MiCA License in Poland: Requirements, Capital and the KNF Procedure

Securing a MiCA license in Poland involves a tightly regulated procedure. The procedure rests on Regulation (EU) 2023/1114, which governs crypto-asset markets and is commonly referred to as MiCA. Each Polish bill to date hands the whole process to one supervisor: Komisja Nadzoru Finansowego (KNF), the Polish Financial Supervision Authority. Poland has applied MiCA directly and unamended from 30 December 2024 onward, so applicants must meet the full European standard as early as the filing stage.

This overview traces the whole licensing cycle: dossier preparation, KNF's review, post-authorization control principles and ongoing supervision. It looks closely at what KNF expects from corporate structure, in-house rules and IT, and from AML (anti-money laundering) and governance mechanisms.

Which Polish authority will issue MiCA authorizations

MiCA's Article 93 obliges every Member State to name a competent authority, and Warsaw settled on KNF in its first crypto-asset bill, put to public consultation in February 2024. Once that law applies, KNF is expected to be the sole recipient of filings from crypto-asset service providers (CASPs), with no second agency or intermediate filter.

As of November 2026, the law is still not in effect. Parliament adopted the Crypto-Asset Market Act three times. Each text met a presidential veto: on 1 December 2025, on 12 February 2026 and on 11 June 2026. No override vote succeeded; the latest failed on 4 September 2026. Four days later the President tabled a separate bill, and the same day a government spokesman announced that the Finance Ministry would prepare another draft. KNF itself states that no Polish body, KNF included, has yet been named competent for CASPs; the one designation in place concerns e-money token issuers. Until the national act applies, the only crypto license Poland recognizes is one issued by another EU regulator and passported in via Article 65. What follows describes how KNF is expected to run the procedure once designated, drawing on its established approach to licensing other financial institutions; references below to KNF practice mean exactly this.

No separate Polish statute adapts MiCA yet. The Regulation applies directly and in its original text, leaving no room for local concessions or alternative procedures. Applicants bear the entire regulatory burden, and each dossier has to match the pan-European standard down to the last detail. One filing with KNF will suffice, since the procedure involves no second regulator.

Unlike dual-control models such as those of Portugal or France, the Polish approach shortens the filing route without narrowing the requirements. KNF examines it all: ownership and funding sources, the operating model, IT infrastructure and the policy for in-house control. The applicant's compliance with AML and counter-terrorist financing (AML/CTF) rules is likewise assessed by KNF. Documents must be planned accordingly, as no other body gives preliminary clearance. A Poland crypto license therefore demands full compliance at the very first stage: a single authority handles the entire review and passes none of its functions to other bodies.

Company formation for a Poland crypto license

KNF accepts applications only from a company incorporated in Poland. Two legal forms are used in practice: the spółka z ograniczoną odpowiedzialnością (sp. z o.o., similar to a limited liability company) and the spółka akcyjna (S.A., a joint-stock company). In 90% of cases founders pick the sp. z o.o., which is easier to administer and lets shareholdings be split flexibly. An S.A. appears only in large projects planning to raise money through a share issue. KNF will not accept the dossier unless the company's founding deed names crypto-asset services among its activities. The first step is therefore to form an sp. z o.o. and enter it in Poland's National Court Register (KRS, Krajowy Rejestr Sądowy).

Each declared activity needs a matching code in the Polish Classification of Activities (PKD). Since 1 January 2025, PKD 2025 has replaced PKD 2007. In most cases the base code remains 66.19.Z, "Other activities auxiliary to financial services", custody included. Under PKD 2025, though, operating an exchange for crypto-assets belongs to 66.11.Z; intermediation in crypto-asset trading in which the intermediary assumes no obligations of its own (pośrednictwo w obrocie aktywami kryptograficznymi bez zobowiązań) is classified under 82.99.B. KNF matches these entries automatically, and a code at odds with the declared services leads to rejection. Where several services are planned, extra codes are advisable, for example 62.10.B (programming; 62.01.Z under PKD 2007) and 63.10.D (data processing; 63.11.Z under PKD 2007). Codes must line up with planned activities before the MiCA filing.

