Regulations for Crypto license in Cyprus

Cyprus has emerged as a leading hub for blockchain and cryptocurrency businesses, providing a favorable legal and regulatory environment for companies operating in the digital asset space. The Cyprus Securities and Exchange Commission (CySEC) plays a pivotal role in supervising cryptocurrency activities, ensuring compliance with both local and EU regulations.

The Cypriot regulatory framework places a strong emphasis on transparency, investor protection, and preventing financial crimes. The country enforces stringent Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) directives, such as The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 to 2023 (L. 98(Ι)/2023), to protect businesses and investors from financial risks.

This guide offers key regulatory insights into obtaining a crypto license in Cyprus. Below are the main regulatory areas crypto businesses must comply:

1. Registration and Licensing

1. Registration and Licensing

  • All companies involved in cryptocurrency activities, including exchanges and wallet providers, are required to register with the Cyprus Securities and Exchange Commission (CySEC).
  • The specific crypto license in Cyprus will depend on the type of services the business provides. In Cyprus, companies offering services related to the exchange, custody of crypto assets, or wallet services must obtain a Crypto Asset Service Provider (CASP) license, following the latest requirements of the 2023 legislation.
2. Anti-Money Laundering (AML) and Know Your Customer (KYC)

2. Anti-Money Laundering (AML) and Know Your Customer (KYC)

  • In Cyprus, all cryptocurrency businesses are required to follow stringent Anti-Money Laundering (AML) regulations as mandated by the Cyprus Securities and Exchange Commission (CySEC). These regulations, consolidated up to Law 98(Ι)/2023, focus on preventing money laundering and terrorist financing by ensuring client identification, transaction monitoring, and reporting suspicious activities to the Unit for Combating Money Laundering (MOKAS).
  • Additionally, companies are obliged to implement robust Know Your Customer (KYC) procedures, including verifying the identity of clients through personal information, conducting background checks, and continuously monitoring transactions to ensure compliance.
3. Financial Reporting and Auditing

3. Financial Reporting and Auditing

  • Cryptocurrency companies in Cyprus must adhere to stringent compliance requirements set by the CySEC. These obligations include maintaining internal controls and procedures that ensure compliance with Crypto Asset Service Provider (CASP) regulations and anti-money laundering (AML) laws.
  • Companies are expected to keep detailed financial records, including data on governance, risk management, and adherence to AML/KYC regulations. This ensures transparency and accountability in all financial activities, in line with CySEC’s regulatory framework. CySEC also periodically requires external audits to verify that CASP-registered businesses comply with both local and EU financial regulations.
4. Consumer Protection

4. Consumer Protection

  • Companies offering cryptocurrency services in Cyprus must provide their customers with clear and detailed information regarding the nature of their services, including associated fees and any potential risks involved with cryptocurrency transactions.
  • Licensed Crypto Asset Service Provider (CASP) in Cyprus are required to take robust measures to safeguard customer assets. This includes the use of secure custodial services that are insured and compliant with both local and European Union regulations, ensuring the protection of customer funds against theft, fraud, or loss.
5. Cybersecurity Standards

5. Cybersecurity Standards

  • Cryptocurrency businesses in Cyprus are required to adopt robust cybersecurity protocols to safeguard sensitive financial data and client information. This includes encryption practices, multi-factor authentication, and consistent system audits. Businesses are also required to implement business continuity plans to ensure operational stability in the event of a cybersecurity incident.
  • In the case of a cybersecurity breach or threat, companies must report the incident to relevant authorities and swiftly implement mitigation measures to limit potential damage. Regular updates and simulations are required to keep security measures up to date.
  • All businesses handling personal data in Cyprus must comply with the General Data Protection Regulation (GDPR), which oversees the storage and processing of data within the European Union.
6. Operational Requirements

6. Operational Requirements

  • Companies applying for a CASP license in Cyprus must comply with specific operational and capital requirements outlined by the Cyprus Securities and Exchange Commission. These requirements depend on the services offered by the company and are designed to ensure that applicants have adequate financial resources to support their operations.
  • Businesses are also required to implement strong governance frameworks and internal controls to mitigate operational risks and ensure compliance with AML regulations and other legal obligations. These measures aim to maintain financial integrity, prevent fraud, and ensure that the company operates within the regulatory frameworks stipulated by both Cypriot law and the broader European Union (EU) standards.
7. Cross-Border Compliance and Cooperation

7. Cross-Border Compliance and Cooperation

Cryptocurrency businesses in Cyprus are required to comply with both local regulations and the international legal frameworks relevant to their operations. This often involves cooperating with foreign regulatory authorities to ensure adherence to international standards. The Financial Action Task Force (FATF) plays a key role in shaping these international standards to combat money laundering and terrorist financing. Additionally, Cyprus-based companies must participate in international initiatives such as the Common Reporting Standard (CRS) to enhance transparency and prevent tax evasion.

