To obtain a MiCA crypto-asset service provider (CASP) licence in Cyprus, a company must apply directly to the Cyprus Securities and Exchange Commission (CySEC), which is the designated competent authority under Regulation (EU) 2023/1114. The application requires a locally incorporated or branch entity, a comprehensive regulatory file covering governance, capital, AML/CFT controls and operational resilience, and a structured engagement with CySEC throughout the review process. Since the MiCA transitional (grandfathering) period ended on 1 July 2026, operating without authorisation is now unlawful, making timely and accurate submissions critical.
Why Cyprus and Why Now
Cyprus occupies a distinct position in the EU crypto-asset regulatory landscape. CySEC established a voluntary registration regime for crypto-asset service providers several years before MiCA took effect, giving the local market and regulator meaningful institutional experience. That experience now translates into a supervisory body that is familiar with crypto-specific business models, custody arrangements and decentralised protocols – a practical advantage for applicants seeking constructive dialogue during the review period.
The urgency of the current moment cannot be overstated. ESMA confirmed on 17 April 2026 that no extension to the grandfathering period would be granted. On 23 June 2026 ESMA issued a further public statement requiring unauthorised CASPs to cease onboarding new clients and marketing, to limit their activities to helping existing clients sell or transfer assets or close positions, and to proceed with an orderly wind-down. By 12 August 2026 there were 325 authorised CASPs on the ESMA register. Businesses that have not yet commenced their CySEC application are operating at direct commercial and legal risk.
Legal Basis and Scope of Authorisation
MiCA (Regulation (EU) 2023/1114) establishes a uniform licensing framework for crypto-asset services across the European Economic Area. Title V of MiCA sets out the requirements for CASPs, which include operators of trading platforms, firms providing custody and administration of crypto-assets on behalf of clients, exchange services (crypto-to-fiat and crypto-to-crypto), order execution, portfolio management, advice, transfer services and placement of crypto-assets.
A Cypriot CASP authorisation is passportable across all EU and EEA member states, meaning a single licence obtained from CySEC may support cross-border services without requiring separate national authorisations in each target jurisdiction. This is the single most commercially significant feature of the MiCA passport. For a detailed analysis of passporting mechanics and notification procedures from a Cyprus base, see our MiCA passporting strategy guide for Cyprus.
Step-by-Step Procedure Before CySEC
Step 1 – Pre-application preparation
Before any documents are filed, map the intended services precisely against the MiCA service categories. Scope creep in the application is a common error: applying for more permissions than the business model supports slows review and invites additional scrutiny. Confirm the legal vehicle – a Cypriot public or private limited company (Ltd) is the standard structure – and verify that the registered office, mind and management, and at least two executive directors are genuinely Cyprus-based rather than nominal.
Step 2 – Incorporate or establish the Cypriot entity
If the entity does not already exist, incorporation is carried out through the Registrar of Companies. Standard incorporation typically takes one to three weeks. The Memorandum and Articles of Association must reflect the proposed regulated activities. Authorised share capital and the minimum own-funds requirement under MiCA must be considered at this stage; the applicable threshold depends on the category of services for which authorisation is sought.
Step 3 – Build the regulatory file
This is the most time-intensive stage. The CySEC application file must include, at a minimum:
- Programme of operations – a clear description of intended services, client types, crypto-asset classes and target jurisdictions.
- Business plan – covering at least three years of financial projections, revenue model and capital adequacy analysis.
- Governance and organisational structure – management body composition, internal control functions (compliance, risk management, internal audit), reporting lines and escalation procedures.
- Fit-and-proper documentation – CVs, criminal record certificates, declarations of honour, professional references and relevant experience evidence for every member of the management body and qualifying shareholders (typically those holding 10% or more).
- Beneficial owner disclosure – the full ownership chain down to the ultimate beneficial owner(s), consistent with the requirements of the AML Directive as transposed in Cyprus.
- AML/CFT policies and procedures – a complete AML/CFT framework including customer due diligence, enhanced due diligence for high-risk clients, transaction monitoring, suspicious activity reporting, record-keeping and a Money Laundering Compliance Officer appointment. This is routinely the area most scrutinised by CySEC. Our AML compliance practice in Cyprus can assist with building and stress-testing this framework.
- IT and cybersecurity documentation – system architecture, access controls, penetration-testing reports or equivalent, business continuity and disaster recovery plans.
- Custody and safeguarding arrangements – applicable where the CASP will hold client assets or private keys.
- Complaints handling and conflict of interest policies.
- Capital evidence – audited or management accounts and confirmation of initial own funds.
Step 4 – Submit the application to CySEC
Applications are submitted through CySEC's designated portal together with the prescribed application fee. CySEC will issue an acknowledgement and may request supplementary information or clarification within the statutory review window. MiCA sets a 40-working-day assessment period from the date CySEC confirms the file is complete; CySEC may request additional information once, which pauses the clock. In practice, the completeness assessment itself may take several weeks, depending on the volume of applications CySEC is processing.
