Our experts Paulina Jeziorska and Zuzanna Prandecka-Walek have analysed this topic in Dziennik Gazeta Prawna. In the article, they discuss step by step what the amendment means in practice for local authorities – from determining who is subject to the new regulations, through the catalogue of obligations, to the sanctions regime.

A few points worth noting:

A new classification of entities. The previous model, which distinguished between operators of key services and digital service providers, is being replaced by a classification into key entities and important entities. In the case of local authorities, the decisive factor is not the scale of their operations, but the type of authority and its position within the structure. Key entities include, amongst others, district authorities and local councils employing at least 50 people. Important entities, in turn, include local government budgetary units, budgetary institutions, cultural institutions and municipal companies – provided they carry out public tasks using information systems.

The obligations go far beyond mere formalities. Implementing an information security management system, handling and reporting incidents, ensuring business continuity, and streamlining relations with suppliers – this is not a one-off project, but a permanent change in the way the organisation operates. For important entities that are public bodies, the legislator has also provided a specific list of minimum requirements in an annex to the Act.

The penalties are substantial. Fines can reach up to €10 million for critical entities and €7 million for important entities. The head of the entity is held personally liable – up to 100% of their salary in the case of public entities. The regulations grant the authority some flexibility in determining the penalty, taking into account, among other things, the entity’s financial capacity, but the lower thresholds are set by law.

A key point of interpretation: is a key entity that does not use information systems to carry out public tasks completely exempt from these obligations? The wording of the regulations does not provide a clear answer, which in practice may create uncertainty for local authorities.

For many local authorities, the coming months will test their ability to rapidly build up the expertise and structures that they simply have not needed until now. Putting this off is no longer an option.

The full article by Paulina Jeziorska and Zuzanna Prandecka-Walek is available in Dziennik Gazeta Prawna:

The post Cybersecurity in local government – from a technical issue to a board agenda item first appeared on Kancelaria LBKP.

NIS2 incidents will soon become the responsibility of the entire organization, not just the IT department. In this webinar, we demonstrate how to recognize incidents in practice, when the obligation to report them arises, and how to prepare procedures compliant with NIS2 and the new UKSC.

During the meeting, we discuss:

• when the obligation to report an incident actually arises,
• how the NIS2 and RTS incident classification works,
• where the line between an incident and a “regular” technical event is drawn,
• the most common mistakes organizations make and how to avoid them.

The webinar is based on specific examples and short case studies.

Presented by: Paulina Jeziorska, legal counsel, and Zuzanna Prandecka-Walek, legal counsel.

If your organization is preparing to implement NIS2, this webinar will help you organize the key responsibilities and risks associated with incident management.

The post NIS2 and the new UKSC getting closer – Incidents in the light of NIS2 first appeared on Kancelaria LBKP.

Do you provide cloud or ICT services, or are you involved in information security? Then this material is for you.

The video is based on a webinar held on 16 October 2025, during which Paulina Jeziorska and Zuzanna Prandecka-Walek discussed the most important obligations of companies in the IT and new technologies sector resulting from the NIS 2 Directive.

In this material, you will find:

how to check if your company is subject to NIS 2,

how to choose the right risk management measures,

how to classify serious incidents,

how to fulfil your reporting obligations.

No theory – just practice, examples and specific tips for IT, compliance and security teams.

The post NIS 2 and the IT sector. What does a technology company need to know? first appeared on Kancelaria LBKP.

The illusion of full regulation

MiCA, in Article 2 and the recitals of the preamble, provides for significant exclusions. MiCA does not apply to, among other things:

• deposits, including structured deposits,
• cash (unless they meet the definition of e-money tokens),
• NFT tokens, provided they are ‘unique and non-fungible’;

However, it will be crucial to pay attention to recital 22 of MiCA. In this recital, the legislator stated that ‘where crypto-asset services are provided in a fully decentralised manner, without intermediaries, they should not be covered by this Regulation.’

Therefore, MiCA effectively covers only centralised or hybrid models. Services where there is no operator, provider or controller are not covered by the new rules.

Lack of DeFi regulation: the premise of ‘fully decentralised’

In practice, not all DeFi business models will meet the criterion of full decentralisation.

Recital 22 of MiCA indicates that the regulation does not cover services provided in a ‘fully decentralised manner, without intermediaries’. Although the term ‘intermediary’ is not defined, it can be assumed that it refers to a legal entity that is actively involved in the operation, provision or control of services related to crypto-assets, whether directly or indirectly.

As a result, the assessment of ‘full decentralisation’ may require determining in each case whether any entity influences the functioning of the protocol or interface. Unfortunately, the EU legislator has not provided more detailed criteria or proposed a definition that would make it easier for supervisory authorities and market participants to clearly classify entities, which is likely to cause interpretation complications in the near future.