The CySEC, which oversees the regulation of digital asset providers, works closely with international organizations, including the European Securities and Markets Authority (ESMA), to ensure that Crypto Asset Service Provider align with global regulatory practices.

8. Innovation and Adaptability

8. Innovation and Adaptability

  • Cyprus is taking proactive measures to ensure its regulatory framework adapts to the fast-evolving landscape of cryptocurrency and blockchain technologies. This includes regularly updating regulations to accommodate emerging technologies, innovative business models, and new developments within the industry.
  • Additionally, the Cyprus Securities and Exchange Commission (CySEC) has introduced several initiatives, including regulatory sandboxes, to support the development of fintech and blockchain startups.

Types of Crypto Licenses in Cyprus

While many European jurisdictions continue to use the Virtual Asset Service Provider (VASP) license, Cyprus has officially adopted the Crypto Asset Service Provider (CASP) framework. This shift aligns with the upcoming MiCA regulation standards, ensuring that the country stays at the forefront of regulatory developments in the crypto industry. Cyprus is progressively adjusting its requirements to meet MiCA, enhancing transparency, compliance, and investor protection, ensuring a smooth transition for businesses operating in the crypto space.

However, by the end of 2024, with the full implementation of MiCA, Cyprus will introduce additional requirements to further harmonize with EU-wide regulations. These new standards will cover enhanced compliance, risk management, and transparency measures, particularly for businesses offering trading, custody, and advisory roles.

Overview of requirements to obtain Crypto license in Cyprus

  • The company must be registered in Cyprus and comply with CySEC regulations, with a physical office presence in the country.
  • Businesses must register as a CASP with CySEC.
  • At least two executive directors must be appointed, passing CySEC’s suitability tests.
  • A Compliance Officer, who must be a resident of Cyprus, is required to oversee AML and CFT compliance as per CySEC’s standards.
  • Share capital requirements depend on the services offered, ranging from Class 1 to Class 3.
  • Development of internal documents, including business plan.

Estimated time frames

Gathering documents

1-2 weeks

Company formation

up to 2 weeks

Documents preparation

3-4 weeks

License Issuance*

3-6 months

*The timeline may vary based on the completeness of documentation and the responsiveness of the СуSEC

Detailed Requirements for Crypto licensing in Cyprus

Obtaining a crypto license in Cyprus involves a rigorous process that ensures full compliance with both local and European Union (EU) regulatory standards. The process is designed to safeguard the integrity of the financial system and prevent illicit activities such as money laundering and terrorism financing. Companies looking to offer crypto-related services must meet various legal, financial, and operational requirements to maintain high standards of transparency and accountability.

The detailed requirements listed below cover the key aspects businesses need to fulfill to successfully obtain a CASP license in Cyprus. This includes essential documentation, share capital requirements, personnel qualifications, and operational standards that align with CySEC’s (Cyprus Securities and Exchange Commission) regulations.

List of required documents

  • AML/KYC/CFT Policy:
    • In line with Cyprus AML regulations and EU directives, companies must develop a comprehensive policy that includes Anti-Money Laundering (AML) procedures to detect and prevent money laundering, Know Your Customer (KYC) measures to verify customer identities, and Countering the Financing of Terrorism (CFT) strategies to monitor and assess risks related to cryptocurrency transactions.
  • Application Form: A comprehensive application detailing the company’s business model, structure, services provided (e.g., exchange, custody), and targeted geographical markets.
  • Business Plan: A detailed business plan outlining the company’s objectives, financial forecasts, market analysis, and operational strategies. This helps assess the viability and growth potential of the business.
  • Memorandum and Articles of Association (MAA): This document must describe the company’s objectives, internal regulations, governance, registered office, and share capital. It is the foundational legal document for the company’s operation in Cyprus.
  • Organizational Structure and Internal Control Systems:
    This document provides an overview of the company’s internal management structures, control processes, and governance mechanisms to ensure compliance with regulatory requirements.
  • List of Outsourced Functions, Services, or Activities:
    Companies must submit a comprehensive list of any outsourced services or functions, including third-party providers, to demonstrate how external activities are managed and supervised.
  • Conflicts of Interest Measures and Product Governance Arrangements:
    This includes strategies for identifying and mitigating conflicts of interest, as well as product governance policies aimed at ensuring fair and transparent services.
  • Systems for Monitoring Firm Activities and Risk Controls:
    Companies are required to provide descriptions of monitoring systems for all business activities, including backup systems and internal risk management procedures.
  • Business Continuity Plans (BCPs):
    The BCP outlines the systems and resources in place, including key personnel, to ensure the company can continue operations during disruptive events and meet regulatory standards.