Office, substance and the shareholder chain: KNF's checks

Licensing presupposes a Polish registered office. A legal address alone falls short, however: KNF assesses substance, meaning real presence on Polish soil. Minimum requirements include premises, operating infrastructure and locally based staff. Supporting evidence accompanies the filing; examples include a lease, a handover certificate, a service contract or a letter from whoever owns the premises. When checking the address, KNF looks at the logic of the operating model together with formal indicators. Authorization requires a physical base proportionate to the declared scale of business.

• Staff in Poland: at least one specialist handling operations or internal control.
• Access to IT systems and communication channels, technical support included.
• Conditions allowing inspections and audits on the registered premises.
• A signed lease or permission to use premises (in a coworking space, with access terms and equipment specified).
• Formalized powers for a local representative or manager.

A virtual office or a mere mailing address may end the application at preliminary screening. These rules stem from European standards: authorization presupposes a lasting presence inside a Member State. Without a physical operating base and documented infrastructure, no MiCA license in Poland can be obtained.

KNF vets shareholders and directors alike. Anyone holding 10% or more is disclosed by name, together with jurisdictions and ownership chains, where capital comes from and any form of control. Holdings through offshore vehicles, trusts or nominee companies are prohibited. For each link through to the final beneficiary, KNF expects details in the format of the Central Register of Beneficial Owners (CRBR), filed as annexes and register extracts. Opacity or inconsistent information is a ground for refusal.

Capital and service scope for a MiCA license in Poland

Each service on MiCA's Article 3(1)(16) list needs authorization:

• Taking client orders to buy, sell or swap crypto-assets, then passing them on for execution.
• Carrying out purchases, sales or swaps for a client and on terms the client chooses.
• Moving client holdings from address to address on instruction.
• Arranging exchanges of clients' crypto-assets at market rates against funds or other crypto-assets.
• Safekeeping client holdings and managing them as instructed.
• Running a venue where clients buy, sell or swap crypto-assets.
• Recommending which crypto-assets are worth buying, selling or holding long term.
• Running portfolios for clients: choosing assets, shaping the mix and tracking results.

Placement of crypto-assets (initial offerings included) completes the list, and MiCA also covers investment recommendations centered on dealings in digital assets. These activities, too, require a crypto license in Poland.

Polish applicants face the full list, points (a) to (j), without adaptation. Each function is disclosed separately: how it works technically and which in-house control procedures apply, how clients reach it and who answers for it.

KNF examines both the fact of a service and the way it is delivered. For example, if an applicant controls execution logic, KNF may treat its order handling as client access to external venues.

Capital floors by service class

MiCA's Article 67, read with Annex IV, links the permanent capital floor to the declared services and their combination. Annex IV defines three classes:

• Class 1, minimum EUR 50,000: only services involving neither custody nor exchange, namely receiving and transmitting orders, executing them, placing, transfers, advice and managing portfolios.
• Class 2, minimum EUR 125,000: any Class 1 services together with one or more of client custody, crypto-to-funds exchange and crypto-to-crypto exchange.
• Class 3, minimum EUR 150,000: the Class 2 scope plus running a crypto-asset trading platform.

Article 67(1) adds a second yardstick, a quarter of fixed overheads as incurred over the preceding year, which applies whenever it exceeds the Annex IV amount. For anyone issuing asset-referenced tokens, Article 35 puts the own-funds floor at EUR 350,000.

Running the functions on one IT platform, or through an outside white-label provider, does not lower the capital. What counts is the combined regulatory load, not the delivery format, and no technical arrangement reduces the threshold.

KNF expects documentary proof that capital was paid in before filing. The filing has to state the amount and show how it relates to operational scale and which main risks it absorbs. Where the model's classification is in doubt, KNF applies the top threshold, whatever the technical set-up or group structure.

