Regulated United Europe OÜ
注册号: 14153440
注册日期: 2016年11月16日
法律形式: 私人有限责任公司（Osaühing）
注册地址: Tartu mnt 83-407, 10115 Tallinn, Estonia
增值税号: EE102031029
电话: +372 56 966 260
电子邮箱: info@rue.ee
MiCA License in Cyprus 2026
Obtain CySEC MiCA authorisation in Cyprus for exchanges, custody, brokerage, and trading platforms. RUE supports structuring, filing, AML, Travel Rule, and DORA readiness.
由 RUE 编辑团队编制 · 经 Milana 审核 · 更新于 26 2 月 2026
Book MiCA Readiness Call
监管机构
CySEC
审查周期
From 6 months
价格
EUR 18900
资本
From 50 000 EUR
洲
eu
本地员工
必需
办公室
必需
欧盟护照权
必需
审计
必需
Why Cyprus for a MiCA License
Cyprus is a practical home state for EU-facing crypto businesses that need CySEC supervision, access to experienced legal and compliance providers, and a tax-efficient corporate environment. RUE helps founders map their business model to MiCA, build substance, prepare the dossier, and manage the authorisation process end-to-end.
“作为您的联系人，我协调整个牌照申请流程，保持沟通清晰，并推动申请进展，避免不必要的延误。”
Regulated United Europe (RUE) provides end-to-end support for a MiCA License in Cyprus, from service-perimeter mapping and company setup to drafting the application dossier, governance framework, AML/CFT controls, outsourcing model, and regulator-facing responses.
We also support related workstreams that often decide the project outcome in practice: banking strategy, accounting setup, local substance, MLRO/compliance staffing, Travel Rule implementation, and post-authorisation compliance.
CySEC as National Competent Authority
CySEC is the licensing authority for Cyprus MiCA authorisation and supervises governance, conduct, safeguarding, and AML controls for CASPs established in Cyprus.
EU Market Access
A Cyprus MiCA license can support cross-border expansion across the EU through passporting after authorisation and notifications.
Strong Fit for Regulated Fintech
Cyprus combines company law flexibility, experienced service providers, and a familiar environment for financial and high-risk businesses.
Operational Compliance Build-Out
Cyprus works best for founders prepared to build real substance, AML architecture, Travel Rule controls, and DORA-grade ICT governance.
塞浦路斯MiCA牌照
18,900 EUR
套餐包含（8）
- Preparation of necessary documents for registration of a new company in Cyprus
- Translation of a certificate of no criminal record through a sworn translator
- Payment of state fees related to company registration
- Payment of notary fees related to company registration
- Preparation of compliance documents for MiCA application
- Preparation of a business plan
- Submission of the necessary documents to CySEC
- Recruitment of local MLRO/Compliance officer
周期： From 6 months
附加服务
Updating policies in line with ESMA / EBA guidelines
from 1,900 EUR
MiCA structuring & jurisdiction selection advisory within the EU
from 2,900 EUR
Regulatory risk memo for business model validation
from 2,900 EUR
Assistance with opening crypto-friendly bank accounts / EMIs
from 2,900 EUR
Legal qualification of tokens (utility vs EMT vs ART vs financial instrument under MiFID II)
from 3,900 EUR
Pre-application gap analysis and readiness assessment
from 4,900 EUR
Annual compliance reviews and internal audits
from 4,900 EUR/year
Cross-border structuring for non-EU founders entering the EU market
from 5,900 EUR
塞浦路斯MiCA牌照 的 MiCA 类别比较
按允许开展的活动和基本要求比较 MiCA 第 1、2 和 3 类。
MiCA 第 1 类 - 50 000 EUR
资本50,000 EUR 起
时间因国家而异
左右滑动切换牌照类型
接收和传递客户订单
代表客户执行订单
配售与咨询服务
投资组合管理
不托管客户加密资产
目标模式
咨询公司
介绍经纪商
投资组合咨询模式
MiCA 第 2 类 - 125 000 EUR
资本125,000 EUR 起
时间因国家而异
左右滑动切换牌照类型
全部第 1 类服务
加密货币与法币及币币兑换
客户资产托管与管理
加密资产转账服务
更高的组织和 AML 要求
目标模式
交易所
托管服务商
经纪交易商业务
MiCA 第 3 类 - 150 000 EUR
资本150,000 EUR 起
时间因国家而异
左右滑动切换牌照类型
全部第 2 类服务
运营加密资产交易平台
加强的治理和内部控制
高级风险管理与报告
通常适用于大型市场平台运营商
目标模式
交易场所
多服务 CASP 集团
机构级运营商
MiCA 类别比较（第 1、2、3 类）
| 活动 / 选项 | MiCA 第 1 类 - 50 000 EUR | MiCA 第 2 类 - 125 000 EUR | MiCA 第 3 类 - 150 000 EUR |
|---|---|---|---|
| 接收和传递订单 | V | V | V |
| 代表客户执行订单 | V | V | V |
| 咨询与投资组合管理 | V | V | V |
| 加密货币与法币及币币兑换 | X | V | V |
| 加密资产托管与管理 | X | V | V |
| 运营交易平台 | X | X | V |
Core Requirements for a Cyprus MiCA License
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. In 2026, the practical test is no longer whether a company can file forms, but whether it can demonstrate a credible operating model, adequate own funds, real governance, and control over AML, safeguarding, outsourcing, and ICT risk.
