Quick actions

Crypto License

Crypto License in Cyprus

Prepare your crypto business in Cyprus for authorisation

cy
Mark Paat

Mark Paat

Last updated: 11 min read

Fact Checked by: Maksim Gasanbekov

Service Snapshot

Regulatory & Service Snapshot

Gofaizen & Sherle assesses your business activities and prepares the application documents for a Cyprus cryptocurrency licence. A crypto-asset service provider (CASP) needs permission for specific services under the EU’s Markets in Crypto-Assets Regulation (MiCA).

  • Authority Cyprus Securities and Exchange Commission (CySEC) for ordinary applications
  • Regime MiCA authorization or an eligible notification route
  • Services Permission covers specified activities
  • Prudential Resources Article 63 service minimums and operating-cost test
  • Establishment Real operations and EU management
  • Review Stages Preparation, completeness check and assessment
  • Current Position Transition ended July 1, 2026

Is Cyprus Suitable for Your Business

sign positive

May fit

  • For Article 63 authorization with Cyprus as your home state, establish actual operations there, including a registered office where you perform at least some services.
  • Effective management must be in the EU, with one EU-resident director.
  • Staffing must fit the business.
  • An already authorized EU CASP can passport into Cyprus under Article 65 without a Cyprus physical presence.
sign warning

May not fit

  • Token issuance, financial instruments and payment activities need separate analysis; CASP permission does not cover them automatically.

Choose the Applicable Regulatory Route

Registration or LicenseWhen It Applies
Article 63 Who Uses It: Ordinary applicant; Permission and Limit: CySEC assesses the application and approves specified services.
Article 60 Who Uses It: Eligible regulated financial entity; Permission and Limit: Notification for permitted equivalent services. CySEC or the Central Bank of Cyprus (CBC), depending on entity.
Article 65Who Uses It: Already authorized EU CASP; Permission and Limit: Home-authority notification for cross-border services within existing scope.

Article 60 requires notice at least 40 working days before first service, complete information and eligibility for the equivalent services. Banks and electronic money institutions notify CBC. Other eligible entities may fall under CySEC. Article 65 provides an EU passport for services already authorized, after the notification procedure.

Services and Prudential Classes

For CASPs authorized under Article 63, each class sets a minimum financial safeguard. It does not automatically authorize every listed service:

  • Class 1, €50,000: execution, placing, reception and transmission of orders, advice, portfolio management and transfers.
  • Class 2, €125,000: adds custody and administration, exchange for funds and exchange for other crypto-assets.
  • Class 3, €150,000: adds operating a trading platform.

Execution means concluding purchases or sales for clients; reception and transmission means passing their orders onward. Placing markets assets for an issuer or seller. Advice gives personal recommendations; portfolio management makes investment decisions under a client’s mandate. Transfers move crypto-assets between addresses or accounts for clients. Custody means holding or controlling clients’ crypto or access keys. Exchange services buy or sell crypto for money or another crypto-asset. A platform brings multiple buyers and sellers together under trading rules.

A CASP authorized under Article 63 must continuously maintain financial safeguards equal to the higher of its service minimum or one quarter of annual fixed overheads. Fixed overheads are regular running costs; a new company uses projections for its first 12 months. Qualifying own funds, insurance or a comparable guarantee, or a combination can meet the rule. These resources protect against business risks; they are not regulator fees. Eligible Article 60 entities are exempt from Article 67 under Article 60(10); their own regulatory requirements still apply.

Our expertise

What Gofaizen & Sherle Handles?

  1. Assessment & Strategy

    • Gofaizen & Sherle assesses the model and jurisdiction
  2. Corporate Structuring

    • supports corporate structuring. Governance work defines how the business is directed and controlled.
  3. Documentation

    • prepares application and compliance documentation
  4. Regulatory Support

    • helps you respond to the regulator.

You provide accurate records and operate the controls. CySEC decides which services to authorize.

