Cyprus Crypto Licence 2026: The CASP Guide

If you run a trading-heavy crypto business and you want a full EU licence with a regulator that actually understands high-volume, cross-border trading, Cyprus is the jurisdiction most exchanges and brokers end up shortlisting. A CASP authorisation from the Cyprus Securities and Exchange Commission (CySEC) under MiCA passports across all 27 EU member states on a notification basis, at initial capital of €50,000 to €150,000 by service class. The capital is fixed EU-wide, so what sets Cyprus apart is the regulator behind it. CySEC is the same authority that made the island Europe’s forex and CFD capital.

CySEC’s grandfathering window for legacy providers closed on 1 July 2026, so a new entrant applies for the full licence, and what Cyprus offers in return is that trading heritage and the ecosystem of banks, lawyers, auditors and talent a decade of licensed brokerage built around it. What they are signing up for is a real financial-services licence: a Cypriot company with genuine substance, qualified management, an AML function and a DORA-compliant technology programme. This guide explains what a Cyprus crypto licence actually is in 2026. It covers the framework, capital, passport, timeline and substance, the 15% tax (up from 12.5% in January 2026) and the trade-off.

What a Cyprus CASP licence is — and the regulator behind it

A Cyprus crypto licence is a Crypto-Asset Service Provider (CASP) authorisation, issued by the Cyprus Securities and Exchange Commission under the Markets in Crypto-Assets Regulation — MiCA, Regulation (EU) 2023/1114. It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing orders, operating a trading platform, or advising on crypto-assets.

The regulator is the main reason to choose Cyprus. CySEC is the authority that supervised the wave of Cyprus Investment Firms (CIFs) that turned the island into Europe’s forex and CFD hub, a market built entirely on high-volume, cross-border, leveraged trading. That heritage is directly relevant to a crypto exchange or broker: CySEC has spent years assessing order-execution models, client-money safeguarding, conflicts of interest and cross-border conduct. It is not learning trading businesses for the first time. And the ecosystem that grew up around the forex industry (crypto-aware banks, auditors, compliance advisers and a genuinely English-speaking professional class) is the same one a licensed CASP will lean on. If you have read our VASP, CASP and MiCA explainer, Cyprus is the jurisdiction where that framework meets a mature trading-supervision culture rather than a standing start. Our deeper MiCA regulation explained guide sets out the regulation itself.

Capital by service class — plus the overhead test

MiCA sets minimum capital by the class of service you provide, and operators often miss that those tiers are the same in every EU country. You do not pick Cyprus for cheaper capital; the capital is fixed by the regulation. MiCA also sets a fixed-overheads requirement that applies in Cyprus as in every member state. You must hold at least a quarter of the previous year’s fixed overheads where that exceeds the class minimum, which for a larger operation pushes the real figure above the headline. The requirement can be met with own funds (Common Equity Tier 1 items such as paid-up share capital, premium and retained earnings), an insurance policy, or both.

Two points shape the budget. First, the classes are cumulative: an exchange with custody lands you in Class 2, and a full order-book trading venue puts you in Class 3 at €150,000. Most exchange and broker projects sit at €125,000 before the overhead test is applied. Second, the capital is not a fee. Held as own funds it stays in the business, an insurance policy can replace some or all of it, and nothing is paid away to the regulator. Scoping the right class before you incorporate is the single decision that most affects your budget. Our Cyprus crypto licence cost breakdown models the full year-one number, capital and overhead test included, and the class-by-class detail against the broader market sits in our CASP capital requirements guide.

From Cyprus, one licence and 27 markets: the EU passport

The reason a CASP licence justifies the substance is the passport. Under MiCA Article 65, once CySEC authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis — the regulator in each host country is notified, and you are in. You license once and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

For most crypto businesses, that reach is the reason to choose an EU licence at all. An offshore registration makes you legal in one jurisdiction; a Cyprus CASP covers all 27 member states under one rulebook from a single file. It also carries weight with the parties that decide whether you can actually operate: the banks that hold your funds, the EMI and PI partners that provide your fiat rails, auditors and institutional counterparties. A CySEC licence, backed by the regulator’s forex-era standing, persuades those parties far more readily than an offshore permit. For the full contrast, our EU CASP vs offshore VASP comparison runs the two models side by side.

