Crypto License in Cyprus

Is Cyprus Suitable for Your Business

For Article 63 authorization with Cyprus as your home state, establish actual operations there, including a registered office where you perform at least some services. Effective management must be in the EU, with one EU-resident director. Staffing must fit the business. An already authorized EU CASP can passport into Cyprus under Article 65 without a Cyprus physical presence.

Token issuance, financial instruments and payment activities need separate analysis; CASP permission does not cover them automatically.

Choose the Applicable Regulatory Route

Route	Who Uses It	Permission and Limit
Article 63	Ordinary applicant	CySEC assesses the application and approves specified services
Article 60	Eligible regulated financial entity	Notification for permitted equivalent services. CySEC or the Central Bank of Cyprus (CBC), depending on entity
Article 65	Already authorized EU CASP	Home-authority notification for cross-border services within existing scope

Article 60 requires notice at least 40 working days before first service, complete information and eligibility for the equivalent services. Banks and electronic money institutions notify CBC. Other eligible entities may fall under CySEC. Article 65 provides an EU passport for services already authorized, after the notification procedure.

Services and Prudential Classes

For CASPs authorized under Article 63, each class sets a minimum financial safeguard. It does not automatically authorize every listed service:

• Class 1, €50,000: execution, placing, reception and transmission of orders, advice, portfolio management and transfers.
• Class 2, €125,000: adds custody and administration, exchange for funds and exchange for other crypto-assets.
• Class 3, €150,000: adds operating a trading platform.

Execution means concluding purchases or sales for clients; reception and transmission means passing their orders onward. Placing markets assets for an issuer or seller. Advice gives personal recommendations; portfolio management makes investment decisions under a client’s mandate. Transfers move crypto-assets between addresses or accounts for clients. Custody means holding or controlling clients’ crypto or access keys. Exchange services buy or sell crypto for money or another crypto-asset. A platform brings multiple buyers and sellers together under trading rules.

A CASP authorized under Article 63 must continuously maintain financial safeguards equal to the higher of its service minimum or one quarter of annual fixed overheads. Fixed overheads are regular running costs; a new company uses projections for its first 12 months. Qualifying own funds, insurance or a comparable guarantee, or a combination can meet the rule. These resources protect against business risks; they are not regulator fees. Eligible Article 60 entities are exempt from Article 67 under Article 60(10); their own regulatory requirements still apply.

Scope and Costs

Cost Category	What It Covers	Charging Basis
Professional work	Agreed assessment, documents and regulatory support	Individual quote
Official application fees	Each requested service, added together	Custody €10,000; platform €30,000; each exchange or transfer €5,000; execution, placing, reception/transmission, advice or portfolio management €8,000 each
Annual supervision	Service components plus turnover charges	No flat renewal fee
Third-party costs	Providers and operating infrastructure	Provider terms; outside professional work unless included

Annual supervision fees are payable within four months after the financial year ends.

What We Need From You

• Ownership and management records to assess suitability.
• Your operating plan.
• Target countries and money/crypto flows to identify regulated services.
• Corporate documents, controls and technology materials to prepare the file.

Timeline and Dependencies

For Article 63, CySEC must:

• Acknowledge receipt within five working days of receiving the application.
• Check required file contents within 25 working days of receipt.
• Assess whether the business meets the rules within 40 working days of a complete application.
• Notify its decision within five working days of taking it.

Missing contents require correction by the deadline CySEC sets. During assessment, an information request made by working day 20 can suspend the clock for up to 20 working days. Preparing the file and arranging providers take additional time. Authorization alone does not make the business ready to launch.

The Applicable Regulatory Framework

MiCA, Regulation (EU) 2023/1114, governs CASP permission. Anti-money laundering and counter-terrorist financing (AML/CFT) controls apply alongside transfer-information rules under the Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113 and technology resilience duties under the Digital Operational Resilience Act (DORA).

Custody or transfers of electronic money tokens may also require payment authorization or an eligible payment service provider arrangement.

Current Authorization Status

Issue	Status	Practical Meaning
Transition	Confirmed ended July 1, 2026	Legacy registration or a pending application does not permit continued unrestricted business
Operating permission	Requires project-specific verification	In CySEC and European Securities and Markets Authority (ESMA) registers, check exact entity, services, home state, domain and status, including withdrawal
New application	Form 2 published; intake requires verification	Confirm submission arrangements with CySEC; filing is not permission

Ongoing Compliance Obligations

• Management periodically reviews governance and keeps review records.
• Compliance maintains AML/CFT checks, verifies transfer information and handles reporting when required.
• Operations staff safeguard and segregate client assets, and record complaints handled free of charge.
• The CASP remains responsible for outsourced work. Technology teams maintain proportionate DORA controls for security, continuity, incidents, testing and providers.

Launch and Enforcement Risk

Expired legacy permission cannot support new EU onboarding or marketing. Protective winddown activity does not allow unrestricted operations.

Banking and Operational Readiness

Banks, electronic money institutions (EMIs) and payment service providers (PSPs) decide whether to open a corporate account. Prepare beneficial-owner details, countries, services, source of funds, flow diagrams and controls. CASP authorization does not ensure acceptance; banking assistance needs its own agreed scope.

Tax and Financial Considerations

The general corporate income tax rate is 15%. Section 20E applies 8% to qualifying gains from disposing of crypto-assets, rather than all CASP service income. Crypto losses reduce only the same taxpayer’s crypto gains in the same year. They cannot be carried into later years or used by other group companies. Assets acquired through mining are excluded from this regime.

Value-added tax (VAT) treatment depends on the service; the fiat/bitcoin exchange exemption does not exempt every CASP activity. Payroll and transfer pricing also need assessment.

Compare Other EU Home States

All require real home operations, EU management and notification for passporting within approved scope.

Home State	Regulator	Substance	Application Readiness	Passporting and Key Limitation
Malta	MFSA	Home operations	MFSA forms/rulebook	Approved scope; provider requirements
Spain	CNMV	Home operations	Current model/manual	Approved scope; check revisions
Germany	BaFin	Common MiCA rules	Verify national filing details	Approved scope; verify local readiness
Portugal	BdP with CMVM coordination	Home operations	National filing and authority coordination	Approved scope; no AML-registration shortcut