Polish VASP Wind-Down After the MiCA Deadline: The Three Paths That Remain

Where Things Stand in May 2026

The Polish situation is paradoxical. The Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) has been in full application since 30 December 2024. The transitional period under Article 143(3) MiCA – which allows pre-existing service providers to continue operating under national law – expires on 1 July 2026. Yet Poland has not enacted the national implementing act required to designate a competent authority and process CASP applications.

The reasons are political rather than technical. The Act on the Crypto-Asset Market has been vetoed by the President of Poland twice (1 December 2025 and 12 February 2026). Three competing draft acts are currently in the legislative pipeline – submitted by the government, the Poland 2050 party, and the Konfederacja party. None has cleared the legislative process.

The UKNF (Office of the Polish Financial Supervision Authority) has issued a position confirming the practical consequences. In the absence of the national implementing act, no Polish public authority is designated as the competent authority for:

• offerors of crypto-assets other than ART or EMT, or persons seeking admission of such crypto-assets to trading;
• issuers of asset-referenced tokens (ART);
• crypto-asset service providers (CASPs).

KNF remains the competent authority for issuers of e-money tokens (EMT) under Article 3(35)(b) MiCA, because EMT issuance falls within KNF’s sectoral competence under existing financial-markets legislation. Outside that narrow exception, no Polish CASP application can be filed, accepted, or processed today.

Most importantly, UKNF has stated unequivocally that the 1 July 2026 deadline “cannot be extended by national law or by a KNF decision.” This closes the door on a frequent client question – whether the Polish authorities will buy time through emergency legislation or administrative practice. They cannot, and UKNF has said so.

The Polish Ministry of Finance has publicly announced that entities listed in the VASP register will be delisted after 1 July 2026 if they have not obtained CASP authorisation by that date. Roughly 1,841 entities are currently in the register maintained by the Director of the Tax Administration Chamber in Katowice. Realistically, only a small fraction will hold a CASP authorisation – in any EU jurisdiction – by then.

For foreign owners of Polish VASP entities, this is not a Polish curiosity. It is a deadline that requires action this month.

Three Exit Paths – Decision Tree

Before the three paths, one point that reorders everything below. Ceasing crypto-asset services is not one of the options. It is the precondition to all of them. Any entity in the Polish VASP register without a CASP authorisation should already have stopped – onboarding, marketing, and the provision of services beyond what an orderly close-out requires. Nothing in the paths below permits continued service provision while a decision is pending.

What remains genuinely open is what happens next to the company, the client book, and the infrastructure:

• Path A – Obtain CASP authorisation in another EU jurisdiction and passport services back to Poland.
• Path B – Sell the business or its assets (share deal or asset deal) to a licensed entity.
• Path C – Terminate customer agreements, transfer customer assets, wind down operations, and start the liquidation of the company.

These are not mutually exclusive in sequence. In practice most entities that pursue Path A or Path B also end up executing Path C on the Polish company – the question is whether it liquidates as an empty shell or as a business that lost its customers in transit.

Path A: CASP Authorisation in Another EU Jurisdiction + Passporting

The realistic jurisdictions remain i.e. Czechia, Slovakia, Lithuania, and Cyprus – Member States that implemented MiCA through national legislation and are processing applications. The Czech National Bank has been the competent authority for CASPs since 15 February 2025 and issued its first six authorisations in February 2026.

Realistic timelines from a complete application to authorisation are four to six months in Czechia, Slovakia and Lithuania for a clean file, and six to nine months in Cyprus, with the upper end extending past twelve months where the business model is complex or the dossier attracts repeated regulatory questions. The statutory clock under Article 63 MiCA – 25 working days for completeness, then 40 working days for assessment – describes the regulator’s obligations, not the elapsed time of a real application.

The critical point is unchanged and now more consequential: CASP authorisation in another Member State requires establishing the management seat in that jurisdiction, appointing a local compliance officer, producing local AML/CFT documentation, and – in practice – operating physically in the authorising jurisdiction. Passporting under Article 65 MiCA then permits service to Polish clients, but the operational base must move.

Article 143(3) MiCA offers nothing to an applicant mid-process. The provision permitted continued operation until 1 July 2026 or until an authorisation was granted or refused, whichever came first. A pending application filed before the deadline did not extend the right to operate, and an application filed after it confers no interim rights at all.

