Cyprus has emerged as a structurally significant jurisdiction for MiCA passporting because CySEC, its competent authority, combines an established track record in financial services supervision with direct EU regulatory standing. As of 12 August 2026, the ESMA register records 325 authorised crypto-asset service providers across the EU, and firms that failed to secure authorisation before the end of the MiCA transitional period on 1 July 2026 are now operating unlawfully if they continue to offer services to EU clients. For international groups evaluating where to anchor their EU CASP licence, Cyprus presents a defined regulatory path – but also a set of strategic and compliance considerations that deserve careful analysis before any commitment is made.
Why the Transitional Period Closure Changes Everything
The MiCA grandfathering window, which allowed certain crypto-asset service providers to continue operating under pre-existing national regimes while pursuing full authorisation, closed on 1 July 2026. ESMA had already signalled in its statement of 17 April 2026 that no extensions would be granted. The ESMA public statement of 23 June 2026 was categorical: firms without CASP authorisation must immediately cease new client onboarding and marketing, restrict residual activity to facilitating the sale or transfer of client assets or the orderly closing of positions, and wind down in a structured manner.
The practical effect is an abrupt market bifurcation. Authorised CASPs – roughly 325 on the ESMA register as of mid-August 2026 – can passport services freely across the EU single market. Unauthorised operators face not only regulatory enforcement but reputational damage with institutional counterparties, banking correspondents and custodians who now treat CASP status as a basic due-diligence requirement. Delay is no longer a neutral option.
Cyprus as a Passporting Base: The CySEC Framework
Under MiCA, a CASP licence granted by CySEC in Cyprus carries full passporting rights across all EU member states. The passport covers each of the services listed in the authorisation: operation of a trading platform for crypto-assets, exchange services, custody and administration, execution of orders, placing, reception and transmission of orders, portfolio management, and advice. Services not listed in the Cypriot authorisation cannot be passported, so the scope of the initial licence application is itself a strategic decision.
CySEC's supervisory approach draws on its existing Investment Firms (IF) and Alternative Investment Fund (AIF) frameworks, which have given the authority a relatively granular methodology for assessing capital adequacy, governance structures and AML/CFT controls. Cyprus transposed the Fifth and Sixth Anti-Money Laundering Directives and has a functioning beneficial owner register maintained by the Registrar of Companies. For international applicants, this matters because MiCA requires competent authorities to assess the fitness and probity of qualifying shareholders, management body members and beneficial owners as part of the authorisation process. An applicant whose beneficial ownership chain is opaque or structured through jurisdictions that do not cooperate with Cypriot regulatory enquiries will encounter material delays.
If you are considering a Cyprus CASP application or assessing whether your current structure is compatible with CySEC's expectations, our team can provide an initial review of the key structural and compliance questions. Contact us at info@ferrazwhitmore.com or visit our contacts page.
The Passporting Notification Procedure
Once a CASP authorisation is granted by CySEC, the firm must follow the MiCA passporting notification procedure before commencing services in another member state. The process requires the authorised CASP to notify CySEC, which then communicates with the competent authority in the host member state. The notification must specify, at minimum, the crypto-asset services to be provided, the member states concerned, the anticipated start date, and whether services will be provided through a branch or on a cross-border basis.
CySEC transmits the notification to the relevant host authority within a prescribed period, and the CASP may generally begin operating in the host jurisdiction once that transmission is completed, subject to any host-state requirements that apply under national law to matters not harmonised by MiCA. Firms should not assume that the passport is automatic from a practical standpoint: some host states have indicated they will scrutinise incoming passport notifications closely, particularly regarding local AML/CFT obligations, local language disclosure requirements, and consumer protection rules that remain within national competence.
AML/CFT: The Make-or-Break Variable
MiCA does not replace the EU AML/CFT framework; it operates alongside it. CASPs authorised in Cyprus are subject to Cyprus's AML/CFT supervisory regime, which places obligations not only on the firm itself but on its compliance officer, senior management and, in certain circumstances, members of the management body individually. The beneficial owner identification and verification requirements interact directly with the authorisation process: CySEC will assess whether the applicant's AML/CFT policies, procedures and internal controls are adequate before granting a CASP licence.
For international groups, the AML/CFT dimension often requires attention at the group level, not just the Cypriot entity. Where a Cyprus CASP is a subsidiary of a non-EU parent, the group-wide AML/CFT framework must be capable of supporting compliance with EU standards, and information-sharing arrangements between group entities must comply with data protection rules. Weaknesses identified at the group level can result in CySEC imposing conditions on the Cypriot licence or, in serious cases, refusing authorisation.
Our AML/CFT compliance practice in Cyprus works with CASPs at each stage of the authorisation and ongoing supervision process. For a confidential discussion of your AML/CFT preparedness, reach out to us at info@ferrazwhitmore.com. You can find more detail on our approach at our AML compliance services page for Cyprus.
