Crypto Regulation in Cyprus: 2026 Update

Crypto regulation in Cyprus sits at the intersection of EU-level rules and national implementation, making it one of the more structured and internationally recognised frameworks in Europe. Cyprus has transposed the EU';s Markets in Crypto-Assets Regulation (MiCA) into its domestic legal order, while the Cyprus Securities and Exchange Commission (CySEC) serves as the primary supervisory authority for crypto-asset service providers. For founders and operators considering Cyprus as a base, understanding both layers - EU-wide obligations and local CySEC requirements - is essential before launching any product or service. This guide covers the current regulatory framework, licensing requirements, compliance obligations, recent legislative developments, and what businesses should expect when operating in this jurisdiction.

Cyprus operates under a dual-layer regulatory structure. At the EU level, MiCA establishes a harmonised rulebook for crypto-asset service providers (CASPs) and issuers of crypto-assets across all member states. At the national level, CySEC administers the registration and supervision of entities providing crypto-related services to clients in Cyprus or passporting into other EU markets.

Before MiCA came into full effect, Cyprus had already established a national VASP (Virtual Asset Service Provider) registration regime under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007, as amended). This regime required entities offering exchange, transfer, or custody services for virtual assets to register with CySEC and comply with anti-money laundering (AML) obligations. The VASP register served as a transitional mechanism, allowing businesses to operate while the EU-wide framework was being finalised.

Under MiCA, the concept of a VASP has been replaced by the broader category of CASP. The regulation covers a wider range of services, including the operation of trading platforms, portfolio management in crypto-assets, advice on crypto-assets, and the issuance of asset-referenced tokens and e-money tokens. Cyprus, as an EU member state, applies MiCA directly, meaning that a CASP authorised by CySEC can passport its services across the entire EU single market without requiring separate licences in each member state.

CySEC has published detailed guidance on the transition from VASP registration to full CASP authorisation under MiCA, including transitional periods for existing registrants. Businesses that were registered under the old VASP regime have been given a defined window to apply for full MiCA authorisation or wind down their activities in Cyprus.

Obtaining a CASP licence from CySEC is the central regulatory step for any crypto business wishing to operate legally in Cyprus or use Cyprus as an EU passport hub. The authorisation process is substantive and involves a detailed review of the applicant';s governance, capital, AML controls, and operational resilience.

Key requirements for CASP authorisation in Cyprus include:

• A registered legal entity in Cyprus (typically a private limited company under the Companies Law, Cap. 113).
• Minimum initial capital, which varies by the type of service offered - ranging from a lower threshold for advice-only services to a higher requirement for firms operating trading platforms or holding client assets.
• Fit and proper assessment of directors, senior managers, and qualifying shareholders.
• A robust AML and counter-terrorist financing (CTF) programme, including a designated compliance officer and money laundering reporting officer (MLRO).
• Organisational and operational requirements covering IT security, business continuity, and conflict of interest policies.
• A detailed business plan and financial projections submitted to CySEC.

The application process typically takes several months from the date of submission of a complete file. CySEC has the authority to request additional information, which can extend the timeline. In practice, well-prepared applications with experienced compliance teams tend to move faster. Incomplete submissions are a common cause of delay, particularly where AML policies or governance documentation do not meet CySEC';s standards.

A non-obvious requirement is that CySEC expects the applicant entity to have genuine substance in Cyprus. This means local directors with relevant expertise, a physical office, and operational staff - not merely a registered address. Foreign founders who attempt to establish a shell entity in Cyprus while running all operations from abroad frequently encounter pushback during the authorisation review.

If you are structuring a CASP application or assessing whether your business model falls within MiCA';s scope, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

MiCA distinguishes between three categories of crypto-assets: asset-referenced tokens (ARTs), e-money tokens (EMTs), and a residual category covering other crypto-assets (sometimes called utility tokens or general crypto-assets). Each category carries different obligations for issuers.

For issuers of general crypto-assets, MiCA requires the publication of a white paper that meets specific content standards. The white paper must describe the issuer, the project, the rights attached to the token, the underlying technology, and the risks involved. It must be notified to CySEC before publication. Importantly, the white paper does not require prior approval by CySEC for general crypto-assets - notification is sufficient. However, the issuer remains liable for the accuracy and completeness of the document.

