As of July 1, 2026, providing crypto-asset services in the European Union requires CASP authorization. Poland still lacks a law designating a supervisory authority and specifying sanctions. Many conclude that the Polish crypto market currently operates outside the reach of criminal law. This conclusion is incorrect. Below, we explain what the current legal status actually means for industry entrepreneurs, their clients, and those whose money is stuck on platforms.
How did the current situation come about?
The scale of the problem is not a niche issue. A CBOS survey conducted this spring for "Dziennik Gazeta Prawna" shows that 6.6% of adult Poles, or approximately 2 million people, declare they own cryptocurrencies, with an estimated total of PLN 40 billion invested in these assets.
The MiCA regulation applies directly in Poland, but its effective implementation requires a national law. Such a law has failed to enter into force three times. The Sejm passed the first version on November 7, 2025, and the President refused to sign it on December 1. The second version was passed and vetoed in February 2026. The Sejm adopted the third version on May 15, and the President vetoed it on June 11. The vote to overturn the final veto took place on September 4, 2026. 241 MPs voted in favor of the rejection, 198 against, and 266 votes were needed for a successful override. A few days later, another initiative emerged. On September 8, the Speaker of the Sejm received the second presidential bill on the crypto-asset market. The Minister of Finance announced that the ministry is working on another bill, but the decision to submit it has not yet been made.
The practical consequences are serious. The Polish Financial Supervision Authority (KNF) indicated in February that licensing proceedings would only be possible in Poland after the statutory designation of a competent authority, and the end of the transitional period provided for in MiCA cannot be extended by either national law or a KNF decision. Therefore, entities wishing to legally serve Polish clients must use licenses obtained in other member states.
Ban without sanctions?
From the perspective of EU law, the matter is clear. Article 59 of the MiCA Regulation reserves the provision of crypto-asset services to licensed entities. In a press release dated April 17, 2026, ESMA confirmed that after July 1, 2026, the provision of such services within the EU without a CASP license violates EU law, regardless of whether the Member State in question has implemented MiCA.
However, illegality is one thing, and criminal liability is another. The regulation requires member states to establish sanctions, but it does not itself introduce them. Pursuant to Article 42(1) of the Constitution of the Republic of Poland and Article 1 § 1 of the Penal Code, only those who commit an act prohibited under penalty by a law in force at the time of its commission are subject to criminal liability. An EU standard cannot replace the national standard for the type of prohibited act. Commentators therefore point to a paradox: since July 1, crypto-asset activities without a CASP license have been prohibited by EU law, yet there are no sanctions for violating this prohibition.
Operating without a CASP permit does not constitute a separate crime in Poland today. However, that's where the good news for entities operating in the gray zone ends.
What still applies: the AML Act
The vetoes concerned the Crypto-Asset Market Act. They did not repeal the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing. Entities providing services referred to in Article 2, Section 1, Item 12 thereof remain obligated institutions. They must apply financial security measures, monitor transactions, and notify the General Inspectorate of Financial Information (GIFI) of circumstances indicating money laundering. Article 129m of this Act still stipulates that virtual currency activity is a regulated activity within the meaning of the Entrepreneurs' Law and may only be conducted after being entered in the register of virtual currency activities. The Act provides for a fine of up to PLN 100,000 for conducting such activity without such an entry.
However, entry in the national register does not replace an EU permit. In a statement dated June 19, 2026, the Director of the Tax Administration Chamber in Katowice stated that entry in the register of virtual currency activities does not constitute a permit for activities regulated by MiCA and, after July 1, does not entitle one to perform them, either in Poland or abroad.
For managers of such entities, the most important provisions are the criminal provisions of the AML Act. According to Article 156, Section 1, a person who, on behalf of or for the benefit of an obligated institution, fails to notify the General Inspectorate of Financial Information (GIFI) of circumstances indicating suspected money laundering, or who provides false information to the GIFI, or conceals true information, is subject to imprisonment from three months to five years. This liability is individual and applies to specific management board members and compliance officers, not solely to the company.
