CMS Expert Guide to Crypto Regulation in Cyprus
- How is crypto regulated?
- What are the steps taken by the regulator to adopt MiCAR?
- Are the following activities regulated or unregulated in your jurisdiction?— Direct sales of tokens by issuers ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services ― Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)
- Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis?
- How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?
- What would be the approximate overall cost of obtaining a licence?
- What is the probability (%) of success in obtaining a licence?
- What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence
jurisdiction
Disclaimer: This chapter was last updated on15th November 2024 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.
1. How is crypto regulated?
| AML Regulation | Any other regulation |
The Fifth Money Laundering Directive (5MLD) extended the Fourth Money Laundering Directive (4MLD) regime to “providers engaged in exchange services between virtual and fiat currencies” and to “custodian wallet providers”. In Cyprus, the Prevention and Suppression of Money Laundering and Terrorist Financing Law, L188(I)/2007 (AML Law) was amended via L13(I)/2021 (Amending Law), in order to harmonise domestic legislation with the provisions of the 4th and 5th AML Directives (Directives (EU) 2015/849 and 2018/843). The Amending Law introduced the definition of “crypto-assets” as: a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically and is not:
In relation to crypto-asset businesses, the Amending Law introduced a definition for Crypto-asset Services Providers (CASPs) which are defined as: “any person who provides or carries out one or more of the following services or activities to another person or on behalf of another person to the extent that these do not fall within the services or activities provided by entities referred to in paragraphs (a) to (h) of section 2A of the AML Law:
(CASP Definition) The term “financial services related to the distribution, offer and sale of crypto-assets” set out in paragraph (e) of the CASP Definition is defined in section 2 of the AML Law as: financial services related to the distribution, offer and sale of crypto-assets’ means the following services and activities in relation to crypto-assets:
Section 61E(2)(a) of the AML Law requires that any CASPs that provide services or activities on a professional basis from Cyprus, must be registered irrespectively of whether they have been registered in another Member State in relation to the same services and activities. Section 61E(2)(b) of the AML Law provides that any CASPs that provide services or activities on a professional basis in Cyprus must also be registered unless they have already been registered in another Member State in respect of the same services and activities. The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC). CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP. CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive). | The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC). CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP. CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive). |
2. What are the steps taken by the regulator to adopt MiCAR?
On 17 October, CYSEC announced that it would cease accepting new CASP applications under the AML Law in anticipation of MiCAR's application to CASPs on 30 December 2024. From that date, CYSEC will no longer process any applications for CASP registration. In addition, until 30 October 2024, CYSEC will no longer accept notifications from European Economic Area ("EEA") entities registered with other EEA national competent authorities to provide crypto-asset services in Cyprus. Notifications submitted after this deadline will not be reviewed until MiCAR comes into force.
In addition, on 13 November 2024, CYSEC announced that it is now accepting applications and notifications for the preliminary assessment of CASPs (or the provision of CASP services by other types of entities) in preparation for the full implementation of MiCAR on 30 December 2024. This preliminary phase will allow CASPs, as defined in Article 3(15) of MiCAR, and other firms to submit applications/notifications to CYSEC (using the relevant forms on the CYSEC website), in particular for
- CYSEC-authorized entities, such as central securities depositories, investment firms, market operators, UCITS management companies, or alternative investment fund managers, which are authorised to provide equivalent crypto-asset services under Article 60 of MiCAR and which wish to make a notification under that Article; or
- any legal entity or other organisation that intends to apply for authorisation as a CASP pursuant to Article 63 of MiCAR.
Additionally, CYSEC will be proactively offering informal feedback to potential applicants to facilitate a smooth transition.
In this preliminary phase, CYSEC has clarified in the announcement that it will exercise discretion in reviewing applications and is not bound to prioritise reviews before the end of the year. CYSEC may prioritise applications from CASPs already registered under national rules, but submitting an application at this stage does not guarantee a speedy processing. Applications will only be officially recognised if the required fees are paid, forms are resubmitted without redundant documentation, and applicants confirm the accuracy of the information submitted by 30 December 2024. Decisions on authorisations or completeness of notification will follow MiCAR requirements once they are fully applicable.
