diff --git a/infra/common/src/main/java/com/evolveum/midpoint/common/crypto/CryptoUtil.java b/infra/common/src/main/java/com/evolveum/midpoint/common/crypto/CryptoUtil.java
index 5ee9ab83c5a..7dde814276c 100644
--- a/infra/common/src/main/java/com/evolveum/midpoint/common/crypto/CryptoUtil.java
+++ b/infra/common/src/main/java/com/evolveum/midpoint/common/crypto/CryptoUtil.java
@@ -200,7 +200,7 @@ private static void checkEncrypted(PrismPropertyValue<?> pval) {
 		    @SuppressWarnings("unchecked")
 		    PrismPropertyValue<ProtectedStringType> psPval = (PrismPropertyValue<ProtectedStringType>)pval;
             ProtectedStringType ps = psPval.getValue();
-            if (ps.getClearValue() != null) {
+            if (ps != null && ps.getClearValue() != null) {
                 throw new IllegalStateException("Unencrypted value in field " + propName);
             }
         } else if (itemDef.getTypeName().equals(MailConfigurationType.COMPLEX_TYPE)) {