A Polish crypto business applying for authorisation elsewhere in the EU faces a question that incorporation documents cannot answer: how much of the business actually has to move?
The developers may be in Warsaw, the customer-support team in Kraków and the operations manager in Wrocław. These people know the product, the customers and the systems. Replacing them to establish a company in another jurisdiction would be expensive and disruptive. Moving them is not necessarily realistic either.
MiCA does not impose a general requirement to relocate every employee to the country issuing the licence. ESMA accepts that some staff will work elsewhere. Having employees abroad must not make it harder to run the business, keep services operating or give the supervisor access to the information it needs. It also expects enough people in the licensing country to support the business, with key roles predominantly based there.
For a Polish business, the difficult part is deciding which responsibilities can remain with the existing team and which need to sit with the company seeking authorisation. The answer depends on employment arrangements, the services being provided and the powers of the applicant’s management.
Keeping the Polish employment contracts
Consider a Polish business opening a company in Latvia to apply for MiCA authorisation. Its developers and operations employees will continue working from Poland. The employees could work for the Latvian company without leaving Poland or keep their contracts with the Polish business. This is an illustrative example, however, not an arrangement already approved in Latvia.
With the Latvian company as their employer, the team would still work in Poland but report through the new company’s management. The application would need to describe how that relationship works. ESMA accepts staff abroad where their location does not obstruct management, access to information or the continued provision of services.
Leaving the employment contracts with the Polish company creates a different arrangement. The Latvian applicant would receive services from a separate company, even though the founders own both. Where that company performs operational functions for the applicant, MiCA’s outsourcing requirements become relevant. ESMA expects supervisors to examine these relationships within groups as well as arrangements with unrelated providers.
The founders would also need to agree how the Polish team’s time is allocated. In our example, a technical problem in Latvia might require help from software developers already working on another project for the Polish company. The service arrangement should give the Latvian manager a way to obtain that help without seeking a new agreement from the founders each time.
Under Article 73, outsourcing does not transfer the crypto-asset service provider’s (CASP’s) responsibility to the provider. The Latvian company would therefore need enough expertise of its own to understand what the Polish team is doing and decide when changes are needed. Using another company in the same group does not change that position.
The founders might transfer certain employees and leave most contracts in Poland. Whichever approach they choose, the Latvian management needs to know which people it can call on and what authority it has over the work they perform.
What the company abroad must actually do
Article 59(2) of MiCA sets out the geographical requirements for a crypto-asset service provider authorised under Article 63. It must have its registered office in a Member State where it carries out at least part of its crypto-asset services. Its place of effective management must be in the EU, and at least one director must be EU-resident.
Article 59(2) does not require all employees to work in the licensing country. The location of management, however, needs to be considered alongside ESMA’s expectations for the company’s presence in its home jurisdiction, not just the article’s EU-residence requirement.
ESMA’s supervisory briefing expects authorities to examine the applicant’s presence in its home jurisdiction. It refers to sufficient in-country personnel, an executive management board member located there and evidence showing where decisions are made. It also says key roles should predominantly be based in that jurisdiction. The briefing includes a limited allowance concerning the executive management board member’s location for small Member States, subject to availability and location conditions.
The distinction between these sources matters. Article 59 sets the legal requirements. ESMA’s briefing does not change them but helps explain how supervisors will examine the proposed business. Meeting the location requirements in the regulation is therefore only part of preparing the application.
For the hypothetical Latvian applicant, the application would therefore need to explain what its Latvian management will do. A director’s appointment and an office lease would not, by themselves, answer questions about who runs the operation.
The Polish team can remain valuable to the business. The applicant still needs people who can take responsibility for its regulated activities.
Poland’s EU location helps, but only with part of the assessment
Keeping the team in Poland means the work stays inside the EU. Applying for a licence in Latvia does not change that.
ESMA gives closer attention to providers outside the EU because their location can make records harder to obtain and supervision more difficult. A Polish provider does not raise the same third-country questions. The Latvian applicant still needs to explain how it will oversee the work.
But the EU location of the Polish team does not establish sufficient substance in the applicant’s home country.
A Latvian company using Polish software developers may have a clear explanation for its staffing model. It would have more to explain if the founders, executive management and people controlling every important function also remained in Poland.
