CASP License in Cyprus

Crypto Asset Regulation in Cyprus

Cyprus has positioned itself as a forward-thinking jurisdiction for crypto asset businesses within the European Union. The regulation of Crypto Asset Service Providers (CASPs) in Cyprus falls under the supervision of the Cyprus Securities and Exchange Commission (CySEC), which serves as the competent authority for the registration and oversight of crypto asset activities.

With the entry into force of the EU’s Markets in Crypto-Assets Regulation (MiCA) — Regulation (EU) 2023/1114 — Cyprus has adopted a comprehensive, harmonised regulatory framework for crypto-assets. MiCA replaces the previous national registration regime and establishes uniform requirements across all EU member states, ensuring legal certainty and investor protection while fostering innovation.

What Is a CASP License?

A Crypto Asset Service Provider (CASP) is any legal person or undertaking whose occupation or business involves the provision of one or more crypto-asset services to clients on a professional basis. Under MiCA, the following services require CASP authorisation:

• Custody and administration of crypto-assets on behalf of clients.
• Operation of a trading platform for crypto-assets (exchanges).
• Exchange of crypto-assets for funds (fiat-to-crypto and crypto-to-fiat).
• Exchange of crypto-assets for other crypto-assets (crypto-to-crypto).
• Execution of orders for crypto-assets on behalf of clients.
• Placing of crypto-assets (assisting in the distribution of newly issued crypto-assets).
• Reception and transmission of orders for crypto-assets on behalf of clients.
• Providing advice on crypto-assets.
• Providing portfolio management of crypto-assets.
• Providing transfer services for crypto-assets on behalf of clients.

Why Cyprus for a CASP License?

Cyprus offers several distinct advantages for crypto asset businesses:

• Early mover advantage – Cyprus was among the first EU member states to establish a domestic registration regime for crypto firms, and CySEC has accumulated significant experience in supervising such entities.
• Favourable tax environment – The standard corporate tax rate of 15%, combined with the IP Box regime and other incentives, creates a tax-efficient base for technology companies.
• EU passporting – Under MiCA, a CASP authorised in Cyprus can provide its services across all EU/EEA member states without the need for separate authorisation in each country.
• Skilled workforce – Cyprus has a well-educated, multilingual workforce with growing expertise in fintech, blockchain technology, and digital finance.
• Supportive regulatory environment – CySEC has adopted a constructive approach to fintech innovation, engaging with the industry through its Innovation Hub and providing guidance to applicants.
• Strategic location and time zone – Cyprus’s location bridges European and Asian markets, which is beneficial for 24/7 crypto trading operations.

Requirements for CASP Authorisation

Legal Entity and Governance

The applicant must be a legal person incorporated or established in Cyprus. The entity must have a registered office and its effective management (head office) in Cyprus. A robust organisational structure must be in place, including clearly defined roles, internal controls, and governance arrangements.

Capital Requirements

MiCA establishes minimum capital requirements based on the type of crypto-asset services provided:

Additionally, CASPs must maintain own funds equal to at least a quarter of the fixed overheads of the preceding year, where this amount exceeds the minimum capital requirement.

Fit and Proper Requirements

All members of the management body, qualifying shareholders, and persons responsible for key functions must satisfy fit-and-proper criteria. This includes demonstrating sufficient knowledge, skills, and experience relevant to the crypto-asset services to be provided, as well as having good repute and no criminal record for serious offences including financial crimes.

AML/CFT Compliance

CASPs must implement comprehensive anti-money laundering and counter-terrorist financing (AML/CFT) policies and procedures in accordance with EU Directive 2015/849 (AMLD5) and its transposition into Cyprus law. This includes customer due diligence (CDD), ongoing transaction monitoring, suspicious transaction reporting, and the appointment of a dedicated AML compliance officer.

Operational and IT Requirements

CASPs must demonstrate robust IT systems, cybersecurity measures, and business continuity plans. Where custody services are provided, the CASP must have adequate safeguarding arrangements for client assets, including the segregation of client crypto-assets from proprietary holdings.

Application Process and Timeline

1. Pre-application engagement – Informal discussions with CySEC to clarify the business model and applicable regulatory requirements.
2. Preparation of the application – Compile the comprehensive application dossier, including business plan, organisational chart, compliance manuals, IT security documentation, financial projections, and fit-and-proper documentation for key personnel.
3. Submission of the application – File the formal application with CySEC together with all supporting documents and the application fee.
4. CySEC review – CySEC reviews the application, which may include requests for clarifications, additional documentation, and meetings with the applicant. Under MiCA, CySEC must make a decision within 40 working days (extendable to 25 additional working days in complex cases).
5. Authorisation decision – CySEC issues the authorisation or provides reasons for rejection. Successful applicants are entered into the ESMA register of CASPs.

The overall timeline from preparation to authorisation typically ranges from 4 to 9 months, depending on the complexity of the business model and the completeness of the initial application.

Ongoing Compliance Obligations

Once authorised, a CASP must maintain continuous compliance with MiCA requirements, including:

• Maintaining adequate capital at all times.
• Filing periodic regulatory reports with CySEC.
• Publishing a white paper for any crypto-assets offered to the public (where applicable).
• Implementing and maintaining client complaint handling procedures.
• Ensuring fair, clear, and not misleading marketing communications.
• Cooperating with CySEC during inspections and investigations.