Share Capital and Government Fees

  • Minimum Share Capital: In Cyprus, the minimum share capital requirements depend on the type of crypto-asset services provided under the CASP (Crypto-Asset Service Provider) license. These share capital requirements range between €50,000 and €150,000, depending on the class of services (Class 1 to Class 3) offered by the company.
  • Government Fees: Government fees related to company registration and licensing in Cyprus also vary depending on the type of services and the scope of the business. These typically include registration fees with the Cyprus Registrar of Companies, notary fees, and other legal costs. The total fees can range from €1,000 to €3,000 depending on the complexity of the application.

Personnel Requirements

  • Compliance Officer: A Responsible Compliance Officer must be appointed, responsible for ensuring the company adheres to AML/CFT regulations.
  • Directors: At least four directors must be appointed, with a minimum of two executive directors and two independent non-executive directors.
  • Money Laundering Reporting Officer (MLRO): In addition to the Compliance Officer, an MLRO is required to oversee the company’s anti-money laundering activities, including reporting suspicious activities to CySEC.

Business premises requirements

  • In Cyprus, a physical office is required for obtaining a crypto asset service provider (CASP) license. This office must be within the Republic of Cyprus and must comply with the substance requirement, meaning the office should be operational and staffed by local employees. Additionally, the office serves as a hub for the company’s operations, ensuring the presence of key management personnel within Cyprus and meeting the legal requirements for tax residency.

Step-by-Step Guide to Obtaining a CASP License in Cyprus

To successfully obtain a CASP License in Cyprus, businesses must follow a structured process that ensures full compliance with both local Cypriot and European regulatory frameworks. This process guarantees that all cryptocurrency operations are performed in strict accordance with local laws, providing the highest standards of security, transparency, and regulatory compliance, in line with the requirements set by the Cyprus Securities and Exchange Commission (CySEC).

With extensive experience in blockchain technology and regulatory compliance, our dedicated team, ensures that each step of the licensing process is handled with precision and tailored to your specific business needs.

Eriks Fijalovs

Head of Blockchain and Crypto

1

Client Assessment and Business Model Review

The process starts by collecting essential documents and conducting an in-depth review of the client’s business model, including their corporate structure and plans for digital asset services. We ensure all necessary documents, especially concerning any corporate shareholders, are in order. This stage includes an initial compliance analysis with CySEC’s regulations to confirm the feasibility of obtaining the crypto license in Cyprus.

2

Company Incorporation in Cyprus

Once the business model review is complete, we proceed with incorporating the company in Cyprus. This involves drafting and submitting the Memorandum and Articles of Association (MAA) to the Registrar of Companies. During this step, we secure the legal foundation for the company and obtain the necessary Tax Identification Number (TIN) for operating in Cyprus.

3

Preparation of Licensing Documentation

Following the incorporation, we help prepare the required documents for the application process with CySEC. This includes drafting AML/KYC policies, compliance procedures, and appointing key individuals such as a Compliance Officer and directors. The company must also demonstrate its capital adequacy and governance structures to meet CySEC’s licensing criteria.

4

Submission of the License Application to CySEC

All prepared documentation is submitted to CySEC for review. This includes detailed information on the company’s business plan, compliance policies, and operational procedures. Once the application is submitted, CySEC will appoint a case officer to oversee the review and communication process.

5

Application Review and Compliance Checks

During the review phase, CySEC may request additional information or clarifications regarding the application. We maintain communication with the regulator, ensuring all queries are addressed efficiently. Any necessary adjustments are made to ensure the company complies with CySEC’s standards.

6

Opening a Corporate Bank Account

Once the application is under review, we assist the company in opening a corporate bank account in Cyprus. This step is essential for handling the company’s financial operations, including initial funding, customer transactions, and compliance with AML/CFT regulations.

7

Operational Launch After License Approval

After the license is granted by CySEC, the company can officially begin its crypto operations. We provide additional support to ensure the business is fully compliant with CySEC’s ongoing regulatory requirements, including regular reporting, monitoring, and governance.

Detailed Time Frames to Obtain a Crypto License in Cyprus

The process of obtaining a crypto license in Cyprus involves multiple stages, each with its own timeline. Below is an estimated timeline for completing the licensing process:

1.  Preparation and Documentation

Estimated Time Frame: 3-4 weeks

2.  Application Submission

Estimated Time Frame: 1-3 days

File the necessary documents and the license application with the Cyprus Securities and Exchange Commission (CySEC). This step ensures that all forms are accurate and complete for efficient processing.

