Since 1 July 2026, any firm providing crypto-asset services in or from Cyprus must hold a valid MiCA authorisation as a Crypto-Asset Service Provider (CASP) – the transitional period confirmed by ESMA has closed with no extensions granted. CySEC is the competent authority in Cyprus responsible for receiving applications, assessing fitness and propriety, and issuing CASP licences that carry passporting rights across the European Economic Area. Firms that have not yet secured authorisation are now operating outside the regulatory framework and face immediate enforcement exposure.
Why the Deadline Matters for Your Business
The end of the MiCA transitional period on 1 July 2026 was not a soft deadline. ESMA confirmed publicly that no member state extensions would be permitted, which means CySEC has no discretion to continue tolerating unauthorised activity. For firms that relied on national transitional registers or grandfathering arrangements, those protections have now lapsed.
The practical consequences are concrete: unregistered entities risk supervisory orders to cease operations, potential fines, and reputational damage that can complicate future authorisation. Institutional counterparties – banks, payment processors, fund administrators – are increasingly conducting their own due diligence on CASP status before onboarding. Operating without a licence is therefore not merely a regulatory problem; it is a commercial one.
If your firm is in this position, or if you are structuring a new operation and need to move quickly, the first step is an honest assessment of where you stand. We are available to discuss your situation at info@ferrazwhitmore.com or through our contacts page.
The Scope of MiCA CASP Authorisation in Cyprus
MiCA establishes a uniform licensing category for providers of crypto-asset services, replacing the patchwork of national virtual asset frameworks that preceded it. A CASP authorisation from CySEC covers a defined list of services – including custody and administration of crypto-assets on behalf of clients, operation of trading platforms, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placing, reception and transmission of orders, portfolio management, and crypto-asset transfer services – subject to the specific services selected in the application.
Cyprus is a particularly practical jurisdiction for this authorisation for several reasons:
- EU passporting: A CySEC-issued CASP licence allows the holder to provide services across all EEA member states either on a cross-border basis or through a branch, without requiring separate national licences.
- Established regulatory infrastructure: CySEC has experience supervising investment firms and alternative fund managers under EU frameworks, and its approach to MiCA applications draws on that institutional knowledge.
- Corporate environment: Cyprus offers a developed legal and corporate services infrastructure, with the Registrar of Companies and an accessible court system – including the District Court – familiar with financial services disputes and regulatory proceedings.
- Treaty network and holding structures: The jurisdiction integrates well with broader group structures for international businesses managing cross-border crypto-asset operations.
White Papers and Ongoing Obligations
MiCA authorisation is not a one-time event. Depending on the crypto-assets you issue or facilitate, you may also be required to prepare and publish a white paper that complies with MiCA's prescribed content standards. White papers must be notified to CySEC and, in certain cases, reviewed by it before publication. Issuers of asset-referenced tokens and e-money tokens face the most demanding white paper and capital requirements; utility token issuers and pure service providers face a lighter – but still substantive – disclosure regime.
Beyond authorisation, CASPs are subject to ongoing obligations covering prudential requirements, organisational and governance standards, conduct of business rules, conflicts of interest policies, safeguarding of client assets, and AML/CFT compliance. The AML dimension is particularly significant: Cyprus is subject to EU anti-money laundering directives and CySEC coordinates with the relevant national AML authorities. Our AML and compliance practice in Cyprus supports CASPs at both the authorisation stage and on a continuing basis.
The Authorisation Process: A Summary
The MiCA authorisation process in Cyprus follows a structured sequence that includes corporate establishment or adaptation, preparation of the regulatory application file, submission to CySEC, the assessment period, and – if approved – registration and commencement of regulated activity. Each stage has its own documentation requirements, internal policy obligations, and fit-and-proper assessments of shareholders and management.
Rather than reproduce the full procedural detail here, we have prepared a dedicated step-by-step guide that walks through each phase, identifies the documentation CySEC expects, and flags the most common points of failure. You can read it at our MiCA CASP Licence Guide for Cyprus.
