Why Choose Cyprus for Crypto Licensing?
Cyprus combines MiCA passporting with an English-language regulator, an established MiFID II investment-firm sector, and a 15% headline corporate tax supported by an effective rate of about 3% on qualifying IP-Box income. CySEC’s MiCA framework provides a route for operators that can clear the substance and governance requirements.
MiCA Passporting from a MiFID-Fluent Supervisor
A Cyprus CASP authorisation passports to all 27 EU Member States plus Iceland, Liechtenstein, and Norway via MiCA Article 65 notification.[23] After receiving all Article 65 information, CySEC must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information.
English Working Language and Common-Law Overlay
All CySEC filings, the Programme of Operations, governance documentation, and ongoing reporting are produced in English. Commercial contracts and shareholder agreements follow English common-law drafting conventions. For operators based in London, the US, the Gulf, or APAC, this removes the translation layer that adds friction in non-English EU jurisdictions and shortens partner onboarding cycles with banks, auditors, and counterparties.
Cyprus Tax Reform 2026: 15% Headline, About 3% on Qualifying IP-Box Profits, 8% on Crypto Disposals
The Cyprus Tax Reform 2026 enacted by Parliament on raised the headline corporate income tax from 12.5% to 15% (Pillar Two alignment) while preserving the IP Box, whose 80% deduction on qualifying profits leaves an effective rate of about 3% on qualifying intellectual-property income.[33]
From , Article 20E taxes profits from disposal of crypto-assets not acquired through mining at 8%; mining-related gains remain within the general income-tax rules.[2] For Special Defence Contribution, a Cyprus tax resident is deemed domiciled after at least 17 of the preceding 20 tax years. Since 2026 a deemed-domiciled individual without a Cyprus domicile of origin can instead elect to pay a lump sum of €250,000 covering five tax years of Special Defence Contribution, subject to the Tax Commissioner’s approval.
Track Record Under MiCA
ESMA’s interim register (edition of ) lists 24 entities with Cyprus as home state, the fourth-largest group in the EU after Germany (95), France (36) and the Netherlands (28). The first, eToro (Europe) Ltd, dates from , and 16 of the 24 were added in 2026; 20 hold cross-border rights, 19 of them to all 29 other EEA states.[3] The file also lists financial entities that notified under Article 60, so these are entities on the register rather than Article 63 authorisations alone.
Regulatory Framework
The Cyprus Securities and Exchange Commission is the sole national competent authority for CASP authorisation under MiCA Article 93,[16] with the Central Bank of Cyprus competent for e-money tokens, for asset-referenced tokens issued by credit institutions, for Article 60 notifications by credit institutions and EMIs, and for payment-services overlap. MiCA (see the MiCA guide) applies directly without national transposition; the supporting Cyprus AML framework was realigned to MiCA and the EU Transfer of Funds Regulation by Law 96(I)/2025, published in the Official Gazette on .[4] CySEC maintains a dedicated MiCA information hub setting out filing expectations and supervisory guidance for applicants.[15]
Definition: Crypto-Asset Service Provider (CASP)
A Crypto-Asset Service Provider is a legal person or undertaking authorised under MiCA Article 59 to provide one or more of the ten regulated crypto-asset services defined in MiCA Article 3(1)(16)(a)-(j). In Cyprus, the authorisation is granted by CySEC under the directly-applicable Regulation (EU) 2023/1114, supplemented by Cyprus AML and prudential rules. Cyprus taxes CASP operating profits at 15% (from ); Article 20E applies an 8% rate to qualifying non-mined crypto-asset disposal profits.
Regulatory History
Cyprus established a national CASP register in September 2021 under Directive R.A.D. 269/2021 issued pursuant to the Prevention and Suppression of Money Laundering Activities Law 188(I)/2007.[5] The register closed to new entrants on ahead of MiCA’s general application date of . The national register imposed its own capital requirements under paragraph 14 of Directive R.A.D. 269/2021 but did not confer EU passporting rights.[34]
Recent Regulatory Developments
- . CySEC announcement on the end of the transitional period. Since 1 July 2026 crypto-asset services may be provided in Cyprus only under MiCA; CySEC relayed ESMA’s warning that clients of unauthorised providers have none of MiCA’s safeguards.[28]
- . DAC8 transposed. Law 38(I)/2026 brings crypto-asset reporting into Cyprus law, deemed in force from 1 January 2026.[32]
- . CySEC press release on MiCA filing deadline. CySEC confirmed 27 February 2026 as the deadline for legacy CASPs to apply under MiCA; applicants could continue until a decision or 1 July 2026, whichever came first, and firms that did not apply had to submit a wind-down plan.[6]
- . Cyprus Tax Reform 2026 enacted. Corporate income tax rises from 12.5% to 15%; Article 20E sets an 8% rate for qualifying non-mined crypto-asset disposal profits. For Special Defence Contribution, deemed domicile applies after at least 17 of the preceding 20 tax years; a deemed-domiciled individual without a Cyprus domicile of origin can elect a €250,000 lump sum covering five tax years of the contribution, subject to the Tax Commissioner’s approval.[2]
- . Law 96(I)/2025 published. Cyprus AML alignment with MiCA and the EU Transfer of Funds Regulation.[4]
- . ESMA reverse-solicitation guidelines published. ESMA35-1872330276-2030, applicable from .[7]
- . DORA application date. Cyprus CASPs in scope from this date.[8]
- . MiCA full application date. The CASP regime goes live and the transitional period opens.[9]
Regulatory Overlap
Three further EU and Cyprus regimes intersect with the MiCA CASP authorisation and must be assessed in parallel:
- EU Transfer of Funds Regulation (Regulation (EU) 2023/1113). Applies to all crypto-asset transfers with no de minimis threshold. Practical consequence: Travel Rule data exchange is mandatory between CASPs from .[14]
- DORA (Regulation (EU) 2022/2554). Applies to all CASPs from . Practical consequence: ICT risk management, third-party register, incident reporting, BCP testing, and TLPT for significant entities are baseline obligations.[8]
- MiFID II / Cyprus Investment Firms regime (Law 87(I)/2017). Engaged where the CASP also provides MiFID-equivalent investment services. Practical consequence: existing CIFs may notify CySEC under MiCA Article 60 instead of applying for CASP authorisation; the notification must be filed at least 40 working days before the services start, and CySEC checks its completeness within 20 working days.
- PSD2 / e-money. Engaged where the CASP processes fiat payments or issues e-money tokens. Practical consequence: the Central Bank of Cyprus is the competent authority, and separate or dual authorisation may apply.[10]
In practice, the dual-licensing question is the most under-budgeted item in Cyprus CASP applications: operators handling fiat top-ups via their own infrastructure often discover the PSD2 overlap only after the Programme of Operations review, adding 8–12 weeks to the timeline.
Regulatory Transition: National CASP Register to MiCA
The Old Regime
The national CASP register combined AML registration with capital requirements under paragraph 14 of Directive R.A.D. 269/2021; it did not confer EU passporting rights.[34] As at its closure to new entrants on , approximately 35 entities were on the register.[5]
The New Regime
MiCA CASP authorisation under Regulation (EU) 2023/1114 has been in force from . It delivers prudential supervision plus AML, EU passporting via Article 65, prudential safeguards under Article 67, and a DORA-aligned ICT framework.
Grandfathering and Transitional Provisions
MiCA Article 143(3) permits Member States to grant a transitional period of up to 18 months for entities authorised under national regimes before . Cyprus opted for the full 18 months, which expired . During the transitional period, a legacy national-regime CASP could continue under Cyprus national rules without an EU passport; cross-border services were possible only where the host state’s own law and transitional regime allowed them.[6]
Conversion Mechanism
There is no simplified conversion path. Filing by the 27 February deadline let a legacy CASP continue under the national rules only until CySEC decided or 1 July 2026, whichever came first;[6] the file CySEC reviews is the full Article 62 package regardless of legacy status.
Key Deadlines
| Milestone | Date | Impact |
|---|---|---|
| MiCA enters into application | New CASP authorisations under MiCA only; national register closed to new entrants | |
| Legacy filing deadline | Last day for legacy CASPs to file under MiCA | |
| Transitional period ended | Legacy CASPs without a MiCA authorisation had to stop providing services |
Practical Implications
Legacy CASPs that had not begun MiCA file preparation by Q4 2025 faced a compressed runway. CIFs already holding MiFID authorisation should evaluate the MiCA Article 60 notification route in preference to a full CASP authorisation: Article 60 uses the existing prudential profile and needs only a notification filed at least 40 working days before the services start, which CySEC checks for completeness within 20 working days, rather than the full MiCA Article 63 authorisation clocks (completeness within 25 working days; decision within 40 working days of a complete file). All sections below this point present MiCA-regime data only; national-regime data belongs exclusively in this section.
