Cyprus CASP Licence Under MiCA 2026 — Application Process, Capital Requirements, and Grandfathering Deadline

1. What CASP authorisation covers

MiCA (Markets in Crypto-Assets Regulation, EU 2023/1114) introduced a harmonised EU-wide regime for crypto-asset service providers, replacing the patchwork of national VASP regimes. A Cyprus CASP licence is granted by CySEC (Cyprus Securities and Exchange Commission) and passport-eligible across the entire EEA via the standard MiFID-style passport.

The CASP licence covers ten regulated services under MiCA Article 3(1)(16):

• Custody and administration of crypto-assets on behalf of clients
• Operation of a trading platform for crypto-assets
• Exchange of crypto-assets for funds
• Exchange of crypto-assets for other crypto-assets
• Execution of orders for crypto-assets
• Placing of crypto-assets
• Reception and transmission of orders
• Providing advice on crypto-assets
• Providing portfolio management on crypto-assets
• Providing transfer services for crypto-assets

2. Three capital tiers — which applies to you?

3. The application file — what CySEC requires

A complete Cyprus CASP application includes 15+ document categories, totalling typically 250-500 pages:

• Programme of operations (services offered, target client segments, geographic markets)
• Business plan with 3-year financial projections (P&L, balance sheet, cashflow)
• Governance framework (organisational chart, three-lines-of-defence, board composition)
• Fit-and-proper assessments for all directors, senior managers, qualifying shareholders (≥10%)
• AML/CFT manual aligned with Cyprus AML Law 188(I)/2007 and EU AMLD6 / AMLR 2024/1624
• Risk-management framework (operational risk, cyber risk, custody risk, conflicts of interest)
• ICT and outsourcing policies (NIS2 + DORA-aligned)
• Custody and segregation policies (for tier-2 services)
• Client onboarding and KYC/EDD procedures
• Market-abuse and surveillance policies (for trading platforms)
• Whitepaper compliance procedures (if offering token issuance services)
• Complaints handling and ADR policy
• Capital adequacy calculations and own-funds policy
• Insurance / professional indemnity arrangements
• Reverse-solicitation policy and EU passporting plan

4. Timeline — typical 6-12 months

Realistic milestones for a 2026 application:

1. 1Pre-application engagement with CySEC (1-2 months) — submit summary file, receive informal feedback
2. 2Full application submission to CySEC (Day 0)
3. 3Completeness check (Day 0 to Day 25) — CySEC confirms file is complete
4. 4Substantive assessment (Day 25 to Day 65) — CySEC reviews all documents; typically 1-3 rounds of follow-up questions
5. 5Decision (Day 65 to Day 90 of completeness, statutory) — extendable by 60 days for complex files
6. 6Authorisation issued and entered in the ESMA CASP register
7. 7Total realistic timeline: 6-9 months for a clean tier-1/2 file; 9-12 months for tier-3 / trading platforms

5. Cost structure — regulator-set vs project-dependent

Regulator-set fees are published by CySEC and are predictable: a per-tier CySEC application fee and an annual CySEC supervisory fee scaled to the licensed firm's size. These are the only line items we can quote against a fixed schedule.

Everything else — legal counsel, the AML / ICT / governance manual build, the compliance officer + MLRO hires (Cyprus-resident), insurance arrangements, capital adequacy buffers — is project-dependent and varies by service tier, group structure, and existing in-house capability. We scope these per engagement and quote against a written proposal after the pre-application call. Talk to us and we will issue a single all-in budget memo before you commit.

6. EU passporting — the killer feature

Once authorised by CySEC, a Cyprus CASP can passport its services across all 30 EEA member states under a notification regime (MiCA Article 65). The passport works in both freedom of services (no local establishment) and freedom of establishment (local branch) modes.

This means a Cyprus-authorised CASP can serve clients in Germany, France, Italy, Spain, the Netherlands etc. without separate national authorisations — a structural advantage vs non-EU jurisdictions like the UAE, Cayman, or BVI which require separate licences for EU client-facing activities.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.