Common Pitfalls We Observe
Based on our work with firms at various stages of MiCA readiness, several issues recur with notable frequency:
- Underestimating the substance requirement: CySEC expects genuine operational substance in Cyprus, not merely a registered address. Management functions, compliance personnel, and decision-making must be demonstrably present or credibly planned.
- Incomplete governance documentation: Internal policies on conflicts of interest, remuneration, client asset safeguarding, and complaints handling must be drafted and operational before the application is filed, not after approval.
- Mis-scoping the service list: Selecting too many services inflates the application and capital requirement; selecting too few can create gaps that require a subsequent licence variation. Careful scoping at the outset saves significant time.
- White paper timing errors: Firms that intend to issue tokens sometimes file the CASP application before finalising white paper content, which creates inconsistencies that CySEC queries during review.
- AML framework gaps: An underdeveloped AML/CFT framework – inadequate policies, no appointed compliance officer, no risk-based customer due diligence procedures – is among the most common reasons for application delays or refusals.
- Passporting assumptions: Assuming that a third-country group entity's existing licensing covers EU activity, when in fact a separate MiCA authorisation is required for EEA-facing services.
Self-Assessment: Is Your Operation Ready?
Before engaging with the formal application process, it is worth working through a candid internal review. The following questions are not exhaustive, but they surface the issues that most frequently require attention:
- Has the entity been incorporated in Cyprus, and does it have the required share capital and corporate structure for its intended service scope?
- Have the members of the management body been identified and are they prepared to submit to CySEC's fit-and-proper assessment?
- Is there a designated AML compliance officer with appropriate qualifications and authority?
- Are client asset safeguarding arrangements in place, including segregation policies and relevant arrangements with custodians or banks?
- Has the firm identified which specific MiCA services it intends to provide and confirmed that its business model maps to those categories?
- If token issuance is planned, has the white paper been drafted and reviewed against MiCA's content requirements?
- Is there a documented business continuity and IT security framework?
If several of these questions reveal gaps, that does not mean authorisation is out of reach – it means the preparation timeline needs to be calibrated accordingly. We encourage you to reach out at info@ferrazwhitmore.com for a preliminary discussion about where your firm stands.
Cross-Border and Group Structures
Many firms seeking MiCA authorisation in Cyprus are not purely domestic operations. They may be subsidiaries of groups headquartered outside the EU, joint ventures with partners in multiple jurisdictions, or platforms that serve clients across several member states simultaneously. The cross-border dimension raises distinct questions that go beyond the application itself.
Passporting under MiCA allows a Cyprus-authorised CASP to notify CySEC of its intention to provide services in another EEA member state, after which CySEC notifies the host state's competent authority. The host state cannot block the service, but it can exercise conduct supervision once activity commences. Firms must therefore understand not only the Cyprus authorisation requirements but also any host-state conduct rules applicable in the markets they intend to serve.
For groups with existing regulated entities in other jurisdictions – whether investment firms, payment institutions, or other financial intermediaries – MiCA authorisation in Cyprus can be structured to complement rather than duplicate existing group licences. Our capital markets practice in Cyprus regularly advises on integrated group structures of this type.
How Ferraz & Whitmore Supports CASP Applicants
Our team in Cyprus works with firms across the full lifecycle of MiCA authorisation: from initial feasibility and corporate structuring through application preparation, regulatory dialogue with CySEC, and post-authorisation compliance. We do not offer a standard template service; each engagement is built around the specific services the client intends to provide, the group context in which the Cyprus entity sits, and the timeline the business requires.
In practical terms, this typically involves legal advice on corporate and regulatory structuring, drafting and review of governance and compliance documentation, co-ordination with local accountants and corporate service providers where needed, and representation in any regulatory dialogue with CySEC. Where a matter involves proceedings before the District Court or other formal proceedings, our litigation capability is available to the same client team.
We work with the understanding that MiCA authorisation is a means to a commercial end – enabling your firm to operate lawfully and competitively across the EU. Our role is to help you get there on a defensible basis and within a realistic timeframe, without understating the requirements or the risks of an incomplete application.
To discuss your MiCA CASP licensing requirements in Cyprus, please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.