Scope and Costs

Comprehensive License Setup

Price on quote

  • Professional work — What It Covers: Agreed assessment, documents and regulatory support; Charging Basis: Individual quote.
  • Official application fees — What It Covers: Each requested service, added together; Charging Basis: Custody €10,000; platform €30,000; each exchange or transfer €5,000; execution, placing, reception/transmission, advice or portfolio management €8,000 each.
  • Annual supervision — What It Covers: Service components plus turnover charges; Charging Basis: No flat renewal fee.
  • Third-party costs — What It Covers: Providers and operating infrastructure; Charging Basis: Provider terms; outside professional work unless included.

Annual supervision fees are payable within four months after the financial year ends.

How the Application Process Works

  1. You and Gofaizen & Sherle map the planned services and select the licensing route.

  2. You establish resources, Gofaizen & Sherle supports corporate and document preparation.

  3. The applicant files

    CySEC examines the submission, may request information and may approve or refuse it.

  4. Before launch, you confirm the approved scope and operating arrangements.

What We Need From You

  • user cog

    Ownership & Management

    Ownership and management records to assess suitability.

  • structure

    Business Model

    Your operating plan

  • analysis

    Transactions & Markets

    Target countries and money/crypto flows to identify regulated services.

  • laptop

    Compliance & Banking

    Corporate documents, controls and technology materials to prepare the file.

Our expertise

Why Gofaizen & Sherle?

We combine legal, regulatory and technical expertise to support businesses navigating complex regulatory requirements from initial assessment to implementation.

  1. Corporate structuring Company formation and cross-border business setup.
  2. Financial regulations Application preparation and regulator-facing documentation.
  3. Compliance & Governance AML/CTF frameworks and post-authorisation support.

What we handle

  • w assessment Project assessment
  • w structuring Structuring & Classification
  • w documentation Documentation
  • w implementation Implementation support
Maksim Gasanbekov

Maksim Gasanbekov

Partner, Head of Sales (Crypto and Blockchain)

maksim@gofaizen-sherle.com

Timeline and Dependencies

For Article 63, CySEC must:

  • Acknowledge receipt

    within five working days of receiving the application.

  • Check required file contents

    within 25 working days of receipt

  • Assess the business

    whether the business meets the rules within 40 working days of a complete application.

  • Notify its decision

    within five working days of taking it.

Missing contents require correction by the deadline CySEC sets. During assessment, an information request made by working day 20 can suspend the clock for up to 20 working days. Preparing the file and arranging providers take additional time. Authorization alone does not make the business ready to launch.

Effective from

The Applicable Regulatory Framework

MiCA, Regulation (EU) 2023/1114, governs CASP permission. Anti-money laundering and counter-terrorist financing (AML/CFT) controls apply alongside transfer-information rules under the Transfer of Funds Regulation (TFR), Regulation (EU) 2023/1113 and technology resilience duties under the Digital Operational Resilience Act (DORA).

Custody or transfers of electronic money tokens may also require payment authorization or an eligible payment service provider arrangement.

Current Authorization Status

StatusPractical Meaning
Transition: Confirmed ended July 1, 2026Legacy registration or a pending application does not permit continued unrestricted business
Operating permission: Requires project-specific verificationIn CySEC and European Securities and Markets Authority (ESMA) registers, check exact entity, services, home state, domain and status, including withdrawal
New application: Form 2 published; intake requires verificationConfirm submission arrangements with CySEC; filing is not permission

Ongoing Compliance Obligations

  1. Management periodically reviews governance and keeps review records.
  2. Compliance maintains AML/CFT checks, verifies transfer information and handles reporting when required.
  3. Operations staff safeguard and segregate client assets, and record complaints handled free of charge.
  4. The CASP remains responsible for outsourced work. Technology teams maintain proportionate DORA controls for security, continuity, incidents, testing and providers.

Tax and Financial Considerations

The general corporate income tax rate is 15%. Section 20E applies 8% to qualifying gains from disposing of crypto-assets, rather than all CASP service income. Crypto losses reduce only the same taxpayer’s crypto gains in the same year. They cannot be carried into later years or used by other group companies. Assets acquired through mining are excluded from this regime.

