1.  How is crypto regulated?
  2. What are the steps taken by the regulator to adopt MiCAR?
  3.  Are the following activities regulated or unregulated in your jurisdiction?— Direct sales of tokens by issuers ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services ― Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)
  4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis? 
  5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?
  6. What would be the approximate overall cost of obtaining a licence?
  7. What is the probability (%) of success in obtaining a licence?
  8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

jurisdiction

Cyprus

Disclaimer: This chapter was last updated on15th November 2024 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

1. How is crypto regulated?

AML RegulationAny other regulation

The Fifth Money Laundering Directive (5MLD) extended the Fourth Money Laundering Directive (4MLD) regime to “providers engaged in exchange services between virtual and fiat currencies” and to “custodian wallet providers”. In Cyprus, the Prevention and Suppression of Money Laundering and Terrorist Financing Law, L188(I)/2007 (AML Law) was amended via L13(I)/2021 (Amending Law), in order to harmonise domestic legislation with the provisions of the 4th and 5th AML Directives (Directives (EU) 2015/849 and 2018/843). The Amending Law introduced the definition of “crypto-assets” as: a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically and is not:

  1. fiat currency; or
  2. electronic money; or
  3. a financial instrument as defined in Part III of the First Appendix of the Investment Services and Activities and Regulated Markets Law [transposing MIFID II].

In relation to crypto-asset businesses, the Amending Law introduced a definition for Crypto-asset Services Providers (CASPs) which are defined as: “any person who provides or carries out one or more of the following services or activities to another person or on behalf of another person to the extent that these do not fall within the services or activities provided by entities referred to in paragraphs (a) to (h) of section 2A of the AML Law:

  1. the exchange of crypto-assets for fiat currency;
  2. the exchange of crypto-assets for other crypto-assets;
  3. the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets;
  4. the offer and/or sale of crypto-assets, including any initial offering; and
  5. the participation in and/or provision of financial services related to the distribution, offer and/or sale of crypto-assets, including their initial offer.”

(CASP Definition) The term “financial services related to the distribution, offer and sale of crypto-assets” set out in paragraph (e) of the CASP Definition is defined in section 2 of the AML Law as: financial services related to the distribution, offer and sale of crypto-assets’ means the following services and activities in relation to crypto-assets:

  1. Reception and transmission of orders;
  2. Execution of orders on behalf of clients;
  3. Dealing on own account;
  4. Portfolio management;
  5. Investment advice;
  6. Underwriting and/or placing of crypto-assets on a firm commitment basis;
  7. Placing of crypto-assets without a firm commitment basis; and
  8. Operation of a multilateral system in which multiple third-party buying and selling trading interests in crypto-assets are able to interact in the system.

Section 61E(2)(a) of the AML Law requires that any CASPs that provide services or activities on a professional basis from Cyprus, must be registered irrespectively of whether they have been registered in another Member State in relation to the same services and activities. Section 61E(2)(b) of the AML Law provides that any CASPs that provide services or activities on a professional basis in Cyprus must also be registered unless they have already been registered in another Member State in respect of the same services and activities.

The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC).

CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP.

CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive).

The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC).

CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP.

CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive).

2. What are the steps taken by the regulator to adopt MiCAR?

On 17 October, CYSEC announced that it would cease accepting new CASP applications under the AML Law in anticipation of MiCAR's application to CASPs on 30 December 2024. From that date, CYSEC will no longer process any applications for CASP registration. In addition, until 30 October 2024, CYSEC will no longer accept notifications from European Economic Area ("EEA") entities registered with other EEA national competent authorities to provide crypto-asset services in Cyprus. Notifications submitted after this deadline will not be reviewed until MiCAR comes into force. 

In addition, on 13 November 2024, CYSEC announced that it is now accepting applications and notifications for the preliminary assessment of CASPs (or the provision of CASP services by other types of entities) in preparation for the full implementation of MiCAR on 30 December 2024. This preliminary phase will allow CASPs, as defined in Article 3(15) of MiCAR, and other firms to submit applications/notifications to CYSEC (using the relevant forms on the CYSEC website), in particular for 

  1. CYSEC-authorized entities, such as central securities depositories, investment firms, market operators, UCITS management companies, or alternative investment fund managers, which are authorised to provide equivalent crypto-asset services under Article 60 of MiCAR and which wish to make a notification under that Article; or 
  2. any legal entity or other organisation that intends to apply for authorisation as a CASP pursuant to Article 63 of MiCAR. 

Additionally, CYSEC will be proactively offering informal feedback to potential applicants to facilitate a smooth transition.

In this preliminary phase, CYSEC has clarified in the announcement that it will exercise discretion in reviewing applications and is not bound to prioritise reviews before the end of the year. CYSEC may prioritise applications from CASPs already registered under national rules, but submitting an application at this stage does not guarantee a speedy processing. Applications will only be officially recognised if the required fees are paid, forms are resubmitted without redundant documentation, and applicants confirm the accuracy of the information submitted by 30 December 2024. Decisions on authorisations or completeness of notification will follow MiCAR requirements once they are fully applicable. 

3. Are the following activities regulated or unregulated in your jurisdiction?— Direct sales of tokens by issuers ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services ― Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)

3.1. Direct sales of tokens by issuers

The exchange of crypto-assets for fiat currency and for other crypto-assets are regulated activities and fall under paragraphs (a) and (b) respectively of the CASP Definition above.

3.2. Exchange (buy/sell)

The exchange of crypto-assets for fiat currency and for other crypto-assets are regulated activities and fall under paragraphs (a) and (b) respectively of the CASP Definition above.

3.3. Custody (hold) 

Yes.

As per the CASP definition, this activity is a regulated activity and falls under paragraph (c).

