CASP Licensing
Introduction
Guide to Crypto-Asset Service Provider Authorisation Under MiCA in Cyprus
CASP licensing in Cyprus represents an important opportunity for businesses seeking to enter or expand within the regulated European cryptocurrency and digital asset market.
With the full implementation of MiCA and the expiry of the transitional period on 1 July 2026, obtaining the appropriate regulatory authorisation has become essential for businesses providing regulated crypto-asset services in or from Cyprus.
Although the licensing process requires substantial preparation, a well-structured application, supported by appropriate legal, compliance, financial, and technological arrangements, can provide a strong foundation for establishing a sustainable crypto-asset business.
Cyprus remains a strategically attractive jurisdiction for digital asset businesses seeking access to the European market through a regulated and transparent operating environment.
Why Choose Cyprus for CASP Licensing?
Cyprus offers several advantages for businesses seeking to establish a regulated crypto-asset operation.
- European Union membership: Cyprus provides access to the EU regulatory framework and the potential to passport authorised services across participating Member States.
- Established financial services sector: The country has an established professional services industry, including legal, accounting, compliance, and corporate advisory firms.
- Strategic location: Cyprus offers a geographical connection between Europe, the Middle East, and other international markets.
- Regulatory framework: The implementation of MiCA provides a harmonised framework for businesses seeking to operate within the European crypto-asset industry.
- Business infrastructure: Cyprus offers an established corporate environment and access to professionals with experience in financial services and regulatory compliance.
These advantages make Cyprus an attractive jurisdiction for eligible businesses seeking to develop a compliant and sustainable presence in the European digital asset market.
How Professional Assistance Can Support Your CASP Application
The CASP authorisation process involves multiple legal, financial, operational, and regulatory considerations.
Professional assistance can help businesses navigate the process efficiently and avoid common regulatory challenges.
A structured advisory engagement may include:
- Initial regulatory assessment of the proposed business model.
- Identification of the required authorisation and ancillary permissions.
- Cyprus company formation and corporate structuring.
- Preparation of the regulatory business plan.
- Assistance with shareholder and management documentation.
- Development of AML/KYC policies and procedures.
- Preparation of internal governance and risk management frameworks.
- Assistance with IT, cybersecurity, and operational resilience documentation.
- Coordination of the application submission.
- Support in responding to regulatory requests.
- Ongoing compliance and regulatory support following authorisation.
The objective is to ensure that the applicant is appropriately structured and adequately prepared to meet the regulator’s expectations.
Which Businesses Require a CASP Licence in Cyprus?
Under MiCA, authorisation is generally required for businesses professionally providing crypto-asset services to clients.
The regulated activities include:
Custody and administration of crypto-assets
Safeguarding crypto-assets or the means of accessing or controlling them on behalf of clients.
Operation of a trading platform
Operating a platform that brings together multiple third-party buying and selling interests in crypto-assets.
Exchange of crypto-assets for funds
Facilitating the exchange of cryptocurrencies for fiat currencies.
Exchange of crypto-assets for other crypto-assets
Providing cryptocurrency-to-cryptocurrency exchange services.
Execution of orders
Executing crypto-asset orders on behalf of clients.
Reception and transmission of orders
Receiving client instructions and transmitting them to another party for execution.
Placement of crypto-assets
Marketing or distributing crypto-assets on behalf of an offeror or a person connected with the offeror.
Transfer services
Transferring crypto-assets from one distributed ledger address or account to another on behalf of clients.
Providing advice
Offering personalised recommendations concerning crypto-asset transactions.
Portfolio management
Managing portfolios containing crypto-assets on a discretionary client mandate.
The precise regulatory classification depends on the actual services provided, the contractual arrangements, the operational structure, and the business model of the applicant.
It is therefore important to assess the proposed activities before establishing the company or submitting an application.
The Regulatory Authority: CySEC
The Cyprus Securities and Exchange Commission (CySEC) is the principal regulatory authority responsible for CASP authorisation and supervision in Cyprus.
Under MiCA, CySEC assesses applications, evaluates the suitability of shareholders and management, reviews organisational arrangements, and supervises authorised providers.