License Types and Activities Covered
A Cyprus CASP authorisation covers any combination of the ten crypto-asset services defined in MiCA Article 3(1)(16)(a)-(j). CySEC groups the services into three capital classes under MiCA Annex IV. Where multiple classes apply, the highest applicable class governs. The authorisation is indefinite, subject to ongoing supervisory fees and compliance.
Covered Activities
The ten MiCA Article 3(1)(16)(a)-(j) services, grouped by capital class, are:
- Reception and transmission of orders (Class 1, €50,000). Passing client orders to other CASPs or trading venues. Applies to broker-style intermediation.
- Execution of orders on behalf of clients (Class 1, €50,000). Buying or selling crypto-assets in the client’s name.
- Placing of crypto-assets (Class 1, €50,000). Marketing on behalf of issuers, with or without firm commitment.
- Advice on crypto-assets (Class 1, €50,000). Personal recommendations on crypto investment.
- Portfolio management (Class 1, €50,000). Discretionary management of client crypto portfolios.
- Transfer services for crypto-assets (Class 1, €50,000). Moving crypto between addresses on client instruction.
- Custody and administration of crypto-assets on behalf of clients (Class 2, €125,000). Safekeeping, key management, segregated wallets.
- Exchange of crypto-assets for funds (Class 2, €125,000). Fiat-to-crypto and crypto-to-fiat conversion.
- Exchange of crypto-assets for other crypto-assets (Class 2, €125,000). Crypto-to-crypto conversion.
- Operation of a trading platform for crypto-assets (Class 3, €150,000). Running a multilateral system that brings together third-party buying and selling interests.
What Does NOT Require CASP Authorisation
- MiFID-licensed Cyprus Investment Firms providing equivalent services may notify under MiCA Article 60 without obtaining a separate CASP authorisation. The notification must reach CySEC at least 40 working days before the services start, and CySEC checks within 20 working days that it is complete; no separate authorisation decision follows.
- Pure technology providers (wallet software developers, blockchain infrastructure providers) without custody, trading, or client-asset relationships fall outside the perimeter.
- Issuance and offering of crypto-assets is governed by MiCA Titles II–IV (white paper requirements) rather than CASP Title V; issuers are not CASPs by virtue of issuance alone.
- EMT and ART issuance is governed by separate MiCA titles: e-money tokens fall under the Central Bank of Cyprus, and asset-referenced tokens under CySEC, or the Central Bank of Cyprus where the issuer is a credit institution.[16]
Tokenised Securities and RWA
A MiCA CASP authorisation does not cover tokenised securities or tokenised real-world assets that qualify as financial instruments. MiCA Article 2(4) carves crypto-assets that are MiFID financial instruments out of the regulation entirely, and a tokenised share, bond, or fund unit is regulated as a financial instrument under MiFID, not as a crypto-asset.
In Cyprus the operative perimeter follows the same EU logic as every member state: a security token requires a Cyprus Investment Firm authorisation under MiFID from CySEC, assessed against ESMA’s Guidelines on the qualification of crypto-assets as financial instruments. For the structuring side of asset and fund tokenisation, see our fund licensing guide.
Cyprus also participates in the EU DLT Pilot Regime under Regulation (EU) 2022/858, which lets DLT market infrastructures trade and settle tokenised financial instruments on distributed-ledger systems. MiCA itself has applied in full since 30 December 2024, but it governs the crypto-asset perimeter, not the securities perimeter. A token-issuance or platform model that touches both worlds needs the CASP authorisation and the CIF authorisation scoped together, not one in place of the other.
DAO and DeFi Treatment
Cyprus has not published dedicated DAO or DeFi guidance distinct from the MiCA framework. MiCA Recital 22 excludes “fully decentralised” services from the regulatory perimeter, but ESMA’s emerging interpretation treats most operating DeFi protocols as in-scope where any identifiable person performs a CASP service.
In practice, CySEC expects DAO-adjacent structures to identify the responsible legal person and route the authorisation through that entity. Operators seeking EEA market access without authorisation should review the dedicated reverse solicitation under MiCA guide, which sets out the narrow third-country exemption.[19]
Requirements
A Cyprus CASP authorisation requires prudential safeguards under MiCA Article 67 and Annex IV, a real Cyprus office, and a complete MiCA Article 62 documentation set, and in practice CySEC expects a Cyprus-resident board majority and a locally resident MLRO and Compliance Officer. The substance bar is high: practitioner guidance published in August 2025 records CySEC’s expectation that the majority of board members be Cyprus-resident and actively involved in decision-making.[11]
Requirements Table
| Requirement | Value |
|---|---|
| Annex IV class floor, Class 1 services | €50,000 |
| Annex IV class floor, Class 2 services | €125,000 |
| Annex IV class floor, Class 3 services | €150,000 |
| Capital test (ongoing) | Higher of class minimum or 25% of preceding year’s fixed overheads |
| Form of prudential safeguards | Own funds (Common Equity Tier 1 after deductions), an insurance policy or a comparable guarantee, or a combination (MiCA Article 67(4)) |
| Minimum directors | 2; majority Cyprus-resident expected by CySEC[11] |
| Independent non-executive directors | At least half of the board (practitioner guidance) |
| MLRO | Required; Cyprus-resident in CySEC practice |
| Compliance Officer | Required; Cyprus-resident in CySEC practice |
| Internal Auditor | Required; can be outsourced subject to MiCA Article 73 outsourcing rules |
| Cyprus office | Registered office and real premises in Cyprus; effective management in the EU under MiCA, from Cyprus in CySEC practice |
| Qualifying shareholders (≥10%) | Fit-and-proper assessment by CySEC; source-of-funds documentation required |
For MiCA CASPs, the amounts shown are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).
Fit-and-Proper Assessment
CySEC assesses each director, qualifying shareholder, and senior management function holder against six dimensions: integrity (no criminal record, civil findings, regulatory sanctions); financial soundness; relevant experience; conflicts of interest; time commitment; and absence of disqualifying circumstances. Prior CySEC approval is required before appointment to a key function role at an authorised CASP. The fit-and-proper questionnaire and supporting evidence (CVs, references, financial standing certificates, criminal-record checks) are submitted as part of the initial application.
Local Presence
Cyprus operates a substance-based model. MiCA Article 59(2) requires a registered office in the Member State where at least part of the services are provided, the place of effective management in the Union and at least one Union-resident director;[9] Cyprus practice goes further, with CySEC expecting the majority of the board to be Cyprus-resident and actively engaged in decision-making.[11] CySEC in practice expects the MLRO and Compliance Officer to be Cyprus-resident; key control functions (risk, compliance, internal audit, IT/security) should be demonstrably performed from Cyprus.
Outsourcing of certain operational and ICT functions is permitted under MiCA Article 73 subject to written contracts, contingency arrangements, and CySEC oversight. The common mistake is presenting a single Cyprus-resident director with the rest of the board flying in for quarterly meetings: CySEC treats this as a substance failure rather than an alternative compliance route.
AML/CFT and Travel Rule
The applicable AML framework is the Prevention and Suppression of Money Laundering Activities Law 188(I)/2007 (as amended, including by Law 96(I)/2025 and Law 25(I)/2026) and CySEC’s AML/CFT Directive. The EU Transfer of Funds Regulation (Regulation (EU) 2023/1113), the crypto-asset Travel Rule, applies to CASPs from with no de minimis threshold for crypto transfers.[14] CASPs must implement risk-based KYC/CDD, PEP, and sanctions screening (EU consolidated list, UN list, OFAC where applicable), transaction monitoring tuned to crypto typologies (mixers, peel chains, privacy coins), an independent AML compliance officer and MLRO function, and an annual independent AML audit. Suspicious-transaction reports go to MOKAS, the Unit for Combating Money Laundering housed within the Cyprus Law Office of the Republic.
Application Process
MiCA Article 63 fixes the CySEC review clock: 5 working days to acknowledge receipt, 25 working days to check completeness, and 40 working days to decide from receipt of a complete application, which one information request made by the 20th working day can suspend for up to 20 working days. End-to-end runs 8–14 months for Class 2/Class 3 files.
