CySEC and Crypto-Asset Service Providers: How Cyprus Regulates CASPs Under MiCA

The Cyprus Securities and Exchange Commission (CySEC) is the national authority responsible for supervising crypto-asset businesses operating in or from Cyprus. Over the past two years its oversight of these firms has been reshaped by the European Union's Markets in Crypto-Assets Regulation (MiCA), which replaced Cyprus's earlier national rulebook with a single, EU-wide licensing framework. That transition reached a decisive point on 1 July 2026.

From a national register to an EU licence

Before MiCA, firms offering crypto services had to register with CySEC as their anti-money-laundering supervisor under the Prevention and Suppression of Money Laundering and Terrorist Financing Law. CySEC opened this national register in 2021 and used it to vet the ownership, governance and AML controls of crypto-asset service providers (CASPs).

That national regime is now closed to new entrants. CySEC stopped accepting fresh national-regime CASP applications on 17 October 2024, and halted equivalent cross-border notifications from other EEA-registered providers shortly afterwards. MiCA's rules for CASPs took effect across the EU on 30 December 2024; its rules for stablecoin-style tokens had already applied from 30 June 2024.

The 1 July 2026 deadline

MiCA allowed firms already active under national rules a transitional window. In Cyprus, existing CASPs could keep operating until 1 July 2026, or until CySEC granted or refused their MiCA licence, whichever came first. To stay in business, providers had to lodge a complete authorisation application with CySEC by 27 February 2026.

Since 1 July 2026, only three types of firm may lawfully provide crypto services in Cyprus: those holding a CySEC MiCA authorisation, EU firms passporting in from another member state, and newly approved entrants. Firms that missed the deadline, or whose applications are still pending, must stop ordinary regulated activity and submit an orderly wind-down plan. Providing crypto services without authorisation is unlawful.

What the rules require

A MiCA licence is more demanding than the old registration. Applicants must meet minimum capital requirements ranging from €50,000 to €150,000 depending on the services offered, with the highest tier applying to firms that operate a trading platform. Core obligations include:

• Custody and client assets: providers holding clients' crypto must keep those assets segregated from their own, maintain accurate records, and remain liable for losses caused by incidents such as hacks.
• KYC and AML: CASPs remain obliged entities under EU anti-money-laundering rules, carrying out customer due diligence, monitoring transactions and reporting suspicious activity; the EU "travel rule" also requires identifying information to accompany crypto transfers.
• Governance and disclosure: fit-and-proper management, complaints handling, conflict-of-interest controls and clear information for clients.

A CASP authorised in Cyprus can passport its licence to offer services throughout the European Economic Area without seeking a separate authorisation in each country — one of the main reasons firms choose to license in Cyprus.

What it means for investors

For consumers, the practical message is to check that any platform is properly authorised. Clients of unauthorised providers do not benefit from MiCA's safeguards, including its protections for client assets. CySEC maintains public registers of authorised firms and continues to publish warnings about unregulated entities. Anyone using a crypto service in Cyprus should confirm its status before depositing funds.