAOs.
The Legal 500 Country Comparative Guides are a series of country-specific question-and-answer guides published by Legalease. The Poland chapter sets out the law on blockchain and crypto assets in 16 questions, so you can compare Poland with other jurisdictions in the series.
The chapter Poland: Blockchain & Crypto Assets was written by Michał Wołoszański, Łukasz Kudela and Marta Solarska-Kaleńczuk of Wołoszański & Partners. The firm is the sole contributor of the Poland chapter (Exclusive Contributor 2026). The chapter reflects the law and market developments as at 9 October 2026. You can read the full text on the Legal 500 website (opens in a new tab).
We covered crypto-asset regulation separately in our overview of the Chambers 2026 chapter on crypto-asset regulation in Poland (June 2026). This overview focuses on what changed after 1 July 2026 and on tokenisation, smart contracts and DAOs.
The transitional period under MiCA, the EU Markets in Crypto-Assets Regulation (EU) 2023/1114, expired on 1 July 2026 while Poland still had no national law allowing crypto-asset service providers (CASPs) to be authorised domestically. From that date, entry in the Polish register of virtual currency activity (the VASP register) no longer provides a basis for services regulated by MiCA.
The VASP register is kept by the Director of the Tax Administration Chamber in Katowice. Entry became a condition of lawful virtual currency business on 31 October 2021, but it was only an anti-money laundering (AML) gateway: no prudential supervision, no capital requirements and no conduct-of-business rules. For years the domestic market of exchanges, brokers and wallet providers was built around it.
Today, access to Polish clients depends on a MiCA entitlement, including authorisation in another EU member state and completion of the cross-border notification process. Poland remains open to eligible EU providers but has no domestic CASP licensing route. We explain MiCA and CASP licensing on our digital assets service page.
As at 9 October 2026, Poland has no MiCA competent authority for crypto-asset service providers (CASPs) or for issuers of asset-referenced tokens (ARTs). The Office of the Polish Financial Supervision Authority (UKNF) has confirmed that the exception is issuers of e-money tokens (EMTs). The bills envisage the Polish Financial Supervision Authority (KNF) as the competent authority, but the KNF does not hold those powers today.
Successive government bills implementing MiCA were vetoed by the President, and Parliament did not override the vetoes. A further presidential bill was submitted on 8 September 2026. The disagreement concerns supervisory fees, powers to block websites and accounts, procedural safeguards and the severity of sanctions, and the timetable for a domestic licensing route remains uncertain.
The other authorities keep their existing roles. The General Inspector of Financial Information (GIIF) supervises AML, the Director of the Tax Administration Chamber in Katowice keeps the VASP register, the President of the Office of Competition and Consumer Protection (UOKiK) protects consumers, the President of the Personal Data Protection Office (UODO) protects personal data, and prosecutors and the Central Cybercrime Bureau (CBZC) handle criminal enforcement. The National Bank of Poland (NBP) does not supervise crypto firms and has not announced a decision on a digital zloty. The KNF maintains a public warning list and runs the Innovation Hub programme, but Poland has no regulatory sandbox allowing waivers of requirements.
Until a domestic licensing route exists, a Polish business that wants to provide crypto-asset services has three options, according to the chapter: obtain CASP authorisation in another EU member state, restructure so that regulated services are provided by an EU-authorised CASP, or suspend or wind down the regulated activity. Certain already-regulated financial institutions can instead use the notification route under Article 60 of MiCA for eligible services.
Authorisation elsewhere requires a registered office in that state, effective management in the EU and genuine local substance. Choosing a home member state is a decision about governance, tax, banking access and the business plan, and a MiCA passport does not remove home-state substance requirements. Reverse solicitation under Article 61 of MiCA is narrowly construed and cannot support active marketing to Polish clients.
The legislative gap is not a permission. Poland has not yet adopted the administrative sanctions regime that MiCA requires, but unauthorised operators remain exposed to AML, consumer protection and criminal liability, and to enforcement by other member states' authorities. The implementing bills would introduce substantial administrative fines and criminal liability for, among other things, providing crypto-asset services without authorisation.
Since 1 July 2026, entry in the Polish VASP register has not been evidence that a firm may provide crypto-asset services regulated by MiCA. Banks, payment institutions, acquirers and investors should check the register of the European Securities and Markets Authority (ESMA) and the relevant home-state registers, including any notification status. A third-country licence alone does not confer an EU passport.
The check must cover the particular entity and the particular services. This matters most in aggregator and white-label structures, where you need to identify which entity actually performs each regulated activity and detect licence borrowing. Compare contractual labels with the actual transaction flows and the allocation of regulated functions, and the entity named in the customer terms with the one that really provides the service.