For ARTs and EMTs, the requirements are significantly more demanding. Issuers of ARTs must obtain prior authorisation from CySEC (or the competent authority in their home member state) and maintain reserve assets backing the tokens. EMT issuers must be authorised either as a credit institution or as an electronic money institution. These categories are subject to ongoing capital, liquidity, and redemption obligations.

A common mistake among founders is underestimating the classification exercise. Whether a token is a general crypto-asset, an ART, or an EMT has significant consequences for the regulatory burden. Tokens that reference a basket of currencies or assets, or that are marketed as stable in value, are likely to be classified as ARTs regardless of the label the issuer applies. CySEC has signalled that it will scrutinise token structures carefully, and misclassification carries legal and financial risk.

In practice, founders should consider obtaining a formal legal opinion on token classification before publishing any marketing materials or white papers. This is not merely a formality - it shapes the entire regulatory pathway.

AML compliance is a cornerstone of the Cypriot regulatory framework for crypto businesses, and CySEC enforces it actively. The relevant legal basis is the Prevention and Suppression of Money Laundering and Terrorist Financing Law, which implements the EU';s Anti-Money Laundering Directives into Cypriot law. CASPs are classified as obliged entities under this law and must implement a full AML programme.

Core ongoing AML obligations include:

• Customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk clients or transactions.
• Ongoing monitoring of business relationships and transactions.
• Suspicious transaction reporting to the Cyprus Unit for Combating Money Laundering (MOKAS).
• Record-keeping for a minimum period as specified by law.
• Regular AML risk assessments updated to reflect changes in the business model or client base.

CySEC conducts both on-site and off-site supervisory reviews of CASPs. Penalties for AML failures can include administrative fines, public censure, suspension of authorisation, and in serious cases, referral to criminal authorities. Many underestimate the resource commitment required to maintain a compliant AML function on an ongoing basis - it is not a one-time setup exercise.

The Travel Rule, derived from the Financial Action Task Force (FATF) recommendations and implemented in EU law, also applies to CASPs in Cyprus. This requires that information about the originator and beneficiary of crypto-asset transfers above a certain threshold accompanies the transaction. Implementing Travel Rule compliance requires technical infrastructure and counterparty agreements, which can be a significant operational challenge for smaller firms.

Beyond AML, CASPs authorised under MiCA must comply with ongoing reporting obligations to CySEC, including periodic financial reports, incident notifications, and material change notifications. Failure to notify CySEC of significant changes to the business - such as a change of control, a new service line, or a material IT incident - is a common compliance gap.

Cyprus is a realistic choice for a range of business models, but it suits some more than others. Understanding where Cyprus adds value - and where it may not - helps founders make an informed decision.

Scenario one: a European crypto exchange seeking an EU passport. A crypto exchange operator based outside the EU wants to offer services to retail and institutional clients across Europe. By establishing a CASP-authorised entity in Cyprus, the operator gains access to the EU single market through MiCA';s passporting mechanism. Cyprus offers a relatively accessible regulatory environment compared to some larger EU jurisdictions, a well-developed legal and professional services sector, and a favourable corporate tax rate of 12.5% on net profits. The operator sets up a Cypriot private limited company, appoints local directors, and builds an AML function in Nicosia. After authorisation, it passports into Germany, France, and the Netherlands without separate licences.

Scenario two: a token issuer planning a public offering. A technology company plans to issue utility tokens to fund development of a decentralised platform. The founders are based in Asia but want EU regulatory credibility for their offering. They incorporate in Cyprus, engage local legal counsel to classify the token and draft a MiCA-compliant white paper, and notify CySEC before publication. Because the token is classified as a general crypto-asset rather than an ART, the process is faster and less capital-intensive than full ART authorisation. The white paper is published, and the offering proceeds to EU retail investors within the MiCA framework.

Both scenarios illustrate that Cyprus works best when the business has genuine substance and a clear regulatory strategy from the outset. Founders who treat Cyprus as a convenience jurisdiction without building real operational presence tend to face difficulties during supervisory review.

For a detailed assessment of whether Cyprus is the right jurisdiction for your specific crypto business model, contact info@vlolawfirm.com. We can assist with documents and filings.