Step 5 – Regulatory dialogue and Q&A phase
CySEC typically raises written questions on governance, AML/CFT robustness, technical infrastructure and conflicts of interest. This dialogue phase is critical. Delayed, incomplete or defensive responses are a significant cause of extended timelines and, in some cases, withdrawal of applications. Legal representatives who have direct experience with CySEC's review style can materially improve the pace and outcome of this phase.
Step 6 – Decision and conditions
If CySEC is satisfied, it issues a Decision to Authorise. The decision may attach specific conditions or supervisory obligations. Authorisation is entered in the CySEC register and subsequently notified to ESMA for inclusion in the EU-wide ESMA register of CASPs, which enables the MiCA passport to be activated.
Step 7 – Post-authorisation obligations and passport notifications
Authorisation is the beginning of ongoing regulatory obligation, not the end of it. CASPs must maintain capital requirements on a continuing basis, file periodic reports with CySEC, notify material changes in governance or operations, and keep AML/CFT policies current as their client base and risk profile evolve. Passporting into other member states requires formal notification procedures to CySEC and, through CySEC, to the host-state authorities.
If your business is in the preparation or mid-application stage, our team can review your current regulatory file and identify gaps before they become CySEC queries. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Realistic Timelines
End-to-end timelines depend heavily on the complexity of the business model, the quality of the initial file and the responsiveness of the applicant during the Q&A phase. As a working estimate, applicants should plan for:
- Preparation of the regulatory file: two to four months for a straightforward single-service CASP; longer for multi-service or multi-jurisdiction structures.
- Completeness assessment by CySEC: subject to CySEC's current workload and the quality of the submission.
- Formal review period: 40 working days from confirmation of a complete file, subject to information requests pausing the clock.
Total elapsed time from the start of preparation to receipt of the CySEC Decision commonly ranges from five to twelve months. Applicants presenting incomplete or inconsistently documented files have experienced significantly longer timelines.
Cost Drivers
Budgeting for a MiCA CASP licence in Cyprus involves several categories of expenditure. Application fees are payable to CySEC in accordance with its published fee schedule; the amount varies by the number and type of services applied for. Beyond regulatory fees, the primary cost drivers are legal and advisory fees for drafting and reviewing the regulatory file, compliance infrastructure build-out (technology, policies, personnel), fit-and-proper due diligence on the management body and beneficial owners, and the cost of minimum own funds that must be maintained on an ongoing basis.
Attempting to minimise costs by filing an incomplete or template-based application typically results in higher overall expenditure due to extended review periods, repeated supplementary submissions and, in some cases, the need to re-structure governance or capital arrangements mid-process.
Common Errors Made by Foreign Applicants
Ferraz & Whitmore regularly encounters the following patterns in files prepared without Cyprus-specific legal guidance:
- Nominal presence: Directors and senior managers whose connection to Cyprus is purely on paper. CySEC assesses genuine management control carefully; this deficiency is identified early and can lead to rejection.
- Underspecified AML/CFT frameworks: Generic group-level AML policies that do not address the specific risks of the Cypriot entity's client base, asset classes or geographies.
- Incomplete beneficial owner disclosure: Failure to trace the ownership structure through intermediate holding vehicles and trusts to the ultimate natural-person beneficial owner. This is a bright-line requirement.
- Mismatch between the business plan and the scope of authorisation: Seeking authorisation for services not actually described in the programme of operations, or vice versa.
- IT documentation that does not address crypto-specific risks: Standard cybersecurity documentation that omits wallet infrastructure, key management, smart-contract risk or DLT-specific continuity scenarios.
- Underestimating the ongoing capital and reporting burden: Structuring the entity without adequate runway to meet continuous own-funds requirements and CySEC's ongoing supervisory reporting obligations.
Decision Checklist
Before committing to a Cyprus CASP licence application, consider the following:
- Is the Cypriot entity properly incorporated with genuine local substance – directors, registered office, management decisions?
- Have all intended crypto-asset services been correctly mapped to MiCA service categories?
- Is the beneficial owner chain fully documented down to ultimate natural persons?
- Are the proposed management body members able to demonstrate fit-and-proper status through verifiable professional history?
- Is there a complete, Cyprus-specific AML/CFT framework in place, including a named Money Laundering Compliance Officer?
- Does the initial capital position satisfy the minimum own-funds threshold for the intended services?
- Is the IT and cybersecurity documentation specific to the crypto-asset operational environment?
- Is there a post-authorisation compliance plan covering ongoing reporting, capital monitoring and any planned passport notifications?
For a comprehensive review of your readiness and a structured engagement plan, our Cyprus MiCA licensing team is available to assist. Details of our scope and approach are set out on our MiCA licensing service page for Cyprus. You may also reach us directly at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.