How services are structured and classified within the filing

Under MiCA, one authorization may cover a single service or several. Legally the result is one CASP status, defined by all the functions declared in the dossier, not a bundle of separate licenses. The model comes from MiCA itself and needs no national adaptation.

Article 62 calls for one document set, which KNF reads as an integrated model where every service feeds into overall risk. KNF assesses platform architecture, how each function runs, who is responsible and whether in-house control procedures exist. Combined functions get analyzed together, never one service at a time. A partial authorization is therefore impossible, and so is a stepwise extension without a new review.

The dossier must disclose the operating model in full, including affiliated entities, technology providers and client access channels. Applying Article 63(10), KNF tests for transparent management, in-house documents that match the declared functions and a sustainable compliance control system. Links between functions draw particular scrutiny. If an applicant combines order execution and asset custody with own-account trading, it must prove that the risks of each business line are identified and segregated, with controls over each.

Requirements for operational readiness

Under MiCA, operational readiness means the capacity to provide declared services in a stable and transparent way, be it exchange, custody, order execution or transfers. Applicants have to answer three questions:

• Which systems exactly will the company use?
• How are the mechanisms organized?
• Who answers for the systems, and how does internal control work?

For that purpose a dossier carries architecture diagrams, process descriptions, role allocation and response plans. The applicant has to present a full model of the operating infrastructure, as detailed as a fintech company or investment intermediary would provide.

For KNF, the existence of IT systems counts for less than their fit with the business. A company declaring custody has to describe:

• How assets are safeguarded: cold and hot storage, multisignature, key control.
• How users get access (including rights, limits and logs of their actions).
• How systems are restored after failures or attacks.
• Who maintains the systems: an in-house team or an external contractor.

With white-label or software-as-a-service (SaaS) solutions, the dossier has to disclose how the arrangement is organized and what the service level agreement (SLA) provides, along with technical limits and control tools. Each contractor must be described precisely: jurisdiction, level of access and degree of integration. Before authorization, an applicant must demonstrate that its technical architecture matches what it declares and that every related risk is covered.

• Completeness of process descriptions.
• Whether the IT really supports declared functions.
• System resilience under failure or load.

A perfunctory or incomplete account of the architecture sends the dossier back. Typical gaps are a missing recovery procedure, undisclosed access points, unclear control over updates and an unstructured backup plan. Registration under MiCA requires a precise, technically verified account of the IT environment, to a standard comparable with that of banking infrastructure.

Risk and data protection policies: how KNF judges internal procedures

Every applicant must build a complete risk management system and run it. The duty is concrete, and the dossier has to state:

• Threats identified.
• How risks are classified.
• Specialists in charge of security.
• Procedures for responding to force majeure.

In particular, the review looks for a risk map and an internal rulebook on assessing events. It also looks for response plans and for a set frequency at which assessments are reviewed. Without a documented approach to operational and technological threats alongside financial ones, a Poland crypto license application cannot succeed.

• A Risk Management Policy setting out risk categories (marketing, operational, IT, legal, compliance).
• A Business Continuity Plan (BCP) with scenarios for outages and incidents.
• An Incident Management Procedure setting out the response, including control points, notification order and recovery.
• A Data Security Policy: protecting client data, logging actions, controlling access and keeping backups.
• Internal Reporting and Escalation rules: who reports events above the acceptable risk level, when and how.

KNF requires these documents to fit the business's scale and architecture. A dossier describing large volumes of operations without an allocation of responsibilities or methods of control makes an applicant look potentially vulnerable. The regulator also checks whether each model applied is justified: a reference to ISO, NIST or European Banking Authority (EBA) guidelines carries weight only if the standard cited is actually implemented. What counts is concrete protection mechanisms built around the specific business rather than citations.