Value-added tax (VAT) treatment depends on the service; the fiat/bitcoin exchange exemption does not exempt every CASP activity. Payroll and transfer pricing also need assessment.

Launch and Enforcement Risk

Expired legacy permission cannot support new EU onboarding or marketing. Protective winddown activity does not allow unrestricted operations.

Banking and Operational Readiness

Banks, electronic money institutions (EMIs) and payment service providers (PSPs) decide whether to open a corporate account. Prepare beneficial-owner details, countries, services, source of funds, flow diagrams and controls. CASP authorization does not ensure acceptance; banking assistance needs its own agreed scope.

Compare Other EU Home States

All require real home operations, EU management and notification for passporting within approved scope.

MarketMain Consideration
MaltaRegulator: MFSA; Substance: Home operations; Application Readiness: MFSA forms/rulebook; Passporting and Key Limitation: Approved scope; provider requirements.
SpainRegulator: CNMV; Substance: Home operations; Application Readiness: Current model/manual; Passporting and Key Limitation: Approved scope; check revisions.
GermanyRegulator: BaFin; Substance: Common MiCA rules; Application Readiness: Verify national filing details; Passporting and Key Limitation: Approved scope; verify local readiness.
PortugalRegulator: BdP with CMVM coordination; Substance: Home operations; Application Readiness: National filing and authority coordination; Passporting and Key Limitation: Approved scope; no AML-registration shortcut.

Frequently Asked Questions

Who authorizes CASPs in Cyprus under MiCA?

CySEC handles ordinary Article 63 applicants. CBC handles relevant financial entities under the entity-specific Article 60 allocation.

Which crypto services can a CASP provide?

Only those specifically authorized, such as custody, exchange or platform operation.

How do the three prudential classes differ?

For Article 63 CASPs, they set service-based minimums of €50,000, €125,000 and €150,000. Running costs can require higher safeguards, each service still needs permission. Article 60 entities follow their own regulatory requirements, exempt from Article 67.

What evidence is needed for an application?

Ownership, management, operating plans, asset flows, corporate records and controls.

Can a legacy registration still support new business?

No. The transition ended July 1, 2026.

How do Articles 60 and 65 differ?

Article 60 concerns eligible regulated financial entities. Article 65 covers cross-border notification for an already authorized EU CASP.

How long does the regulatory review take?

Substantive assessment takes up to 40 working days from a complete application, with a possible information-request suspension.

Does authorization guarantee a bank account?

No. Each provider makes its own acceptance decision.

What duties continue after authorization?

Governance, AML/CFT, transfer checks, client protection, complaints, outsourcing oversight and technology resilience remain ongoing responsibilities.

How is a Cyprus crypto business taxed?

General corporate income faces 15%, qualifying crypto disposal gains fall under the conditional 8% regime.

Client Testimonials

Trusted by Industry Leaders

At Pilsenga since the very beginning we counted with Gofaizen & Sherle to build our financial institution in 21 days, we started our operations in record time thanks to them, it's been pleasant to work with them through the rush of building a Financial Institution in record time. They for real understand compliance and crypto businesses!

pilsenga logo Victor Romero CEO - UAB Pilsenga
VirtuaBroker Case study

VirtuaBroker

Services Provided: Jurisdiction analysis, Lithuania VASP licensing, corporate setup, AML/KYC documentation, HR (local AML officer), banking solutions, ongoing regulatory maintenance, and adaptation to new 2024 AML requirements.

Read case

Connect with our experts

Our experts will tell you how to do it as quickly and easily as possible.

Mark Paat
Mark Paat
Associate, Consultant
Maksim Gasanbekov
Maksim Gasanbekov
Partner, Head of Sales (Crypto and Blockchain)
Get in touch
Phone
Estonia +372 Estonia

    Connect with our experts

    Our experts will tell you how to do it as quickly and easily as possible.

    Estonia

      By clicking the button, I confirm that I have read the privacy policy and consent to the collection and processing of my personal data in accordance with the GDPR rules.

      Thank you

      Thank you for reaching us. Our team is working on your request, and we will contact you soon.

      Message not sent