Obtain CySEC MiCA authorisation in Cyprus for exchanges, custody, brokerage, and trading platforms. RUE supports structuring, filing, AML, Travel Rule, and DORA readiness.
Prepared by RUE editorial team · Reviewed by Milana · Updated 20 October 2026
Book MiCA Readiness CallCyprus is a practical home state for EU-facing crypto businesses that need CySEC supervision, access to experienced legal and compliance providers, and a tax-efficient corporate environment. RUE helps founders map their business model to MiCA, build substance, prepare the dossier, and manage the authorisation process end-to-end.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
Regulated United Europe (RUE) provides end-to-end support for a MiCA License in Cyprus, from service-perimeter mapping and company setup to drafting the application dossier, governance framework, AML/CFT controls, outsourcing model, and regulator-facing responses.
We also support related workstreams that often decide the project outcome in practice: banking strategy, accounting setup, local substance, MLRO/compliance staffing, Travel Rule implementation, and post-authorisation compliance.
CySEC is the licensing authority for Cyprus MiCA authorisation and supervises governance, conduct, safeguarding, and AML controls for CASPs established in Cyprus.
A Cyprus MiCA license can support cross-border expansion across the EU through passporting after authorisation and notifications.
Cyprus combines company law flexibility, experienced service providers, and a familiar environment for financial and high-risk businesses.
Cyprus works best for founders prepared to build real substance, AML architecture, Travel Rule controls, and DORA-grade ICT governance.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. In 2026, the practical test is no longer whether a company can file forms, but whether it can demonstrate a credible operating model, adequate own funds, real governance, and control over AML, safeguarding, outsourcing, and ICT risk.
CySEC will typically assess the applicant across five layers at once: service perimeter under MiCA, Cyprus AML law, Travel Rule obligations under the Transfer of Funds Regulation, DORA-style ICT resilience, and fit-and-proper suitability of shareholders and management. Generic templates and shell-company structures are a common failure point.
Below are the main requirements that usually determine whether a Cyprus MiCA application is review-ready.
You must identify exactly which MiCA crypto-asset services your business model triggers. This is the first legal gate in any Cyprus MiCA license project.
A weak perimeter memo creates downstream problems in capital, policies, disclosures, and passporting notifications.
Minimum capital for a MiCA License in Cyprus depends on the authorised service scope, not on marketing labels such as “exchange license” or “broker license”. The commonly referenced thresholds are €50,000, €125,000, and €150,000.
Minimum capital is only the entry threshold. CySEC will also assess whether the firm has adequate own funds, realistic liquidity planning, and enough runway to operate through the first 12 months. Capital must be funded in fiat, not in volatile crypto-assets, and source-of-funds evidence must be clean and documented.
You need a Cyprus legal entity with real operational presence. A paper office is not a credible basis for a CySEC MiCA authorisation.
Substance is also relevant for banking, tax residency analysis, and credibility of outsourcing oversight.
CySEC will assess whether qualifying shareholders, UBOs, directors, and senior managers are fit and proper. This is not a box-ticking exercise.
Non-EU founders can apply, but the management model must still support effective supervision in Cyprus.
A Cyprus MiCA license does not replace AML obligations. CASPs remain subject to Cyprus AML law, CySEC AML expectations, and suspicious transaction reporting to MOKAS.
Generic AML manuals copied from forex or EMI templates are one of the fastest ways to trigger extensive RFIs.
A credible CASP must show governance that works in practice. For a MiCA authorisation in Cyprus, that usually means clear board oversight, segregation of duties, and documented control ownership.
The operational question is simple: if the vendor fails tomorrow, can the board explain the risk, the fallback, and the client impact?
In 2026, a serious Cyprus MiCA license application should already be aligned with DORA-grade ICT governance, especially for custody, exchange, and platform models.
Independent penetration testing, audit trails, and a realistic business continuity plan materially improve application credibility.
The dossier for a MiCA license in Cyprus must show that the business is understandable, financeable, and controllable.
At RUE, we treat the dossier as an operating model pack, not just a filing pack. That approach reduces rework during regulator review.
Compare Cyprus with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Cyprus is often chosen for a MiCA license in Cyprus because the tax baseline is commercially attractive, but founders should avoid simplistic claims. The headline corporate income tax rate is 12.5%, yet the effective tax position of a crypto business depends on legal characterisation of income, expense deductibility, transfer pricing, substance, and whether parts of the group perform regulated, technology, treasury, or IP functions.
The first issue is not only tax rate but operating model alignment. A Cyprus CASP may have revenues from exchange spreads, custody fees, listing/placement fees, advisory, SaaS-style technology services, or group recharge arrangements. Each revenue stream can produce a different VAT and direct-tax analysis. The second issue is substance: if strategic control, key staff, and risk management sit elsewhere, tax residency and transfer-pricing questions become harder.
Cyprus also remains relevant because of its treaty network, professional services ecosystem, and compatibility with cross-border group structures. That said, no responsible advisor should present Cyprus as a one-line “low-tax crypto jurisdiction”. For regulated businesses, the real question is whether the tax structure survives audit and matches the governance reality shown to CySEC, banks, and counterparties.
