Why Cyprus for Crypto Licensing
Cyprus is one of the EU’s strongest crypto-licensing homes: MiCA passporting from an English-language regulator, the EU’s largest MiFID II investment-firm population, and a 15% headline corporate tax supported by a 2.5–3% effective rate on qualifying IP-Box income. CySEC has a working CASP pipeline and supervises operators ranging from retail brokers to institutional custody. It rewards a serious file with real substance, and that is exactly the kind of file we build.
The substance bar here is not a compliance checkbox: CySEC expects a resident board majority actively managing the firm, not a single resident director with the board flying in quarterly. The technical file will pass review, but the working licence lives or dies in banking, where MiCA-authorised CASPs have appetite but institutions still condition on prior operating history and clean correspondent chains—we arrange both during the application, not after, so your licence becomes a business, not a certificate on the wall.
MiCA passporting from a MiFID-fluent supervisor. A Cyprus CASP authorisation passports to all 30 EEA states via MiCA Article 65 notification, with services commencing in the host state 15 calendar days after filing. Cyprus’s edge is a deep population of around 250 Cyprus Investment Firms under CySEC supervision, a depth of supervisory experience newer MiCA jurisdictions cannot match.
English working language. All CySEC filings, the Programme of Operations, governance documentation and ongoing reporting are produced in English, and commercial contracts follow English common-law drafting. For operators based in London, the Gulf or APAC, that removes the translation layer that adds friction elsewhere in the EU and shortens onboarding with banks, auditors and counterparties.
A tax position built for operators. The Cyprus Tax Reform 2026 raised headline corporate tax to 15% (Pillar Two alignment) while keeping the IP Box that delivers roughly 2.5–3% effective tax on qualifying IP income, and introduced a flat 8% rate on crypto-asset disposals by tax residents. Combined with the 17-year non-domiciled regime and 0% withholding on outbound dividends, the all-in rate on distributed founder profits sits in the mid-teens. We build this in from incorporation through our Cyprus company formation service, not retrofitted later.
Which Business Models Suit Cyprus
We deliver Cyprus CASP authorisations across the full range of MiCA crypto-asset services. Cyprus is the right call when the structure below matches your business. If it does not, we will tell you plainly and point you to the jurisdiction that does.
- Retail and institutional brokers who want a MiFID-grade home supervisor and EU-wide passporting from a single licence.
- Custody and exchange operators that need a credible, English-language regulator institutional counterparties already recognise.
- Trading-platform operators building a multilateral venue who can meet the Class 3 capital and substance bar.
- Operators with material IP income (exchange technology, custody software, white-label infrastructure) who fit the IP Box.
- Existing Cyprus Investment Firms already holding CySEC MiFID permissions, who can often use the faster MiCA Article 60 notification route.
- Founders relocating to Cyprus who want the 17-year non-dom regime and the 8% crypto-disposal rate working together.
Cost-led startups working to a tight budget, or operators who need a live licence in six months, are usually better served in Estonia or Lithuania. We deliver in both, so the recommendation we give you is the one that fits, not the one that happens to be on this page. US persons are excluded as service clients.
What We Do For You
This is not a referral. We form the company, build the file, put the substance in place, file with CySEC and deal with the regulator directly through to authorisation. One firm owns the outcome from first call to live licence.
- Cyprus company formation. We incorporate the Cyprus Ltd, open the corporate account for the capital deposit and prepare the shareholder and ultimate-beneficial-owner documentation.
- Substance build. We put the resident board majority, MLRO, Compliance Officer and real Cyprus office in place before filing, the way CySEC expects to see it.
- The full MiCA file. We draft the Programme of Operations, AML/CFT manual, DORA and ICT framework, governance policies and service-specific procedures, written for your business model, not adapted from a template.
- We file and manage the application. We submit through the CySEC e-portal, run the statutory review clock and answer every supplementary-information request ourselves.
- We deal with the regulator directly. You are not relaying messages through an intermediary; we are the firm on the file.