3.  Regulatory Review by CySEC

Estimated Time Frame: 3-6 months

4.  Final Approval and Registration

Estimated Time Frame: 1-2 weeks

Licensing Confirmation: Once the review is complete and the company meets all criteria, CySEC will grant the license, officially recognizing the entity as a Crypto Asset Service Provider (CASP) under Cypriot law.

Overall Estimated Time Frame – Approximately 4-7 months

Factors Affecting the Time Frame

The process of obtaining a crypto license in Cyprus is comprehensive and includes several stages. It requires meticulous preparation of the required documentation, submitting a well-structured application, and passing through a detailed regulatory review. On average, this process can take between 4 to 7 months, depending on the intricacy of the business model and the specific regulatory obligations. By following all compliance requirements closely and working with experts like those at Legalaes, businesses can ensure a smoother and more efficient journey towards receiving their crypto license.

Advantages of the Crypto license in Cyprus

Links for Legislation Related to Crypto Business in Cyprus

CySEC oversees the regulation of financial services, including crypto-asset service providers (CASPs), ensuring compliance with both national and European regulations.

The FIU focuses on anti-money laundering (AML) regulations and countering the financing of terrorism (CFT). It plays a critical role in ensuring compliance for companies operating under the CASP framework.

Oversees taxation for cryptocurrency businesses, including corporate taxes, VAT, and other related tax matters.

The Central Bank regulates financial operations and payment systems, which can be relevant for crypto businesses.

These directives set forth regulatory requirements for anti-money laundering measures applicable to businesses in the EU, including Cyprus. Compliance with these directives is crucial for obtaining a CASP license in Cyprus.

The MiCA Regulation is the forthcoming EU-wide framework governing virtual financial assets and crypto businesses. It aims to harmonize the issuance, trading, and regulation of crypto-assets across Europe, including those under the CASP framework in Cyprus.

This document provides official guidelines for the registration and regulation of CASP providers in Cyprus.

The Data Protection Commissioner ensures compliance with the General Data Protection Regulation (GDPR) for businesses operating in Cyprus, including those offering crypto services.

This law establishes the legal framework for combating money laundering and the financing of terrorism in Cyprus. It includes requirements for compliance with AML and CFT measures and is critical for crypto businesses operating under the CASP framework.

Regulatory body for CASP license in Cyprus

Taxation of Cryptocurrency Companies in Cyprus

Taxation of cryptocurrency companies in Cyprus forms a key component of the country’s regulatory framework, reflecting the government’s approach to integrating digital assets within its broader financial system. Cyprus offers a competitive tax regime for businesses, including those involved in blockchain and cryptocurrency sectors, with several beneficial policies designed to foster growth and compliance.

Below are the essential aspects of how crypto companies are taxed in Cyprus:

1. Corporate Tax

1. Corporate Tax

  • Cryptocurrency companies operating in Cyprus are subject to a standard corporate tax rate of 12.5%, which is one of the lowest corporate tax rates in the European Union. The tax applies to worldwide income, making Cyprus an attractive jurisdiction for crypto-related businesses.
  • Income from cryptocurrency transactions must be recognized as part of taxable income. This includes any gains or profits derived from cryptocurrency trading, exchange, or other crypto activities.
  • Cryptocurrency businesses can deduct a wide range of operational expenses, including those related to technology, software, infrastructure, and professional services. Other eligible deductions include staff salaries, marketing expenses, and costs related to maintaining the company’s business operations.
2. Dividend and Withholding Tax

2. Dividend and Withholding Tax

  • Withholding Tax: Dividends paid to non-residents in Cyprus are generally not subject to withholding tax. This is a significant benefit under Cyprus’s tax framework, which aims to promote foreign investment.
  • Dividends: Cyprus offers a favorable environment for dividend distribution, with dividends paid by companies in Cyprus to non-resident shareholders being exempt from withholding tax. For residents, the Special Defence Contribution is the key tax to consider on dividend income, with the rate standing at 17%.
3. Value Added Tax

3. Value Added Tax

  • The standard VAT rate in Cyprus is 19%, applicable to most goods and services, including those related to the cryptocurrency sector.
4. Capital Gains Tax

4. Capital Gains Tax

  • Cryptocurrency profits are generally exempt from Capital Gains Tax in Cyprus. Unlike some other jurisdictions, profits from the sale or exchange of cryptocurrencies are not currently subject to capital gains tax, making Cyprus an attractive environment for crypto businesses and traders.
5. International Transactions

5. International Transactions

Cross-Border Payments: Cryptocurrency companies in Cyprus that engage in cross-border transactions are generally not subject to withholding taxes on outbound payments, such as dividends or interest payments to non-residents, provided the payments meet EU and international tax treaty standards.

