Quick Facts
| Parameter | Value |
|---|---|
| Regulator | CySEC (Cyprus Securities and Exchange Commission) |
| License types | MiCA CASP — Class 1 · MiCA CASP — Class 2 · MiCA CASP — Class 3 |
| Minimum capital | €50,000 / €125,000 / €150,000 (by CASP class) |
| Typical timeline | 9–12 months (CySEC; statutory max 6 months from a complete file) |
| Corporate tax | 15% (raised from 12.5% on 1 Jan 2026; IP Box & non-dom intact) |
| Region | Europe |
What CySEC's pre-MiCA CASP register means for your application today
Cyprus did not discover crypto when MiCA arrived. CySEC ran a national CASP register from 2021, vetting and supervising crypto firms under domestic AML rules years before the EU regime existed. That register stopped accepting new applicants on 17 October 2024, and the transition is now closing: existing national-regime CASPs had to file their MiCA applications by 27 February 2026, and the transitional window — during which a registered firm could keep operating while its file was pending — ends on 1 July 2026.
Two consequences follow. First, the easy on-ramp is gone — there is no lightweight national registration to fall back on while you build toward MiCA. Second, and more usefully, CySEC reviewers have years of crypto supervisory muscle memory; they have seen the AML gaps, the custody-segregation hand-waving and the governance shells before. A thin file gets caught faster here than at a regulator authorising its first CASP — which is exactly why a Cyprus licence carries weight with banks, and why you should not treat it as a formality.
The CIF angle: structuring a CASP next to a Cyprus investment firm
Cyprus's real structural edge is that it is already full of MiFID investment firms (CIFs). If your group holds, or plans to hold, a CIF, the crypto piece does not have to live in a vacuum.
- Shared compliance backbone. The AML/CFT framework, MLRO, internal audit, risk and governance built for a CIF map closely onto MiCA CASP requirements — you reuse the spine rather than building two of everything.
- Streamlined notification route. An authorised CIF can provide certain in-scope crypto-asset services to MiCA via notification to CySEC rather than a separate full CASP authorisation, where the service overlaps existing MiFID permissions. Specialist activities (custody, operating a trading platform) still need full CASP licensing. Verify the current scope of notification-eligible services against live CySEC guidance.
- One regulator, one relationship. CySEC supervises both the CIF and the CASP — you are not managing two unrelated NCAs.
A pure-crypto applicant with no CIF and no group context gets none of this leverage — which is the honest dividing line for whether Cyprus is your jurisdiction.
When Cyprus is the wrong choice
- You want the cheapest or fastest stamp. Realistic end-to-end timing is 9–12 months, and CySEC's pre-MiCA experience makes reviewers demanding.
- You can't build real substance. The 15% tax, IP Box and non-dom benefits assume a genuine Cyprus operation — directors, office, local compliance presence.
- You have no CIF and no plans for one. Strip out the investment-firm synergy and Cyprus becomes a generic MiCA jurisdiction competing on cost, where Lithuania or Estonia may serve a lean crypto-native startup better.
- You're pre-revenue and capital-thin. Class 2 (€125k) and Class 3 (€150k) own funds must sit in a Cyprus bank as qualifying capital, on top of overhead-based requirements.
Why Cyprus?
- CySEC is a battle-tested EU regulator with a real pre-MiCA CASP register (2021→2024) and deep MiFID passporting experience;
- MiFID/CIF synergy: existing Cyprus investment firms can fold crypto into the same group and share AML, compliance and governance;
- One MiCA CASP licence passports across all 27 EU/EEA states via a 15-working-day host-state notification;
- 15% corporate tax (still bottom-tier in the EU), plus IP Box, 0% dividend withholding tax and the non-dom regime.
Cyprus rewards applicants who already have, or can build, genuine local substance and ideally CIF adjacency; it is a poor fit for thin pre-revenue startups chasing the lowest cost or fastest stamp.
Requirements for a Cyprus crypto license
Every Cyprus crypto application turns on six pillars. Get them right and the regulator interaction becomes routine; get them wrong and you spend the next six months in RFI cycles.
- A locally-registered company with a clear corporate structure and identified ultimate beneficial owners;
- A resident director and a Money Laundering Reporting Officer (MLRO) familiar with Cyprus compliance practice;
- An AML/KYC programme calibrated to CySEC (Cyprus Securities and Exchange Commission) expectations, including transaction monitoring rules and FATF Travel Rule readiness;
- A demonstrable office presence — physical address, document retention policies and incident response plan documented;
- Capital evidence consistent with the regime: €50,000 / €125,000 / €150,000 (by CASP class);
- A clean source-of-funds and source-of-wealth file for all controllers, with supporting documentation.
Step-by-step process for a Cyprus crypto license
- Strategy and gap analysis. We map your business model to the available licence categories at CySEC (Cyprus Securities and Exchange Commission) and identify the gaps before any regulator interaction.
- Incorporation and substance setup. Local entity formation, resident-director arrangement, registered office and AML officer appointment are completed in parallel to save weeks on the timeline.