- Banking and passporting. We arrange banking and file your Article 65 passporting notifications so the licence is operational, not just granted.
We are candid about timelines, the substance bar and what can and cannot be delivered. When something genuinely sits outside what we can do, we say so. Book a free consultation and we will scope your file and give you a single fixed quote.
Regulatory Framework
The Cyprus Securities and Exchange Commission is the sole competent authority for CASP authorisation under MiCA Article 93; the Central Bank of Cyprus handles e-money token issuers and payment-services overlap. MiCA applies directly without national transposition, and the supporting Cyprus AML framework was realigned to MiCA and the EU Transfer of Funds Regulation by Law 96(I)/2025 (18 June 2025). CySEC publishes a dedicated MiCA information hub setting out filing expectations, and we build to those expectations on every file we run.
Definition: Crypto-Asset Service Provider (CASP)
A legal person authorised under MiCA Article 59 to provide one or more of the ten regulated crypto-asset services defined in MiCA Article 3(1)(16). In Cyprus the authorisation is granted by CySEC under the directly-applicable Regulation (EU) 2023/1114, supplemented by Cyprus AML and prudential rules. CASP operating profits are taxed at 15% (from 1 January 2026), with an 8% flat rate on crypto-asset disposals.
The legacy register closes hard in 2026
The old national CASP register, run by CySEC under Directive R.A.D. 269/2021, was an AML-perimeter registration only, with no prudential supervision and no EU passporting. It closed to new entrants on 17 October 2024. The MiCA CASP authorisation, in force from 30 December 2024, is the first prudential crypto regime in Cyprus, adding capital under Annex IV, passporting via Article 65 and a DORA-aligned ICT framework. There is no simplified conversion: the MiCA file is the full Article 62 package regardless of legacy status. Legacy holders must file a complete application with CySEC by 27 February 2026 to keep operating past 1 July 2026, when the register closes; there is no extension mechanism. If you are on the legacy register, talk to us now, the documentation and substance build will not fit a late start.
Overlapping regimes we scope in parallel
Three further regimes intersect with the CASP authorisation. The EU Transfer of Funds Regulation imposes mandatory Travel Rule data exchange between CASPs with no de minimis threshold; DORA sets the ICT resilience obligations; and where a firm also provides MiFID-equivalent services, an existing CIF may notify under MiCA Article 60 (a 40 working day objection window) instead of seeking full authorisation. The most under-budgeted item is the PSD2 overlap: operators handling fiat top-ups on their own infrastructure often discover the Central Bank of Cyprus perimeter only after the Programme of Operations review, adding 8–12 weeks. We assess this from day one.
Licence Classes and What They Cover
A Cyprus CASP authorisation covers any combination of the ten crypto-asset services defined in MiCA Article 3(1)(16), grouped into three capital classes under Annex IV. Where multiple classes apply, the highest governs. You hold authorisation for the specific services you intend to provide, and we confirm the right class for your model before any capital is locked.
| Class | Capital | Services covered |
|---|---|---|
| 1 | €50,000 | Reception and transmission of orders, execution, placing, advice, portfolio management and transfer services: broker-style intermediation, discretionary management and on-instruction transfers |
| 2 | €125,000 | Custody and administration (safekeeping, key management, segregated wallets), and exchange of crypto for funds or for other crypto |
| 3 | €150,000 | Operation of a trading platform: a multilateral venue bringing together third-party buying and selling interests |
Some activity sits outside the perimeter: pure technology providers with no custody or client-asset relationship, and crypto-asset issuance, which follows the MiCA white-paper rules or the Central Bank of Cyprus for e-money and asset-referenced tokens. Tokenised securities and real-world assets that qualify as financial instruments are carved out by MiCA Article 2(4): a tokenised share, bond or fund unit follows MiFID and needs a Cyprus Investment Firm authorisation, assessed against ESMA’s Guidelines on the qualification of crypto-assets. A model spanning both perimeters needs the CASP and the CIF authorisation scoped together; see our fund licensing guide. Operators seeking EEA access without authorisation should review our reverse solicitation under MiCA guide.