A critical point often missed: CASP authorisation in another Member State typically requires establishing the management seat in that jurisdiction, appointing a local compliance officer, producing local AML/CFT documentation, and – in practice – operating physically in the authorising jurisdiction. Passporting under Article 65 MiCA then permits service to Polish clients, but the operational base must move.

For many Polish VASPs, Path A means building a new business in a new jurisdiction, not relocating the existing one. The Polish entity remains for wind-down or quiet runoff – which returns the structure to Path C.

UKNF has confirmed the symmetric point: CASPs authorised in other Member States can passport services into Poland under Article 65 MiCA even before Poland designates its competent authority, provided they notified their home-state competent authority. This is the legal basis for foreign CASPs entering the Polish market – and, by extension, the basis on which they may consider acquiring Polish VASPs (see Path B below).

For the full Polish authorisation pathway once the national act takes effect, see my guide on the CASP / MiCA Licence in Poland.

Path B: Sale of Business or Assets

Two basic transactional structures:

Share deal – sale of the shares in the company holding the VASP entry. The buyer acquires the entire business, including the register entry. The complication: after 1 July 2026 the register entry loses economic value because the register itself will be delisted. The buyer must therefore have its own path to CASP authorisation. If the buyer is already a CASP in another jurisdiction, the deal can make sense as an acquisition of the customer base, infrastructure, and Polish market presence. Where the buyer is a MiCA-licensed entity, Article 41 MiCA notification of qualifying acquirers applies.

Asset deal – sale of selected assets: customer base (subject to GDPR notification and contractual transfer mechanics), technical infrastructure, compliance documentation, trademarks. Customers are not transferred automatically – each customer contract requires either a properly executed assignment or individual consent to a novation. In practice, thirty to forty percent of customers will not respond to a transfer notice, and that portion of the book is lost in transit.

Market dynamics have shifted decisively against the seller. Before the deadline, a buyer was acquiring a register entry with residual optionality. After it, the entry is worth nothing – it confers no authorisation, and the Tax Administration Chamber says so in terms. What retains value is narrower: the customer base, the technical infrastructure, the compliance documentation, the brand, and any banking or payment relationships that survive a change of control.

This means the buyer profile has narrowed to entities that already hold CASP authorisation elsewhere and want Polish market presence without building it organically. A buyer without its own authorisation path is acquiring a liability. Where the buyer is a MiCA-licensed entity, Article 41 MiCA notification of qualifying acquirers applies.

It also means the seller is negotiating against a clock of a different kind. A client book decays: customers who have been told to withdraw their assets do withdraw them, and every week of delay reduces what is left to sell. Earn-out structures tied to customer retention are now the norm rather than the exception.

For foreign CASPs, Polish VASPs are becoming attractive market-entry vehicles – particularly for licensed entities in Lithuania, Cyprus, or Czechia seeking to acquire a Polish customer book without building it organically. This is a window that exists only between now and Q3 2026; once the Polish market stabilises under proper licensing, valuations will normalise.

Path C: Termination of Contracts, Asset Transfer, Liquidation

The most commonly chosen path – and the most legally complex. The sequence has six steps.

Step 1 – Board resolution to cease operations. A formal, documented decision with a date and reasons stated. It forms the legal basis for all subsequent client communications and operational actions. If services have not yet ceased, the cessation date is today, not a date to be scheduled – and the resolution should record when services in fact stopped, since that date will be the reference point for every subsequent question from a regulator, a liquidator, or a claimant. Where services stopped in late June, the resolution should reflect that date rather than the date it is signed.

Step 2 – Termination of customer master agreements. Notice periods under the contract – usually thirty days – must be respected, with additional consumer-protection notice rules where the customer is a consumer. The communication must state unambiguously the cessation date, the deadline for asset withdrawal, the withdrawal procedure, and the consequences of customer inaction. A bulk e-mail is not sufficient – effective delivery typically requires the contractual communication channel (customer panel plus e-mail plus, where contractually agreed, SMS).

Step 3 – Transfer of customer assets. Crypto-assets: transfer to a customer-designated on-chain address or to a customer-designated CASP. Fiat: return to the customer’s bank account. Every transfer requires current KYC (refreshed if older than twelve months) and – for crypto-asset transfers above EUR 1,000 – full Travel Rule compliance (Regulation (EU) 2023/1113).

Step 4 – Edge cases. Customer non-response, customer on sanctions lists, customer disputing balances, customer in personal bankruptcy. Each requires an individualised legal solution – court deposit, balance lock with notification to the Polish Financial Intelligence Unit (GIIF), restitution procedures after corporate dissolution. These are the situations that generate court cases lasting two to three years after the company has otherwise closed.

