Cyprus Crypto Licence Requirements in 2026

A Cyprus crypto (CASP) licence requires a Cyprus company with genuine local substance — a registered office, real operating presence and management directed from Cyprus. Cyprus is one of the EU’s most credible homes for a crypto licence — but the requirements file behind a CASP authorisation is a full financial-services file, assessed by a regulator that already supervises Europe’s densest cluster of trading firms. The Cyprus Securities and Exchange Commission (CySEC), the same authority that built the island into the continent’s forex and CFD hub, is the competent authority for Crypto-Asset Service Provider (CASP) authorisation under MiCA. That heritage cuts both ways: CySEC understands high-volume cross-border trading, and it knows exactly what a serious application looks like.

This guide is the requirements checklist we work from on our own desk. It covers what the 2026 Cyprus CASP regime actually demands — a Cypriot company with substance, initial capital by service class plus the fixed-overhead test, fit-and-proper management vetted by CySEC, an MLRO, and a DORA-compliant ICT framework — so you can price the licence on what it truly takes rather than on the state fee alone.

The company and local substance

Everything starts with a Cypriot company. CySEC authorises a Cyprus legal entity with genuine substance behind it — there is no remote-only route. The applicant is incorporated in Cyprus, keeps a registered office there, and runs a real operating presence with the right people performing the core functions on the island. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test.

Substance is assessed in the round. CySEC wants to see that the business is directed and administered from Cyprus, staffed for the services it intends to offer, and capable of being supervised locally. This is the first hard difference from the light-touch registration that some jurisdictions were once known for, and it is the requirement operators most often underestimate. For the full picture of what a CASP authorisation buys and how it sits within MiCA, our flagship Cyprus crypto licence overview maps the regime end to end.

Capital by service class — and the overhead test

This is the requirement that catches operators pricing Cyprus on the headline floor. MiCA sets a minimum capital figure by the service class you run, and Cyprus applies it directly — but with a twist that other EU regulators apply too and that trading-heavy applicants feel most: the fixed-overhead requirement. Your minimum own funds are the higher of the class floor or a quarter of the previous year’s fixed overheads, so a business with a large cost base must hold more than the €50,000–€150,000 headline.

Two points matter beyond the table. First, the capital must sit in qualifying own funds — paid-up share capital, share premium and retained earnings — not in crypto held on the balance sheet, and it remains working capital of the business rather than a fee you write off. Second, the class floors are identical in every EU member state because they come from MiCA, not national law, so the tier is not something you optimise by choosing Cyprus. What Cyprus adds around the same requirement is a 15% corporate tax (raised from 12.5% in January 2026) and a deep fintech ecosystem. Costs sit outside scope here; for the year-one build see the Cyprus crypto licence cost guide, and for how each class works across the EU our CASP capital requirements primer breaks them all down.

People, governance and fit-and-proper vetting

Under MiCA the people behind the company are assessed as rigorously as the business itself, and CySEC runs the vetting with a level of practice few regulators can match — it has spent more than a decade supervising the governance, capital and conduct of hundreds of Cyprus Investment Firms. That depth is a feature for a well-prepared applicant and a filter for an unprepared one.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. CySEC expects a board and senior management with genuine financial-services or crypto backgrounds — not a founder team with no regulated-industry track record — and expects directors to demonstrate they can actually run a licensed EU financial-services business under supervision.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting — and must be a real, appointable and locally credible person, not a name on an org chart.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. You must show not only that the business is funded, but where the money comes from and how the beneficial owners built their wealth. Vague or undocumented wealth is one of the most common reasons a file stalls — the same standard a tier-1 bank applies.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme

Alongside people and capital, CySEC reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what turns a six-month approval into a twelve-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU anti-money-laundering directives and the Travel Rule — the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers — because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP without exception. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody.

Transition, passporting and the VASP deadline

Two dates frame the requirements. First, the transition: under MiCA the legacy national VASP registration is being retired, and the transitional window for previously registered providers closes by 1 July 2026. Cyprus is moving faster than the headline suggests — CySEC set an internal filing deadline of 27 February 2026 for existing providers, so the real runway to get a complete file in is short. New entrants apply directly for a CASP authorisation; there is no VASP shortcut left. If you hold a legacy registration, our Cyprus VASP-to-CASP transition guide walks through the upgrade path and the deadline mechanics.

Second, the reward for meeting the full requirements: passporting. Once CySEC grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one licence, the single largest regulated crypto market in the world, without applying jurisdiction by jurisdiction. That EU-wide reach, backed by CySEC’s standing among European financial regulators, is precisely what the substance, capital and DORA requirements are the price of.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: fix your CASP service classes and the matching capital tier first — modelling the fixed-overhead test against your real cost base — then incorporate the Cyprus company, fund the own funds and stand up the local office and roles. Assemble every UBO and management fit-and-proper file — source of funds, suitability, experience evidence — in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model, not off a template. Only then does the CySEC application go in.

None of this is a light registration — and that is the point. The Cyprus CASP regime asks for a real Cypriot company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential from a regulator that institutional banks and PSPs already recognise, passportable across 27 markets. Get the file complete and internally consistent the first time and the six-to-twelve-month window is achievable; file with gaps and it drifts.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Cyprus substance, fit-and-proper, AML and DORA build end to end and will review any application against CySEC’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.