3. Are the following activities regulated or unregulated in your jurisdiction?— Direct sales of tokens by issuers ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services ― Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)
3.1. Direct sales of tokens by issuers
The exchange of crypto-assets for fiat currency and for other crypto-assets are regulated activities and fall under paragraphs (a) and (b) respectively of the CASP Definition above.
3.2. Exchange (buy/sell)
The exchange of crypto-assets for fiat currency and for other crypto-assets are regulated activities and fall under paragraphs (a) and (b) respectively of the CASP Definition above.
3.3. Custody (hold)
Yes.
As per the CASP definition, this activity is a regulated activity and falls under paragraph (c).
3.4. Borrowing/lending
At the time of writing, there is no local legal framework that specifically regulates the borrowing/lending activity of crypto-assets. However, we note that the borrowing/lending of crypto-assets may incidentally involve the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets which falls under paragraph (c).
3.5. Yield/staking
At the time of writing, there is no local legal framework that regulates the yielding/staking activity of crypto-assets. To the extent that yielding/staking is undertaken by a third party on behalf of the owner of a crypto-asset then this activity may incidentally involve the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets which falls under paragraph (c).
3.6 Staking on proof of stake consensus mechanism
The method used for proof is immaterial, as there is no local legal framework regulating the yielding/staking activity of crypto-assets. As per the above to the extent that staking involves custody of a third party’s crypto-assets then this would fall within the scope of the CASP definition.
4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis?
Section 61E of the AML Law provides that any CASPs that provide services or activities on a professional basis to customers in Cyprus must register in Cyprus unless they have already been registered in another EU Member State in respect of the same services and activities. The CYSEC CASP Directive requires that CASPs that are registered in other EU Member States must notify CYSEC of their intention to offer CASP services in Cyprus before doing so. Persons that are not registered in Cyprus or in another EU Member State as CASPs cannot provide CASP services to local customers on an active solicitation basis.
Neither the AML Law, nor the CYSEC CASP Directive contain any provisions allowing a person not registered as a CASP (in Cyprus or another EU Member State) to rely on anything analogous to the reverse solicitation exemption set out in article 42 of Directive 2014/65/EU. CYSEC has not issued any guidance or directive which addresses or regulated the application of anything analogous to the reverse solicitation exemption in relation to CASPs or CASP services. As such our advice to prospective market entrants is to seek registration as a CASP, either in Cyprus or another EU Member State.
5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?
| AML Regulation | Any other regulation |
Setting up a crypto-asset business or obtaining a licence in this jurisdiction is influenced by factors such as the complexity of the business structure and the completeness of the application. Under the 5AMLD, the licensing process with CYSEC typically takes 4-6 months from submission, assuming all documentation is provided and no additional inquiries arise. As noted in question 2 above, CYSEC is currently accepting applications and notifications for CASP authorisations under MiCAR, but is not bound by specific assessment timelines. Once MiCAR is fully implemented, CySEC will be subject to the regulatory timelines set out in MiCAR for the assessment of CASP applications. Therefore, for firms submitting applications now, authorisation decisions are likely to be finalised within the timeframes set by MiCAR once it is in force, although the exact timeframe may vary depending on the complexity of the business and compliance requirements. | N/A |
6. What would be the approximate overall cost of obtaining a licence?
| AML Regulation | Any other regulation |
Registration of a CASP includes the following charges:
If the application is successful CYSEC’s annual fees are waived for the first year, and amount to EUR 5,000 per annum thereafter. Fees for notifying changes to CYSEC regarding a CASP’s registration details would cost between EUR 1,000- EUR 5,000 depending on the type of notification required. Legal and other professional fees will be necessary. | N/A |
7. What is the probability (%) of success in obtaining a licence?
| AML Regulation | Any other regulation |
At the time of writing, CYSEC has registered eight CASPs. One CASP has been de-registered. Applicants will either meet or not meet the registration requirements specified in the AML Law and the CASP Register Directive. Therefore it is difficult to currently provide a probability percentage of success of registration of a CASP. CYSEC has not and does not publish any information regarding the amount of applications it receives. | N/A |
8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence
| AML Regulation | Any other regulation |
The following highlights the key requirements of the CASP Register Directive:
As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months. | As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months. |
The experts from Chrysostomides Advocates & Legal Consultants provided the input.