What CySEC Requires
A Cyprus CASP authorisation requires capital under MiCA Annex IV, a Cyprus-resident board majority, locally-resident MLRO and Compliance Officer, a real Cyprus office and a complete MiCA Article 62 documentation set. The substance bar is high: CySEC expects the majority of the board to be Cyprus-resident and actively involved in decision-making, and it treats a single resident director with the rest of the board flying in for quarterly meetings as a substance failure that adds three to six months. The make-or-break items are genuine substance and a complete, file-ready ICT and DORA package on submission, not deferred to post-authorisation. We put all of it in place before we file.
| Requirement | Value |
|---|---|
| Minimum capital, Class 1 services | €50,000 |
| Minimum capital, Class 2 services | €125,000 |
| Minimum capital, Class 3 services | €150,000 |
| Capital test (ongoing) | Higher of class minimum or 25% of preceding year’s fixed overheads |
| Form of capital | Common Equity Tier 1 instruments under the Capital Requirements Regulation |
| Minimum directors | 2; majority Cyprus-resident expected by CySEC |
| Independent non-executive directors | At least half of the board (practitioner guidance) |
| MLRO | Required; Cyprus-resident |
| Compliance Officer | Required; Cyprus-resident |
| Internal Auditor | Required; can be outsourced subject to MiCA Article 73 outsourcing rules |
| Cyprus office | Real premises, not nameplate; place of effective management in Cyprus |
| Qualifying shareholders (≥10%) | Fit-and-proper assessment by CySEC; source-of-funds documentation required |
Fit-and-proper, substance and source of funds
CySEC assesses each director, qualifying shareholder and senior function holder on integrity, financial soundness, experience and time commitment, with prior approval required before appointment to a key role. The decisive element for owners holding 10% or more is source-of-funds and source-of-wealth evidence; complex structures with trusts, holding companies or token-treasury chains need this front-loaded, since deferring it is the most common trigger of supplementary rounds. On substance, MiCA Article 68 requires the place of effective management in the EU and at least one Union-resident director, but Cyprus practice goes further: a resident board majority, a Cyprus-resident MLRO and Compliance Officer, and key control functions performed locally. The AML framework runs under Law 188(I)/2007 (as amended by Law 96(I)/2025) and the CySEC AML/CFT Directive, with the EU Transfer of Funds Regulation applying with no de minimis threshold; the manual must be crypto-tuned for mixers, peel chains and privacy coins, not adapted from a payments business, and suspicious-transaction reports go to MOKAS. We build each of these to the standard that clears.
Application Process and Timeline
The realistic end-to-end timeline is 8–14 months. MiCA Article 63 fixes the CySEC review clock once the file is complete: 5 working days for acknowledgement, 25 for the completeness check and 40 for substantive assessment, with up to 20 additional working days where supplementary information is requested. Most of the calendar time before that is preparation, which cannot be rushed with off-the-shelf templates. Clean files with prior CySEC engagement and substance at filing complete in 8–10 months; complex multi-service or trading-platform applicants extend to 12–14. We run the whole sequence and keep the regulator’s clock moving.
Stage 1 3–4 weeks
We form the Cyprus company and put substance in place
We incorporate the Cyprus Ltd, open the corporate account for the capital deposit, prepare shareholder and UBO documentation and install resident directors, the MLRO and the Compliance Officer (see our Cyprus company formation service).
Stage 2 8–12 weeks
We build the compliance suite
We draft the full bespoke MiCA Article 62 set: the Programme of Operations, governance framework, AML/CFT manual and risk assessment, the DORA and ICT framework with third-party register, business-continuity and wind-down plans, and service-specific procedures for custody segregation, trading rules and the Travel Rule. This is the work that wins or loses the application, and it cannot be templated.
Stage 3 2–4 weeks (parallel)
We open banking and run pre-submission engagement
We arrange the operational and safeguarding accounts in parallel, and for non-standard models we engage CySEC through its Innovation Hub for early feedback before the statutory clock starts.