The regulator examines whether an applicant has the financial resources, governance structure, internal controls, technical infrastructure, and compliance arrangements necessary to provide crypto-asset services responsibly.
The authorisation framework also requires CASPs to comply with applicable European requirements concerning:
- Anti-money laundering and counter-terrorist financing.
- Customer due diligence and Know Your Customer (KYC) procedures.
- Governance and internal control arrangements.
- Safeguarding of client crypto-assets and funds.
- Information security and operational resilience.
- Conflicts of interest.
- Complaints handling.
- Record keeping and regulatory reporting.
- Prevention and detection of market abuse.
CASP Licensing Requirements in Cyprus
A company seeking CASP authorisation in Cyprus must demonstrate that it satisfies the relevant requirements under MiCA and the applicable regulatory and technical standards.
The main requirements include the following.
The applicant must establish an appropriate legal and operational structure within the European Union in accordance with MiCA.
The corporate structure should clearly identify the company’s ownership, management responsibilities, operational functions, and reporting lines.
The applicant must demonstrate that its proposed establishment and management arrangements satisfy the applicable regulatory requirements.
CySEC assesses the suitability of shareholders and individuals holding qualifying holdings in the applicant.
The assessment generally considers:
- Reputation and integrity.
- Financial soundness.
- Source of wealth and source of funds, where relevant.
- Ownership and control arrangements.
- Potential conflicts of interest.
- The suitability of direct and indirect qualifying shareholders.
The ownership structure should be transparent and properly documented.
The members of the management body must satisfy applicable fit-and-proper requirements.
CySEC considers the reputation, knowledge, skills, experience, and availability of individuals responsible for managing the business.
The company should have clearly defined responsibilities and an appropriate governance framework, including sufficient expertise in financial services, compliance, risk management, technology, and crypto-asset operations.
MiCA establishes minimum prudential safeguards depending on the crypto-asset services provided.
The applicable permanent minimum capital requirements generally fall into three categories:
| CLASS | MINIMUM CAPITAL | SERVICES |
|---|---|---|
| Class 1 | €50,000 | For specified services, including reception and transmission of orders, execution of orders, placement, transfer services, and providing advice. |
| Class 2 | €125,000 | For services such as custody and administration of crypto-assets, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, and portfolio management. |
| Class 3 | €150,000 | For operating a crypto-asset trading platform. |
These amounts represent the applicable minimum capital thresholds under the MiCA classification. The actual prudential requirement must also be assessed in accordance with the relevant own-funds calculation and ongoing capital requirements.
Applicants should ensure that sufficient financial resources are available to support their intended activities and operational commitments.
Anti-money laundering compliance is a fundamental component of CASP authorisation.
A CASP must implement appropriate policies and procedures to identify, assess, and mitigate money laundering and terrorist financing risks.
These typically include:
- Customer identification and verification.
- Beneficial ownership identification.
- Customer risk assessments.
- Enhanced due diligence where appropriate.
- Source-of-funds and source-of-wealth checks where required.
- Transaction monitoring.
- Suspicious activity reporting.
- Sanctions screening.
- Record retention.
- Ongoing customer monitoring.
The company must establish a compliance framework proportionate to the nature, scale, and complexity of its operations.
Given the technology-driven nature of crypto-asset businesses, applicants must demonstrate that their IT systems are secure, reliable, and appropriate for their intended services.
Relevant considerations include:
- Cybersecurity policies and procedures.
- Access controls and identity management.
- Data protection and information security.
- Business continuity and disaster recovery.
- Incident detection and response.
- Wallet security and private-key management, where applicable.
- Outsourcing and third-party technology risk management.
CASPs must also consider their obligations under the Digital Operational Resilience Act (DORA), where applicable.
The CASP Licensing Application Process in Cyprus
Obtaining CASP authorisation is a structured regulatory process requiring detailed preparation and engagement with CySEC.
The main stages generally include:
Step 1: Business Model Assessment
The first stage involves identifying the exact crypto-asset services the company intends to provide.