CySEC will typically assess the applicant across five layers at once: service perimeter under MiCA, Cyprus AML law, Travel Rule obligations under the Transfer of Funds Regulation, DORA-style ICT resilience, and fit-and-proper suitability of shareholders and management. Generic templates and shell-company structures are a common failure point.
Below are the main requirements that usually determine whether a Cyprus MiCA application is review-ready.
Correct Service Mapping and MiCA Perimeter Analysis +
You must identify exactly which MiCA crypto-asset services your business model triggers. This is the first legal gate in any Cyprus MiCA license project.
- Typical regulated services include custody and administration, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, execution of orders, reception and transmission of orders, placing, transfer services, portfolio management, advice on crypto-assets, and operation of a trading platform.
- A single product may trigger multiple service categories. For example, an exchange with hosted wallets usually combines exchange + custody + transfer.
- MiCA does not apply where the token qualifies as a financial instrument under MiFID II. That boundary analysis is often decisive for tokenised securities, profit-right tokens, and some structured yield products.
A weak perimeter memo creates downstream problems in capital, policies, disclosures, and passporting notifications.
Minimum Capital and Own Funds +
Minimum capital for a MiCA License in Cyprus depends on the authorised service scope, not on marketing labels such as “exchange license” or “broker license”. The commonly referenced thresholds are €50,000, €125,000, and €150,000.
Class 1 (€50,000): execution, placing, transfers, reception/transmission, advice and portfolio management. Class 2 (€125,000): Class 1 services plus custody or exchange against funds or other crypto-assets. Class 3 (€150,000): Class 2 services plus operation of a trading platform. The highest applicable class determines the Annex IV minimum.
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately. Funding sources and the proposed safeguards must be documented in the CySEC application.
Cyprus Company, Office and Effective Management +
You need a Cyprus legal entity with real operational presence. A paper office is not a credible basis for a CySEC MiCA authorisation.
- The company should have a registered office in Cyprus and practical arrangements for day-to-day management, record-keeping, and regulator access.
- CySEC will look at place of effective management, governance meetings, local decision-making, and whether critical functions are genuinely directed and overseen from the firm.
- For most serious applications, founders should expect to budget for office rent, local service providers, and at least a core operational presence rather than a nominee-only structure.
Substance is also relevant for banking, tax residency analysis, and credibility of outsourcing oversight.
Directors, Shareholders and Fit-and-Proper Assessment +
CySEC will assess whether qualifying shareholders, UBOs, directors, and senior managers are fit and proper. This is not a box-ticking exercise.
- Expect review of CVs, education, relevant crypto/fintech/regulated-sector experience, criminal record certificates, bankruptcy/insolvency history, and time commitment.
- Applicants with complex ownership chains must provide a transparent group structure and reliable source of wealth/source of funds evidence.
- Weak management biographies are a common reason for regulator questions, especially where the proposed board has no hands-on experience with custody, exchange operations, AML, or financial regulation.
Non-EU founders can apply, but the management model must still support effective supervision in Cyprus.
AML/CFT Framework, MOKAS Reporting and Travel Rule +
A Cyprus MiCA license does not replace AML obligations. CASPs remain subject to Cyprus AML law, CySEC AML expectations, and suspicious transaction reporting to MOKAS.