KNF quickly spots weak points: architecture disconnected from the policies, roles left vacant, procedures at odds with one another. Its review is substantive, focused on practical feasibility. A dossier that declares automatic failure alerts has to describe what triggers them. If it mentions internal control, named persons must perform that function. For KNF, risk documents underpin operational resilience, and any break in their logic is reason to return the application.

AML/CTF: compliance with Polish law and the link with MiCA

The application also has to include a complete program against illicit transactions, built on Poland's anti-money laundering act dated 1 March 2018 (Ustawa o przeciwdziałaniu praniu pieniędzy oraz finansowaniu terroryzmu), amended in 2021. This statute defines the national approach, and every policy must align with it. By the filing date, the supervisor expects an AML/CTF system already implemented and tested, and in operation.

• An AML/CTF policy that includes risk assessment, internal procedures and rules for decisions and record-keeping.
• KYC (customer identification) procedures graded by client risk (including the ultimate beneficial owner, jurisdiction, transaction type and expected volumes).
• A client classification methodology setting criteria for standard, high and unacceptable risk.
• In-house control rules naming who decides to block a transaction, update a client profile or request proof of where funds come from.
• A data storage model spanning retention periods and formats, access points and protection of activity logs.

Documents have to fit the company's profile. Serving only legal entities requires a model that shows this; where individuals are clients, KNF checks how remote identification works. Evidence of a policy alone falls short: the company also has to prove it can technically apply it.

Polish law prohibits unadapted template wording. KNF treats generic documents as unsuitable, especially when they ignore real operational scale, typical clients and internal structure. Copying bank or fintech documents without rethinking their logic is a frequent error, and the likely outcome is rejection because they contradict how the applicant actually operates. Before authorization, an applicant must demonstrate that its AML system complies with both MiCA and Poland's own act. A bare declaration proves nothing; the evidence lies in procedures and documents, backed by accountable persons.

Accountable persons: control functions and profile assessment

Each provider must appoint a specialist to oversee MiCA compliance, including transaction review, oversight of client-asset safekeeping and adherence to KYC/AML procedures. This person has to report regularly to the board and needs the qualifications to detect breaches and take decisions independently of other officers.

In Polish practice the function splits into two separate roles, a compliance officer and an AML/CTF specialist known as the money laundering reporting officer (MLRO), though small structures may combine them. For a crypto license in Poland, each appointment must be formalized through a board resolution, a contract or an in-house order. Without named control-function holders and evidence of their qualifications, KNF does not proceed with an application.

• At least 2 to 3 years in compliance, a legal department or AML work.
• An understanding of how crypto-assets work and of digital wallet operations.
• Past work on projects supervised by KNF or a similar authority.
• Polish residence or close ties with Poland (tax residence, a contract with a Polish company, physical presence).

KNF requires a CV describing experience and qualifications. Criminal record certificates must come from every jurisdiction where the candidate has worked professionally, and evidence of specialized training in MiCA, AML/CTF or financial regulation is also needed. Last, the applicant has to justify the specialist's resources: system access, independent decision-making and internal accountability.

KNF checks that the specialist's function is embedded in company structure. Where one officer doubles as director, IT specialist and controller, KNF sees a conflict of interest. Without system access or the necessary powers, such a set-up is considered unworkable. Documents must prove that control actually operates within the working model, not just on paper.

KNF also checks that this officer's role appears consistently elsewhere: risk management materials, the AML policy and dossier structure. Someone named in only one file, or missing from the operating chart, prompts KNF to ask for clarification. Errors in key staff profiles are likely to lead to a return even when every policy is complete. Before authorization, a company therefore has to appoint competent controllers with documented credentials, confirmed functions and genuine independence.

