The MiCA transitional period that allowed crypto-asset service providers to operate in Cyprus under grandfathered status ended on 1 July 2026. From that date, any business providing crypto-asset services to EU clients without a valid CASP authorisation is acting unlawfully, regardless of when it began operations. Companies that have not yet secured authorisation from CySEC must take immediate, concrete steps to avoid regulatory exposure.
What Changed and When
The Markets in Crypto-Assets Regulation (MiCA) introduced a transitional grandfathering window that permitted certain crypto-asset service providers already operating before the regulation's full application to continue offering services while seeking authorisation. That window closed on 1 July 2026.
Well in advance of that deadline, the European Securities and Markets Authority (ESMA) issued a public statement on 17 April 2026 confirming that no extension to the transitional period would be granted. A further ESMA public statement on 23 June 2026 set out the precise obligations for any CASP still operating without authorisation: stop all new client onboarding and marketing activity immediately, limit services strictly to the selling or transferring of assets or the closing of positions, and wind down operations in an orderly manner. As of 12 August 2026, the ESMA register recorded 325 authorised CASPs across the EU. Any entity not on that register is now operating outside the law when serving EU clients.
The Cyprus Dimension: CySEC as Competent Authority
In Cyprus, the competent authority for MiCA authorisation and supervision is the Cyprus Securities and Exchange Commission (CySEC). CySEC has been at the forefront of crypto-asset regulation in the EU, having operated a voluntary registration regime for crypto-asset service providers before MiCA's full application. That earlier regime, however, does not automatically convert into a MiCA CASP licence; authorisation under MiCA requires a separate, substantive application and assessment.
Companies that previously held CySEC registration under national transitional rules should not assume that status provides any ongoing protection after 1 July 2026. The regulatory expectation is clear: either hold a valid MiCA CASP authorisation, or cease providing services to EU clients. For businesses incorporated in Cyprus or using Cyprus as their EU gateway, the consequences of non-compliance fall directly within CySEC's supervisory and enforcement perimeter.
If your business is evaluating the CASP licensing process in Cyprus or assessing whether an existing authorisation remains adequate for your service scope, our team can assist. Please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
Who Is Affected
The end of the transitional period affects a broad range of businesses. The following categories should review their status without delay:
- Crypto-asset exchanges and trading platforms operating in or from Cyprus that have not obtained full MiCA CASP authorisation from CySEC.
- Custody and wallet service providers offering services to EU-based clients under grandfathered status that has now lapsed.
- Operators of crypto-asset transfer services, including those facilitating peer-to-peer transactions or acting as intermediaries.
- Portfolio management and advisory firms whose crypto-asset activities fall within MiCA's CASP service categories.
- Foreign businesses using Cyprus as an EU passporting hub – a CASP authorisation from CySEC enables passporting of services into other EU member states, making Cyprus a common structuring choice for non-EU groups.
- Businesses that applied for authorisation but have not yet received it – pending applications do not, on their own, permit continued full service provision after 1 July 2026.
The test is functional, not merely structural. If a business is providing any of the services listed under MiCA to EU clients, it requires authorisation, regardless of where it is incorporated or how it describes its activities.
AML/CFT Obligations Remain in Full Force
Compliance with MiCA authorisation requirements does not exist in isolation. CASPs are also subject to EU AML/CFT obligations, including requirements around customer due diligence, beneficial owner identification and verification, transaction monitoring, and suspicious activity reporting. In Cyprus, these requirements apply alongside the MiCA framework and are supervised in coordination with relevant national authorities.
Businesses seeking CASP authorisation from CySEC must demonstrate that their AML/CFT policies, procedures, and governance structures meet the applicable standards. Weaknesses in AML/CFT compliance can delay or prevent authorisation and may give rise to separate enforcement action. For businesses that have operated under grandfathered status, a gap analysis of current AML/CFT arrangements is a prudent early step. Our AML compliance practice in Cyprus can assist with that assessment.
Immediate Action Items for International Companies
For any business currently providing crypto-asset services to EU clients from or through Cyprus, the following steps are recommended as a matter of urgency:
- Verify authorisation status: Confirm whether the business holds a valid MiCA CASP authorisation from CySEC. Cross-reference with the ESMA public register. If authorisation is not confirmed, treat the position as non-compliant until clarified.
- Cease onboarding and marketing immediately: In line with the ESMA statement of 23 June 2026, any CASP without authorisation must halt all new client onboarding and promotional activity directed at EU clients. This is not optional guidance – it reflects the regulatory expectation stated publicly by ESMA.
- Prepare or advance the CASP authorisation application: If an application has not been filed, assess the requirements and begin preparation. If an application is already with CySEC, review its status and respond promptly to any queries. A robust application requires documented governance, capital adequacy evidence, AML/CFT policies, and information on beneficial owners and qualifying shareholders.
- Assess passporting needs: If the business intends to serve clients across multiple EU member states from a single Cyprus authorisation, passporting strategy should be addressed as part of the licensing process, not as an afterthought. Our analysis of MiCA passporting strategy for Cyprus sets out the practical considerations in detail.
- Develop an orderly wind-down plan if authorisation is not being pursued: For businesses that have decided not to seek CASP authorisation, the ESMA guidance requires services to be wound down in an orderly manner. This includes notifying affected clients, facilitating asset transfers, and closing open positions in an orderly sequence. Legal advice on the mechanics and timing of a compliant wind-down is strongly advisable.
What "Orderly Wind-Down" Means in Practice
The ESMA statement of 23 June 2026 used the phrase "orderly wind-down" without prescribing a specific timeline or procedure at EU level. The practical content of that requirement in Cyprus is subject to CySEC guidance and any applicable national rules. At minimum, an orderly wind-down implies: advance notice to clients, a defined period during which assets can be transferred out or positions closed, clear communication about the termination of services, and documentation of the process for regulatory purposes.
Businesses that treat wind-down as an informal process – for example, simply switching off a platform without client notification or structured asset return – risk regulatory sanction and civil claims from affected clients. Where client assets are involved, the obligations of the Registrar of Companies and, potentially, the District Court may also be engaged depending on how the wind-down is structured legally.
If your business is navigating the CASP authorisation process with CySEC or needs assistance structuring a compliant wind-down, our lawyers in Cyprus are available to advise. You can reach us at info@ferrazwhitmore.com or through our contacts page.
The Broader Regulatory Landscape
The closure of the MiCA transitional period represents a significant shift in the EU crypto-asset regulatory environment. With 325 authorised CASPs recorded in the ESMA register as of 12 August 2026, the authorised market is taking shape. Businesses that delay pursuing authorisation not only face enforcement risk in the present but may also find themselves at a competitive disadvantage as institutional clients and counterparties increasingly require MiCA-compliant status as a condition of engagement.
Cyprus, given its existing financial services infrastructure, English-language legal environment, and CySEC's established supervisory capacity, continues to attract businesses seeking an efficient EU entry point for crypto-asset services. The CASP licensing process in Cyprus involves precise requirements and a structured engagement with CySEC; early and well-prepared applications are more likely to proceed smoothly.
Ferraz & Whitmore advises international companies on the full lifecycle of MiCA compliance in Cyprus, from pre-application structuring through to ongoing regulatory obligations. To discuss how the end of the transitional period affects your business specifically, contact us at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.