The Cyprus crypto license after MiCA

A “Cyprus crypto license” in 2026 means one thing: authorisation as a crypto-asset service provider (CASP) under MiCA — Regulation (EU) 2023/1114 — supervised in Cyprus by CySEC. This is a genuine regulatory shift, not a rebrand. Cyprus used to run a national registration regime for crypto firms; MiCA replaced it with a single EU authorisation that passports across the whole bloc. The catch, and the most important fact on this page: the transitional period ended on 1 July 2026. Firms that once operated under the old national rules no longer have an automatic right to continue. If you are planning a crypto business here, you are planning a full CASP authorisation from the start.

What MiCA changed, and when

MiCA applies in phases:

• 30 June 2024 — the rules for asset-referenced tokens and e-money tokens (stablecoins), Titles III and IV.
• 30 December 2024 — the rest of the regulation, including the CASP authorisation regime.
• 1 July 2026 — the outer limit of the transitional period for firms that were already providing crypto services under national law. Cyprus applied that window in full; it has now closed.

So the framework is fully live. There is no “coming soon” left to wait for, and no national shortcut still open.

What a CASP authorisation covers

The authorisation is defined by the services you are cleared to provide. MiCA lists them: custody and administration of crypto-assets, operating a trading platform, exchanging crypto-assets for funds or for other crypto-assets, executing orders, receiving and transmitting orders, placement, advice, portfolio management, and transfer services. CySEC writes the specific services into your authorisation. Adding a service later is a variation, not an afterthought — which is why scoping the business honestly at the outset matters.

Capital classes

MiCA sets minimum capital by service class, and the firm must hold own funds at the higher of the class minimum or one quarter of the preceding year’s fixed overheads:

The class figure is a floor. As overheads grow, the own-funds requirement grows with them — the same live-capital logic that applies to a regulated forex firm under the investment-firm regime.

What CySEC expects beyond capital

Authorisation is about the whole operation, not the balance alone. CySEC reviews governance and fit-and-proper management, a compliance and risk framework, custody and safeguarding arrangements for client assets, ICT and cybersecurity resilience, complaint handling and conflict-of-interest rules, and full AML/CFT controls — MiCA sits on top of anti-money-laundering obligations, it does not replace them. Genuine substance in Cyprus — real management, staff and premises — is part of the picture, not decoration.

The process, and an honest word on timing

The route runs the way any regulated-entity build does: incorporate the company, stand up the team and premises, build the policies and safeguarding arrangements, capitalise to the right class, then file a complete application and work through CySEC’s review. MiCA gives national authorities a defined assessment period once an application is complete — but, as with any licence, the clock that matters starts at genuine completeness, and the preparation before filing is what sets the real timeline. We do not quote a fixed short number; the file’s quality decides it.

Where this leaves you today

Because the transitional window has closed, there is no interim status to lean on. Lawful crypto-asset services in Cyprus now require an actual MiCA authorisation, or coverage under a passport from an authorised CASP elsewhere in the EU. A licensed CASP is still an ordinary Cyprus company, so corporate tax at 15% and normal accounting and audit obligations apply alongside the CySEC regime. If your plan assumed a quick national registration or a grandfathered right to keep trading, that plan needs rebuilding — and it is better to hear that now than after a wind-down notice.

How we run it

1. Scope the services first. We map exactly which MiCA services you need to the right capital class — before anything is filed.
2. Build the company and substance. Incorporation, directors, premises and the compliance, risk and custody functions CySEC expects to see operating.
3. Assemble a review-ready application. Governance, safeguarding, ICT and AML frameworks documented to answer CySEC’s questions before it asks them.
4. Run the CySEC dialogue. We manage the assessment rounds and keep the process moving on the facts, not on optimism.
5. Maintain the authorisation. Own-funds monitoring, reporting and ongoing MiCA and AML obligations kept current — authorisation is the beginning of supervision.