Open Questions and Areas of Interpretive Risk
MiCA leaves a number of questions to member state implementation or to future ESMA guidance. Several of these are directly relevant to a Cyprus passporting strategy.
- Scope of services and asset classification: MiCA's definitions of crypto-assets, asset-referenced tokens and e-money tokens create boundary questions. Where a CASP's product portfolio includes instruments that may be classified as financial instruments under MiFID II rather than crypto-assets under MiCA, the applicable regulatory regime differs, and CySEC will expect a documented legal analysis.
- Branch versus cross-border services: The regulatory obligations – and the supervisory responsibilities of CySEC versus the host authority – differ depending on whether a passported service is delivered through a branch or on a cross-border basis. Some host states have indicated an expectation of local presence for retail-facing services, which may limit the commercial utility of a purely cross-border passport in those markets.
- Significant CASP designation: ESMA has the power to designate CASPs as significant, which triggers more intensive direct oversight. The criteria for significance are volume and cross-border reach based. Firms with an EU-wide growth strategy should model the potential regulatory implications of reaching significance thresholds over time.
- Interaction with national courts: Enforcement actions by CySEC, as well as disputes arising from authorisation decisions, are subject to challenge before the Cypriot administrative and judicial system, including the District Court. International clients should understand the procedural and evidential standards applicable in Cypriot proceedings when assessing their risk position.
- Third-country equivalence: MiCA's provisions on third-country firms remain subject to ongoing development at EU level. For groups that provide services both inside and outside the EU, the absence of a finalised equivalence framework creates operational uncertainty in relation to intragroup transactions and back-to-back arrangements.
Strategic Considerations for International Applicants
The choice between Cyprus and other EU jurisdictions as a CASP passporting base should be driven by the firm's specific service scope, client base, operational model and existing regulatory footprint – not by assumptions about relative supervisory leniency. CySEC has demonstrated a willingness to act where authorisation conditions are not met, and the post-transitional enforcement environment across the EU is materially more assertive than the grandfathering period suggested.
Firms with an existing Cyprus IF or AIF licence may find that CySEC's familiarity with their governance and AML/CFT arrangements facilitates a more streamlined CASP application process, though this depends on the degree of operational and personnel overlap between the licenced entity and the proposed CASP. Groups establishing a new Cyprus entity specifically for MiCA purposes face a longer runway: they must demonstrate genuine substance in Cyprus, including locally-based management body members and a compliance function capable of satisfying CySEC's day-to-day supervisory expectations.
For firms that are already authorised in another EU member state and are considering whether to supplement or relocate their CASP licence to Cyprus for passporting purposes, the analysis is different again. A comparison of the scope of services authorised, the capital and governance requirements, and the practical experience of passporting into target markets should inform the decision. Our CASP licence guide for Spain offers a parallel analysis that may be useful for firms assessing multiple EU options simultaneously.
The Market Context: 325 Authorised CASPs and Growing Competition
With 325 CASPs recorded on the ESMA register as of 12 August 2026, the authorised market is already populated by a range of operators – from large exchanges with multinational licence portfolios to specialist custody providers and advisory firms. Firms entering the authorisation process now will be competing for banking relationships, institutional clients and technology infrastructure with peers that have a head start. Speed to authorisation is commercially significant, but it cannot be achieved by shortcutting the substantive requirements that CySEC will examine.
The market data also reflects the asymmetric outcome of the transitional period closure: many firms that began the application process did not reach authorisation before 1 July 2026. Those firms are now in wind-down or in the process of restructuring their operations. For authorised CASPs and those close to authorisation, this creates a window of competitive advantage that is finite – as the overall number of authorised operators grows, the differentiation will shift from regulatory status to service quality, pricing and market access.
Outlook
The regulatory environment for CASPs operating from Cyprus is set to become more detailed, not less. ESMA is expected to publish further technical standards and supervisory guidance across a range of MiCA topics over the coming months and years. CySEC, for its part, is likely to refine its supervisory expectations in light of early application experience and the findings from its ongoing market monitoring. Firms that invest in robust governance and compliance infrastructure at the authorisation stage will be better placed to absorb future regulatory developments without material operational disruption.
For CASPs already authorised, the focus should now be on maintaining compliance with the conditions of the CySEC licence, ensuring that passporting notifications are properly filed before services commence in any new host state, and monitoring ESMA guidance for developments that affect the scope or conduct of their authorised activities. Compliance is not a one-time exercise at authorisation; it is a continuous obligation that attracts supervisory attention and, where deficiencies are found, enforcement risk.
Ferraz & Whitmore advises crypto-asset service providers at each stage of the MiCA authorisation and passporting process in Cyprus. For a structured discussion of your situation and the options available to you, please write to us at info@ferrazwhitmore.com or visit our MiCA licensing page for Cyprus to learn more about how we work with international clients. You can also reach our team directly through the contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.