Application language: English (mandatory).
Pre-application engagement: optional but recommended for non-standard business models. CySEC operates an informal pre-submission engagement channel through its Innovation Hub for complex tokenomics or atypical service combinations.
Cyprus Entity Formation and Structuring
Forming a Cyprus entity is the first step: see the full Cyprus company formation guide → Incorporate a Cyprus private limited company (Ltd) under the Companies Law Cap. 113, open a corporate bank account (it holds paid-in own funds where the safeguards are met that way), prepare shareholder and ultimate beneficial owner (UBO) documentation, and begin recruitment of resident directors, MLRO, and Compliance Officer.
Documentation Build
Draft the MiCA Article 62 documentation set: Programme of Operations describing services, target markets, and resources; governance framework including conflicts-of-interest, complaints, outsourcing, and marketing policies; AML/CFT manual and risk assessment; ICT and DORA framework with third-party register; business continuity and wind-down plans; and service-specific procedures (custody segregation, trading rules, transfer-rule compliance).
Pre-Submission Engagement and Final Review
Optional preliminary review with CySEC for non-standard business models. Internal mock-review of the policy suite against MiCA Article 62 sub-paragraphs and CySEC’s expectations under published practitioner guidance.[11] Put the prudential safeguards in place (own funds, an insurance policy or a comparable guarantee), confirm the Cyprus office lease and complete director onboarding.
Formal Application and CySEC Review
File the complete application via CySEC’s e-portal. CySEC acknowledges receipt within 5 working days, checks completeness within 25 working days and decides within 40 working days of receipt of a complete application; only an information request made by the 20th working day of that period suspends it, for up to 20 working days, and later requests do not. The overall engagement-to-authorisation estimate is 8–10 months for clean files with prior CySEC engagement and resident substance in place at filing, and 12–14 months for complex files.
Authorisation Grant and Operational Launch
CySEC board decision; entry on ESMA’s MiCA register; annual fees start pro rata; passporting notifications filed under MiCA Article 65 for target host states; live operations commence. The authorisation is indefinite, subject to ongoing supervision. What CySEC’s published guidance does not cover is how the regulator treats the difference between an applicant with a Cyprus-resident-from-day-one substance package and one promising substance build-out post-authorisation: the second route typically adds three to six months to the end-to-end timeline.
The independent specialist, within its own engagement with the client, drafts the Cyprus-specific MiCA documentation: the Programme of Operations, AML/CFT policy manual, DORA framework, and conflicts-of-interest and outsourcing policies. The compliance documentation is the most time-intensive component of any Cyprus CASP application: 8–12 weeks of specialist work that cannot be shortcut with generic templates. Book a Licensing Assessment →
Required Documents
CySEC requires the full MiCA Article 62 documentation set, supplemented by Cyprus-specific AML and DORA expectations.[11] The documentation falls into five categories: corporate, personal (directors / officers / UBOs), compliance, business and financial, and technology and operational. The compliance documentation is the most heavily scrutinised category.
Corporate Documents
Certificate of incorporation, memorandum and articles of association, register of directors and members, certificate of registered office, corporate structure chart showing ownership down to ultimate beneficial owners, board resolutions appointing senior officers, and evidence of share capital subscription.
Personal Documents (All Directors, Qualifying Shareholders ≥10%, Senior Management)
Curriculum vitae and reference letters (3 minimum, professional); passport copy and proof of address (utility bill within 3 months); criminal record certificate from each country of residence over the past 10 years; financial standing certificate or bank reference; tax clearance certificate; fit-and-proper questionnaire (CySEC form); and detailed disclosure of all directorships and shareholdings held over the preceding 10 years.
Compliance Documentation
The compliance documentation is the most heavily scrutinised component of any Cyprus CASP application. The independent specialist drafts each of these documents within its own engagement with the client: bespoke and Cyprus-specific, not templates adapted from other jurisdictions. Each document must reflect the applicant’s specific business model, risk profile, and operational structure.
Must reference Cyprus-specific reporting to MOKAS, the EU consolidated sanctions list, OFAC where applicable, and the UN sanctions regime. The most common deficiency CySEC flags is generic AML policy adapted from a payments business: crypto typology coverage (mixers, privacy coins, peel chains, cross-chain bridges) must be specific. The manual is reviewed annually and updated for material risk-environment changes.
Cyprus expects the risk assessment to be calibrated to the specific services authorised (custody risks differ from exchange risks), the geographic exposure of the client base, and the technology stack. The risk-rating methodology must be documented and the assessment refreshed annually or on material change.
Screening must cover the client, beneficial owners, counterparties to transactions, and the originator/beneficiary of crypto-asset transfers under the TFR. Cyprus expects a documented escalation pathway for positive matches and a four-eyes review for false-positive clearance.
The matrix must distinguish prohibited jurisdictions (no business), enhanced-due-diligence jurisdictions (additional documentation, senior management approval), and standard jurisdictions. Cyprus regulators expect the matrix to be reviewed quarterly and the rationale for inclusion documented.
The framework must specify the scenarios in use, the threshold logic, the alert review process, and the escalation pathway to MLRO and SAR/STR filing. Cyprus expects vendor selection rationale and false-positive tuning evidence.
Cyprus has no de minimis threshold under the EU TFR: every crypto-asset transfer requires the originator and beneficiary data exchange. The implementation must name the technology provider, document the protocol used (IVMS 101 or equivalent), and specify the procedure for transfers to unhosted wallets per EBA guidelines.
Cyprus law requires submission to MOKAS as the financial intelligence unit; tipping-off provisions apply. The procedure must specify the MLRO’s authority to file, the four-eyes internal review, the record-retention period, and the no-tipping-off training requirement for client-facing staff.
Cyprus KYB must identify the natural persons who ultimately own or control a corporate client. The current ownership indicators are 25% plus one share, or an ownership interest of more than 25%; control through other means must also be assessed. PEP screening and enhanced due diligence depend on risk.[36]
From , AMLR Article 52 sets the ownership-interest threshold at 25% or more; control remains a separate basis for identifying a beneficial owner. Onboarding rules should distinguish the current national test from that forthcoming EU rule.[37]
The programme must specify the frequency and scope of compliance testing, the reporting cadence to the board, and the remediation tracking process. Cyprus regulators expect annual independent compliance reviews documented in board minutes.
The DORA framework must cover the ICT risk management function, the third-party register naming critical providers, the incident classification taxonomy (major / minor / significant cyber threats), business continuity testing on a documented schedule, and TLPT planning for significant CASPs on the three-year cycle.
Business Plan and Financial Projections
Three-year revenue projections by service line; cost base including capital, supervisory fees, technology, personnel, and compliance; capital adequacy and 25%-of-overheads buffer calculation; sensitivity analysis under stress scenarios; and commercial assumptions including target geography, average client value, and acquisition cost.
Technology and Operational Documentation
IT infrastructure architecture including hosting (cloud / on-premise / hybrid); custody architecture with hot / warm / cold wallet segmentation; key management procedures including multi-signature thresholds, key ceremony documentation, and backup procedures; cybersecurity policy; data protection and GDPR compliance; and an operational manual covering trade execution, settlement, custody onboarding, and complaints handling.
Costs and Pricing
CySEC charges cumulative, non-refundable application fees for every service sought: €5,000 for each exchange service and transfer; €8,000 for execution, placing, reception and transmission, advice, and portfolio management; €10,000 for custody; and €30,000 for operating a trading platform. The annual supervisory fee is charged pro rata from the month services start and is payable within four months after the financial year ends,[26] and CySEC also charges a DORA fee of €2,000 to €20,000 a year by entity size.[27] The application fees run €28,000 to €64,000 in Year 1 for a typical four to six service file, before the pro-rata annual fees. The build on top of it, covering entity, advisory, compliance and ICT documentation, substance and tooling, is an indicative €189,000 to €398,000 for a Class 2 or Class 3 applicant, and it is quoted per case.