- AML / KYC programme drafting. Transaction monitoring rules, sanctions screening, KYB onboarding flow, MLRO reporting matrix and Travel Rule provider selection are documented to regulator-grade standard.
- Application file and submission. The application file is built to the actual reading list of CySEC (Cyprus Securities and Exchange Commission) examiners — not a generic template — and submitted with a covering memo addressing the most common RFI triggers.
- Regulator engagement and RFI cycles. We respond to Requests for Information within published service-level windows and brief you weekly on engagement progress.
- Approval and onboarding. On approval, the post-licence onboarding sprint covers banking, payment rails, audit firm appointment, and the first annual return calendar.
- Ongoing supervision. Annual reporting, AML programme refresh, MLRO appointments and material change notifications are calendared and monitored.
Costs breakdown
Total first-year all-in cost combines four lines: regulator fee, statutory capital tied up unproductively, legal fees, and substance (resident director, office, AML officer, technology audit). Ongoing supervision sits on top from year two onwards. We model three-year total cost upfront so the budget is realistic.
| Cost line | Indicative range |
|---|---|
| Regulator fee | Confirmed in writing at engagement |
| Statutory capital | €50,000 / €125,000 / €150,000 (by CASP class) |
| Legal fees | Fixed-scope quote at kickoff |
| Substance (year 1) | Resident director, office, AML officer |
| Ongoing supervision (year 1+) | Annual audit, returns, AML refresh |
Taxation
The corporate tax position in Cyprus is 15% (raised from 12.5% on 1 Jan 2026; IP Box & non-dom intact). Tax is structuring-dependent — the headline rate is rarely the rate a properly-structured group ends up paying. Tax advice is provided in cooperation with locally-admitted tax counsel and is scoped separately from the licensing engagement.
Documents required
- Certificate of incorporation, articles, shareholder register and group ownership chart;
- UBO identification — passports, addresses, source-of-funds and source-of-wealth documentation for all controllers;
- Director and senior-management CVs, regulatory references, fit-and-proper questionnaires;
- Business plan with three-year financial projections and stress-tested assumptions;
- AML/KYC policy pack — programme manual, risk assessment, transaction-monitoring rules, sanctions-screening procedure, MLRO appointment and reporting matrix;
- Technology architecture description — wallet model, custody segregation, key management, incident-response plan, cybersecurity certifications;
- Lease and proof of substantive office in Cyprus where applicable.
Our experts for Cyprus
Tomáš Novák
Senior Counsel — EU & Eastern Europe
Six years at the European Banking Authority working on MiCA technical standards and the Transfer of Funds Regulation.
- LL.M. KU Leuven
- Czech Bar
- Former EBA Senior Policy Officer
Daniel R. Whitmore
Founder & Managing Partner
Founder. Eight years at a Magic Circle firm leading the financial-regulation emerging-tech desk before founding the firm in 2018.
- LL.M. Financial Regulation, LSE
- Solicitor (England & Wales)
- New York Bar
- CLLS Financial Law Committee
Frequently asked questions
Did Cyprus regulate crypto before MiCA?
Yes. CySEC operated a national CASP register from 2021, supervising crypto firms under domestic AML rules well before MiCA. New national applications closed on 17 October 2024, and the regime is being wound into MiCA — the transitional period ends 1 July 2026.
What are the MiCA CASP classes and minimum capital in Cyprus?
Three classes under MiCA Annex IV: Class 1 (advice, RTO, placement, execution, transfers, portfolio management) needs €50,000; Class 2 adds custody and exchange and needs €125,000; Class 3 adds operating a trading platform and needs €150,000. Capital must be paid-up qualifying own funds held with a Cyprus credit institution — crypto on the balance sheet does not count.
How long does CySEC take to approve a CASP licence?
CySEC has roughly 40 working days to confirm your file is complete, then a statutory maximum of 6 months to decide from that point. In practice, a well-prepared application with the usual follow-up rounds runs about 9–12 months end to end.
If I already hold a Cyprus CIF licence, do I need a separate CASP licence?
Not necessarily for every service. A CySEC-authorised investment firm (CIF) can provide certain in-scope crypto-asset services via a streamlined notification rather than a full separate CASP authorisation. But specialist activities — custody and operating a trading platform — still require full CASP licensing. Confirm the current notification scope with CySEC, as it is the part most often misread.
What is the corporate tax rate for a Cyprus crypto company in 2026?
15%, effective 1 January 2026 (raised from 12.5% under the 2026 tax reform to meet the OECD Pillar Two minimum). It remains one of the lowest headline rates in the EU, and the IP Box, 0% withholding tax on outbound dividends and the non-dom regime stayed intact.
Can a Cyprus CASP licence be used across the rest of the EU?
Yes. A MiCA CASP authorisation passports into all EU/EEA states. You notify CySEC of each host state you intend to serve; CySEC forwards the notification to the host regulator within 15 working days, and you can begin once that notification is communicated — no separate national licence per country.