CMS Expert Guide to Crypto Regulation in Cyprus

The Fifth Money Laundering Directive (5MLD) extended the Fourth Money Laundering Directive (4MLD) regime to “providers engaged in exchange services between virtual and fiat currencies” and to “custodian wallet providers”. In Cyprus, the Prevention and Suppression of Money Laundering and Terrorist Financing Law, L188(I)/2007 (AML Law) was amended via L13(I)/2021 (Amending Law), in order to harmonise domestic legislation with the provisions of the 4th and 5th AML Directives (Directives (EU) 2015/849 and 2018/843). The Amending Law introduced the definition of “crypto-assets” as: a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically and is not:

1. fiat currency; or
2. electronic money; or
3. a financial instrument as defined in Part III of the First Appendix of the Investment Services and Activities and Regulated Markets Law [transposing MIFID II].

In relation to crypto-asset businesses, the Amending Law introduced a definition for Crypto-asset Services Providers (CASPs) which are defined as: “any person who provides or carries out one or more of the following services or activities to another person or on behalf of another person to the extent that these do not fall within the services or activities provided by entities referred to in paragraphs (a) to (h) of section 2A of the AML Law:

1. the exchange of crypto-assets for fiat currency;
2. the exchange of crypto-assets for other crypto-assets;
3. the management, transfer, retention, and/or safekeeping, including custody, of crypto-assets, cryptographic keys or any others means which permit the exercise of control over crypto-assets;
4. the offer and/or sale of crypto-assets, including any initial offering; and
5. the participation in and/or provision of financial services related to the distribution, offer and/or sale of crypto-assets, including their initial offer.”

(CASP Definition) The term “financial services related to the distribution, offer and sale of crypto-assets” set out in paragraph (e) of the CASP Definition is defined in section 2 of the AML Law as: financial services related to the distribution, offer and sale of crypto-assets’ means the following services and activities in relation to crypto-assets:

1. Reception and transmission of orders;
2. Execution of orders on behalf of clients;
3. Dealing on own account;
4. Portfolio management;
5. Investment advice;
6. Underwriting and/or placing of crypto-assets on a firm commitment basis;
7. Placing of crypto-assets without a firm commitment basis; and
8. Operation of a multilateral system in which multiple third-party buying and selling trading interests in crypto-assets are able to interact in the system.

Section 61E(2)(a) of the AML Law requires that any CASPs that provide services or activities on a professional basis from Cyprus, must be registered irrespectively of whether they have been registered in another Member State in relation to the same services and activities. Section 61E(2)(b) of the AML Law provides that any CASPs that provide services or activities on a professional basis in Cyprus must also be registered unless they have already been registered in another Member State in respect of the same services and activities.

The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC).

CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP.

CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive).

The supervisory authority that regulates and registers CASPs, and maintains the Register of CASPs, is the Cyprus Securities and Exchange Commission (CYSEC).

CYSEC has issued the Directive on Preventing and Combating the Laundering of Proceeds from Illegal Activities (Register of Crypto-asset Service Providers) (the CASP Register Directive) which sets out the requirements for registration of a CASP.

CASPs must also comply with the CYSEC directive for the prevention and suppression of money laundering and terrorist financing (the CYSEC AML Directive).

The following highlights the key requirements of the CASP Register Directive:

• Initial capital requirements: maintaining at all times a minimum equity capital which will be either (i) EUR 50,000 (if only investment advice is offered), (ii) EUR 125,000 in the event any other services are offered (except custody, underwriting or operation of an MTF) or (iii) EUR 150,000 if custody/underwriting services are offered or if the CASPS operates a multilateral trading facility);
• Capital adequacy requirements: must maintain at all times own funds equal to the greater of: (a) the amount of the initial capital as set out above and depending on the nature of its functions and activities or (b) one quarter (1/4) of the fixed overheads of the CASP during the previous year, reviewed annually;
• Board Composition: the Board of Directors shall be composed of at least four persons who meet the requirements, two of whom shall direct the applicant’s business activities and two of whom shall be independent directors;
• Competency: persons holding an administrative position must be honest, competent and of good repute. The beneficiaries of the CASP must also be of good repute and be able to maintain a strong financial position of the CASP;
• Close links: any close links between the CASP and other natural or legal persons do not prevent CYSEC’s effective monitoring, evaluation and supervision of the CASP;
• Governance: appropriate policies and procedures must be established and appropriate
  systems and controls should be in place in order to ensure compliance with the relevant directives issued by CYSEC, i.e. CYSEC AML Directive and CYSEC Register Directive;
• Organisational arrangements: sound administrative and accounting procedures, internal control mechanisms, effective risk assessment procedures and effective control and safeguard arrangements for information processing systems should be established;
• Staff: the persons employed by the CASP are to be honest, professional and possess the appropriate knowledge for the tasks assigned to them; and
• Conflict of Interest: the performance of the staff should not be remunerated or evaluated in a manner that conflicts with its duty to act in the best interests of its customers and in particular does not make any arrangement in the form of remuneration, sales targets or otherwise, which could provide an incentive for its staff to engage in aggressive marketing practices for products or services.

As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months.

As CASPs are obliged entities under the AML Law they must fully comply with their obligations stemming from the AML Law and the relevant directives issued by CYSEC. CYSEC may remove a CASP from the Register of CASPs if the registered CASP does not provide cryptoasset services for a continuous period of six (6) months.