DeFi regulation & security
DeFi regulation in Poland
Separate the Polish domestic procedure from an existing EU provider’s cross-border rights. The KNF notice updated on 4 September 2026 still points to an authority gap.
- Sources checked
- Published
- Prepared by
- DeFi Security Alliance
Scope: Polish market-access verification based on the currently published KNF position. No functioning new domestic CASP application route, fee or approval timetable is asserted.
Read the current KNF position with its limits
The KNF announcement updated on 4 September 2026 links its statement on the absence of a designated domestic authority for specified MiCA functions. Section I of the linked UKNF statement distinguishes the CASP, ART and other-token procedures from KNF's competence for EMT issuers.
This source does not establish an available Polish CASP application channel. A bill, a company registration or a name on a contact list is insufficient evidence that a domestic authorization procedure has opened. Confirm the enacted designation and current instructions before relying on a Polish filing route. The announcement's update date does not mean every paragraph of the linked statement was newly written that day.
Distinguish transition from cross-border permission
MiCA's Article 143 transition cannot provide an ongoing route after its final 1 July 2026 limit. UKNF's section III also rejects extension through a national law or KNF decision. An old entry in the virtual-currency activity register is therefore not evidence of a current MiCA passport.
Article 65 provides a separate procedure for an authorized CASP from another Member State. UKNF explains that cross-border provision into Poland remains possible under that procedure despite the domestic authority gap. Verify the actual licensed legal entity and the relevant home-authority notification. A group affiliate's license does not automatically cover a Polish customer contract.
For a DeFi interface, map execution, custody, transfer and administrative control before applying this analysis. Fully decentralized services without an intermediary have a distinct MiCA scope question. A product name or an offshore website does not answer it.
Verify the legal entity behind the service
This DeFiSec worksheet is a verification record for a prospective operator or counterparty. It is not a route to operate without a required permission.
| Check | Evidence to obtain | Mismatch to investigate |
|---|---|---|
| Contracting entity | Exact legal name and identifier in customer terms | A license belonging to a different group company |
| Home-state permission | Official entry and service scope | Exchange permission presented as authority for custody |
| Polish cross-border service | Home-authority notification record covering Poland | A marketing page used as the only passport evidence |
| Domestic application claim | Enacted designation and current filing instructions | A legislative proposal described as an open procedure |
| Operational responsibility | Supplier contracts and accountable service owners | The authorized entity cannot oversee the service it sells |
For a provider with an established permission, Pharos Production's guide to the DORA information register helps connect legal entities, contracts and ICT services. That work is useful for testing who supplies and controls the Polish-facing service. It cannot fill a missing authorization or passporting record.
Document the next decision point
Preserve the date and exact source used for each market-access decision. Recheck the KNF publication and the relevant home-state register before contracting or launching, because the domestic institutional position can change. Record unresolved service or entity mismatches rather than treating them as administrative details.
A token issuer requires a separate analysis from a CASP. The EMT distinction in the UKNF statement is one reason not to describe Poland as having no crypto supervision at all. The RWA classification guide also explains why a financial instrument follows a different legal route from an ordinary MiCA crypto-asset.
Continue your research
Sources and further reading
Legislation and regulator publications establish the legal basis. Technical resources explain implementation. Source checks cover the passages cited in this guide.
- MiCA — Regulation (EU) 2023/1114European Union ·
- DORA — Regulation (EU) 2022/2554European Union ·
- DORA Register of InformationPharos Production ·
- Statement on absence of a designated MiCA authorityUKNF ·
- Statement: domestic authority gap and cross-border MiCA servicesUKNF ·