3.4. Borrowing/lending

At the time of writing, there is no local legal framework that specifically regulates the borrowing/lending activity of crypto-assets. However, we note that the borrowing/lending of crypto-assets may incidentally involve the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets which falls under paragraph (c).

3.5. Yield/staking

At the time of writing, there is no local legal framework that regulates the yielding/staking activity of crypto-assets. To the extent that yielding/staking is undertaken by a third party on behalf of the owner of a crypto-asset then this activity may incidentally involve the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets which falls under paragraph (c).

3.6 Staking on proof of stake consensus mechanism 

The method used for proof is immaterial, as there is no local legal framework regulating the yielding/staking activity of crypto-assets. As per the above to the extent that staking involves custody of a third party’s crypto-assets then this would fall within the scope of the CASP definition.

4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis? 

Section 61E of the AML Law provides that any CASPs that provide services or activities on a professional basis to customers in Cyprus must register in Cyprus unless they have already been registered in another EU Member State in respect of the same services and activities. The CYSEC CASP Directive requires that CASPs that are registered in other EU Member States must notify CYSEC of their intention to offer CASP services in Cyprus before doing so. Persons that are not registered in Cyprus or in another EU Member State as CASPs cannot provide CASP services to local customers on an active solicitation basis. 

Neither the AML Law, nor the CYSEC CASP Directive contain any provisions allowing a person not registered as a CASP (in Cyprus or another EU Member State) to rely on anything analogous to the reverse solicitation exemption set out in article 42 of Directive 2014/65/EU. CYSEC has not issued any guidance or directive which addresses or regulated the application of anything analogous to the reverse solicitation exemption in relation to CASPs or CASP services. As such our advice to prospective market entrants is to seek registration as a CASP, either in Cyprus or another EU Member State.

5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?

AML RegulationAny other regulation

Setting up a crypto-asset business or obtaining a licence in this jurisdiction is influenced by factors such as the complexity of the business structure and the completeness of the application. Under the 5AMLD, the licensing process with CYSEC typically takes 4-6 months from submission, assuming all documentation is provided and no additional inquiries arise.

As noted in question 2 above, CYSEC is currently accepting applications and notifications for CASP authorisations under MiCAR, but is not bound by specific assessment timelines. Once MiCAR is fully implemented, CySEC will be subject to the regulatory timelines set out in MiCAR for the assessment of CASP applications.

Therefore, for firms submitting applications now, authorisation decisions are likely to be finalised within the timeframes set by MiCAR once it is in force, although the exact timeframe may vary depending on the complexity of the business and compliance requirements.

N/A

6. What would be the approximate overall cost of obtaining a licence?

AML RegulationAny other regulation

Registration of a CASP includes the following charges:

  • EUR 10,000 for the examination of an application. Successful applicants will not be required to pay an additional fee for the first year of their registration;
  • EUR 5,000 for the purposes of renewal of registration per year.

If the application is successful CYSEC’s annual fees are waived for the first year, and amount to EUR 5,000 per annum thereafter. Fees for notifying changes to CYSEC regarding a CASP’s registration details would cost between EUR 1,000- EUR 5,000 depending on the type of notification required. Legal and other professional fees will be necessary.

N/A

7. What is the probability (%) of success in obtaining a licence?

AML RegulationAny other regulation

At the time of writing, CYSEC has registered eight CASPs. One CASP has been de-registered.

Applicants will either meet or not meet the registration requirements specified in the AML Law and the CASP Register Directive. Therefore it is difficult to currently provide a probability percentage of success of registration of a CASP.

CYSEC has not and does not publish any information regarding the amount of applications it receives.

N/A

8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

AML RegulationAny other regulation

The following highlights the key requirements of the CASP Register Directive:

  • Initial capital requirements: maintaining at all times a minimum equity capital which will be either (i) EUR 50,000 (if only investment advice is offered), (ii) EUR 125,000 in the event any other services are offered (except custody, underwriting or operation of an MTF) or (iii) EUR 150,000 if custody/underwriting services are offered or if the CASPS operates a multilateral trading facility);
  • Capital adequacy requirements: must maintain at all times own funds equal to the greater of: (a) the amount of the initial capital as set out above and depending on the nature of its functions and activities or (b) one quarter (1/4) of the fixed overheads of the CASP during the previous year, reviewed annually;
  • Board Composition: the Board of Directors shall be composed of at least four persons who meet the requirements, two of whom shall direct the applicant’s business activities and two of whom shall be independent directors;
  • Competency: persons holding an administrative position must be honest, competent and of good repute. The beneficiaries of the CASP must also be of good repute and be able to maintain a strong financial position of the CASP;
  • Close links: any close links between the CASP and other natural or legal persons do not prevent CYSEC’s effective monitoring, evaluation and supervision of the CASP;
  • Governance: appropriate policies and procedures must be established and appropriate
    systems and controls should be in place in order to ensure compliance with the relevant directives issued by CYSEC, i.e. CYSEC AML Directive and CYSEC Register Directive;
  • Organisational arrangements: sound administrative and accounting procedures, internal control mechanisms, effective risk assessment procedures and effective control and safeguard arrangements for information processing systems should be established;
  • Staff: the persons employed by the CASP are to be honest, professional and possess the appropriate knowledge for the tasks assigned to them; and
  • Conflict of Interest: the performance of the staff should not be remunerated or evaluated in a manner that conflicts with its duty to act in the best interests of its customers and in particular does not make any arrangement in the form of remuneration, sales targets or otherwise, which could provide an incentive for its staff to engage in aggressive marketing practices for products or services.

As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months.

As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months.

 

The experts from Chrysostomides Advocates & Legal Consultants provided the input.