Statutory Cost
Every line below is a CySEC charge set out in the published fee schedule and can be checked against it.[21] Application fees are non-refundable, cumulative by service and due on filing, so the band reflects a typical four to six service Class 2 or Class 3 file rather than a single price.
| Statutory item | Amount (EUR) |
|---|---|
| Application fee, custody (single payment on filing) | €10,000 |
| Application fee, exchange for funds, crypto-to-crypto exchange or transfer, €5,000 for each service (single payment on filing) | €10,000–€15,000 |
| Application fee, execution, placing, RTO, advice or portfolio management, €8,000 for each service (single payment on filing) | €8,000–€24,000 |
| Application fee, operating a trading platform, if the file includes one (single payment on filing) | €30,000 |
| Annual MiCA fee for the first year (pro rata from the month services start; payable within four months after the financial year ends) and DORA fee (pro rata from the month of authorisation; payable by 30 November of that year) | Pro rata |
| Notification of a board change, if one is filed (€2,000 per filing) | €2,000 |
| Statutory cost, Year 1: application fees (typical Class 2/3 file of four to six services, not the sum of all rows), before the pro-rata annual fees | €28,000–€64,000 |
| Supervisory fee, custody (annual, fixed component) | €10,000 |
| Supervisory fee, exchange, execution, placing, RTO or transfer, €5,000 for each service (annual, fixed component) | €10,000–€25,000 |
| Supervisory fee, advice or portfolio management, €8,000 for each service where those services are in scope (annual, fixed component) | €8,000–€16,000 |
| Supervisory fee, operating a trading platform, if the file includes one (annual, fixed component) | €20,000 |
| DORA annual fee by entity size (CySEC Directive DI 73-2009-07; a threat-led penetration test assessment costs €20,000 more where one is required) | €2,000–€20,000 |
| Variable supervisory component stacked above the fixed fees: 1% of relevant turnover from €500k to €1m, 0.4% of the €1m to €5m tranche, 0.3% of the €5m to €10m tranche, 0.1% above €10m, with fixed and variable together capped at €500,000 (annual) | Scaled |
| Statutory cost, Year 2 onwards (annual MiCA fixed fees plus the DORA fee, before the turnover-scaled component) | €22,000–€91,000 |
Typical Build Cost (quoted per case)
| Build item | Amount (EUR) |
|---|---|
| Cyprus entity formation, including registered office, secretary and initial filings | €4,000–€8,000 |
| Legal advisory and Programme of Operations (Cypriot law firm, Class 2/3 application) | €40,000–€80,000 |
| Compliance documentation, specialist drafting priced separately from legal advisory (AML/CFT policy suite, risk assessment, Travel Rule, sanctions framework) | €30,000–€60,000 |
| Technology and ICT documentation, DORA-aligned and in scope from (DORA framework, cybersecurity policy, BCP, key management) | €20,000–€45,000 |
| Local representative engagement, first year: director, MLRO and Compliance Officer | €15,000–€30,000 |
| Office lease and operational set-up, first year: real Cyprus premises, rent and fit-out | €25,000–€60,000 |
| Audit and first-year accounting (Cyprus-licensed auditor) | €15,000–€25,000 |
| ICT tooling and AML/Travel-Rule technology, first year including implementation | €40,000–€90,000 |
| Prudential safeguards, Class 2 example: higher of the class minimum or 25% of fixed overheads (own funds, qualifying insurance or a comparable guarantee; held rather than spent if funded as own funds) | €125,000 |
| Typical build, Year 1 (quoted per case) | €189,000–€398,000 |
| Local representative engagement: director, MLRO and Compliance Officer (annual) | €15,000–€30,000 |
| Office lease and running costs (annual) | €25,000–€60,000 |
| External audit and accounting (annual) | €15,000–€25,000 |
| ICT tooling and AML/Travel-Rule technology subscriptions (annual) | €40,000–€90,000 |
| Typical build, annual ongoing from Year 2 (quoted per case) | €95,000–€205,000 |
Both build figures cover the licensing programme and the substance it requires. They exclude operational headcount above the MLRO and Compliance Officer: a trading desk, engineering and customer support are a business decision rather than a licensing cost, and a fully staffed Cyprus CASP runs materially above the ongoing band shown.
Authorisation is indefinite; the supervision fee structure replaces the renewal-fee model used in pre-MiCA national regimes. The variable supervisory component scales with crypto-asset turnover up to the €500,000 annual cap.
Timeline
The shortest realistic Cyprus CASP timeline runs 8 months for a clean file with prior CySEC engagement and substance in place at filing. The longest, for a complex multi-service or trading-platform applicant building team and ICT framework in parallel, extends to 14 months. Once CySEC has a complete application, the MiCA Article 63 clocks take roughly two to three months, up to about four with the one permitted suspension of up to 20 working days; the rest of the review stage is spent completing the file and answering requests.
| Stage | Duration | Cumulative |
|---|---|---|
| Cyprus entity formation and structuring | 3–4 weeks | 3–4 weeks |
| Documentation build (Programme of Operations + policy suite + DORA) | 8–12 weeks | 11–16 weeks |
| Pre-submission engagement and final review | 4–6 weeks | 15–22 weeks |
| CySEC review, filing to decision (completing the file, answering requests and the Article 63 clocks) | 5–9 months | 8–14 months |
| Total, initial engagement to authorisation grant | 8–14 months |
Clean files with prior CySEC engagement, an experienced local team, and substance in place at filing close in 8–10 months. Files with complex tokenomics, atypical custody arrangements, multi-jurisdictional shareholder structures, or substance build-out promised post-authorisation regularly extend to 12–14 months.
Experienced applicants prepare MiCA Article 65 passporting notifications alongside, or shortly after, authorisation. After receiving all Article 65 information, CySEC must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP; the CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the information.
Taxation
Cyprus is a low-headline-tax EU jurisdiction with a competitive IP regime, but the Cyprus Tax Reform 2026 raised the corporate income tax rate from 12.5% to 15% from . Article 20E taxes profits from disposal of crypto-assets not acquired through mining at 8%; mining-related gains remain within the general income-tax rules.[2] The reform aligns Cyprus with OECD Pillar Two while preserving the structural tax features that anchor the jurisdiction’s value proposition.
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate Income Tax | 15% (from )[2] | Standard rate on CASP operating profits |
| Crypto-Asset Disposal Tax | 8% (from )[2] | Article 20E profits on crypto-assets not acquired through mining; mining-related gains follow general income-tax rules |
| IP Box (effective) | About 3% | Nexus-qualifying profits from eligible intellectual property (80% deduction) |
| Capital Gains Tax | 20% | Applies only to disposals of Cyprus immovable property and of shares in companies holding it |
| VAT | 19% (standard); largely exempt for crypto exchange | CJEU C-264/14 Hedqvist analogy |
| Withholding Tax, dividends to non-residents | 0% | No WHT for most non-residents; SDC of 5% on dividends to associated companies in low-tax jurisdictions and 17% in EU-listed non-cooperative ones |
| Withholding Tax, interest to non-residents | 0% | No WHT for most non-residents; 17% SDC on interest to associated companies in EU-listed non-cooperative jurisdictions |
| Withholding Tax, royalties to non-residents | 0% or 10% | 0% where the rights are used outside Cyprus; 10% where used in Cyprus (EU associated companies exempt) or paid to associated companies in EU-listed non-cooperative jurisdictions |
| Special Defence Contribution, dividends | 5% (down from 17%) | Resident, domiciled individuals, on dividends from 2026 profits (17% on earlier profits received by the end of 2031); non-doms and non-residents 0% |
| Notional Interest Deduction on new equity | Reference rate + 5% | Continues post-reform |
Cyprus Tax Reform 2026
Enacted by Parliament on and published in the Official Gazette (No. 5070) on , in force from . Key changes: headline corporate tax 12.5% to 15%; Article 20E taxes profits of any person from disposal of crypto-assets not acquired through mining at 8%, with crypto losses set only against crypto gains of the same year; tax losses carried forward for seven years instead of five; a company incorporated in Cyprus is now tax resident unless a treaty provides otherwise;[29] and Special Defence Contribution on dividends cut from 17% to 5% for resident, domiciled individuals on dividends from 2026 profits, with 17% still due on dividends from earlier profits received by the end of 2031.[30]
For Special Defence Contribution, deemed domicile applies after at least 17 of the preceding 20 tax years; a deemed-domiciled individual without a Cyprus domicile of origin can elect a €250,000 lump sum covering five tax years of the contribution, subject to the Tax Commissioner’s approval.[17][18][30]
DAC8 / CARF Reporting
Cyprus transposed DAC8 (Council Directive (EU) 2023/2226 amending DAC) by Law 38(I)/2026, published on and deemed in force from : CASPs report crypto-asset transactions to the Cyprus Tax Department by 30 June of the following year, so the first reports, on 2026, are due in 2027, and EU tax administrations exchange them by 30 September 2027.[32][12] CARF (the OECD Crypto-Asset Reporting Framework) is being implemented in parallel via DAC8 for EU coverage; for CARF exchanges with non-EU jurisdictions, the OECD Global Forum list of 14 September 2026 places Cyprus among the jurisdictions undertaking first exchanges by 2028.[22]
Pillar Two (Global Minimum Tax)
Cyprus enacted its Pillar Two law, Law 151(I)/2024, in 2024, separately from the 2026 reform.[31] The 15% global minimum effective tax rate applies to multinational and large domestic groups with consolidated revenue of €750 million or more. Standalone CASP entities below this threshold are not in scope of Pillar Two top-up tax but must still file the standard Cyprus corporate income tax return at 15%.