- You need a business-wide risk assessment, onboarding and KYC/CDD procedures, sanctions screening, ongoing monitoring, enhanced due diligence, record retention, and staff training.
- Crypto transfers also trigger the Transfer of Funds Regulation (TFR), which extends the Travel Rule to crypto. In practice, firms should be ready to transmit and receive originator/beneficiary data and maintain interoperability with market standards such as IVMS101.
- CySEC will expect the AML framework to be tailored to your exact channels, client types, geographies, token exposure, and transaction flows.
Generic AML manuals copied from forex or EMI templates are one of the fastest ways to trigger extensive RFIs.
Governance, Control Functions and Outsourcing Oversight +
A credible CASP must show governance that works in practice. For a MiCA authorisation in Cyprus, that usually means clear board oversight, segregation of duties, and documented control ownership.
- Typical functions include AML/MLRO, compliance, risk, legal, and depending on scale, internal audit and dedicated ICT/security oversight.
- Outsourcing is allowed, but not if it turns the applicant into an empty shell. The firm must keep a vendor register, due diligence files, service-level controls, monitoring cadence, and exit plans for critical providers.
- CySEC will usually focus on who controls the outsourced exchange engine, wallet infrastructure, KYC tooling, customer support, and incident response.
The operational question is simple: if the vendor fails tomorrow, can the board explain the risk, the fallback, and the client impact?
Technology Security, Safeguarding and DORA Readiness +
In 2026, a serious Cyprus MiCA license application should already be aligned with DORA-grade ICT governance, especially for custody, exchange, and platform models.
- Expected controls usually include access management, MFA, encryption, privileged-user logging, incident response, disaster recovery, vulnerability management, and third-party ICT risk oversight.
- Custody models should document wallet architecture such as MPC, multisig, HSM-backed key management, and hot/cold wallet segregation.
- Safeguarding must cover segregation of client assets, reconciliation, insolvency protection and audit trails. Under Article 70(3), client funds other than e-money tokens must be placed with a credit institution or central bank by the end of the next business day in separately identifiable accounts. An account with an EMI alone does not satisfy this requirement. Article 70(5) provides an exception where the CASP itself is a payment institution, electronic money institution or credit institution.
Independent penetration testing, audit trails, and a realistic business continuity plan materially improve application credibility.
Business Plan, Financial Model and Full Application Dossier +
The dossier for a MiCA license in Cyprus must show that the business is understandable, financeable, and controllable.
- Core documents usually include a business plan, programme of operations, 3-year financial projections, governance papers, shareholder pack, AML/CFT framework, safeguarding policy, complaints policy, conflicts policy, outsourcing policy, ICT/security documentation, and client-facing terms.
- Financial projections should show realistic assumptions on volumes, spreads, custody fees, staffing, compliance tooling, and regulatory overhead.
- CySEC is more likely to challenge applications where revenue assumptions are aggressive, cost lines are understated, or the firm cannot explain how it will fund loss-making initial months.
At RUE, we treat the dossier as an operating model pack, not just a filing pack. That approach reduces rework during regulator review.
司法辖区比较
将 Cyprus 与其他司法辖区按取得和运营 MiCA/CASP 牌照的关键条件进行比较：监管机构、审查周期、费用、资本、本地实质要求及欧盟护照权。
此表包含 6 个司法辖区
* 此表侧重 MiCA/CASP 授权条件。使用设置图标可自定义国家和参数。
💰 牌照成本估算器
根据您的业务需求估算加密货币牌照的大致成本
配置您的牌照套餐
选择以下选项查看预计费用
预计成本
€0
预计周期
因国家而异
资本要求
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Tax and Cost Considerations for Cyprus CASPs
Cyprus is often chosen for a MiCA license in Cyprus because the tax baseline is commercially attractive, but founders should avoid simplistic claims. The headline corporate income tax rate is 15% from 1 January 2026, yet the effective tax position of a crypto business depends on legal characterisation of income, expense deductibility, transfer pricing, substance, and whether parts of the group perform regulated, technology, treasury, or IP functions.
What matters in practice for a Cyprus MiCA structure
The first issue is not only tax rate but operating model alignment. A Cyprus CASP may have revenues from exchange spreads, custody fees, listing/placement fees, advisory, SaaS-style technology services, or group recharge arrangements. Each revenue stream can produce a different VAT and direct-tax analysis. The second issue is substance: if strategic control, key staff, and risk management sit elsewhere, tax residency and transfer-pricing questions become harder.