A detailed assessment should determine whether the proposed activities fall within MiCA, identify the applicable authorisation category, and establish whether any additional regulatory permissions may be necessary.
Step 2: Company Formation and Corporate Structuring
The applicant must establish an appropriate corporate and operational structure.
This includes determining the ownership structure, appointing suitable directors and management personnel, and defining the company’s business activities.
The corporate structure should be designed to support the proposed regulated activities and satisfy the applicable substance and governance requirements.
Step 3: Preparation of the Regulatory Documentation
The applicant must prepare a comprehensive application package in accordance with Article 62 of MiCA and the relevant regulatory standards.
Depending on the proposed activities, documentation may include:
- Detailed business plan.
- Description of crypto-asset services.
- Corporate structure and ownership chart.
- Information concerning shareholders and beneficial owners.
- Management and organisational structure.
- Programme of operations.
- Prudential safeguards and financial projections.
- AML/CFT policies and procedures.
- Risk management framework.
- Internal control arrangements.
- IT and cybersecurity documentation.
- Business continuity and disaster recovery plans.
- Client asset safeguarding procedures.
- Outsourcing policies.
- Complaints handling procedures.
- Conflicts of interest policy.
The application must provide a clear and consistent picture of how the business will operate and manage its regulatory responsibilities.
Step 4: Submission to CySEC
The formal application is submitted to CySEC using the relevant MiCA application procedure.
CySEC reviews the submitted documentation and may request additional information, explanations, or amendments.
Applicants should be prepared to respond to regulatory questions and provide further supporting evidence throughout the assessment process.
Step 5: Regulatory Assessment
During the assessment, CySEC evaluates the applicant’s compliance with the applicable MiCA requirements.
The assessment may cover the company’s ownership structure, management suitability, financial resources, governance arrangements, internal controls, operational capabilities, and technological infrastructure.
Step 6: Granting of Authorisation
Where CySEC is satisfied that the applicant fulfils the applicable regulatory requirements, it may grant authorisation to provide the approved crypto-asset services.
Following authorisation, the CASP must maintain ongoing compliance with MiCA and all other applicable regulatory obligations.
The company must not assume that submitting an application or incorporating a Cyprus company gives it permission to conduct regulated crypto-asset activities.
MiCA and the Transition from the Previous Cyprus CASP Registration Regime
One of the most important developments for cryptocurrency businesses in Cyprus has been the introduction of MiCA.
Before MiCA became applicable, Cyprus operated a national CASP registration framework under its anti-money laundering legislation, supervised by CySEC.
Under that previous framework, CASPs were registered in different categories depending on their activities.
However, the introduction of MiCA fundamentally changed the regulatory landscape.
CySEC stopped accepting new applications under the former national registration regime on 17 October 2024.
Existing CASPs that qualified under the transitional arrangements could continue providing services until 1 July 2026 or until their MiCA authorisation application was granted or refused, whichever occurred first.
CySEC subsequently announced that existing national-regime CASPs were required to submit their MiCA authorisation applications by 27 February 2026 if they intended to continue operating under the transitional arrangements.
As of November 2026, the transitional period has expired.
Consequently, businesses intending to provide regulated crypto-asset services in or from Cyprus must operate under the applicable MiCA authorisation framework or another valid regulatory route.
A previous national CASP registration should not be treated as equivalent to a current MiCA authorisation.
European Passporting Rights
One of the principal advantages of obtaining CASP authorisation in Cyprus is the ability to access the wider European Union market.
Under MiCA, an authorised CASP may provide its authorised services in other EU Member States through the applicable passporting notification procedure.
This allows a Cyprus-authorised CASP to expand its business across the European Economic Area without having to obtain a separate full CASP authorisation in every Member State.
However, passporting is not automatic. The provider must comply with the relevant notification procedures, the scope of its authorisation, and applicable host-country requirements.
For businesses seeking to operate internationally, this framework offers an important opportunity to establish a regulated presence within the European market.
Thinking of obtaining a CASP licence in Cyprus?
Contact our team to discuss your proposed crypto-asset business model, assess the applicable licensing requirements, and receive professional assistance with the CASP authorisation process.
For more information
Our Clients