Ongoing Compliance & Post-Registration
A Cyprus CASP authorisation creates a permanent compliance infrastructure obligation across capital adequacy, AML, prudential reporting, DORA operational resilience, client-asset segregation, and supervisory engagement with CySEC. The authorisation is indefinite, replaced by ongoing supervisory fees and continuous fitness review.
Annual Reporting Obligations
Capital adequacy reviewed annually against the higher-of-class-minimum-or-25%-of-fixed-overheads rule; quarterly client-asset statements; annual audited financial statements filed with CySEC within four months of year-end; MOKAS suspicious-transaction reporting on a per-event basis; annual independent AML audit; complaints reporting to CySEC; and market-abuse surveillance reporting for trading platforms.
Supervision Fees and Operational Costs
Annual supervisory fees as set out in the Costs section above. Recurring build costs are those in the build table above, quoted per case: local representatives (€15,000–€30,000 a year), office (€25,000–€60,000), external audit and accounting (€15,000–€25,000), and ICT, AML and Travel-Rule tooling (€40,000–€90,000).
Regulatory Inspections
CySEC conducts both scheduled supervisory engagements and thematic reviews. Scheduled engagements typically run on a 12–24 month cycle for newly-authorised CASPs, transitioning to a risk-based cycle thereafter. Thematic reviews in 2025–2026 have focused on AML control effectiveness, DORA implementation, and client-asset segregation. CySEC has powers to conduct unannounced on-site inspections and to require documentation production within stated timelines.
Enforcement
CySEC has a developed enforcement record across MiFID, AIFMD, and the national CASP register. Penalties include administrative fines (calibrated to the violation’s gravity, the firm’s size, and the period of non-compliance), public reprimands, withdrawal of authorisation, and individual sanctions on directors and senior management. Providing crypto-asset services without a CASP authorisation, a MiCA passport or an Article 60 notification breaches MiCA Article 59 and exposes the provider to the administrative penalties Member States must set under Article 111;[9] since 1 July 2026 CySEC has reminded the public that crypto-asset services may be provided only under MiCA.[28]
ICT Risk Management & Operational Resilience
DORA (Regulation (EU) 2022/2554) applies to all Cyprus CASPs as financial entities under Article 2 from .[8] Compliance is documented through an ICT risk framework, an incident-management workflow, a third-party register, and resilience testing.
ICT Risk Management Framework
The framework must specify ICT governance (board oversight, designated function holder), risk identification methodology, classification of ICT assets, risk assessment cadence, and risk mitigation controls. Cyprus expects the framework to be approved by the board and reviewed annually.
Incident Reporting
Major ICT-related incidents must be classified per DORA Article 18 criteria and reported to CySEC within the timeframes set by the regulator. Significant cyber threats are also reportable. The classification matrix (critical / major / significant) must be documented and applied consistently.
Digital Operational Resilience Testing
Annual BCP testing with documented results and remediation. Significant CASPs (designated under DORA criteria) must conduct threat-led penetration testing on a three-year cycle. The testing scope, methodology, and remediation tracking are documented.
Wallet and Key Management
Cold-wallet segregation from hot-wallet operations; documented key ceremony with multi-party computation or multi-signature thresholds; backup procedures with geographic and operator separation; and quarterly attestation of key custody.
Third-Party ICT Risk
Third-party register naming each ICT service provider, criticality assessment, contractual safeguards (DORA-aligned clauses), exit strategy for critical providers, and concentration risk assessment. CySEC has noted in supervisory communications that single-vendor dependency on cloud or custody-tech providers is a recurring area of concern.[11]
Banking
Cyprus banking access for crypto-asset businesses is selective but workable. Local credit institutions take a case-by-case approach, with stronger appetite for MiCA-authorised CASPs than for pre-MiCA or AML-only registered entities. The EMI and payment-institution ecosystem provides widely-used operational alternatives, and Cyprus IBANs integrate fully into SEPA and SWIFT.
The Cyprus Banking Landscape
Indicative local-bank onboarding: 4–8 weeks for an ordinary company with economic substance; 8–14 weeks from initial contact to a live account for a MiCA-authorised CASP at an institution that accepts this profile. Other regulated or high-risk cases need a separate assessment; rejection remains possible.
Practical Architecture
EMI and payment-institution access in Cyprus and across the EEA is broader and faster, with several specialist providers maintaining established CASP-onboarding programmes. For operational redundancy, most Cyprus CASPs maintain one credit-institution relationship plus one to two EMI relationships, distributing operational fiat flows while reserving the credit institution for client funds under MiCA Article 70(3).
For larger CASPs with institutional flow, correspondent banking access is selective; operators with substantial USD turnover should structure their banking stack with the USD correspondent route in mind from the outset.
The Correspondent-Banking Constraint
The real constraint on Cyprus banking is not the local credit institution itself but the correspondent banking layer above it: an operator’s bank can be onboarded comfortably while still finding that USD wires are routed through a chain that takes a separate compliance view. Operators should engage the correspondent question early where institutional USD flow is material, rather than discovering the routing constraint after the local account is live.
Jagelski & Partners’ Banking Service
Jagelski & Partners’ banking partner network spans more than 90 credit institutions and EMIs across the EU, the UK, the Gulf, Asia, and offshore centres. A licence without banking access is a certificate on the wall: learn about our Banking service →
Operating, safeguarding, EMI redundancy, and specialist acquirer layers planned together, across more than 90 institutions in the EU, UK, the Gulf, Asia, and selected offshore corridors.
Explore Banking SolutionsFATF Status & International Standing
Cyprus is evaluated by MONEYVAL, the Council of Europe’s anti-money-laundering body. Its fifth-round mutual evaluation, adopted in December 2019, rated effectiveness substantial on three of the eleven immediate outcomes and moderate on the other eight.[25] After four enhanced follow-up reports, the last adopted in May 2025, Cyprus is rated compliant or largely compliant on 38 of the 40 FATF Recommendations, with R.8 (non-profit organisations) and R.31 (powers of law enforcement and investigative authorities) still partially compliant; it has left the fifth-round follow-up process, and the sixth-round on-site visit is scheduled for October 2028.[24] Cyprus is on neither FATF list, and as an EU Member State it cannot appear on the EU list of high-risk third countries.
MiCA Passporting and EU Market Access
A Cyprus CASP authorisation passports to the 27 EU Member States plus Iceland, Liechtenstein, and Norway under MiCA Article 65. After receiving all Article 65 information, CySEC must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information.
No separate national authorisation is required in passported jurisdictions; conduct-of-business rules remain governed by MiCA, with host competent authorities retaining limited supervisory powers for branches and certain ongoing conduct matters.
Passporting filings are typically front-loaded against the markets with confirmed commercial pipeline and banking. As of , ESMA’s interim MiCA register lists 338 entities with an EU home state, including financial entities that notified under Article 60; Cyprus accounts for 24, with the highest concentration in Germany (95).[3] Across the EEA, 217 of the 357 entities on the register hold cross-border rights, 20 of the 24 Cyprus entities among them.[3]
The MiCA passporting framework genuinely delivers single-licence EU/EEA market access, but the host-state conduct-of-business and consumer-protection overlay is more material than the headline framework suggests: operators expecting “30 markets, one rulebook” will find that the rulebook is uniform while the local consumer-protection and tax-disclosure interfaces vary materially, and 4–6 weeks of host-state-specific preparation per major market is realistic.
Advantages and Limitations
Cyprus delivers MiFID-grade EU supervision in English with a competitive tax architecture and a working MiCA authorisation pipeline. The trade-offs are real: total cost-to-launch is above the Baltic cost-leaders, the substance bar is high, and the legacy-CASP application window closed on 27 February 2026, with the transitional period ending on 1 July 2026.