Stage 4 5–9 months
We file and manage assessment to a decision
We file the complete application in English through the CySEC e-portal and answer every information request ourselves. On authorisation, the licence is indefinite and entered on ESMA’s MiCA register, and we file your Article 65 passporting notifications so an EEA-wide live date follows 4–6 weeks after the grant, not months later.
Taxation
Cyprus is a low-headline-tax EU jurisdiction with a competitive IP regime. The Cyprus Tax Reform 2026 raised the corporate income tax rate from 12.5% to 15% from 1 January 2026 and introduced a flat 8% rate on crypto-asset disposals. The reform aligns Cyprus with OECD Pillar Two while preserving the structural tax features that anchor the jurisdiction’s value. We structure your entity to make the most of them.
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate Income Tax | 15% (from 1 January 2026) | Standard rate on CASP operating profits |
| Crypto-Asset Disposal Tax | 8% flat (from 1 January 2026) | Cyprus tax residents; replaces case-by-case treatment |
| IP Box (effective) | ~2.5–3% | Qualifying intellectual-property income (80% deduction) |
| Capital Gains Tax | 20% | Applies only to disposals of Cyprus immovable property |
| VAT | 19% (standard); largely exempt for crypto exchange | CJEU C-264/14 Hedqvist analogy |
| Withholding Tax, dividends to non-residents | 0% | No WHT on outbound dividends |
| Withholding Tax, interest to non-residents | 0% | |
| Withholding Tax, royalties to non-residents | 0% (subject to conditions) | |
| Special Defence Contribution, dividends | 5% (down from 17%) | Resident and domiciled individuals only; non-doms and non-residents 0% |
| Notional Interest Deduction on new equity | Reference rate + 5% | Continues post-reform |
Reform, reporting and the global minimum tax
The Cyprus Tax Reform 2026, in force from 1 January 2026, raised headline corporate tax to 15%, introduced the 8% flat rate on crypto-asset disposals by tax residents, cut the Special Defence Contribution on dividends from 17% to 5% (resident and domiciled individuals only) and extended the non-dom regime to 17 years, with two five-year extensions to 27 years total. On reporting, Cyprus is implementing DAC8 for CASP transaction reporting (2026 reportable, first EU exchange from 2027), with the OECD CARF running in parallel. Pillar Two’s 15% global minimum bites only on multinational groups above €750m consolidated revenue, which rarely touches a standalone CASP. We structure your entity to use the reliefs it qualifies for.
Ongoing Compliance and DORA
The authorisation is indefinite, but supervision is active and continuous fitness review replaces renewals. CASPs review capital adequacy annually (higher of class minimum or 25% of fixed overheads), file quarterly client-asset statements and audited accounts within four months of year-end, report to MOKAS per event, run an annual independent AML audit, and carry out market-abuse surveillance for trading platforms. CySEC runs scheduled engagements, thematic reviews and unannounced inspections, and enforcement is real: penalties range from administrative fines and public reprimands to withdrawal of authorisation and individual sanctions on directors. Operating without authorisation is a criminal offence, and unauthorised continuation by non-filers after 1 July 2026 is the regulator’s highest priority for the transitional period.
DORA and ICT resilience
DORA applies to every Cyprus CASP from 17 January 2025, and CySEC expects the complete framework on initial application, not deferred. It sets an ICT risk function under board oversight, incident classification and reporting under DORA Article 18, annual business-continuity testing, and threat-led penetration testing on a three-year cycle for significant entities. Custody operators must run cold-wallet segregation, a documented key ceremony with multi-signature thresholds and geographically separated backups, and the third-party register must name each ICT provider with contractual safeguards, exit strategies and concentration-risk analysis, where CySEC treats single-vendor dependency as a recurring concern. We build this into the application and operationalise it after.