In practice, therefore, it will be the national supervisory authority – in Poland, the Financial Supervision Authority – that will decide whether a particular DeFi is subject to MiCa and whether it requires a CASP authorisation. For the time being, there are no detailed guidelines to assist in making such a decision, but it is likely that EU authorities will provide guidance on what elements should be taken into account in order to assess whether certain services are provided in a fully decentralised manner without intermediaries or not.

Partial decentralisation remains subject to MiCA

The ‘comfort’ of no regulation is not provided by partial decentralisation. Recital 22 itself stipulates that if ‘part of such activities or services are carried out in a decentralised manner’, MiCA obligations remain in force. Such a modern hybrid could be a DEX with an upgrade key, i.e. a smart contract that can be changed or suspended by the project management. In practice, such a protocol is not fully decentralised, as there is an entity that retains the ability to interfere with its functioning.

In such configurations, it may be possible to identify the controlling entity (even partially), and therefore the competent national authority may consider that such an entity can only operate after obtaining a CASP licence.

Issuance of crypto-assets ‘without an issuer’

The second exception provided for in recital 22 does not concern services but the issuance of crypto-assets. If a crypto asset ‘has no identifiable issuer’, the provisions of Titles II to IV of MiCA (concerning, inter alia, the information document, obligations towards token holders, issuance, offering and admission to trading of crypto assets) do not apply.

This exception may apply to issues made directly by an on-chain protocol launched without a central entity, e.g. through a fair launch or automatic minting mechanism, without the involvement of any managing person.

It is worth noting that MiCA does not specify what specific characteristics should determine whether a particular entity can be considered an issuer. Nevertheless, the degree of control over the issuance process and the possibility of linking specific persons or structures to the management of the issuance or the economic benefits derived from it may be of key importance.

Practical consequences for the market

• The national authority (in Poland – the Polish Financial Supervision Authority) will have to determine whether there is an ‘intermediary’ in a given project model and whether the issuer can be identified. Under the draft Polish law on the cryptoasset market (June 2025), the KNF will gain instruments to restrict access to or block the interface to such a website.
• Entrepreneurs should assess the level of centralisation of their products today. Projects that use multisig to upgrade a contract, charge transaction fees or control issuance revenues, or set rules for service/token management may qualify as CASPs.
• Investors should be aware that the absence of an issuer or CASP also means that there is no European regulatory protection under MiCA.

Conclusions

MiCA is only the first step towards a harmonised crypto-asset market. By drawing a line in recital 22, the European legislator has recognised that DeFi requires a separate – perhaps entirely new – regulatory approach. Until such a framework is developed:

• full decentralisation remains the only way for a service to fall completely outside MiCA;
• any element of centralisation may entail licensing obligations;
• the national authority will have to assess whether it is dealing with DeFi or not.

The post MiCA does not cover DeFi. What does this mean for the crypto asset market in the EU? first appeared on Kancelaria LBKP.

You can read more about this here: https://lbkp.pl/rozpoczecie-stosowania-mica-co-oznacza-dla-rynku-krypto-w-polsce/

MiCA transition period at EU level – 18-month safety buffer

The basic premise of the MiCA Regulation is to introduce a certain ‘time buffer’ during which existing crypto-asset service providers will be able to operate under the old rules laid down in national legislation. According to Article 143(3) of the MiCA Regulation, this period is 18 months from the date of application of the new rules, until 1 July 2026.

During this time, companies providing crypto-asset services may continue to operate in accordance with existing local regulations until they obtain the formal authorisation required by MiCA in accordance with Article 63 or until such authorisation is refused, whichever comes first. This is a particularly important stage for all entities, both those already present on the market and new players planning to enter the cryptocurrency market in the European Union.

Flexibility in setting transition periods at national level

MiCA provides flexibility for Member States in determining the length of the transition period. Recital 114 of the Regulation emphasises that if national regulations in force before 30 December 2024 were significantly less stringent than the MiCA requirements, Member States may decide to shorten or even omit the transitional period. This allows them to raise the standards of crypto-asset entities more quickly to the level set by the EU.

Article 143(3) MiCA – specific conditions for the use of the transitional period in the EU

Pursuant to Article 143(3) of MiCA, crypto-asset service providers who provided their services in accordance with applicable national law before 30 December 2024 may continue to operate under the existing rules until 1 July 2026, until they obtain authorisation under Article 63 of MiCA or until authorisation is refused. Only these companies will be eligible for transitional arrangements – companies that commence operations after that date will be subject to the full MiCA regime from the outset.

Provisions concerning entities not covered by the register of virtual currency activities in Poland

Poland is participating in the process of implementing the MiCA Regulation and in June 2025 submitted a draft law on the crypto-asset market to the Sejm.