- English working language across regulator, advisers, and courts. Eliminates the translation layer that adds friction in non-English EU jurisdictions; faster partner onboarding.
- MiFID-grade supervisory experience. CySEC supervises an established investment-firm sector alongside its MiCA mandate.
- Cyprus Tax Reform 2026 architecture. 15% headline corporate tax, IP Box about 3% on nexus-qualifying profits from eligible IP, 8% for qualifying non-mined crypto-asset disposal profits, no withholding on most outbound dividends to non-residents.[2]
- A large MiCA cohort. 24 entities on ESMA’s register have Cyprus as home state (24 September 2026 edition), the fourth-largest group in the EU.
- Special Defence Contribution domicile rules. A Cyprus tax resident is deemed domiciled after at least 17 of the preceding 20 tax years; a deemed-domiciled individual without a Cyprus domicile of origin can elect a €250,000 lump sum covering five tax years of the contribution, subject to the Tax Commissioner’s approval.
- MiCA Article 60 notification route for existing CIFs. Faster path for MiFID-authorised firms providing equivalent crypto services: a notification filed at least 40 working days before the services start and checked for completeness within 20 working days, instead of an Article 63 authorisation.
- Total cost-to-launch is above the Baltic cost-leaders. €217,000–€462,000 in Year 1 (application fees and build, before pro-rata annual fees) vs €131,750–€308,500 in Estonia and €75,925–€268,425 in Lithuania; the Czech Republic, at €232,000–€604,000, costs more. Mitigation: for operators where institutional credibility, English working language, and tax structuring outweigh upfront cost, the lifetime economics favour Cyprus; for cost-constrained startups, Estonia is the preferred lower-cost EU alternative.
- High substance bar. In practice (practitioner guidance; CySEC has published no residence rule for CASPs), CySEC expects a Cyprus-resident board majority, a locally engaged MLRO and Compliance Officer, a real Cyprus office, and management exercised from Cyprus. Mitigation: front-load substance recruitment and office lease before filing; CIF-experienced directors with crypto fluency are available in the Cyprus market, and the lease and key-person recruitment can run in parallel with documentation build during weeks 4–12.
- Transitional window for legacy national-regime CASPs closed hard in 2026 (see Key Deadlines above). Missed deadlines had no extension mechanism.[6] Consequence: legacy CASPs that had not engaged in MiCA file preparation faced a hard stop, because the standard 8–12 week documentation phase plus capital and substance build could not fit a Q1 2026 start. Operators not on the legacy register file as fresh MiCA applicants with no transitional cover.
- Banking access is selective and correspondent-banking dependent. Cyprus credit institutions onboard MiCA CASPs case-by-case; USD correspondent routing adds an additional compliance layer above the local bank’s own decision. Mitigation: structure the banking stack with one credit institution for client funds (MiCA Article 70(3)) plus one to two EMIs for operational redundancy; engage the correspondent question early if institutional USD flow is material to the business model.
How Cyprus Compares
Cyprus sits in the EU/EEA Established Crypto Centres tier alongside Malta and Gibraltar, with Estonia as the lower-cost EU alternative. Malta brings a dedicated crypto track record under the 2018 VFA Act; Gibraltar offers post-Brexit DLT positioning; Estonia is the cost-leader on regulatory and advisory fees.
| Factor | Cyprus | Malta | Gibraltar | Estonia |
|---|---|---|---|---|
| Licence Type | MiCA CASP authorisation | MiCA CASP authorisation | DLT Provider Licence (custodial) / VAAP Licence (non-custodial) | MiCA CASP authorisation |
| Regulator | Cyprus Securities and Exchange Commission (CySEC) | Malta Financial Services Authority (MFSA) | Gibraltar Financial Services Commission (GFSC) | Estonian Financial Supervision Authority |
| Timeline | 8–14 months | 9–18 months | 9–12 months | 6–12 months |
| Capital / prudential safeguards | Annex IV class floors: €50k / €125k / €150k by class | Annex IV class floors: €50k / €125k / €150k by class | No statutory minimum; risk-based (GFSC) | Annex IV class floors: €50k / €125k / €150k by class |
| Year 1 all-in | €217,000–€462,000 plus pro-rata annual fees | €490,000–€1,075,000 build; statutory fees additional | £355,454–£883,154 | €131,750–€308,500 |
| Corporate Tax | 15% (from 2026); IP Box about 3% on nexus-qualifying profits from eligible IP; 8% on qualifying non-mined crypto-asset disposal profits | 35% headline; ~5% effective via shareholder refund | 15% (from July 2024) | 0% retained / 22% distributed |
| Local Presence | Resident board majority and local MLRO and Compliance Officer expected in CySEC practice; real office | Resident senior management; real office | Resident senior management; substance required | Two-member board (at least one EU-resident director); real Estonian office |
| EU Passporting | Yes (MiCA Article 65) | Yes (MiCA Article 65) | No (third country under MiCA) | Yes (MiCA Article 65) |
| FATF Status | MONEYVAL-assessed (not a FATF member); no adverse listings | MONEYVAL-assessed; off the FATF grey list since June 2022 | MONEYVAL-assessed; off the FATF grey list since February 2024 | MONEYVAL-assessed; no adverse listings |
| Best For | English-language MiFID-grade supervision; institutional + retail CASPs | Established crypto track record from VFA-era; effective-tax optimisation | DLT-native operators wanting a bespoke non-EU regime | Cost-conscious EU CASPs prioritising speed and lean capital |
For MiCA CASPs, the amounts shown are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).
Compare every crypto jurisdiction side by side →
Cyprus and Malta are the closest peers in regulatory standing: both run MiFID-grade supervisors with English working language, both target institutional + retail CASPs, and both deliver MiCA passporting from established financial-services jurisdictions. The decision typically reduces to tax structuring (Cyprus IP Box and 8% crypto-disposal rate vs Malta’s imputation refund) and existing operational footprint.
Gibraltar’s positioning is distinct: the DLT framework predates MiCA and brings a different operator profile (DLT-native businesses, crypto-native legal structures), but Gibraltar is a third country under MiCA, so a DLT licence carries no EU passporting. Estonia is the cost-leader cross-sell: operators where lifetime tax economics outweigh upfront cost choose Cyprus; operators with capital constraints and EU passporting as the binding requirement choose Estonia.
When Cyprus Is the Right Choice
Choose Cyprus if:
- English-language regulator and advisory infrastructure are decisive (institutional client base, US/UK/Gulf founders)
- You expect material IP income (white-label tech, custody software, exchange tech) that fits the IP Box
- The MiCA Article 60 notification route is available because the entity already holds CySEC MiFID permissions
- The operator targets EU institutional flow and needs a MiFID-grade home supervisor
Consider alternatives if:
- Total upfront cost is the binding constraint and €100k–€200k is the working budget: see Estonia
- Speed-to-passport is the binding constraint and 6 months is the target: Lithuania has a 4–8 month end-to-end planning range (with a selective regulator)
- The business has substantial Maltese commercial history or VFA-era authorisation: see Malta
- The DLT framework’s specific token-issuance treatment is decisive for the business model: consider Gibraltar
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in Cyprus Applications
Practitioner guidance published in August 2025, supplemented by ESMA’s fast-track peer review of MFSA’s MiCA practice (read across to all NCAs including CySEC), points to five recurring file deficiencies that delay or downgrade Cyprus CASP applications.[11][13]
- Generic, payments-derived AML manual. Applicants reuse AML manuals drafted for payment-services businesses without adapting for crypto-specific typologies (mixers, peel chains, privacy coins, cross-chain bridges). CySEC routinely flags this on first review and requests Cyprus-specific, crypto-tuned manuals with MOKAS reporting pathways, EU consolidated sanctions list integration, and TFR Travel Rule plumbing.
- Substance promised post-authorisation. Submitting with a single Cyprus-resident director and a commitment to recruit MLRO, Compliance Officer, and additional resident directors after authorisation. CySEC treats this as a substance failure that typically adds 3–6 months to the end-to-end timeline, through repeated requests for missing information rather than a single rejection; only the first request in the Article 63 assessment period suspends the clock, for up to 20 working days.
- Deferred DORA package. Treating DORA as a post-authorisation project. The ICT framework, third-party register, incident classification, BCP testing schedule, and TLPT plan are expected as part of the initial Article 62 file, not as conditional commitments.
