Remote VASP serving residents in Poland
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Poland with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with GIIF (Minister of Finance) under the Polish AML Act (Ustawa z dnia 1 marca 2018 r. o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu).
- Appoint a designated AML Officer responsible for AML/CTF compliance.
- Implement Customer Due Diligence (CDD) procedures including identification of beneficial owners and sanctions screening.
- Conduct ongoing monitoring of client relationships and transactions.
- Implement transaction monitoring systems to detect unusual patterns or threshold breaches.
- Report suspicious transactions and activities to GIIF.
- Maintain records of client identification data and transactions for at least 5 years.
- Provide regular AML/CTF training for relevant employees.
- Develop and implement internal AML/CTF procedures including a business-specific risk assessment.
- Management board members and beneficial owners must meet fit-and-proper criteria (no criminal record for intentional financial crimes).
- Proof of knowledge and experience in the field of virtual currencies is required for registration.
Key Restrictions
- The operator must be a Polish legal entity (e.g., sp. z o.o. or S.A.) — a foreign-incorporated entity cannot directly register.
- At least one management board member must have residence in Poland or Polish citizenship.
- The registration regime is AML-only — no prudential supervision or capital requirements currently, but MiCA will introduce authorization by KNF with capital requirements (€50k–€150k) from December 2024.
- Under MiCA, CASPs must segregate client crypto-assets and funds and enter into custody agreements with clients.
- No minimum capital requirement for current VASP registration, but MiCA will impose capital thresholds.
Key Risks
- Operating without registration as a Polish entity constitutes unlicensed VASP activity, exposing the operator to enforcement action by GIIF and potential criminal liability under the AML Act.
- The transition from AML registration under GIIF to MiCA authorization under KNF creates regulatory uncertainty and potential dual regime burden.
- No specific client asset segregation requirement currently — creates ambiguity on custodial standards and potential exposure under commercial law.
- Foreign operators serving Polish residents without a local entity and registration face material enforcement risk, as demonstrated by EU-wide actions against unregistered VASPs (e.g., Binance).
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Polish AML Act (current consolidated text, in Polish): Ustawa z dnia 1 marca 2018 r. o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu. You can find the consolidated text on the Polish government's legislative information system (ISAP) at: https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20180000723
GIIF (Ministry of Finance page regarding Virtual Currencies - in Polish): https://www.gov.pl/web/finanse/dzialalnosc-w-zakresie-walut-wirtualnych (This page provides information on the register and requirements).
Current (Registration): Poland operates a registration regime for VASPs under its AML Act. This means entities must register their activities with GIIF and comply with AML/CTF obligations. It is not a full "licensing" regime in the sense of prudential supervision (e.g., capital adequacy, operational risk, consumer protection oversight by KNF) like banks or investment firms currently face. The focus is purely on preventing money laundering and terrorist financing.
Legal Entity / Local Presence:
The applicant must be a Polish legal entity (e.g., Spółka z ograniczoną odpowiedzialnością - limited liability company, or Spółka akcyjna - joint-stock company).
At least one individual from the management board of the Polish legal entity must have their residence in Poland or possess a Polish citizenship.
AML Officer: Appoint a designated individual responsible for AML/CTF compliance (AML Officer or Compliance Officer).
Customer Due Diligence (CDD): Implement procedures for identifying and verifying the identity of clients, including beneficial owners, and understanding the purpose and nature of business relationships. This involves collecting identity documents, verifying data, and screening against sanctions lists.
Ongoing Monitoring: Conduct ongoing monitoring of client relationships and transactions to detect suspicious activities.
Transaction Monitoring: Implement systems to monitor transactions for unusual patterns or thresholds.
Reporting: Report suspicious transactions and activities to GIIF.
Record-keeping: Maintain records of client identification data and transactions for at least 5 years.
Training: Provide regular AML/CTF training for relevant employees.
Internal AML/CTF Procedures: Develop and implement robust internal anti-money laundering and counter-terrorist financing procedures, including a risk assessment specific to the business and its clients.
Fit & Proper Criteria (Management/Owners):
Individuals intending to perform activities in the field of virtual currencies, as well as members of the management board and beneficial owners, must:
Under the current Polish AML Act, there are NO specific minimum capital requirements solely for VASP registration. This is a significant difference from traditional financial licenses.
Future MiCA Impact: MiCA will introduce capital requirements for Crypto-Asset Service Providers (CASPs), ranging from €50,000 to €150,000 depending on the type of services provided.
Requirement: Entities providing services related to virtual currencies, including "holding virtual currencies, including offering services to their users that consist of maintaining virtual currency instruments or access keys on their behalf," are considered Virtual Asset Service Providers (VASPs). These entities are obliged to register in the Register of Activities in the Field of Virtual Currencies (Rejestr Działalności w Zakresie Walut Wirtualnych).
Conditions for Registration:
The applying entity must be a legal person, an organizational unit without legal personality, or a natural person conducting business activity.
Individuals involved in management or ownership must not have been convicted of specific financial crimes or money laundering offenses.
Proof of knowledge and experience in the field of virtual currencies (e.g., certificate of completion of training, professional experience) is required.
Regulatory Body: The register is maintained by the Minister of Finance.
Purpose: This registration primarily serves AML/CFT purposes, ensuring that service providers implement appropriate customer due diligence (KYC), transaction monitoring, and suspicious activity reporting measures. It is not a comprehensive prudential license.
Current Status: The current Polish AML Act does not explicitly mandate specific rules for the segregation of client assets for virtual currency custodians. While good practice and general commercial law principles might suggest segregation, there is no direct regulatory requirement specific to crypto custody in the current AML framework.
Requirement: Under MiCA, entities wishing to provide custody and administration of crypto-assets will need to obtain an authorization from their competent national authority (likely the Polish Financial Supervision Authority – KNF). This authorization will be passportable across the EU.
Requirement: MiCA explicitly mandates the segregation of client crypto-assets and funds. Article 67 specifies that CASPs providing custody services must:
Having a minimum initial capital (Article 60).
Regulatory Body: The KNF will be the primary national competent authority for MiCA in Poland.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP may serve Polish residents only by incorporating as a Polish legal entity, registering with GIIF under the AML Act, and complying with AML/CTF obligations; direct cross-border service without local presence is not permitted, and MiCA will introduce a full prudential licensing regime under KNF by end of 2024.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?