ESMA considers the roles performed abroad and the concentration of overseas personnel within particular functions. Its assessment goes beyond checking that everybody works within EU borders.
The distinction concerns responsibilities. Saying that the team remains in Poland explains where the work happens. The application also needs to show who directs it and what the management in Latvia can decide without referring matters back to Poland.
Which jobs are easier to keep in Poland?
There is no universal list of positions that may remain abroad. ESMA does, however, distinguish supporting work from roles central to management and control. Its examples include non-management IT and HR support.
The same distinction applies to operations. For example, the Polish team might answer customer enquiries while referring problems involving client assets to a manager in Latvia. The application should explain that division of responsibility: what the team handles itself, what it refers to management and who decides what happens next.
These examples do not guarantee that a role can remain abroad. ESMA calls for particular scrutiny of compliance, risk, ICT systems and security arrangements, alongside other highly important activities.
For the Latvian applicant, this means describing more than job titles. If employees in Poland approve important changes or direct the response to incidents, the application should explain those responsibilities rather than group them under “support”.
Compliance cannot be assessed as one undivided function
An experienced Polish compliance team may be one of the strongest reasons for retaining the existing workforce. Its employees know the customers and the platform. They may also understand why particular controls were introduced and where weaknesses have appeared.
That knowledge is useful. It does not remove the need to examine the proposed allocation of responsibilities.
ESMA expects responsibility for compliance and risk to remain with the CASP. Its briefing discusses the independence, competence, capacity and authority required for these functions and draws attention to restrictions affecting AML outsourcing.
The question is therefore not simply whether “compliance” can stay in Poland. The business needs to identify the work performed by the team and the decisions held by particular people.
For example, reviewing information and preparing an escalation are not necessarily the same responsibility as deciding the company’s response. Reporting to management also requires a clear allocation. The applicant needs to know who can raise a concern and who can require action.
Some activities may be performed by Polish-based personnel within an acceptable structure. Others may require a different arrangement because of their importance or the rules governing the particular role.
AML requirements need a separate assessment alongside MiCA. ESMA refers to the relevant EBA guidance and applicable AML obligations. Article 73 should not be treated as blanket permission to outsource every part of an AML function.
Common ownership can make dependencies harder to see
The Polish company will often be the obvious service provider. It already employs the people, knows the systems and may own the technology. There may be sound reasons to retain it.
ESMA does not prohibit that choice. It expects supervisors to examine the reasons for selecting a group provider, the due diligence undertaken and the effect on the applicant’s autonomy.
Suppose the applicant asks for a change to a monitoring system. The Polish company controls the budget and believes another project should come first. The applicant’s manager cannot authorise the expenditure or assign the developers. Until then, the arrangement may have worked without difficulty. But getting the change made now depends on persuading the Polish company to give it priority.
Under Article 73, the Latvian company must have sufficient expertise and resources to assess the Polish company’s work, supervise the service and manage the risks. It cannot rely solely on the Polish company’s own oversight. The Polish company may supply the developers, but the Latvian company remains responsible for meeting its own obligations.
The service agreement should deal with the disagreement in this example. Can the Latvian manager require the change under the agreed terms, or does it need separate approval? Who must respond if the Polish company cannot provide the developers? Leaving those questions unanswered makes the applicant dependent on an informal negotiation when it needs work done.
A local director must be able to make decisions
A director’s appointment in Latvia tells the supervisor little about how the company will be managed if the founders in Poland continue to make its operational decisions. The application needs to show what authority the director has in practice, including access to staff and control over spending within their remit.
ESMA gives a practical indication of the autonomy it expects. Applicant representatives should be able to meet the supervisor without a group representative and without taking the discussion back to the group for clearance.
That does not prevent shareholder involvement or group coordination. It requires the authorised company to have management capable of acting for its own regulated activities.
For founders accustomed to approving everything themselves, this can require more change than expected. They may retain ownership while giving the applicant’s executives genuine responsibility for its operations.
The relevant authority needs to be reflected in budgets, reporting lines and approval arrangements. A job description cannot compensate for an organisation that prevents its management from acting.
Access to records must not depend on goodwill
The Polish company may hold records that the Latvian applicant needs to supervise the service. Common ownership does not remove the need to agree how those records will be made available.