Double Taxation Treaties: Cyprus has a broad network of double taxation treaties (DTTs), which can help reduce tax liabilities on international transactions, providing benefits to companies dealing with multiple jurisdictions. These treaties allow companies to avoid paying tax on the same income in multiple countries.

Foreign Income: In cases where income is generated from foreign sources, it may be exempt from Cypriot taxation, subject to compliance with specific criteria under Cypriot tax law.

6. Tax Reporting and Compliance

6. Tax Reporting and Compliance

  • Companies must submit annual tax returns to the Cyprus Tax Department and maintain transparent financial records, including details on all cryptocurrency transactions.
  • Regular audits are required, depending on the size and scope of the company’s activities, particularly to ensure compliance with Anti-Money Laundering (AML) regulations.
  • Companies must adhere to all Cypriot tax laws and regulations, which include filing Value Added Tax (VAT) returns (if applicable) and ensuring full compliance with the Income Tax Law.
7. Special Considerations

7. Special Considerations

  • Incentives for Startups: Cyprus provides attractive tax incentives for new businesses, particularly those in the tech, blockchain, and financial sectors. Startups can benefit from various government grants and deductions aimed at fostering innovation and growth in these industries.
  • Tax Benefits for IP and R&D: Companies engaged in activities related to blockchain and other innovative technologies can access special tax deductions for intellectual property (IP) rights and research and development (R&D) expenses. This includes deductions or exemptions on income earned from qualifying IP assets, offering significant tax savings.
  • Notional Interest Deduction (NID): Cyprus offers the NID regime, which allows businesses to deduct a notional interest expense on new equity injections. This can reduce the taxable base on new investments and is particularly beneficial for companies looking to grow through capital investments.
8. Regulatory Guidance and Updates

8. Regulatory Guidance and Updates

  • Cypriot tax authorities regularly update regulations regarding cryptocurrencies and digital assets to ensure compliance with both local and European Union standards. Businesses operating in this sector need to stay up-to-date with any regulatory changes.
  • It is crucial for companies to actively monitor these updates and adjust their operations accordingly. The Cypriot government frequently revises its guidelines concerning the taxation of digital assets, reflecting the evolving nature of blockchain technology and the digital economy.

FAQ about Crypto license in Cyprus

1. What is a CASP License in Cyprus, and why is it essential for my crypto business

A Virtual Asset Service Provider (VASP) License from the Malta Financial Services Authority (MFSA) is required for businesses offering services like cryptocurrency exchanges, wallet providers, and custody of crypto assets. It ensures compliance with Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) regulations.

2. What are the primary requirements for obtaining a cryptocurrency license in Cyprus?

Key requirements include company incorporation in Cyprus, a physical office, AML/KYC compliance, appointed directors, and passing CySEC’s suitability tests.

3. How long does it take to obtain a CASP license in Cyprus?

On average, the process takes between 4 to 6 months, depending on the completeness of the application and CySEC’s review timeline.

4. What are the tax benefits for cryptocurrency companies in Cyprus?

Cyprus offers competitive corporate tax rates and various exemptions, such as 0% tax on dividends from foreign subsidiaries and no withholding tax on dividends paid to non-residents.

5. Is it mandatory to appoint a Compliance Officer and AML Manager for my crypto business in Cyprus?

Yes, CySEC requires the appointment of a Compliance Officer and an AML Manager (MLRO) to ensure adherence to AML and CFT regulations.

 

6. Do I need to establish a physical office in Cyprus to obtain a Crypto License?

Yes, a physical office in Cyprus is mandatory. It must be operational and staffed by local employees to meet substance requirements.

7. What are the minimum capital requirements to apply for a CASP license in Cyprus?

Minimum capital requirements range from €50,000 to €150,000, depending on the class of services your company will provide.

8. What are the benefits of obtaining a CASP License in Cyprus compared to other jurisdictions?

Cyprus offers a favorable tax regime, access to the EU market, a streamlined licensing process, and a robust legal framework that enhances business credibility and operational flexibility.

<< 1 >>


EMI license in Lithuania 2024

Business activity: Payment institution, Digital bank

EMI license in Cyprus 2024

Business activity: Payment institution, Digital bank

MSB License in Canada 2024

Business activity: Payment institution, Digital bank