Banking
Banking is the constraint that turns a Cyprus licence into a working business, and it is part of what we deliver. MiCA Article 70 requires client funds to be held with a licensed credit institution, not an EMI, in a segregated account, which means two layers: an operational account for day-to-day flows and a credit-institution relationship for safeguarding. Cyprus access is selective but workable, with stronger appetite for MiCA-authorised CASPs than for pre-MiCA or AML-only entities.
Credit institutions with crypto-onboarding mandates move from contact to live account in 8–14 weeks; those without may decline at intake. The harder constraint is often the correspondent layer above the local bank: a bank can onboard you comfortably while USD wires route through a chain that takes a separate compliance view, so where institutional USD flow is material we engage that question early. We open and drive these conversations during the application phase, working with the institutions directly so banking lands when your licence does. More on our banking support →
How Cyprus Compares
Cyprus sits in the EU/EEA established-crypto-centre tier alongside Malta and Gibraltar, with Estonia the lower-cost EU alternative. Malta has the longest dedicated crypto track record (the 2018 VFA Act), Gibraltar a post-Brexit DLT framework, and Estonia the lowest regulatory and advisory fees.
| Factor | Cyprus | Malta | Gibraltar | Estonia |
|---|---|---|---|---|
| Licence Type | MiCA CASP authorisation | MiCA CASP authorisation | DLT Provider Licence (custodial) / VAAP Licence (non-custodial) | MiCA CASP authorisation |
| Regulator | Cyprus Securities and Exchange Commission (CySEC) | Malta Financial Services Authority (MFSA) | Gibraltar Financial Services Commission (GFSC) | Estonian Financial Supervision Authority |
| Timeline | 8–14 months | 9–18 months | 9–12 months | 6–12 months |
| Min. Capital | €50k / €125k / €150k by class | €50k / €125k / €150k by class | No statutory minimum; risk-based (GFSC) | €50k / €125k / €150k by class |
| Corporate Tax | 15% (from 2026); IP Box ~2.5–3% effective; 8% on crypto disposals | 35% headline; ~5% effective via shareholder refund | 15% (from July 2024) | 0% retained / 22% distributed |
| Local Presence | Resident board majority; local MLRO and Compliance Officer; real office | Resident senior management; real office | Resident senior management; substance required | Local board member; real Estonian office |
| EU Passporting | Yes (MiCA Article 65) | Yes (MiCA Article 65) | No (third country under MiCA) | Yes (MiCA Article 65) |
| FATF Status | MONEYVAL-assessed (not a FATF member); no adverse listings | MONEYVAL-assessed; off the FATF grey list since June 2022 | MONEYVAL-assessed; off the FATF grey list since February 2024 | MONEYVAL-assessed; no adverse listings |
| Best For | English-language MiFID-grade supervision; institutional + retail CASPs | Established crypto track record from VFA-era; effective-tax optimisation | DLT-native operators wanting a bespoke non-EU regime | Cost-conscious EU CASPs prioritising speed and lean capital |
Compare every crypto jurisdiction side by side →
Cyprus and Malta are the closest peers: both run MiFID-grade English-language supervisors, both target institutional and retail CASPs, and both passport under MiCA, with the decision usually reducing to tax structuring (the Cyprus IP Box and 8% crypto-disposal rate vs Malta’s imputation refund) and existing footprint. Gibraltar’s DLT framework suits DLT-native operators but is a third country under MiCA, so it carries no EU passporting, and Estonia is the cost-leader. Choose Cyprus when an English-language regulator is decisive, you expect material IP income that fits the IP Box, the entity already holds CySEC MiFID permissions (the Article 60 route), or you target EU institutional flow. Consider Estonia when upfront cost is the binding constraint, Lithuania for the fastest documented MiCA review, or Malta where there is substantial VFA-era history. We deliver in all of them, so we recommend the column that fits your business, not the one this page is about. Book a free consultation and we will tell you straight which jurisdiction fits, then deliver it.
Frequently Asked Questions
What does Tomberg & Partners do for a Cyprus CASP licence?