The written agreement required by Article 73 must cover the parties’ rights and obligations, including termination rights. The article also addresses access to information and the provider’s cooperation with the authorities. The arrangement must not prevent effective supervision.
The applicant would therefore need to know what information it can obtain from the Polish provider. A performance report may help it review the service over a month. For an investigation, the Latvian manager might need to go back through the Polish team’s records rather than rely on its summary.
Who supplies them when the employee responsible is away? The cover arrangements should confirm that someone can retrieve the records and respond to the request. The person covering the absence should already have permission to retrieve and release the records. The Latvian manager could then obtain them through the agreed process, without waiting for further approval.
The applicant still needs knowledgeable employees
Keeping the technical team in Poland does not settle who will assess its work for the Latvian company.
Article 73 requires the applicant to retain sufficient expertise and resources. ESMA also expects the person directly employed by the CASP who is responsible for an outsourced activity to know enough to monitor and control it.
Suppose the Polish developers report that they have fixed a recurring fault. Who checks that explanation for the Latvian company? The employee responsible needs enough technical knowledge to question what was done and decide whether anything remains unresolved. They need not match every developer’s specialist skills.
ESMA also considers whether that employee has time for the work. Someone qualified to oversee the development service may not be equipped to supervise several other outsourced functions alongside it.
The founders may therefore retain the Polish developers and still need to recruit for the applicant. In our example, the missing role could be someone able to examine the developers’ account of the fault and decide whether further work is needed. That responsibility would remain with the applicant even though the developers stayed with the Polish company.
An exit plan needs to be operationally credible
Article 73 includes contingency plans and exit strategies among the matters covered by the outsourcing policy. The policy is to take account of the scale, nature and range of the applicant’s services.
For the Latvian company, much will depend on what remains with the Polish company. If the Polish company owns the software and employs the developers, appointing a replacement provider would leave several questions unresolved. Could it access the applicant’s records? What knowledge would have to be transferred? Which activities could continue while another arrangement was established?
The companies can address some of these questions when negotiating the service. They might agree on a period of assistance from the Polish developers, for example, or on the documentation to be supplied to a replacement. Any limits on using the Polish company’s software would also need consideration.
The plan should distinguish steps the applicant could take itself from those requiring the Polish company’s help. A transfer involving software rights and technical knowledge may take longer than replacing a routine support service.
The applicant should be able to explain how it would move from the existing arrangement to an alternative, including any steps that still depend on the Polish company’s cooperation.
What the application needs to make clear
The application should show the regulator how the arrangement will work in practice. For each significant function carried out in Poland, it should say who employs the team, where its members work and who they report to. It should also explain which decisions the team can make itself. The person overseeing the function within the applicant should be named, along with the information they will receive from Poland.
Important subcontractors and the arrangements for disruption or exit belong in the same explanation. These points bring together the governance and outsourcing concerns discussed in ESMA’s briefing and Article 73. They do not replace the chosen authority’s application requirements.
Preparing that account may reveal problems before filing. A proposed manager may lack budget authority. An important outsourced service may have no competent internal owner. The Polish company may perform activities that need a separate authorisation assessment.
Those findings require changes to the organisation. More detailed policy wording will not resolve them on its own.
What can remain in Poland?
For the business in our example, the answer may differ between teams and between individuals within a team. Some employees could work directly for the applicant from Poland. Others could remain with the Polish company, providing services under an outsourcing agreement. The applicant would still need to meet the expectations concerning personnel and management in the jurisdiction where they are applying for authorisation.
The new company can draw on the existing team’s knowledge rather than build it again from scratch. But the founders still need to decide who will manage the team and answer for its decisions. The staffing proposal must go beyond saying where people will work: their managers need to be able to assign tasks and get the information they need to oversee the work.
This article addresses the organisational questions under MiCA. ICT service arrangements also require consideration of applicable requirements under the Digital Operational Resilience Act (DORA), which are not covered here. It does not determine the employment, payroll, social-security, tax or corporate consequences of the arrangement, or establish Poland’s current domestic implementation position.
Some employees may stay where they are while reporting to different managers. The founders should explain those changes in the application, including which decisions they will hand over to the new company’s executives.