Cyprus also remains relevant because of its treaty network, professional services ecosystem, and compatibility with cross-border group structures. That said, no responsible advisor should present Cyprus as a one-line “low-tax crypto jurisdiction”. For regulated businesses, the real question is whether the tax structure survives audit and matches the governance reality shown to CySEC, banks, and counterparties.
Illustrative launch and annual cost stack
Founders usually underestimate the total budget for a Cyprus MiCA license. The real cost stack typically includes:
- company incorporation and corporate maintenance;
- legal and regulatory drafting;
- AML/CFT framework build and compliance tooling;
- MLRO/compliance/risk staffing;
- office and local substance;
- audit, accounting, and tax support;
- IT security uplift, penetration testing, and vendor due diligence;
- banking and payment onboarding.
For many applicants, the practical first-year budget is materially higher than the regulatory minimum capital. This page provides indicative market ranges only and should not be treated as legal or tax advice.
Corporate Income Tax
Standard Cyprus corporate tax baseline
15%
Corporate Income Tax
Standard Cyprus corporate tax baseline
Cyprus’s standard corporate income tax rate is 15% from 1 January 2026. The effective treatment of a CASP depends on the nature of its income, deductible expenses, transfer pricing and applicable tax residence rules. Specific tax regimes must be assessed separately. This is the baseline rate often cited for Cyprus companies, including regulated CASP structures. The effective tax outcome depends on actual revenue streams, deductible expenses, transfer pricing, and whether the company is genuinely managed and controlled in Cyprus.
Value Added Tax (VAT)
Depends on service characterisation
19% / mixed
Value Added Tax (VAT)
Depends on service characterisation
The standard Cyprus VAT rate is 19%, but crypto-related services are not taxed under one universal rule. Some services may be exempt or outside scope depending on the exact legal and economic nature of the activity, while advisory, software, or support services may be taxable. VAT analysis should be done transaction-by-transaction.
Withholding Tax
Often efficient for cross-border structures
0%*
Withholding Tax
Often efficient for cross-border structures
Cyprus is commonly used in international structures because outbound payments can be efficient in many scenarios. However, withholding outcomes depend on the type of payment, recipient jurisdiction, anti-abuse rules, and specific fact pattern. Treat any “0% withholding” statement as structure-dependent, not universal.
Accounting and Audit
Mandatory annual finance function
€8,000-€35,000+
Accounting and Audit
Mandatory annual finance function
Cyprus companies should budget for bookkeeping, management accounts, annual financial statements, and statutory audit support. A regulated CASP with transaction volume, safeguarding flows, and multiple counterparties will usually incur higher accounting and audit costs than a standard trading company. RUE can coordinate with accounting services in Cyprus.
Legal and Compliance Build
Initial project cost beyond state fees
€20,000-€90,000+
Legal and Compliance Build
Initial project cost beyond state fees
This range typically covers perimeter analysis, application drafting, governance and policy set, AML/CFT framework, outsourcing pack, regulator correspondence support, and remediation rounds. Complex models such as exchange + custody + platform operation sit at the upper end of the range.
Local Substance and Staffing
Office, directors, MLRO, compliance, admin
€90,000-€350,000+
Local Substance and Staffing
Office, directors, MLRO, compliance, admin
Annual cost depends on whether functions are in-house, outsourced, or hybrid. Founders should budget for office, board support, local administration, and control functions. Even where outsourcing is used, CySEC expects meaningful internal oversight and documented accountability.
Technology, Security and Travel Rule
Operational compliance tooling
€25,000-€150,000+
Technology, Security and Travel Rule
Operational compliance tooling
Typical recurring spend includes KYC/AML systems, blockchain analytics, sanctions screening, transaction monitoring, Travel Rule connectivity, security tooling, logging/SIEM, penetration testing, and vendor assurance. Custody and exchange models usually face the highest recurring technology compliance spend.
Banking and Payment Setup
Onboarding and maintenance costs
€5,000-€40,000+
Banking and Payment Setup
Onboarding and maintenance costs
Crypto businesses should budget for account opening support, compliance packs, enhanced due diligence, onboarding fees, and ongoing bank/EMI charges. Banking is often a gating issue for launch, so this cost line should be planned early. RUE also assists with bank account opening in Cyprus and crypto business banking.