We deliver the whole licence and stand behind it. We form the Cyprus company, deposit the capital, put the resident board majority, MLRO and Compliance Officer in place, build the full bespoke MiCA Article 62 file, submit through the CySEC e-portal and deal with the regulator directly through to authorisation. We arrange banking and file your Article 65 passporting notifications. You deal with one accountable firm, not a chain of intermediaries. Contact us and we will scope your file and give you a single fixed quote.
What is the deadline for legacy Cyprus CASPs to apply under MiCA?
Legacy CASPs on the Cyprus national register must file complete MiCA applications with CySEC by 27 February 2026. Filing by that date preserves the legacy authorisation while the application is under review; non-filers must cease operations by 1 July 2026, and there is no extension mechanism. Operators not on the legacy register file as fresh MiCA applicants with no transitional cover and must complete the full 8 to 14 month cycle before commencing operations.
Can a Cyprus Investment Firm provide crypto services without a full CASP authorisation?
Yes, in limited circumstances. MiFID-authorised Cyprus Investment Firms providing crypto-asset services equivalent to their existing MiFID services may notify CySEC under MiCA Article 60 rather than obtaining a full CASP authorisation. CySEC reviews the notification on a 40 working day objection window; absent objection, the firm may commence without further authorisation. The route is faster than full Article 63 authorisation and reuses the firm’s existing prudential profile and supervisory relationship.
How long does a Cyprus CASP authorisation take?
8 to 14 months end-to-end. MiCA Article 63 sets the CySEC review clock once the file is complete: 5 working days for acknowledgement, 25 for the completeness check, 40 for substantive assessment, plus up to 20 additional working days where supplementary information is requested. The rest is pre-filing preparation. Clean files with prior CySEC engagement and substance in place complete in 8 to 10 months; complex files extend to 12 to 14.
What is the minimum capital for a Cyprus CASP under MiCA?
Capital is set by MiCA Annex IV by service class: €50,000 for Class 1, €125,000 for Class 2 (custody and exchange) and €150,000 for Class 3 (operation of a trading platform). Where multiple classes apply, the highest governs. Capital must be held in Common Equity Tier 1 instruments and reviewed annually against the higher of the class minimum or 25% of the preceding year’s fixed overheads. We confirm the class your model needs before you lock up capital.
Does a Cyprus MiCA CASP licence cover tokenised securities or RWA?
No. MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments, so a tokenised share, bond or fund unit follows MiFID, not MiCA, and in Cyprus needs a Cyprus Investment Firm authorisation from CySEC, assessed against ESMA’s Guidelines on the qualification of crypto-assets. A model spanning both perimeters needs the CASP and the CIF authorisation scoped together; see our fund licensing guide.
[Formation
Cyprus Company Formation
Incorporate the Cyprus Ltd for your CASP application, complete with substance setup and capital deposit.](/company-formation/cyprus/) [Banking
Open a Crypto Business Account
Cyprus credit institutions plus EU EMI alternatives, structured for MiCA Article 70 client-fiat safeguarding.](/banking/) [Compare
Estonia CASP Licensing
The cost-leader EU alternative: 0% retained corporate tax, faster regulatory review, lower run-rate.](/crypto-licensing/estonia/)
Get Your Cyprus CASP Licence Delivered
We form the Cyprus company, build and file the CySEC MiCA CASP application, deal with the regulator directly, arrange banking and run ongoing compliance, in one engagement, with one firm accountable for the outcome. Book a free consultation and we will scope your file and give you a single fixed quote.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Cyprus Company Formation: The Cyprus Ltd is the standard vehicle for the CASP application
- Banking for Crypto Businesses: Cyprus credit-institution onboarding and EU EMI alternatives for MiCA Article 70 safeguarding
- Crypto Licensing (VASP / CASP / MiCA): The consolidated EU + offshore crypto-licensing overview
- Reverse Solicitation Under MiCA: How third-country firms reach EU clients without CASP authorisation
- Solutions: Crypto Exchanges: End-to-end CASP, banking, and compliance for exchange operators