Application preparation and the KNF review

A dossier follows the logic EU licensing practice applies to CASPs and investment intermediaries, and its mandatory part rests on these components:

• Business model: including services offered, target clients, access channels and volumes.
• Legal form and structure: company details and KRS entry, owners and ownership chain, governing bodies.
• Infrastructure: IT architecture, access control and transaction processing, SaaS or white-label arrangements, backup solutions.
• Policies and procedures: in-house control, risk, AML/CTF and client classification.
• Key persons: CVs, criminal record certificates, qualifications and confirmation of every individual role.
• Business plan: financial model, projected flows, costs and resources.

The applicant submits these documents and aligns them with one another. KNF judges the set as a whole: does IT architecture support the services, do staff match declared procedures, are control functions built into the operating model? In KNF practice, weak logic between files is a frequent reason for a return at the assessment stage.

Filing through the KNF portal

Filing takes place on KNF's electronic platform, a secure channel carrying every document in the licensing procedure. The system accepts no drafts, staged submissions or preliminary comments, only a complete package with a valid structure.

• Complete the company's KRS registration.
• Appoint a representative with an electronic signature that the system accepts.
• Check every document for translation and signature, and for labels matching dossier structure.

The portal takes the whole application as one package. Each file carries a name and a reference to its section, a status (original, copy or translation) and a signature. The portal automatically rejects any file missing one of these details and accepts no blank fields, incomplete blocks or duplicates. Nothing can change after submission, even if the only error is in a file name. KNF gives no "draft" feedback, and a package that breaches the format comes back without explanation.

• The declared services, checked against MiCA's Article 3.
• The corporate structure and capital sources.
• Operating infrastructure.
• AML/CTF policies, in-house control and IT systems.

For a MiCA license Poland application, approval is impossible without precise filing, a consistent structure and well-thought-out links between all sections. KNF assesses how documents work together, not only what each says, and this internal logic determines both review speed and result.

How the KNF review works and what happens after a request

Review at KNF has two stages: a formal (technical) check, then a substantive one. The formal check covers structure: correct naming, signatures, file formats and cross-references between sections. In KNF practice this stage takes 3 to 10 working days. Where a package breaches these formal requirements, the portal rejects it automatically, before content is assessed. Outer limits come from MiCA's Article 63: KNF has 5 working days from filing to acknowledge receipt and 25 to judge whether the package is complete. Gaps in information lead the authority to fix a period for filling them, and review can be declined only if they persist after that period.

Once technical verification is passed, the substantive stage starts. KNF issues no interim notices during this phase. Where it finds gaps, it sends an official request to remedy deficiencies (wezwanie do usunięcia braków), which states:

• Case number.
• Sections needing further work.
• Type of documents required.
• Deadline for remedying the deficiencies.

Replies go as a separate file and must contain a cover letter, current versions of corrected documents and references to each specific point in the request. Formal comments without documents are not accepted.

Several rounds of corrections may precede authorization. Article 63(12) lets only KNF's first information request during assessment stop the clock, with a ceiling of 20 working days; later ones are discretionary and leave it running. The fully reasoned decision, positive or negative, must be issued by the 40th working day after KNF receives a complete application. If KNF considers a reply incomplete, it returns the application again, and unstructured materials or outdated versions count as a breach.

• A nominee ownership structure.
• Policies duplicated from other projects.
• Key persons lacking sufficient qualifications.
• Inconsistency between declared services and infrastructure.

In such cases it asks for further explanations or evidence, for instance proof of experience, contracts, interface screenshots or IT system diagrams.

Simplified filing and the transition for former virtual asset service providers

Poland applied the Article 143(3) transitional period on standard terms until it lapsed on 1 July 2026; KNF has made clear that neither a statute nor its own decision can extend it. Former virtual asset service providers (VASPs) are entered on Poland's virtual currency register, kept under the AML act by the Tax Administration Chamber in Katowice. Each now needs full MiCA authorization as a CASP: from KNF once the national act applies or, meanwhile, from another EU regulator, passported in via Article 65. From 1 July 2026 onward, a Katowice register entry gives no entitlement whatsoever to offer crypto-asset services. No simplified filing format exists. Even a company that supplied information to KNF earlier must compile a complete new MiCA-compliant package.