Compliance and Ongoing Obligations After Authorisation
A Cyprus MiCA license is the start of supervision, not the end of the project. CySEC expects continuous compliance across conduct, AML, safeguarding, governance, and ICT resilience.
Regulatory Reporting
- Periodic prudential and operational reporting to CySEC
- Annual audited financial statements
- Notifications of material changes in ownership, management, or services
- Incident and breach reporting where applicable
- Maintenance of complete books, records, and decision logs
AML and Travel Rule Controls
- Risk-based KYC/CDD and enhanced due diligence
- Ongoing transaction monitoring and sanctions screening
- Suspicious transaction reporting to MOKAS
- Travel Rule data collection, transmission, and reconciliation
- Periodic AML training and independent review
Safeguarding and ICT Resilience
- Segregation of client assets from the firm’s own assets
- Wallet governance, key management, and access controls
- Reconciliations, exception handling, and audit trails
- Incident response, disaster recovery, and business continuity
- Outsourcing oversight and ICT vendor monitoring under DORA-style controls
Conduct and Governance
- Fair, clear, and not misleading client communications
- Complaints handling and documented service-level timelines
- Conflicts of interest identification and disclosure
- Board oversight, policy review, and governance minutes
- Ongoing fit-and-proper maintenance for key persons
RUE 为您处理合规事务。 我们的团队提供持续合规支持，包括 AML 负责人服务、监管报告和政策更新，确保您的牌照年复一年保持良好合规状态。 联系我们获取合规支持 →
MiCA License in Cyprus in 2026
MiCA License in Cyprus in 2026: what it is and who needs it
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. In practical terms, it is the legal basis for providing regulated crypto-asset services from Cyprus into the EU market.
The key dates matter. MiCA entered into force in 2023. Rules for ARTs and EMTs started applying from 30 June 2024. The main CASP regime started applying from 30 December 2024. Transitional arrangements in some Member States could run up to 1 July 2026, but by 2026 new applicants should think in full MiCA terms, not in legacy national-registration terms.
A Cyprus MiCA license is typically required if your business provides regulated services such as:
- custody and administration of crypto-assets on behalf of clients;
- exchange of crypto-assets for funds or for other crypto-assets;
- execution, reception/transmission, or placing of orders;
- transfer services for crypto-assets on behalf of clients;
- portfolio management or advice on crypto-assets;
- operation of a trading platform for crypto-assets.
The term “crypto license Cyprus” is still used commercially, but in 2026 it is too broad. The real legal question is whether your exact business model falls within the MiCA CASP perimeter, or outside it, or partly into another regime such as MiFID II, EMT/e-money, or payments regulation.
RUE helps founders answer the only question that matters before filing: what exactly are you licensing, under which legal perimeter, with which capital, and with which control framework?
📝 检查您的适用性
回答几个简短问题，了解该司法辖区是否适合您的加密业务
第 1 步，共 5 步
您将提供哪类加密货币服务？
兑换（法币 ↔ 加密货币）
托管与钱包服务
转账与支付服务
咨询 / 投资组合管理
多项 / 以上全部
第 2 步，共 5 步
您的目标市场是什么？
仅欧盟
欧盟 + 全球市场
全球（优先非欧盟市场）
第 3 步，共 5 步
您是否已在欧盟注册公司？
是，在该司法辖区
是，在另一个欧盟国家
否，我需要注册一家公司
第 4 步，共 5 步
您的可用预算范围是多少？
低于 €20,000
€20,000 – €50,000
€50,000 – €100,000
高于 €100,000
第 5 步，共 5 步
您计划何时上线？
尽快（1–3 个月）
6 个月内
一年内
只是了解可选方案
该司法辖区非常适合您！
根据您的回答，该司法辖区与您的业务需求较为匹配。以下是简要概览：
建议的牌照
CASP 牌照
预计预算
€24,000 – €35,000
预计周期
4–6 个月
欧盟护照权
可用
Step-by-Step Cyprus MiCA Process
第 1 步
Scoping and Feasibility
Define the exact MiCA service perimeter, check MiCA vs MiFID/EMT boundary issues, assess whether Cyprus is the right home state, and build an initial budget and timeline. Duration: 1-2 weeks.
第 2 步
Company Setup
Incorporate the Cyprus entity, plan office and governance substance, appoint directors, map control functions, and prepare ownership and source-of-funds documentation. Duration: 2-4 weeks.