Pursuant to Article 162 of the draft law, an entity which, on 29 December 2024, provided crypto-asset services within the meaning of Article 3(1)(16) of MiCA (for more information on the scope of services, see https://lbkp.pl/rozpoczecie-stosowania-mica-co-oznacza-dla-rynku-krypto-w-polsce/), but which do not constitute economic activities consisting in the provision of services in the field of:

a) exchange between virtual currencies and means of payment,

b) exchange between virtual currencies,

c) intermediation in the exchange referred to in point (a) or (b),

d) keeping accounts referred to in Article 2(17)(E) of the AML Act

– may provide these services in relation to crypto assets under the existing rules, but for no longer than:

• 4 months from the entry into force of the draft Act,
• or for 9 months from the date of entry into force of the draft act, if, within 3 months of the date of entry into force of this act, it submits a complete application for the issuance of this authorisation and receives the notification referred to in Article 63(4) of the MiCA Regulation.

Regulations for companies entered in the VASP register (i.e. the register of virtual currency activities) in Poland

For companies that were entered in the national VASP register on the date of entry into force of the draft act, similar rules apply – they may continue to operate under the existing rules for 4 months from the date of entry into force of the draft law, or for 9 months from the date of entry into force of the draft law if they submit a complete application within the prescribed time limit and receive notification of acceptance of the application.

An exception is if such an entity is removed from the register before the expiry of the specified time limits.

Practical consequences for the market – what do companies need to do?

The regulatory changes resulting from MiCA and the Polish Cryptoasset Market Act impose an obligation on companies to closely monitor the current legal situation and develop an implementation strategy. The key actions that companies operating on the market should take include, in particular:

• verifying their current legal status (whether the company is registered as a VASP, whether it has been operating in accordance with the existing regulations),
• preparing a complete set of documentation necessary to apply for a CASP licence,
• monitoring transition deadlines and responding quickly to any changes in legislation,
• implementing new internal procedures in accordance with MiCA and national requirements and guidelines from supervisory authorities.
• Failure to meet deadlines or lack of adequate preparation may result in the loss of the ability to operate on the crypto asset market in Poland and throughout the EU.

Documentation and formal obligations – challenges for companies

Preparing for the full implementation of MiCA will require companies to conduct an in-depth analysis and carry out numerous formal and legal activities. The CASP registration process is multi-stage and includes:

• developing AML/KYC policies and measures to prevent money laundering and terrorist financing,
• preparing compliance documentation and risk management rules,
• implementing comprehensive IT security and personal data protection procedures,
• providing detailed descriptions of services, products, technological architecture and mechanisms for securing customer funds,
• presenting risk analyses and business continuity plans.
• You can read more about this here: https://lbkp.pl/uzyskanie-zezwolenia-casp-kluczowe-informacje-dla-firm-kryptowalutowych/

Why start preparing for MiCA now?

Currently, despite the fact that the act implementing MiCA in Poland has not yet entered into force, it is worth starting to prepare documentation and analyse your own activities in terms of the new regulations in advance. Companies with a complete set of ready-made documents will be able to go through the CASP registration process faster and obtain the required permits. This allows for smooth continuation of operations and gaining a competitive advantage in the market.

Importantly, current legislative analyses do not indicate any risk of significant changes to the key provisions of the draft law, which is why preparatory measures are already fully justified at this stage.

No possibility to submit an application before the law enters into force

It is not yet possible to submit an application for CASP registration to the relevant authority, as the law enabling this process has not yet entered into force. However, our clients are providing services in accordance with the existing regulations, while preparing with us the documentation necessary to apply for a CASP licence.

The work on the bill so far does not indicate that the draft will undergo major changes. We recommend that you start preparing all the required documents now. Due to the broad scope of the guidelines already set by the EU authorities, completing all the documentation and introducing the necessary procedures may be time-consuming and require careful planning. Starting these preparations in advance will allow you to go through the registration process smoothly and adapt your business to the new requirements.

Gain an edge with professional MiCA support

The implementation of the MiCA Regulation and the new Crypto Asset Market Act in Poland requires a multi-stage, well-planned process covering legal, technical and management issues. Proper preparation and understanding of the transition periods are key to the smooth functioning of the crypto asset services market, both for existing and new entities.

Our law firm offers comprehensive support in the implementation of MiCA requirements – from completing documentation and training staff to ongoing compliance support and legal advice. We encourage companies that want to efficiently and effectively adapt to the new regulations to contact us – from consultation, through the preparation of policies and procedures, to the finalisation of the CASP registration process.

Don’t wait until the last minute – a delayed response to legislative changes may mean losing your competitive position and growth opportunities. Contact us!

The post MiCA in Poland – a compendium of knowledge about transition periods and deadlines in the draft law on the crypto-asset market first appeared on Kancelaria LBKP.