The only exception covers unchanged documents filed earlier: CVs, criminal record certificates and group structure. They may be reused only when accompanied by a direct reference to their KNF archive number and an explanation of why refiling is unnecessary. Even then, KNF may demand updates.

A former VASP seeking a Poland crypto license is assessed on criteria identical to those for a newcomer, whatever its pre-MiCA status nationally.

How KNF assesses applicants

Beyond the filing procedure, MiCA lays down principles for overseeing applicants. KNF follows its own method, combining European provisions with national instruments. As the country moves to the pan-European standard, the procedure for a MiCA license in Poland sees frequent updates.

The assessment tool

Internal verification starts once a dossier reaches the platform. KNF does not pass documents between departments: each application stays within its specialist crypto-asset unit. Submitted data automatically build a digital applicant profile for later monitoring. The system records:

• File structure and content.
• Log-in dates and authentication marks.
• Submission sequence and accuracy of completion.

From here on, declared services are compared with business scale and with what the documentation says.

What KNF probes in a business model

KNF's assessment runs on two tracks: conformity with MiCA and with how Polish practice applies it. It weighs both formal completeness and how coherent the business model is. Parameters reviewed are:

• Realism of projected operating volumes (particularly where custody or asset transfers are involved).
• Transparency of ownership.
• Substantiation of IT architecture.
• Justification of risks reflected in management policy.
• Specificity of the internal control mechanism and of key staff functions.

KNF reviews none of these elements in isolation. For example, declaring custody services without describing a safekeeping mechanism or backup access model is a breach. The same holds for AML/CTF: a dossier that declares identification mechanisms yet lacks KYC rules for high-risk clients comes back. Precision, sound logic and reliability are therefore critical in KNF's assessment.

The proportionality principle as KNF applies it

Once KNF's designation takes effect, a company it licenses will come under its continuous supervision. The regulator monitors compliance and checks whether processes match what the dossier describes. All communication runs through KNF's digital platform, the only channel available.

KNF applies the proportionality principle: the larger the business and the higher its risks, the tighter the control. Custody services, or transactions carried out for clients, automatically attract closer attention. Holding a license here means continuing compliance control, not just the initial review.

Post-authorization obligations

Once the national act applies, duties attached to a crypto license in Poland are to include:

• A yearly report on risk types and the internal control measures that manage them.
• Confirmation that key employees remain qualified and their functions current.
• Updates on beneficial owners whenever ownership changes.
• Notice to KNF of planned operating-model changes.
• Documents on request evidencing performance of its obligations.

The regulator tracks every key business parameter. KNF compares current data against the original dossier and treats any discrepancy as a risk requiring explanation. Where doubts arise, KNF carries out an extraordinary audit, temporarily restricts activities or withdraws the authorization.

Change control: how KNF tracks structure and management

Authorization imposes a duty of continuous disclosure. KNF expects advance notice of any change, not a report after the event. This applies to:

• Changes of directors.
• IT system updates.
• Office relocation.
• Reallocation of shares.

It also applies to any new contract with a provider of key services. Even a switch to a new custody model requires notice to KNF.

A notification not filed on time breaches license conditions. Unscheduled inspections are possible after authorization, most often for these reasons:

• Contradictions between the declared model and actual activity.
• Client complaints or incidents involving data leaks.
• Missed reporting deadlines or a refusal to provide documents.
• A technical failure that disrupted the platform or any service it runs.
• Replacing key persons without informing KNF.

KNF monitors whether procedures comply and also how far declared policies work in practice. Reporting cannot be a formality: documents must record specific actions taken to reduce threats, process transactions and serve clients.

Authorization automatically brings the company into a full supervisory system. Periodic remote and on-site inspections include log analysis, incident reviews, interviews with officers and IT infrastructure audits. Supervision weighs substance and data consistency above formal indicators, and KNF reads any inaccuracy or inconsistency as a risk factor.