- Under-budgeting the EMT payment-services perimeter. EMT transfers on behalf of clients and custodial wallets enabling transfers to and from third parties require the CASP’s own appropriate PSP authorisation or an authorised PSP partnership. Crypto-asset exchange and crypto-purchase intermediation with EMTs are outside this PSD2 requirement.[35]
- Insufficient source-of-funds for qualifying shareholders. Qualifying shareholders (≥10%) must document source of funds and source of wealth to CySEC’s satisfaction. Complex shareholder structures with international trusts, holding companies, or token-treasury chains require front-loaded documentation; deferred source-of-funds and source-of-wealth evidence is the most common single trigger of information requests for non-CIF applicants.
The dominant failure mode for Cyprus CASP applications is not a flaw in the regulatory framework but a misread of CySEC’s substance expectations: applicants treat Cyprus as if it were a flag-of-convenience jurisdiction with a tolerant approach to nameplate substance, when in practice CySEC operates closer to the MFSA and BaFin end of the EU spectrum than to the Eastern European cost-leaders.
Frequently Asked Questions
The Cyprus national CASP register was operated by CySEC under Directive R.A.D. 269/2021 from September 2021. The national register imposed its own capital requirements under paragraph 14 of Directive R.A.D. 269/2021 but did not confer EU passporting rights.[34] The MiCA CASP authorisation, available since , is a prudential authorisation under Regulation (EU) 2023/1114: it requires prudential safeguards under MiCA Article 67, full Article 62 documentation, substance, and governance compliance, and confers EU passporting under MiCA Article 65. The national register closed to new entrants on and ceased operating on .
Yes, in limited circumstances. MiFID-authorised Cyprus Investment Firms providing crypto-asset services that are equivalent to existing MiFID services may notify CySEC under MiCA Article 60 rather than obtaining a full CASP authorisation. The firm must notify CySEC at least 40 working days before it first provides those services, and CySEC checks within 20 working days that the notification is complete; there is no separate authorisation decision, and CySEC charges a €10,000 notification fee. The Article 60 route is faster than full Article 63 authorisation and reuses the firm’s existing prudential profile, supervisory relationship, and governance.
No. A MiCA CASP authorisation does not cover tokenised securities or tokenised real-world assets that qualify as financial instruments. MiCA Article 2(4) excludes crypto-assets that are MiFID financial instruments from the regulation, so a tokenised share, bond, or note follows MiFID, not MiCA. In Cyprus that means a Cyprus Investment Firm (CIF) authorisation under MiFID from CySEC, with the qualification assessed against ESMA’s Guidelines on the qualification of crypto-assets as financial instruments.
Cyprus also participates in the EU DLT Pilot Regime under Regulation (EU) 2022/858 for DLT market infrastructures handling tokenised instruments. A model that spans both perimeters needs the CASP and the CIF authorisation scoped together. For the structuring side, see our fund licensing guide.
End-to-end, 8 to 14 months from initial engagement to authorisation grant. MiCA Article 63 sets the statutory CySEC clocks: 5 working days to acknowledge receipt, 25 working days to check completeness, and 40 working days to decide from receipt of a complete application, with one suspension of up to 20 working days for an information request. The total includes 15 to 22 weeks of pre-filing work (entity formation, documentation build, final review, prudential safeguards, and substance) plus the regulatory review.
Clean files with prior CySEC engagement and in-place substance complete in 8 to 10 months; complex files extend to 12 to 14 months.
Legacy CASPs on the Cyprus national CASP register had to apply to CySEC for MiCA authorisation by . Applicants could continue under the national rules until CySEC approved or rejected the application or until the transitional period ended on 1 July 2026, whichever came first; continuing beyond 1 July 2026 required a MiCA authorisation. Firms that did not apply had to submit a wind-down plan and stop by ; there was no extension mechanism.
CySEC confirmed these dates in its press release of . Operators not on the legacy register file as fresh MiCA applicants with no transitional cover and must complete the full 8 to 14 month application cycle before commencing operations.
The Annex IV class floor depends on the services authorised: €50,000 for Class 1 services (reception/transmission, execution, placing, advice, portfolio management, transfer); €125,000 for Class 2 (custody and exchange); €150,000 for Class 3 (operation of a trading platform). Where multiple classes apply, the highest applicable class governs.
The requirement can be met with own funds (Common Equity Tier 1 after deductions), an insurance policy or a comparable guarantee, or a combination, and is reviewed annually against the higher-of-class-minimum-or-25%-of-preceding-year’s-fixed-overheads rule. For a Class 2 firm with €1.5m fixed overheads, the ongoing capital requirement reaches €375,000.
Two figures, not one. The statutory cost is what CySEC charges under its published schedule: €28,000 to €64,000 in Year 1 for a typical four to six service Class 2 or Class 3 file, since application fees are cumulative by service, then €22,000 to €91,000 a year in fixed MiCA supervisory fees and the DORA fee before the turnover-scaled component; the annual MiCA fee starts pro rata from the month services begin, and the DORA fee from the month of authorisation.
The build is everything else and is quoted per case: Cyprus entity formation, legal advisory and the Programme of Operations, compliance documentation, DORA and ICT documentation, local-presence build-out, AML and Travel-Rule technology and audit: an indicative €189,000 to €398,000 in Year 1 and €95,000 to €205,000 a year thereafter. Neither figure includes prudential safeguards or operational headcount above the MLRO and Compliance Officer. If the safeguards are met with own funds, those funds are held rather than spent.
Indicative local-bank onboarding: 4–8 weeks for an ordinary company with economic substance; 8–14 weeks from initial contact to a live account for a MiCA-authorised CASP at an institution that accepts this profile. Other regulated or high-risk cases need a separate assessment; rejection remains possible.
Most Cyprus CASPs maintain one credit-institution relationship plus one to two EMI relationships for operational redundancy. Unless the CASP is itself a credit institution, EMI, or payment institution, MiCA Article 70(3) requires client funds other than e-money tokens to be placed with a credit institution or a central bank by the end of the following business day, separately identifiable from its own funds. Correspondent banking for USD flows is selective and adds a separate compliance layer.
Yes. A Cyprus CASP authorisation passports to the 27 EU Member States plus Iceland, Liechtenstein, and Norway under MiCA Article 65. After receiving all Article 65 information, CySEC must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information.
No separate national authorisation is required in passported jurisdictions. Conduct-of-business and consumer-protection overlays remain in scope locally, and 4 to 6 weeks of host-state-specific preparation per major market is realistic.
From , 15% on operating profits (raised from 12.5% under the Cyprus Tax Reform 2026 to align with OECD Pillar Two). The IP Box continues to deliver about 3% effective tax on qualifying intellectual-property income via the 80% deduction. From , Article 20E taxes profits from disposal of crypto-assets not acquired through mining at 8%; mining-related gains remain within the general income-tax rules.
Dividends and most interest paid to non-residents carry no withholding tax; dividends to associated companies in low-tax or EU-listed non-cooperative jurisdictions bear 5% or 17% Special Defence Contribution, and royalties are free of withholding where the rights are used outside Cyprus (10% where used in Cyprus or paid to associated companies in EU-listed non-cooperative jurisdictions, which also bear 17% on interest). For Special Defence Contribution, a Cyprus tax resident is deemed domiciled after at least 17 of the preceding 20 tax years. Since 2026 a deemed-domiciled individual without a Cyprus domicile of origin can instead elect to pay a lump sum of €250,000 covering five tax years of Special Defence Contribution, subject to the Tax Commissioner’s approval.
From , Article 20E taxes profits from disposal of crypto-assets not acquired through mining at 8%; mining-related gains remain within the general income-tax rules.
For non-resident individual shareholders extracting profits via dividends, no withholding tax applies, which keeps the all-in tax cost on distributed founder profits competitive in the EU; dividends to associated companies in low-tax or EU-listed non-cooperative jurisdictions bear 5% or 17%.
DORA (Regulation (EU) 2022/2554) applies to Cyprus CASPs from . The framework covers ICT risk management (board-approved governance, risk identification, classification, mitigation), ICT third-party risk (register, contractual safeguards, exit strategies, concentration risk), incident reporting (classification per DORA Article 18, reporting to CySEC within stated timeframes), digital operational resilience testing (annual BCP, three-year TLPT cycle for significant entities), and ICT-related information sharing. CySEC expects the DORA package to be complete on initial application, not deferred to post-authorisation.
