Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.
posted 3 hours ago
Designing compliant crypto custody in Poland has never been more operationally complex, or more commercially urgent. The EU Markets in Crypto-Assets Regulation (MiCA) is directly applicable across Poland, yet the national implementing act needed to stand up the domestic CASP licensing regime has been vetoed multiple times by the President of Poland, leaving firms in a regulatory halfway house. The Polish Financial Supervision Authority (KNF) has responded with transitional statements allowing registered VASPs to continue operating under national law, but banks, payment service providers and institutional counterparties are raising their due-diligence thresholds in parallel.
This article delivers a practical playbook: which crypto custody models meet MiCA expectations today, how to structure AML/KYC controls for the Polish market, and a step-by-step bank-onboarding template that firms can deploy immediately.
Poland sits in a unique position among EU member states. MiCA is binding EU law, but without a functioning domestic CASP licence route, firms must simultaneously operate under the existing VASP registration while preparing documentation, governance and custody architectures that will satisfy CASP requirements the moment a national act takes effect. Industry observers expect this window to close quickly once legislative gridlock resolves.
The practical consequence is that crypto custody firms in Poland cannot afford to wait. Banks are already tightening onboarding criteria, the KNF is signalling supervisory expectations through public statements, and the General Inspector of Financial Information (GIIF) continues to flag AML risks associated with virtual-currency trading. Firms that invest in MiCA-grade custody and compliance infrastructure today will be better positioned for both bank acceptance and future CASP authorisation.
Five actions to take immediately:
MiCA (Regulation (EU) 2023/1114) is a directly applicable EU regulation. It does not require transposition into national law to be binding, it takes effect across all member states automatically. For crypto custody specifically, MiCA sets requirements around asset segregation, governance, record-keeping and client disclosures that apply regardless of whether a member state has adopted supplementary national legislation. For a comprehensive overview of Poland’s crypto licence requirements under MiCA 2026, see our detailed guide.
On 26 September 2025, the Sejm of the Republic of Poland adopted the Crypto-Asset Market Act, which was intended to ensure the full application of MiCA domestically and establish the KNF as the competent supervisory authority for CASP licensing. However, the President of Poland vetoed the legislation. A subsequent version was also vetoed on 12 February 2026. These repeated vetoes mean that Poland still lacks the domestic procedural framework, the application forms, fee schedules, supervisory powers and transitional arrangements, necessary for the KNF to accept and process CASP licence applications.
The KNF has issued a public statement clarifying that the MiCA transitional regime allows entities lawfully providing crypto-asset services under applicable national law before 30 December 2024 to continue operating until 1 July 2026, or until they receive or are denied a CASP licence, whichever comes first. In practical terms, this means Poland’s VASP register (maintained by the Tax Administration Chamber) remains the operative domestic authorisation mechanism. Firms on the register may continue offering custody, exchange and other services listed in their registration. However, the KNF has also warned that this transitional window is finite, and firms should be preparing for the full MiCA supervisory regime.
Understanding why firms need a crypto licence and how to obtain one remains essential background for this transition.
Choosing the right custody model is the single most consequential operational decision a crypto firm makes in Poland. The model must satisfy MiCA custody requirements, asset segregation, governance controls, reconciliation and client-asset protection, while also being intelligible to Polish banks and auditors who will scrutinise the design during onboarding.
| Custody Model | Legal / Regulatory Fit (MiCA & CASP Poland) | Security & Recovery | Bank Acceptance | Recommended For |
|---|---|---|---|---|
| In-house cold storage (single custodian) | Can satisfy custody duties if segregation, governance and reconciliation are fully documented; higher internal supervision burden under MiCA | High security when properly implemented; single point of failure for key management; recovery depends on backup procedures | Moderate, banks typically request third-party attestations and independent audits before accepting | Early-stage firms with strong internal security teams; lower transaction volumes |
| Third-party qualified custodian (EU passported) | Closest alignment with MiCA institutional custody expectations; provider handles segregation and reporting; reduces firm’s own supervisory burden | Provider-grade security (SOC 2, insurance); counterparty concentration risk; recovery governed by custodian SLA | High, banks strongly prefer recognised qualified custodians; simplifies due-diligence process | Institutional custody in Poland; firms seeking fastest bank onboarding; those storing client stablecoins or asset-referenced tokens |
| MPC (multi-party computation) hybrid | Increasing regulator acceptance where key-management policies and independent audits exist; strong controls demonstration | Eliminates single-key risk; good balance of liquidity and security; requires robust key-share governance | Moderate to high, banks may require proof of MPC provider controls and independent attestation of the key-share protocol | Exchanges with high transaction frequency; firms balancing hot-wallet liquidity with cold-storage security |
| Multi-custodian split | Strong risk-distribution profile; meets MiCA concentration-risk expectations; requires more complex governance documentation | Reduces single-custodian failure risk; increases operational complexity; recovery procedures must cover multiple providers | High, demonstrates sophisticated risk management; banks view diversification favourably | Larger CASPs; firms holding diverse asset types across chains; institutional custody Poland operations |
| Hot wallet only (custodial exchange model) | Unlikely to meet MiCA custody standards for client assets without supplementary controls; acceptable only for limited operational floats | Highest attack surface; fastest transaction execution; suitable only for small, working-capital balances | Low, banks view hot-wallet-only models as high risk; expect significant additional controls or refusal | Operational float only; never for client-asset custody |
Hot wallets remain necessary for operational liquidity, processing withdrawals, funding trades and paying fees, but should never hold more than a defined percentage of total client assets. Industry observers expect that MiCA-aligned supervisors will look for policies capping hot-wallet exposure at a maximum of 2–5% of total assets under custody, with automated sweeps transferring excess to cold or MPC-secured reserves.