A license is a standing compliance obligation, not a fixed status. At filing, an application faces only a documentary review; after authorization, the regulator judges facts rather than intentions. Any company preparing for authorization must therefore be able to confirm every element of its model regularly.

Legal support for a CASP license Poland application

MiCA applies directly, without national adaptation. Commission Delegated Regulation 2025/305 and Implementing Regulation 2025/306 spell out EU-wide what goes into CASP filings, and guidance issued by the EBA and by ESMA (European Securities and Markets Authority) supplements them. With no KNF interpretations to cite, each applicant reads and applies MiCA unaided. This matters most for Articles 62 to 67, which run from filing and assessment through to post-authorization duties. Before authorization, a company has to work out which rules apply, what they mean for its structure and how "control" should be read. Without official interpretative practice, borderline cases are harder to judge, and refusal can come even without a formal breach.

EU licensing practice for crypto projects shows that experience with digital assets is no substitute for knowledge of investment regulation. KNF holds a dossier to a standard close to that for investment intermediaries, with a focus on resilient, complete and reproducible processes. The work therefore needs a specialist fluent both in crypto markets and in what regulation demands from a licensed provider. During registration under MiCA, descriptions of officers' functions, IT architecture and escalation procedures have to follow regulatory logic rather than stay declarative. Drafting errors can be hard to spot, yet they lead to rejection.

KNF neither corresponds with applicants nor gives preliminary opinions. In its administrative supervision procedure, KNF reviews materials without oral or informal clarification. Even a returned application carries only a general reason (braki formalne lub merytoryczne, "formal or substantive deficiencies") and no legal characterization of the breach. Authorization therefore depends on a correctly structured dossier and on an applicant's ability to identify, unaided, the legal grounds behind each objection and remedy it in a resubmission. Since the supervisor offers no comments, the applicant's own legal groundwork on the dossier has to reach a high standard at the first attempt.

Some business models are hard to classify. For example, where a crypto company offers custody through a contractor or relies on white-label solutions, the question arises whether it needs CASP status with a custody authorization. MiCA offers no exhaustive list of licensable models, and KNF publishes no precedents. Such cases call for interpretation grounded in MiCA itself, EBA guidelines and licensing practice for comparable operators. When a full-cycle strategy for a Polish MiCA authorization is being developed, qualified legal advice helps classify the service correctly, avoid applying for more permissions than needed and lower the chance of rejection over an inaccurate description of operations.

The company's founding deed, its PKD codes and the dossier's business description must also agree. If registered activities differ from what the filing declares, rejection is automatic. After filing, the deed can be reworded only by amending the KRS entry, which takes several weeks. A crypto company's MiCA registration in Poland starts correctly only when corporate purpose, PKD codes (such as 66.19.Z, 62.10.B and 63.10.D) and application structure are consistent. Legal support helps rule out contradictions in advance and avoid formal returns. Any CASP license Poland grants under the future national act will rest on this same alignment.

Conclusion

When the national act designates it, KNF will supervise every authorized provider continuously. A company enters KNF's supervisory system on the day of authorization and must comply with every MiCA provision throughout the license's term.

The applicant is accountable for keeping corporate structure, IT architecture, control mechanisms and AML/CTF current. Any change in these areas requires disclosure in advance. Missed notification deadlines or gaps between the actual model and the dossier breach license conditions.

Supervision is proportionate: business scale, client risk classification and service range determine how deep and how often inspections go. Each year, reports on internal control and on the risk profile are mandatory. KNF may also order an unscheduled review, such as an IT infrastructure audit or a KYC analysis.

Once a company obtains a crypto license in Poland, its obligations remain in force, and KNF monitors compliance with them through its digital infrastructure, without feedback or paper-based exchange. In later monitoring, KNF bases its assessment on how complete, logical and reliable the information provided is.