MiCA authorisation does not guarantee a bank account. Polish banks are not prohibited from serving crypto businesses, but many apply restrictive risk policies and each bank makes its own assessment. For services involving e-money tokens (EMTs), also check whether a payment services authorisation or another entitlement is needed under the second Payment Services Directive (PSD2). We show how we work with this market on our legal solutions for cryptocurrency firms page.
Virtual currency businesses are obliged institutions under the Polish Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (the AML Act). They apply customer due diligence, ongoing transaction monitoring and enhanced measures for higher-risk relationships, keep records, and report suspicious activity to the GIIF.
Since 30 December 2024, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (the TFR, or travel rule) has required originator and beneficiary information to accompany crypto-asset transfers involving CASPs, with no minimum threshold. For transfers above EUR 1,000 to or from a self-hosted address, the provider must also assess whether the address is owned or controlled by its customer.
From 10 July 2027, Regulation (EU) 2024/1624 (the AMLR) will apply as a directly applicable EU AML rulebook. CASPs will be prohibited from maintaining anonymous accounts or accounts allowing the anonymisation of customers, including through anonymity-enhancing coins. From 2028, the EU Anti-Money Laundering Authority (AMLA) will directly supervise selected high-risk cross-border entities, potentially including CASPs.
EU sanctions apply to crypto-assets as they do to traditional funds. Council Regulation (EU) No 833/2014 prohibits crypto-asset services to specified Russian persons and entities, subject to exemptions, and separate restrictions apply under the Belarus regime. At national level, the Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and to protect national security provides a domestic sanctions list and freezing measures. Fully decentralised arrangements without an identifiable intermediary are not obliged entities; AML duties attach to intermediaries such as custodians, on-ramps and off-ramps and, depending on their functions, front-end operators.
Since 1 January 2019, an individual's income from the paid disposal of virtual currency has been taxed separately within capital income at a flat 19%. Disposal includes exchanging virtual currency for legal tender, goods, services or other property rights and using it to settle obligations; exchanges between virtual currencies are tax-neutral. Where the individual's aggregate income included in the solidarity levy base exceeds PLN 1 million, a 4% levy may apply to the excess.
Deductible costs are documented expenditure directly incurred on acquiring virtual currency and costs connected with its disposal. Excess costs are carried forward, and income and costs are reported in the annual PIT-38 return. Companies have a broadly parallel corporate income tax regime, with an exception for specified professional virtual currency businesses covered by the AML Act. For VAT, exchanging virtual currency for traditional currency is an exempt financial service following the Court of Justice of the EU judgment in Hedqvist (C-264/14), and the sale or exchange of virtual currency is exempt from Polish tax on civil-law transactions.
The main uncertainties concern staking, lending, liquidity provision and yield farming; airdrops, hard forks and mining; and NFTs, utility tokens and tokenised real-world assets. Polish tax law still relies on the AML concept of virtual currency, while regulation now uses MiCA's broader concept of crypto-assets, so changes to the AML definitions in the implementing law could have tax consequences. An individual tax ruling protects a taxpayer who acts in accordance with it, subject to statutory conditions and to the actual facts matching those described in the application.
Poland implemented the DAC8 Directive through the Act of 13 February 2026 (Journal of Laws 2026, item 347) amending the Act on the Exchange of Tax Information with Other States. Reporting crypto-asset service providers must collect and verify customer identity and tax-residence data and report covered exchanges and transfers. The first reporting cycle in 2027 covers data for 2026, and reports to the Polish tax authority are due by 30 June 2027.
Poland has no dedicated tokenisation statute: a token is regulated according to the rights it represents. A token equivalent to a share, bond or fund unit is subject to the financial-instrument rules, a token referencing a currency or basket of assets may be an EMT or ART, and other tokens are assessed against MiCA's scope and exclusions. Recording an asset on a ledger does not change its legal nature or transfer formalities, and labelling a token an NFT does not by itself take it outside MiCA.
Retail projects in Poland have mainly involved tokenised real estate, private credit and revenue-sharing products, generally structured through special purpose vehicles (SPVs). Depending on the structure, the prospectus rules (Regulation (EU) 2017/1129 and the Act on Public Offering), Regulation (EU) 2020/1503 on European crowdfunding service providers, which the KNF already supervises, the collective investment rules or MiCA apply. Classification turns on substance, informed by ESMA guidelines. A key risk is mis-labelling an investment-type token as a utility token, although an expectation of profit alone does not make a token a financial instrument.