Air-gapped cold storage, where private keys are generated and stored on hardware that has never been connected to the internet, remains the gold standard for high-value asset protection. For crypto custody in Poland, firms should implement geographically distributed cold-storage facilities, each with dual-control access requirements, tamper-evident seals, and CCTV logging. The operational trade-off is slower withdrawal processing; firms typically mitigate this with pre-signed transaction batches authorised under multi-signature schemes.
Multi-party computation eliminates the single private key as a point of failure. Instead, cryptographic key shares are distributed across multiple independent parties, the firm, a co-signer and optionally a disaster-recovery service. This architecture allows real-time transaction signing without any single party holding a complete key, while maintaining auditability. For CASP Poland applicants, MPC models are increasingly viewed favourably provided the firm can demonstrate key-share governance policies, periodic key-rotation procedures and independent audits of the MPC protocol.
Qualified custody providers, whether Polish-domiciled or EU-passported, offer the clearest path to satisfying MiCA custody requirements and gaining bank acceptance. When selecting a provider, firms should verify SOC 2 Type II attestations, insurance coverage, regulatory status in the provider’s home jurisdiction, and the contractual framework for asset segregation and insolvency protection. Early indications suggest that Polish banks are more comfortable with EU-passported providers that hold authorisations in jurisdictions where MiCA implementation is further advanced, such as France, Germany or the Netherlands.
Custody AML KYC in Poland must satisfy two overlapping frameworks: Poland’s existing Anti-Money Laundering Act (which governs VASP-registered entities today) and MiCA’s own requirements for CASPs, which will apply fully once the domestic licensing regime becomes operational. Designing controls that meet both frameworks simultaneously is not optional, it is a prerequisite for bank onboarding and future CASP authorisation.
The Polish AML Act already requires VASPs to perform customer identification and verification before establishing a business relationship. Under MiCA, CASPs must additionally apply enhanced due diligence for higher-risk clients and transactions. Practical implementation should include:
Transaction monitoring for custodial services must cover both fiat and on-chain movements. The General Inspector of Financial Information has specifically flagged risks associated with trading through entities headquartered outside Poland and the EU, reinforcing the expectation that firms implement robust ongoing monitoring. Key controls include:
MiCA requires clear separation between client assets and the firm’s own treasury. In practical custody architecture, this translates to:
Securing a banking relationship is the most common bottleneck for crypto firms operating in Poland. Bank onboarding for crypto in Poland requires meticulous preparation: banks conduct detailed AML, legal, operational and reputational due diligence, and the absence of any single document can delay the process by weeks or result in outright refusal.
Assemble the following documents before your first bank meeting. Present them in a single, indexed PDF binder with a cover letter summarising your firm, its regulatory status and the specific banking services requested.
Expect the bank’s compliance and risk team to request the following within the first 5–7 business days after receiving your packet:
Banks in Poland are not uniformly hostile to crypto firms, but they are cautious. The following tactics improve outcomes:
Sample 14-day timeline:
Custody failures, whether from theft, smart-contract exploits, insider threats or court-ordered seizures, require a pre-documented response. Poland’s criminal-law framework allows prosecutors to serve formal freeze orders on centralised exchanges and custodial service providers, making incident-response readiness a legal necessity as well as an operational one.
Use this custody operational checklist to assess your firm’s readiness across governance, technical, AML, operational and bank-facing dimensions. Each item is labelled by priority level.
Crypto custody in Poland in 2026 demands a dual-track approach: operate compliantly under the existing VASP registration and KNF transitional framework while building the documentation, controls and institutional relationships that a full CASP licence will require. The firms that treat MiCA readiness as an operational priority, not a future compliance exercise, will secure banking relationships faster, reduce regulatory friction and position themselves to apply for CASP authorisation on day one. Use the checklists, templates and the 14-day bank-onboarding playbook in this article as a starting point, and seek specialist legal counsel to tailor them to your firm’s specific custody architecture and risk profile.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Aaron Glauberman at LegalBison, a member of the Global Law Experts network.
Member
Find the right Legal Expert for your business
Sign up for the latest advisor briefings and news within Global Advisory Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.
Naturally you can unsubscribe at any time.
Global Advisory Experts is dedicated to providing exceptional advisory services to clients around the world. With a vast network of highly skilled and experienced advisors, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.