第 3 步
Control Framework Build
Draft the business plan, financial model, AML/CFT framework, safeguarding model, outsourcing pack, complaints/conflicts policies, and ICT security documentation. Duration: 4-10 weeks.
第 4 步
Application Filing
Submit the complete dossier to CySEC, align supporting annexes, and ensure the filing is internally consistent across legal, financial, AML, and technology sections. Duration: 1-2 weeks.
第 5 步
Completeness Review
CySEC checks whether the application is complete enough to enter substantive review. In practice this stage often takes around 25-30 working days, depending on filing quality and follow-up clarifications.
第 6 步
Substantive Assessment
CySEC reviews governance, safeguarding, AML, outsourcing, financials, and fit-and-proper suitability. Expect RFIs, document refinements, and possible management interviews. Duration: often 40 working days plus pauses/extensions.
第 7 步
Approval and Register
After approval, final conditions are closed, internal controls are confirmed, and the authorised CASP proceeds to registration visibility and cross-border notification planning. Duration: 2-4 weeks.
第 8 步
Go-Live and Passporting
Finalize banking/payment rails, Travel Rule operations, staff training, internal reporting, and passporting notifications for target EU states. Duration: 2-6 weeks depending on launch complexity.
解答
常见问题
查看创始人、合规团队和法务负责人在上线前通常需要确认的关键问题。
What is a MiCA license in Cyprus? +
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. It allows an authorised firm established in Cyprus to provide in-scope crypto-asset services and, after proper notification, use MiCA passporting for cross-border activity in the EU.
It is not the same as the old Cyprus AML-based CASP registration model. In 2026, new applicants should approach Cyprus as a full MiCA authorisation jurisdiction with governance, safeguarding, conduct, AML, Travel Rule, and ICT-resilience obligations.
Who needs a Cyprus MiCA license? +
A business usually needs a Cyprus MiCA license if it provides regulated crypto-asset services from Cyprus or into the EU market from a Cyprus establishment. Typical examples include:
- custodial wallet providers;
- crypto-fiat and crypto-crypto exchanges;
- brokers and OTC desks;
- trading platforms;
- crypto advisers and portfolio managers;
- firms placing crypto-assets or transmitting client orders.
The exact answer depends on the service flow and token classification. Some models marketed as “crypto” may instead fall under MiFID II, e-money, or payments rules.
Can a non-EU founder obtain a MiCA license in Cyprus? +
Yes, non-EU founders can own a Cyprus CASP structure, but ownership is only one part of the analysis. CySEC will still require transparent UBO disclosure, clean source-of-funds evidence, fit-and-proper management, and a governance model that supports effective supervision in Cyprus.
In practice, non-EU ownership usually increases scrutiny around:
- group structure and beneficial ownership transparency;
- source of wealth and source of funds;
- where strategic decisions are actually made;
- whether the Cyprus entity has genuine substance or is only a routing vehicle.
Non-EU founders can succeed, but the Cyprus company must still look and operate like a real regulated business.
Does a Cyprus MiCA license allow passporting across the EU? +
Yes, a Cyprus MiCA license can support passporting across the EU after the required notification process. The license is granted by CySEC as the home-state authority, and the firm can then notify cross-border services into other Member States.
Passporting is not a free-for-all. The firm must still comply with applicable local rules on matters such as consumer communications, marketing, tax, and data protection. The practical rule is: one authorisation, multiple local conduct overlays.
Is a physical office required in Cyprus? +
A real operational presence is strongly expected for a credible MiCA License in Cyprus. While the exact office footprint depends on the business model, a virtual address alone is usually not enough for a serious CySEC application.
CySEC will look at substance through a wider lens:
- where management and control sit;
- where records are kept and decisions are made;
- whether key functions can be supervised effectively;
- whether the entity has practical operational capability in Cyprus.
For most applicants, the right question is not “minimum office” but “minimum credible substance”.
Do I need a local MLRO or can the function be outsourced? +
The MLRO/AML function can sometimes be structured with outsourcing support, but CySEC will expect clear accountability, oversight, and practical availability. For many Cyprus CASP projects, a local or strongly Cyprus-connected AML setup is commercially safer.
The regulator will typically test:
- who owns AML decisions internally;
- whether the MLRO has sufficient authority and time commitment;
- how suspicious activity is escalated to MOKAS;
- whether outsourced AML support can actually monitor the business in real time.