Public offers of crypto-assets other than ARTs and EMTs fall under Title II of MiCA, but as at 9 October 2026 an offeror with its registered office in Poland cannot complete a domestic white-paper notification, because no competent authority has been designated. The offeror must be a legal person, draw up a white paper with the information MiCA prescribes and notify it to the home-state authority at least 20 working days before publication. Marketing communications must be fair, clear, not misleading and consistent with the white paper; the 14-day withdrawal right applies where relevant, and the offeror is liable for the information in the white paper.
White-paper exemptions include offers to fewer than 150 persons per member state, offers with total consideration of up to EUR 1 million over 12 months, and offers solely to qualified investors where the crypto-assets may only be held by such investors. Each exemption has conditions and does not necessarily remove other obligations.
For wholesale tokenisation, the DLT Pilot Regime (Regulation (EU) 2022/858) lets DLT market infrastructures operate with targeted exemptions, and Poland adapted its law through the Act of 16 August 2023. According to the chapter, no Polish DLT market infrastructure appeared on ESMA's list at the date of writing, although the Central Securities Depository of Poland (KDPW) has engaged with the technology.
Poland has no general smart contract regime: whether a smart contract creates a binding agreement depends on the Civil Code, including capacity, intention, agreed terms and any required form. Code may express the agreement or automate performance of an existing contract. The EU Data Act defines smart contracts and sets requirements for those used to execute data-sharing agreements, but these rules do not apply to every blockchain contract.
Some code-based declarations may meet documentary form, which requires that the content of a declaration can be accessed and its maker identified. Code or an ordinary blockchain signature alone does not satisfy written form; a declaration bearing a qualified electronic signature is equivalent to it. Transactions requiring a notarial deed, such as transfers of real estate, remain subject to that formality.
Polish courts interpret contracts by reference to the parties' intention and the purpose of the contract, not code alone. Where the code's output departs from what the parties agreed, a transfer made without legal basis may be reclaimed as unjust enrichment. Mistake or fraud may affect a declaration of intent, and code cannot exclude consumer protection: information duties, the right to withdraw from distance contracts and the ban on unfair terms. A natural-language agreement alongside the code can set out the parties' rights, the relationship between the contract and the software, the allocation of coding risks and the remedies if execution goes wrong.
A decentralised autonomous organisation (DAO) is not a legal entity under Polish law and has no dedicated legal form. A DAO that exists only as smart contracts cannot hold assets in its own name, enter into contracts, or sue or be sued.
Participants may incur personal liability depending on the arrangement and their role. A court could consider whether an agreement to pursue a common economic purpose meets the conditions for a civil-law partnership (spółka cywilna), whose partners are jointly and severally liable for its obligations. Token ownership or voting alone does not establish a partnership, but developers, front-end operators and others exercising control may be liable for their own conduct.
Polish-led projects that need legal capacity, for example to contract with service providers, hold intellectual property or a treasury, or deal with regulated counterparties, typically use a legal wrapper: a Polish limited liability company, a foundation or a foreign vehicle such as a foundation or purpose trust. The choice depends on the wrapper's role, the governance model, tax and investor expectations. A DAO structure does not take regulated activity outside the perimeter: if an identifiable person provides crypto-asset services, offers tokens to the public or operates a trading venue, MiCA, AML or securities law applies to that person.
The same logic applies to DeFi (decentralised finance). Under recital 22 of MiCA, crypto-asset services provided in a fully decentralised manner without any intermediary fall outside its scope, but services provided only partly in a decentralised manner do not. Control over a front-end, administrative keys, upgrades or fees can help identify a service provider, and centralised firms that route client activity through DeFi protocols remain responsible for the regulated services they provide.
The Polish Civil Code does not expressly classify crypto-assets: they are not things, so the owner's vindication claim does not apply directly, but they are generally treated as transferable assets with economic value. An on-chain transaction transfers technical control but does not necessarily satisfy every legal formality, and the transfer mechanism depends on the rights the crypto-asset represents.
Polish law has no dedicated security regime for crypto-assets. A civil-law or registered pledge may be available where the collateral is an identifiable transferable right, but this cannot be assumed for every type of crypto-asset; the financial-collateral regime may be relevant where a token falls within an eligible category, such as a financial instrument. Lender-controlled or multi-signature wallets and tri-party custody can support contractual enforcement, but control of private keys alone does not establish the legal effectiveness or insolvency priority of a security interest.