The regulatory landscape for crypto in Cyprus has evolved rapidly in recent years, and several developments are shaping the current environment.

CySEC has increased its supervisory intensity following the broader EU push for consistent MiCA enforcement across member states. The regulator has published updated guidance on CASP authorisation requirements, clarified its expectations on substance, and issued warnings to entities that continue to offer crypto services without proper authorisation. Enforcement actions against unregistered operators have become more frequent.

The transition from the old VASP registration regime to full MiCA CASP authorisation has been a significant operational challenge for many businesses. Entities that were registered under the transitional regime but have not yet obtained full MiCA authorisation are operating under a defined grace period. Once that period expires, continued operation without authorisation constitutes a regulatory breach. Businesses in this position should treat the authorisation process as an immediate priority.

At the EU level, the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) have published technical standards and guidelines that supplement MiCA';s core text. These cover areas such as white paper content requirements, complaints handling, conflicts of interest, and the classification of crypto-assets. CySEC is expected to incorporate these standards into its supervisory practice, meaning that compliance programmes must track not only the MiCA regulation itself but also the evolving body of Level 2 and Level 3 measures.

Cyprus is also developing its approach to decentralised finance (DeFi) and non-fungible tokens (NFTs), areas where MiCA';s coverage is limited or absent. CySEC has indicated that it is monitoring developments at the EU level and will issue guidance as the regulatory perimeter becomes clearer. For now, businesses operating in these spaces should seek specific legal advice on whether their activities fall within or outside the current regulatory framework.

What is the practical difference between the old VASP registration and a MiCA CASP authorisation in Cyprus?

The VASP registration was a lighter-touch national regime focused primarily on AML compliance. It allowed entities to register with CySEC and operate in Cyprus, but it did not grant passporting rights across the EU. MiCA CASP authorisation is a full prudential and conduct licence that imposes capital requirements, governance standards, and ongoing reporting obligations. It also grants the holder the right to passport services across all EU member states without separate national licences. The substantive difference in compliance burden is significant - CASP authorisation requires considerably more organisational infrastructure than VASP registration did. Businesses that were comfortable under the old regime should not assume that their existing setup meets MiCA standards.

How long does it take to obtain a CASP licence from CySEC, and what does it cost?

The formal review period under MiCA is up to three months from the date CySEC confirms that the application is complete. In practice, the total timeline from initial preparation to authorisation is typically longer - often six to twelve months - because assembling a complete application file takes time, and CySEC frequently requests additional information during the review. Professional fees for legal, compliance, and consulting support vary depending on the complexity of the business model and the state of the applicant';s existing documentation. State and regulatory fees are set by CySEC and vary by service category. Ongoing compliance costs - including the MLRO function, AML technology, and regulatory reporting - represent a material recurring expense that founders should budget for from the outset.

Can a non-EU founder or shareholder obtain a CASP licence in Cyprus?

Yes. MiCA does not restrict ownership of a CASP to EU nationals or entities. Non-EU founders and shareholders can hold qualifying stakes in a Cyprus CASP, subject to the fit and proper assessment that CySEC applies to all qualifying shareholders. This assessment covers financial soundness, reputation, and the absence of relevant criminal convictions. What matters more than nationality is substance: CySEC expects the authorised entity to have genuine operational presence in Cyprus, with local directors who have relevant expertise and decision-making authority. A structure where all real management and operations remain outside Cyprus is unlikely to satisfy CySEC';s substance requirements, regardless of the ownership structure.

Cyprus offers a well-structured and EU-compliant environment for crypto businesses, anchored by MiCA and supervised by CySEC. The jurisdiction provides genuine passporting benefits, a developed professional services sector, and a clear regulatory pathway - but only for businesses prepared to meet substantive authorisation and ongoing compliance requirements. The transition from the old VASP regime to full MiCA authorisation is the defining regulatory event of the current period, and businesses that have not yet completed this transition should act without delay.

VLO Law Firms advises international clients on crypto regulation in Cyprus. We can assist with CASP licence applications, token classification, white paper preparation, AML programme design, and ongoing CySEC compliance. To request a consultation, contact: info@vlolawfirm.com