Introduction
Cyprus has established itself as an attractive jurisdiction for businesses operating in the cryptocurrency, blockchain, and digital asset sectors. Its membership of the European Union, strategic geographical position, developed financial services industry, and access to the European Single Market make it an appealing destination for companies seeking to establish and expand their crypto-related operations.
However, operating a cryptocurrency business in Cyprus requires careful consideration of the applicable regulatory framework. Under the European Union’s Markets in Crypto-Assets Regulation (MiCA), businesses providing regulated crypto-asset services must obtain the appropriate authorisation before commencing their activities.
A Crypto-Asset Service Provider (CASP) licence in Cyprus enables eligible businesses to provide regulated crypto-asset services under a harmonised European regulatory framework, subject to the applicable authorisation and passporting requirements.
The Cyprus Securities and Exchange Commission (CySEC) is the principal competent authority responsible for authorising and supervising CASPs in Cyprus.
This article examines the CASP licensing framework in Cyprus, the applicable regulatory requirements, the authorisation process, compliance obligations, and the advantages of establishing a licensed crypto business in the jurisdiction.
What Is a CASP Licence?
A Crypto-Asset Service Provider licence is a regulatory authorisation required under Regulation (EU) 2023/1114, commonly known as the Markets in Crypto-Assets Regulation (MiCA).
MiCA establishes a harmonised regulatory framework for crypto-asset markets throughout the European Union. Its purpose is to increase transparency, strengthen consumer and investor protection, address financial stability risks, and provide legal certainty for businesses operating in the digital asset industry.
A company intending to provide one or more regulated crypto-asset services must obtain authorisation unless it falls within an applicable exemption or notification regime.
The CASP framework covers a broad range of business models, including cryptocurrency exchanges, digital asset brokers, custodial wallet providers, trading platforms, and crypto portfolio management businesses.
Which Businesses Require a CASP Licence in Cyprus?
Under MiCA, authorisation is generally required for businesses professionally providing crypto-asset services to clients.
The regulated activities include:
- Custody and administration of crypto-assets: Safeguarding crypto-assets or the means of accessing or controlling them on behalf of clients.
- Operation of a trading platform: Operating a platform that brings together multiple third-party buying and selling interests in crypto-assets.
- Exchange of crypto-assets for funds: Facilitating the exchange of cryptocurrencies for fiat currencies.
- Exchange of crypto-assets for other crypto-assets: Providing cryptocurrency-to-cryptocurrency exchange services.
- Execution of orders: Executing crypto-asset orders on behalf of clients.
- Reception and transmission of orders: Receiving client instructions and transmitting them to another party for execution.
- Placement of crypto-assets: Marketing or distributing crypto-assets on behalf of an offeror or a person connected with the offeror.
- Transfer services: Transferring crypto-assets from one distributed ledger address or account to another on behalf of clients.
- Providing advice: Offering personalised recommendations concerning crypto-asset transactions.
- Portfolio management: Managing portfolios containing crypto-assets on a discretionary client mandate.
The precise regulatory classification depends on the actual services provided, the contractual arrangements, the operational structure, and the business model of the applicant.
It is therefore important to assess the proposed activities before establishing the company or submitting an application.
The Regulatory Authority: CySEC
The Cyprus Securities and Exchange Commission (CySEC) is the principal regulatory authority responsible for CASP authorisation and supervision in Cyprus.
Under MiCA, CySEC assesses applications, evaluates the suitability of shareholders and management, reviews organisational arrangements, and supervises authorised providers.
The regulator examines whether an applicant has the financial resources, governance structure, internal controls, technical infrastructure, and compliance arrangements necessary to provide crypto-asset services responsibly.
The authorisation framework also requires CASPs to comply with applicable European requirements concerning:
- Anti-money laundering and counter-terrorist financing.
- Customer due diligence and Know Your Customer (KYC) procedures.
- Governance and internal control arrangements.
- Safeguarding of client crypto-assets and funds.
- Information security and operational resilience.
- Conflicts of interest.
- Complaints handling.
- Record keeping and regulatory reporting.
- Prevention and detection of market abuse.
CASP Licensing Requirements in Cyprus
A company seeking CASP authorisation in Cyprus must demonstrate that it satisfies the relevant requirements under MiCA and the applicable regulatory and technical standards.
The main requirements include the following.
- Establishment and Corporate Structure
The applicant must establish an appropriate legal and operational structure within the European Union in accordance with MiCA.
The corporate structure should clearly identify the company’s ownership, management responsibilities, operational functions, and reporting lines.
The applicant must demonstrate that its proposed establishment and management arrangements satisfy the applicable regulatory requirements.
- Shareholders and Beneficial Owners
CySEC assesses the suitability of shareholders and individuals holding qualifying holdings in the applicant.
The assessment generally considers:
- Reputation and integrity.
- Financial soundness.
- Source of wealth and source of funds, where relevant.
- Ownership and control arrangements.
- Potential conflicts of interest.
- The suitability of direct and indirect qualifying shareholders.
The ownership structure should be transparent and properly documented.
- Management and Key Personnel
The members of the management body must satisfy applicable fit-and-proper requirements.
CySEC considers the reputation, knowledge, skills, experience, and availability of individuals responsible for managing the business.
The company should have clearly defined responsibilities and an appropriate governance framework, including sufficient expertise in financial services, compliance, risk management, technology, and crypto-asset operations.
- Minimum Capital Requirements
MiCA establishes minimum prudential safeguards depending on the crypto-asset services provided.
The applicable permanent minimum capital requirements generally fall into three categories:
- Class 1 – €50,000: For specified services, including reception and transmission of orders, execution of orders, placement, transfer services, and providing advice.
- Class 2 – €125,000: For services such as custody and administration of crypto-assets, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, and portfolio management.
- Class 3 – €150,000: For operating a crypto-asset trading platform.
These amounts represent the applicable minimum capital thresholds under the MiCA classification. The actual prudential requirement must also be assessed in accordance with the relevant own-funds calculation and ongoing capital requirements.
Applicants should ensure that sufficient financial resources are available to support their intended activities and operational commitments.
Additional Regulatory Considerations: Payment Services and Stablecoins
Obtaining CASP authorisation does not necessarily mean that every activity involving digital assets is covered by that authorisation.
Certain services involving electronic money tokens (EMTs), particularly specific transfers and custody arrangements, may also constitute payment services under the Payment Services Directive (PSD2).
Depending on the business model, an additional authorisation from the Central Bank of Cyprus (CBC), or an appropriate arrangement with an authorised payment service provider, may be required.
Businesses should therefore assess their payment-related activities separately from their CASP authorisation requirements.
Furthermore, the issuance of asset-referenced tokens and electronic money tokens is subject to specific MiCA requirements. A CASP licence should not be confused with an authorisation to issue these types of tokens.
For more information please contact: marketing@osysglobal.com