Quarterly client-asset statements; annual audited financial statements within four months of year-end; annual independent AML audit; capital adequacy review against the 25%-of-fixed-overheads test; per-event suspicious-transaction reporting to MOKAS; complaints reporting; market-abuse surveillance reporting for trading platforms; notifications of qualifying-holding changes, board changes, and material outsourcing; and DORA incident reports. The authorisation is indefinite; the annual fee, charged pro rata from the month services start, combines fixed components per service with a turnover-based variable component, capped together at €500,000 a year, and a separate DORA fee of €2,000 to €20,000 applies by entity size.
Cyprus Company Formation
Incorporate the Cyprus Ltd for your CASP application, with the substance in place before filing.
Open a Crypto Business Account
Cyprus credit institutions for client funds under MiCA Article 70(3), plus EU EMIs for operating flows.
Estonia CASP Licensing
The cost-leader EU alternative: 0% retained corporate tax, a shorter end-to-end timeline, lower run-rate.
Start Your Cyprus CASP Application
Send us your Cyprus crypto-licensing brief. We scope the requirements in writing, then introduce you to an independent specialist.
Not ready to submit a brief? Ask Emma first. She answers now and can collect your written brief for a specialist introduction.
References
Show all references
- Finance Magnates, “New European Rules May Attract More Serious Asset Managers to Cyprus,” Says CySEC Chair, financemagnates.com, accessed .
- The Sovereign Group, Cyprus Tax Reform 2026: Corporate and Personal Tax Changes, sovereigngroup.com, accessed .
- European Securities and Markets Authority, Interim MiCA register: crypto-asset service providers (CASPS file, edition of ; the file also lists credit institutions and other financial entities that notified under MiCA Article 60), esma.europa.eu, accessed .
- Harris Kyriakides, Cyprus Enacts New AML Law Aligned with EU Crypto-Asset Framework, harriskyriakides.law, accessed .
- Harneys, CySEC Updates on Transitional Measures for Crypto-Asset Providers and Local CASP Regime, harneys.com, accessed .
- Cyprus Securities and Exchange Commission, Press Release: MiCA Licence Applications Due by 27 February 2026, cysec.gov.cy, accessed .
- European Securities and Markets Authority, Guidelines on Reverse Solicitation Under MiCA (ESMA35-1872330276-2030), esma.europa.eu, accessed .
- European Union, Regulation (EU) 2022/2554 (DORA), eur-lex.europa.eu, accessed .
- European Union, Regulation (EU) 2023/1114 (MiCA), eur-lex.europa.eu, accessed .
- Central Bank of Cyprus, Dual Licensing of CASPs Under PSD2, centralbank.cy, accessed .
- KPMG Cyprus, Markets in Crypto-Assets Regulation (MiCA), August 2025, kpmg.com (archived), accessed .
- Council of the European Union, Council Directive (EU) 2023/2226 (DAC8), eur-lex.europa.eu, accessed .
- European Securities and Markets Authority, Fast-Track Peer Review on a CASP Authorisation and Supervision in Malta (ESMA42-2004696504-8164), esma.europa.eu, accessed .
- European Union, Regulation (EU) 2023/1113 (Transfer of Funds Regulation), eur-lex.europa.eu, accessed .
- Cyprus Securities and Exchange Commission, MiCA Information Hub, cysec.gov.cy, accessed .
- European Securities and Markets Authority, List of Competent Authorities Designated Under MiCA Article 93, esma.europa.eu, accessed .
- Lexology, Cyprus Tax Reform 2026: A Comprehensive Legal Analysis of the New Tax Framework in Force from 1 January 2026, lexology.com, accessed .
- ITR World Tax, Cyprus Tax Reform Updates Effective from 2026, itrworldtax.com, accessed .
- Maples Group, ESMA Reverse Solicitation Guidance MiCA, maples.com, accessed .
- Finance Magnates, Capital.com’s Crypto Ambitions Become Imminent as It Secures a MiCA License in Cyprus, financemagnates.com, accessed .
- Cyprus Securities and Exchange Commission, Policy Statement PS-03-2024 on Fees Payable by Entities Falling Under MiCAR and Directive DI 73-2009-04, cysec.gov.cy, accessed .
- OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, Jurisdictions committed to implement the Crypto-Asset Reporting Framework (CARF) in time to commence exchanges in 2027, 2028 or 2029 (last update 14 September 2026), oecd.org, accessed .
- EFTA, EEA-Lex: Regulation (EU) 2023/1114 (MiCA), incorporated into the EEA Agreement by Joint Committee Decision No 41/2025 and in force in the EEA from 24 June 2025; Directive (EU) 2015/2366 (PSD2), JCD 165/2019, in force 1 May 2022; Directive 2009/110/EC (EMD2), JCD 120/2010, in force 1 November 2012; Directive 2014/65/EU (MiFID II), JCD 78/2019, in force 3 December 2019, efta.int, accessed .
- MONEYVAL, Anti-money laundering and counter-terrorist financing measures: Cyprus, 4th Enhanced Follow-up Report and Technical Compliance Re-Rating (MONEYVAL(2025)2), adopted by written procedure on , rm.coe.int, accessed .
- MONEYVAL, Anti-money laundering and counter-terrorist financing measures: Cyprus, Fifth Round Mutual Evaluation Report, Executive Summary, adopted , rm.coe.int, accessed .
- Cyprus Securities and Exchange Commission, Directive DI 73-2009-04 on Markets in Crypto-Assets (Charges and Fees) of 2024 (R.A.D. 415/2024), unofficial English translation, paragraphs 5(3) and 6(2)–(3), cysec.gov.cy, accessed .
- Cyprus Securities and Exchange Commission, Press release: CySEC issues Policy Statement on fees related to DORA Regulation (PS-03-2025), , cysec.gov.cy; Circular C731: Annual fees in relation to the DORA Regulation, , cysec.gov.cy; Policy Statement PS-03-2025, Annex I (Directive DI 73-2009-07, paragraph 4: DORA fee payable by 30 November, prorated in the year of grant from the month of authorisation), cysec.gov.cy, accessed .
- Cyprus Securities and Exchange Commission, Announcement: Crypto-asset services may only be provided in accordance with the provisions of the Markets in Crypto-Assets Regulation, , cysec.gov.cy, accessed .
- Republic of Cyprus, Income Tax (Amendment) (No. 4) Law of 2025, Law 244(I)/2025, Official Gazette No. 5070, (Article 20E on crypto-asset disposals; seven-year loss carry-forward; incorporation test; 15% rate), cylaw.org, accessed .
- Republic of Cyprus, Special Defence Contribution (Amendment) (No. 4) Law of 2025, Law 245(I)/2025, Official Gazette No. 5070, (Article 2(3) deemed domicile; Article 3 dividend rates; Article 3Δ lump-sum election), cylaw.org, accessed .
- Republic of Cyprus, Law 151(I)/2024 on securing a global minimum level of taxation of multinational enterprise groups and large-scale domestic groups in the Union, cylaw.org, accessed .
- Republic of Cyprus, Administrative Cooperation in the Field of Taxation (Amendment) Law of 2026, Law 38(I)/2026 (transposing Directive (EU) 2023/2226, DAC8), Official Gazette No. 5081, , cylaw.org, accessed .
- Republic of Cyprus, Income Tax Law N.118(I)/2002, consolidated (Article 9(1)(κ), 80% deduction for qualifying intangible-asset profits; Article 21, 10% on royalties for rights used in Cyprus; Article 21A, 10% on royalties paid to associated companies in EU-listed non-cooperative jurisdictions), cylaw.org, accessed .
- Cyprus Securities and Exchange Commission, Directive for the Register of Crypto Asset Services Providers of 2021 to 2023 (R.A.D. 269/2021, as amended), unofficial English consolidation, paragraph 14 (capital adequacy; including the investment-firm exception), cysec.gov.cy, accessed .
- European Banking Authority, EBA/Op/2025/08, paragraph 23, EBA opinion (FMA copy); MiCA Article 70(4), esma.europa.eu, accessed .
- Republic of Cyprus, Prevention and Suppression of Money Laundering Law 188(I)/2007, section 2 (beneficial owner), cylaw.org, accessed .
- European Union, Regulation (EU) 2024/1624 (AMLR), Articles 51, 52 and 90 (ownership, control and application), eur-lex.europa.eu, accessed .