Outsourcing can reduce cost, but it does not remove board responsibility.
How much capital is required for a MiCA License in Cyprus? +
The standard MiCA minimum capital thresholds commonly referenced for a Cyprus MiCA license are €50,000, €125,000, and €150,000, depending on the authorised service scope.
- Class 1 — €50,000: execution, placing, transfer, reception/transmission, advice and portfolio management.
- Class 2 — €125,000: custody and exchange for funds or other crypto-assets, with any Class 1 services.
- Class 3 — €150,000: operation of a trading platform, with any Class 1 or Class 2 services.
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately.
How much does a MiCA license in Cyprus really cost in 2026? +
A realistic first-year budget for a MiCA license in Cyprus is usually much higher than the minimum capital alone. In practice, founders should budget for:
- company formation and corporate maintenance;
- legal and regulatory drafting;
- AML/CFT framework and compliance tooling;
- MLRO/compliance/risk staffing;
- office and substance costs;
- audit, accounting, and tax support;
- security, penetration testing, and ICT remediation;
- banking and payment onboarding.
For many serious applicants, the practical project budget starts from the mid-five figures and can move well into six figures depending on scope. Exchange and custody models are typically the most expensive. RUE provides a tailored feasibility estimate rather than a generic headline quote.
How long does CySEC take to review a MiCA application? +
The practical answer is usually 6-9 months end-to-end, including preparation, filing, review, RFIs, and go-live remediation.
A common timing structure is:
- 4-10 weeks for preparation;
- around 25-30 working days for completeness review;
- around 40 working days for substantive assessment, subject to pauses and RFIs;
- 2-6 weeks for final conditions and operational readiness.
Delays usually come from weak documentation, unclear outsourcing, poor substance, or slow responses rather than from the formal clock alone.
What happens to old Cyprus CASP structures after the transition period? +
Legacy Cyprus CASP/VASP structures do not remain a permanent substitute for MiCA authorisation. Transitional treatment depended on the national and EU timing framework, with a ceiling that could run up to 1 July 2026 in some cases.
In 2026, the practical approach for legacy firms is:
- perform a MiCA gap analysis;
- upgrade governance, safeguarding, AML, Travel Rule, and ICT controls;
- prepare a full authorisation strategy rather than relying on historical registration status.
If a business is still operating on a legacy logic without a valid MiCA path, it should obtain jurisdiction-specific legal advice immediately.
Does MiCA cover token issuance, staking, and DeFi? +
Sometimes yes, sometimes no. MiCA covers certain issuer activities and CASP services, but not every blockchain activity fits neatly inside it.
- Token issuance: MiCA can apply to public offers and admissions to trading of crypto-assets, with separate regimes for ARTs and EMTs, including white paper and issuer obligations.
- Staking: treatment depends on how the product is structured. Native protocol participation, custodial staking, reward pooling, and yield-bearing wrappers can produce different regulatory outcomes.
- DeFi: fully decentralised models may sit outside parts of MiCA, but many projects marketed as DeFi still have identifiable operators, interfaces, treasury control, or governance concentration that bring regulation back into scope.
The right answer depends on factual control, custody, client intermediation, and token rights. A product memo is usually required before choosing the Cyprus licensing path.
When does MiCA not apply because MiFID II may apply instead? +
MiCA does not apply where the token is a financial instrument within the meaning of MiFID II. This can happen with tokenised shares, bonds, fund interests, and some rights-bearing or profit-linked instruments.
The boundary is assessed by substance, not branding. Regulators will look at:
- the legal rights attached to the token;
- whether it resembles transferable securities or other financial instruments;
- how returns are generated and promised;
- whether the structure creates investment-service features.
This is one of the most important threshold questions in a Cyprus MiCA project because the wrong perimeter choice can invalidate the entire application strategy.
What are the penalties for operating without authorisation in Cyprus? +
Operating an in-scope crypto business without the required authorisation can lead to severe regulatory consequences, including cease-and-desist measures, administrative sanctions, reputational damage, banking termination, and personal exposure for directors.
The exact enforcement route depends on the facts, but the commercial consequences are often immediate:
- loss of banking and payment support;
- inability to onboard institutional partners;
- public enforcement visibility;
- difficulty obtaining future licenses in Cyprus or elsewhere in the EU.
If a business may already be in scope, the safest step is to stop expansion, preserve records, and obtain urgent legal advice on authorisation strategy.