Step 5 – Post-cessation AML/CFT obligations. The most common misconception is that AML obligations end on cessation date. They do not. Article 49 of the Polish AML Act of 1 March 2018 requires retention of KYC and transaction records for five years from the end of the customer relationship. Suspicious transaction reporting obligations on activity discovered after the cessation date remain. The corporate liquidator assumes these duties.

Step 6 – Corporate liquidation. Polish company-law procedure under the Code of Commercial Companies (Articles 270–290 for limited liability companies, Articles 459–478 for joint-stock companies) – opening of liquidation, appointment of liquidators, KRS registration, public notice in the Court and Economic Monitor, balance sheet of opening, conduct of liquidation, final report, asset distribution, removal from the KRS. Realistic duration from opening resolution to deregistration: six to nine months. Operational service cessation occurs much earlier – typically in the first four to six weeks.

Board Liability After 1 July 2026

Providing crypto-asset services in the EU without CASP authorisation breaches Article 59 MiCA. This is no longer a prospective risk – for any entity still operating, the breach is continuing and dated from 1 July 2026. Once the Polish implementing act is enacted, current drafts envisage fines up to PLN 5,000,000 and imprisonment, or both. Even before the Polish act takes effect, such conduct may be qualified under Article 153(1) of the Polish AML Act. ESMA has stated that it and the national competent authorities may take coordinated action against unauthorised providers, which removes the practical assumption that the Polish supervisory gap means no one is watching.

More operationally significant from a director’s standpoint – corporate liability does not shield directors personally. Article 299 of the Polish Code of Commercial Companies (for limited liability companies) and Article 21 of the Polish Bankruptcy Law extend liability to directors personally where the board fails to file a bankruptcy petition within thirty days of insolvency. A company that continues to provide services without legal basis, loses customers and revenue, and slides into insolvency exposes its directors directly.

D&O insurance does not cover gross negligence or knowing breach of law. Continuing to provide services subject to an authorisation requirement without that authorisation – particularly with a publicly known deadline – typically qualifies as at minimum gross negligence. Coverage gap follows automatically.

Common Mistakes I See in Wind-Down Planning

Mistake 1 – “We’ll wait for the Polish act.” The act has been vetoed three times, the last on 11 June 2026, and no plenary vote followed the Public Finance Committee’s recommendation of 30 June. There is no national implementing act, no Polish competent authority for CASPs, and no date by which either will exist. Waiting is not a strategy – it is unauthorised operation with a narrative attached. Even if the act took effect tomorrow, a CASP application meeting Article 62 MiCA requirements takes four to eight months to prepare, and nothing in it would retroactively authorise services provided in the interim.

Mistake 2 – The “quasi-agent” model under a licensed CASP. Some advisers propose continuing service provision after 30 June as an “agent” of a foreign-licensed CASP. The construct is not legally tested and is prone to audit by the regulator. MiCA – unlike PSD2, which provides for payment service agents under Article 19 – does not contemplate the agent of a crypto-asset service provider. Every entity providing services to clients needs its own CASP authorisation under Article 59 MiCA or operates under an Article 65 passport as a CASP authorised in another jurisdiction. White-label and tied-agent constructs from the payments market have no MiCA equivalent. Article 73 MiCA outsourcing is a different construct – it concerns the delegation of CASP internal functions (compliance, custody operations) to a third party, not service provision to clients under a third party’s brand. Conflating the two may lead to unauthorised service provision.

Mistake 3 – Assuming AML/CFT obligations end on cessation date. They do not. Five-year retention of KYC and transaction records under Article 49 of the Polish AML Act, post-cessation suspicious transaction reporting, GIIF reporting obligations – all of these transfer to the liquidator.

Mistake 4 – Failure to close marketing channels on the cessation date. A website still advertising crypto-asset services, social media profiles inviting users to the platform, active performance campaigns – each of these constitutes an inducement to a service that has no legal basis after 1 July. This is a separate violation, independent of whether actual services are still being rendered.

Mistake 5 – Customer communications drafted at the last minute. Notices sent in the final week, ambiguous deadlines, missing complaints procedures, abusive clauses (which the Polish consumer-protection regulator UOKiK maintains in a public register), inadequate GDPR notification on data transfer to a new provider. Each of these can become the subject of a complaint to UOKiK or the Polish data protection authority – extending the company’s exposure for years beyond operational closure.