There is no special insolvency regime for crypto-asset firms. MiCA requires legal segregation of client crypto-assets held in custody, including protection from the custodian's creditors, but the client's position still depends on the arrangement, identification of the assets and compliance in practice. A trustee's ability to secure assets depends on access to private keys and cooperation from custodians and exchanges, and Polish bankruptcy law generally converts non-monetary obligations into monetary ones valued at the date of bankruptcy. On data protection, the European Data Protection Board (EDPB) adopted the final version of Guidelines 02/2025 on 7 July 2026; in practice, keep personal data off-chain where possible.
The chapter lists the issues that will shape blockchain law in Poland in the 12 months from 9 October 2026. First, the outcome of the presidential and government bills and the designation of the KNF as competent authority for CASPs and ART issuers. Then the application of the AMLR from 10 July 2027 and AMLA's selection process in 2027, the first DAC8 reporting cycle in 2027, the European Commission's review of MiCA (including possible coverage of DeFi, crypto-asset lending and staking), and the proposed third Payment Services Directive (PSD3) and Payment Services Regulation (PSR) and their interaction with stablecoin-based payments.
The list also includes the Zondacrypto proceedings. The exchange served Polish clients through its Estonian operator, BB Trade Estonia OÜ. The Regional Prosecutor's Office in Katowice opened an investigation in April 2026 into suspected fraud and possible money laundering, the operator was declared bankrupt in Estonia on 27 August 2026, and the investigation has since been taken over by a dedicated team of prosecutors at the National Prosecutor's Office. The proceedings are ongoing, and any charges brought do not establish guilt, which is a matter for the courts. The case has influenced the debate on Polish supervisory legislation and shows how hard it is to trace and recover client assets across borders.
While the legislative process continues, a firm preparing for Polish authorisation can work on governance, prudential safeguards, client-asset protection, conflicts of interest, AML and travel-rule procedures, ICT risk under Regulation (EU) 2022/2554 on digital operational resilience (DORA) and orderly wind-down arrangements.
Legal position: as described in the chapter, as at 9 October 2026. The rules and proceedings may change, so check the current position with us before you decide.
Chapter published in: The Legal 500 Country Comparative Guides 2026 - Blockchain & Crypto Assets, Poland (opens in a new tab) (Legalease).
No: since 1 July 2026, entry in the Polish VASP register has not provided a basis for services regulated by MiCA.
The register was an AML gateway, without prudential supervision or capital requirements. Since the MiCA transitional period ended, these services require a MiCA entitlement, such as CASP authorisation in another member state and cross-border notification.
If you deal with a crypto business as a bank, payment institution or investor, check it in the ESMA register and the home-state registers, not only in the VASP register.
As at 9 October 2026, you can obtain CASP authorisation in another EU member state, rely on an EU-authorised CASP for the regulated services, or suspend the regulated activity.
Poland has not designated a competent authority for CASPs, so there is no domestic route. Authorisation abroad requires a registered office in that state, effective management in the EU and genuine local substance.
Reverse solicitation is narrowly construed and does not allow active marketing to Polish clients. In the meantime, you can prepare governance, AML and travel-rule procedures, client-asset protection and ICT risk management.
No: code or an ordinary blockchain signature alone does not satisfy written form, but a declaration bearing a qualified electronic signature is equivalent to it.
Some code-based declarations may meet documentary form if the content of the declaration can be accessed and its maker identified. Transactions requiring a notarial deed, such as transfers of real estate, still need one.
A Polish court will interpret the contract by the parties' intention and its purpose, not by the code alone. A natural-language agreement alongside the code reduces disputes about what the parties actually agreed.
Possibly: a DAO has no legal personality in Poland, and a court may treat the participants' agreement as a civil-law partnership whose partners are jointly and severally liable.
Token ownership or voting alone does not establish a partnership. The arrangement and the participant's role decide, and developers, front-end operators and others exercising control may also be liable for their own conduct.
Where a project needs legal capacity, for example to sign contracts or hold a treasury, it typically uses a legal wrapper: a Polish limited liability company, a foundation or a foreign vehicle.
By 30 June 2027: the first DAC8 reporting cycle in 2027 covers data for 2026.
Poland implemented DAC8 through the Act of 13 February 2026 amending the Act on the Exchange of Tax Information with Other States. Reporting crypto-asset service providers must collect and verify customer identity and tax-residence data and report covered exchanges and transfers.
If you are a reporting provider, check now whether the customer data collected in 2026 will be enough for the first report.
Related service
We advise crypto businesses, fintechs and funds on CASP licensing, the move from the VASP register, and MiCA and AML compliance. See how we work, or read the full chapter at the publisher.