The Penal Code knows no regulatory loophole
The lack of a sector-specific law does not affect the application of the provisions of the Penal Code. These provisions have always been the main tool for prosecuting abuses in the cryptocurrency market. In practice, the following classifications appear most frequently in proceedings involving cryptocurrency platforms: fraud (Article 286 of the Penal Code), misappropriation of entrusted property (Article 284 § 2 of the Penal Code), computer fraud (Article 287 of the Penal Code), breach of trust in business transactions (Article 296 of the Penal Code), money laundering (Article 299 of the Penal Code), and participation in an organized criminal group (Article 258 of the Penal Code). None of these types of offenses require determining whether the perpetrator held a CASP license. It is sufficient that they misled customers, misused entrusted funds, or engaged in activities that could prevent or significantly impede the determination of the criminal origin of the assets.
The best illustration is the ongoing investigation into the Zondacrypto platform. The fraud and money laundering proceedings were initiated on April 17, 2026, at the Regional Prosecutor's Office in Katowice. In the summer, the Silesian Branch of the Department of Organized Crime and Corruption of the National Prosecutor's Office took over the case and combined it with the investigation into the disappearance of the founder of the exchange's predecessor. According to the prosecutor's office, the charges filed so far include participation in an organized criminal group, causing significant property damage to the exchange's operators, aiding and abetting the misappropriation of entrusted property and computer fraud, and money laundering. The case is at the pre-trial stage, and all those charged enjoy the presumption of innocence. From a systemic perspective, however, it demonstrates one thing: law enforcement agencies did not need the Cryptoasset Market Act to apply the most severe penalties under the Penal Code.
Customer perspective
For those who have lost funds on a cryptocurrency platform, the status of aggrieved party, as defined in Article 49 § 1 of the Code of Criminal Procedure, is crucial. This status opens up access to files, allows for the submission of evidentiary motions, and appeals against dismissal decisions. It also allows for the ability to act as an auxiliary prosecutor and file a motion for a ruling on the obligation to compensate for damages under Article 46 § 1 of the Code of Criminal Procedure. In the Zondacrypto case, the Regional Prosecutor's Office in Katowice instructed district prosecutors in its area to receive notifications, interview victims, and secure evidence from them. Therefore, injured parties do not have to file notifications exclusively in Katowice. However, they should ensure complete documentation from the outset: transaction history, correspondence with the platform, confirmations of fiat transfers, and wallet addresses.
The other side of the coin is sometimes less obvious. Flows between a bank account and a platform operating without permission signal increased risk to banks. Therefore, the account holder may be subject to the procedure under Article 106a of the Banking Law, even if they are not suspected of any crime. After initiating proceedings, the prosecutor may issue an order suspending the transaction or blocking funds for a specified period, no longer than six months, and extending the block for another six months. This order may be appealed to the court. The block is lifted if no decision is issued before the deadline to secure assets or material evidence. Article 86 et seq. of the AML Act provides for a separate blocking procedure involving the General Inspectorate of Financial Information (GIFI). The issue of oversight over the extension of blocking has become a point of political contention. The new presidential bill provides for mandatory warnings for investors before making a deposit and judicial review of the extension of the account blocking.
Having your account blocked doesn't mean you're at fault. However, it's also not a situation where you should just wait passively. Appeal deadlines are short. Early submission of documents explaining the origin of the funds often determines whether the case ends with a block or moves on to a security interest.
The current legal status quo doesn't create a zone of impunity. It creates a zone of uncertainty, and this situation is in some ways more dangerous. A business operating without a CASP permit doesn't commit a crime per se. However, it remains an obligated institution under the AML Act, its management is criminally liable for breaches of obligations to the General Inspectorate of Financial Information (GIIF), and any abuse of customers is subject to the full rigors of the Penal Code. Clients of such platforms risk losing their funds without national supervision to turn to. They also risk having their own transactions classified as suspicious. Regardless of whether another law is passed in the fall, the criminal risks associated with the cryptocurrency market are already real and require individual assessment.
This article is for informational purposes only and does not constitute legal advice
Legal status as of September 23, 2026.
Author:
Series editor:
