Cyprus Crypto License

To obtain a CASP/VASP license in Cyprus, the applicant must meet several conditions relating to corporate structure, financial stability, internal control, and compliance with AML/CFT regulations:

Company registration

The company must be registered in Cyprus as a legal entity. A virtual office is not sufficient to obtain a license — it is necessary to rent or purchase physical premises.

Board of directors

The company is required to appoint at least four directors, two of whom must be executive directors. All directors must have experience in the financial or crypto sphere and pass a qualification check, including the CySEC test. Executive directors must reside in Cyprus.

Reputation of participants

All beneficiaries, directors, and key employees undergo a background check and professional suitability assessment.

Employees

Staff performing key functions of the company must work in Cyprus. At least one employee is appointed as responsible for financial monitoring (AML officer).

Minimum capital

The amount of authorized capital depends on the license class:

• Class 1 — from €50,000 (consulting and basic services);
• Class 2 — from €125,000 (crypto asset exchange, crypto wallets, placement);
• Class 3 — from €150,000 (underwriting, storage, multilateral transactions).

The capital must be deposited in a bank account in Cyprus.

Internal policies and procedures

The company is required to develop and implement:

• Anti-money laundering and counter-terrorist financing (AML/CTF) policies;
• KYC systems for customer identification and risk assessment;
• a business continuity and recovery plan;
• internal guidelines for employees.

Management mechanisms are required to ensure transparency, prevent conflicts of interest, and guarantee the stability of the company’s operations. CySEC requires that business processes be formalized and documented.

Reporting and auditing

The company must report regularly to CySEC, comply with accounting standards, and undergo internal and external audits.

Government fees

A registration fee of €10,000 is payable upon application.

In accordance with MiCA regulations, the Cyprus Securities and Exchange Commission (CySEC) establishes three classes of licenses, each of which corresponds to different volumes of services provided and minimum capital requirements:

Class 1

This license is issued to companies whose main activity is the provision of financial advisory services.

The required authorized capital is €50,000.

Class 2

Allows the provision of advice and various financial services, including the acceptance of applications and transmission of client orders, execution of orders on behalf of clients, conversion of cryptocurrencies into fiat, exchange between different crypto assets, participation in financial transactions related to cryptocurrencies, risk-free placement of crypto assets, and investment portfolio management.

The required share capital is €125,000.

Class 3

The company provides type 1 and type 2 financial services, administration and transfer of ownership rights to crypto assets, secure storage and management of cryptographic keys, and creates a multilateral system for convenient transactions with crypto assets.

The required share capital is €150,000.

With the introduction of MiCA throughout the EU from mid-2025, CASPs previously licensed in Cyprus will face a number of changes:

• License compliance.

Current licenses need to be adapted to the new MiCA categories, whether they are crypto exchanges, wallets, token issuers, or advisory activities.

• Transparency for users.

Official documents must reflect the risks, technologies used, team composition, and token management.

• Regulation of stablecoins.

CASP issuing asset-backed tokens or electronic money are required to comply with reserve requirements and conduct audits.

• Market conduct

Transaction processing systems and supervision must include measures to prevent manipulation.

• Cross-border transparency.

One license now provides access to all 27 EU countries.

How to adapt a CASP license obtained before 2025 to a VASP license:

• audit internal documentation for compliance with MiCA requirements;
• train employees on their new responsibilities;
• monitor CySEC’s MiCA implementation plan;
• consult with specialists to reorganize Class 1-3 licenses.

Timely preparation will help you avoid penalties and maintain your competitive advantage.

Suppose you are a Crypto Asset Service Provider (CASP) and operate in the context of the Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Law. In that case, you must formally register with the Cyprus Securities and Exchange Commission (CySEC) in Cyprus or elsewhere.

Suppose you are already a registered CASP in the European Economic Area (EEA) and carry out activities related to Cyprus (including the participation of Cypriot residents or organizations in Cyprus). In that case, you must provide documentation confirming your up-to-date registration for each specific service or activity. If your actions do not meet the AML/CFT registration framework, you should apply for CASP registration before CySEC.

New companies planning to start operating in or from Cyprus must first register with CySEC.

Existing companies providing significant cryptoasset services must apply for registration before CySEC and fully comply with the legislation on the prevention of money laundering and terrorist financing, as well as the relevant directives issued under that legislation.

The applicable regulatory framework for CASPs is based on:

• The Law on Combating Money Laundering and Terrorist Financing.
• The CySEC directive regarding the registry of cryptoasset service providers.
• CySEC Directive on the Prevention and Suppression of Money Laundering and Terrorist Financing.

These documents are essential for regulating cryptoasset activities and ensuring compliance with the legislation in this area.

Taxation of cryptocurrencies in Cyprus is based on the principles of the country’s general corporate system, which is considered one of the most liberal in the European Union.

Cryptocurrencies are recognized as a taxable asset, and companies working with them are subject to standard tax legislation.

Income from cryptocurrency transactions is subject to corporate tax at a rate of 12.5%, which is one of the lowest rates in the EU. At the same time, expenses related to income generation are deductible, which reduces the tax burden. Foreign investors enjoy significant benefits: zero withholding tax on dividends and interest payments.

An important advantage is that capital gains from the sale of cryptocurrencies or shares are, in many cases, not taxed. In addition, there is an IP Box regime that allows income from the use of intellectual property to be taxed at a reduced effective rate of 2.5%, which may be relevant for blockchain developments.

Cyprus has also signed more than 60 double taxation agreements, which facilitate international cryptocurrency transactions. The inheritance of crypto assets is not taxed, which increases the attractiveness of the jurisdiction for long-term asset ownership.

After obtaining a license, a cryptocurrency company must maintain sufficient share capital—it must be higher than the amount initially contributed when submitting the application or amount to at least a quarter of the annual fixed costs (starting from the second year of operation). In addition, a fixed fee of €5,000 is charged annually for license renewal.
The regulatory authority requires licensees to submit regular reports: quarterly and annual reports are submitted, and audited accounts are provided. Companies are required to maintain and continuously update KYC documentation, recording all business relationships and transactions in a transparent and accessible manner.

Key attention is paid to compliance with AML/CFT requirements. To this end, companies must conduct an annual risk assessment, develop a matrix of potential threats, monitor the effectiveness of internal procedures, and ensure that employee incentives do not conflict with customer interests.

Additional obligations:

• training staff on AML/CTF and regulatory compliance issues;
• conducting cybersecurity stress tests to protect customer data and digital assets;
• appointing a responsible employee for GDPR and data protection issues;
• timely updating of internal policies to reflect changes in European and local legislation, including new rules such as MiCA.

Failure to comply with the established requirements has serious consequences, ranging from fines to license revocation.

Liability for non-compliance

Liability for non-compliance with crypto business requirements in Cyprus is regulated by CySEC, which has broad powers to impose sanctions.

When considering violations, factors such as the severity and duration of the offense, the degree of fault of the company or its employees, the financial situation of the violator, the amount of unlawful gain, the losses caused, the existence of past violations, and the willingness to cooperate with the regulator are taken into account.

Depending on the circumstances, the following measures may be applied to violators:

• large fines (up to €1 million or twice the amount of the benefit received);
• additional fines for each day the violation continues;
• and modification, suspension, or complete revocation of the license.

In some cases, personal restrictions are imposed, such as a temporary ban on the activities of specific officials.

In addition to financial penalties, the company is required to make a public statement about the violations and take measures to remedy the violations and hold those responsible accountable.

In 2025, the introduction of MiCA will change the rules for crypto companies in the EU, including Cyprus, where the CASP license was previously in effect. Now, businesses need to adapt their licenses to the new MiCA categories, comply with transparency, risk management, and reporting requirements, and take into account the special regulation of stablecoins. Cyprus remains an attractive jurisdiction with a loyal tax system, but companies are required to undergo thorough registration with CySEC, comply with AML/KYC procedures, and maintain a high level of compliance to avoid fines and license loss.

Gofaizen & Sherle is ready to support businesses at all stages: from obtaining a crypto license in Cyprus to adapting an existing CASP license to MiCA requirements. Experts will help audit documentation, organize internal procedures, and prepare the company to operate in the new EU legal environment.