Timeline, and the transition deadlines

CySEC runs a substantive review, and you should plan six to twelve months from a complete filing — realistically ten to fourteen months from incorporation once you factor in company setup, capitalisation and building the file. The clock that matters is not the regulator’s queue but your own preparation: the classes scoped, the Cypriot company incorporated and funded, the programme of operations and the AML, DORA and safeguarding policies drafted to CySEC standard, and management genuinely fit-and-proper. Poorly prepared applications stall in review questions, which is where most of the timeline risk sits.

Two dates shaped the current queue. The grandfathering window for legacy crypto providers closed on 1 July 2026, the outer limit of MiCA’s transitional arrangements, and CySEC had set an internal filing deadline of 27 February 2026 for existing providers wanting continuity of service. New entrants apply directly for CASP authorisation. The queue is active and moving, so the practical advice is to start the file now. Existing Cyprus-based operators moving from the old regime should read our Cyprus VASP-to-CASP transition guide, which walks through exactly what changes and by when.

The real substance requirement in Cyprus

This is where a modern Cyprus licence separates hardest from the old registrations, and where the real work goes. A CASP authorisation requires a Cypriot company with genuine local substance with a registered office and real operating presence on the island. A nominee shell will not qualify. The prudential safeguards must satisfy the class minimum and the overhead test, as own funds, insurance or both, and management must be assessed by CySEC as qualified and fit-and-proper, with relevant financial-services or crypto experience on the board. CySEC also runs suitability and source-of-funds checks on shareholders and ultimate beneficial owners.

On top of the entity, you need a live compliance function. A dedicated MLRO (money-laundering reporting officer) and AML/CFT policies aligned to the EU’s 5th and 6th AML directives; the EU Transfer of Funds Regulation (the Travel Rule) for originator and beneficiary data on transfers; and a DORA-compliant ICT programme covering operational resilience, incident reporting, resilience testing and third-party ICT oversight. For a crypto business that also means serious custody, key-management and cybersecurity controls, with client crypto segregated from company assets. None of this existed under the old registrations, and it is exactly what gives the CASP licence its standing. The full document and governance checklist lives in our Cyprus crypto licence requirements guide. Building it properly is a project in itself; the banking around it (crypto-friendly banks and EMI/PI partners for your fiat rails) is usually the hardest single piece, as our crypto-friendly banking guide explains.

Tax, and who Cyprus actually suits

Cyprus pairs its trading heritage with a genuinely competitive tax position: a 15% corporate tax (raised from 12.5% in January 2026 to meet the EU/OECD Pillar Two minimum), sitting inside an extensive double-tax-treaty network and an English-language legal system. The capital and the compliance programme cost far more than the state fees, but the tax and the ecosystem are why so many trading firms are already domiciled on the island and why a crypto arm often fits neatly alongside an existing forex operation.

So who is it for? Cyprus suits trading-heavy operators such as exchanges, brokers, custodians, trading platforms and OTC desks that value a regulator experienced with cross-border trading and want the tax and ecosystem to match. It is a particularly natural fit for existing forex firms bolting on crypto. If your market is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market, so many groups run an EU CASP for Europe and a separate licence for the rest of the world. For a fuller price comparison across regimes, see our cheapest crypto licence 2026 breakdown.

The Cyprus trade-off

CySEC built its reputation supervising Europe’s forex and CFD brokers, and it reviews a CASP file with the same eye for trading risk, so budget six to twelve months from a complete filing plus a DORA programme that runs for as long as you hold the licence. In exchange you get passporting across the EU from one authorisation, a regulator that already understands order books and client money, a 15% corporate tax rate and a credential that banks can underwrite. For a trading-heavy business meant to operate in Europe for years, that trade is usually worth making.

If a full EU crypto licence is where your project is heading, we run the entire file, including the Cypriot company, the substance and management, the AML and DORA framework, the CySEC application and the crypto-friendly banking around it. Our fees and the state costs are always shown separately. See the scope on our Cyprus crypto licence page, then book a free consultation and we’ll model the real year-one economics (the right service class, the capital and overhead test, and whether Cyprus or a neighbour fits your plan) before you commit a euro.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.