Founders usually underestimate the total budget for a Cyprus MiCA license. The real cost stack typically includes:
For many applicants, the practical first-year budget is materially higher than the regulatory minimum capital. This page provides indicative market ranges only and should not be treated as legal or tax advice.
A Cyprus MiCA license is the start of supervision, not the end of the project. CySEC expects continuous compliance across conduct, AML, safeguarding, governance, and ICT resilience.
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. In practical terms, it is the legal basis for providing regulated crypto-asset services from Cyprus into the EU market.
The key dates matter. MiCA entered into force in 2023. Rules for ARTs and EMTs started applying from 30 June 2024. The main CASP regime started applying from 30 December 2024. Transitional arrangements in some Member States could run up to 1 July 2026, but by 2026 new applicants should think in full MiCA terms, not in legacy national-registration terms.
A Cyprus MiCA license is typically required if your business provides regulated services such as:
The term “crypto license Cyprus” is still used commercially, but in 2026 it is too broad. The real legal question is whether your exact business model falls within the MiCA CASP perimeter, or outside it, or partly into another regime such as MiFID II, EMT/e-money, or payments regulation.
RUE helps founders answer the only question that matters before filing: what exactly are you licensing, under which legal perimeter, with which capital, and with which control framework?
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define the exact MiCA service perimeter, check MiCA vs MiFID/EMT boundary issues, assess whether Cyprus is the right home state, and build an initial budget and timeline. Duration: 1-2 weeks.
Incorporate the Cyprus entity, plan office and governance substance, appoint directors, map control functions, and prepare ownership and source-of-funds documentation. Duration: 2-4 weeks.
Draft the business plan, financial model, AML/CFT framework, safeguarding model, outsourcing pack, complaints/conflicts policies, and ICT security documentation. Duration: 4-10 weeks.
Submit the complete dossier to CySEC, align supporting annexes, and ensure the filing is internally consistent across legal, financial, AML, and technology sections. Duration: 1-2 weeks.
CySEC checks whether the application is complete enough to enter substantive review. In practice this stage often takes around 25-30 working days, depending on filing quality and follow-up clarifications.
CySEC reviews governance, safeguarding, AML, outsourcing, financials, and fit-and-proper suitability. Expect RFIs, document refinements, and possible management interviews. Duration: often 40 working days plus pauses/extensions.
After approval, final conditions are closed, internal controls are confirmed, and the authorised CASP proceeds to registration visibility and cross-border notification planning. Duration: 2-4 weeks.
Finalize banking/payment rails, Travel Rule operations, staff training, internal reporting, and passporting notifications for target EU states. Duration: 2-6 weeks depending on launch complexity.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
A MiCA license in Cyprus is a CySEC authorisation for a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. It allows an authorised firm established in Cyprus to provide in-scope crypto-asset services and, after proper notification, use MiCA passporting for cross-border activity in the EU.
It is not the same as the old Cyprus AML-based CASP registration model. In 2026, new applicants should approach Cyprus as a full MiCA authorisation jurisdiction with governance, safeguarding, conduct, AML, Travel Rule, and ICT-resilience obligations.
A business usually needs a Cyprus MiCA license if it provides regulated crypto-asset services from Cyprus or into the EU market from a Cyprus establishment. Typical examples include:
The exact answer depends on the service flow and token classification. Some models marketed as “crypto” may instead fall under MiFID II, e-money, or payments rules.
Yes, non-EU founders can own a Cyprus CASP structure, but ownership is only one part of the analysis. CySEC will still require transparent UBO disclosure, clean source-of-funds evidence, fit-and-proper management, and a governance model that supports effective supervision in Cyprus.
In practice, non-EU ownership usually increases scrutiny around:
Non-EU founders can succeed, but the Cyprus company must still look and operate like a real regulated business.
Yes, a Cyprus MiCA license can support passporting across the EU after the required notification process. The license is granted by CySEC as the home-state authority, and the firm can then notify cross-border services into other Member States.
Passporting is not a free-for-all. The firm must still comply with applicable local rules on matters such as consumer communications, marketing, tax, and data protection. The practical rule is: one authorisation, multiple local conduct overlays.
A real operational presence is strongly expected for a credible MiCA License in Cyprus. While the exact office footprint depends on the business model, a virtual address alone is usually not enough for a serious CySEC application.
CySEC will look at substance through a wider lens:
For most applicants, the right question is not “minimum office” but “minimum credible substance”.
The MLRO/AML function can sometimes be structured with outsourcing support, but CySEC will expect clear accountability, oversight, and practical availability. For many Cyprus CASP projects, a local or strongly Cyprus-connected AML setup is commercially safer.
The regulator will typically test:
Outsourcing can reduce cost, but it does not remove board responsibility.
The standard MiCA minimum capital thresholds commonly referenced for a Cyprus MiCA license are €50,000, €125,000, and €150,000, depending on the authorised service scope.
Minimum capital is not the full answer. CySEC will also assess own funds, liquidity, funding sources, and whether the firm has enough runway to operate safely after authorisation.
A realistic first-year budget for a MiCA license in Cyprus is usually much higher than the minimum capital alone. In practice, founders should budget for:
For many serious applicants, the practical project budget starts from the mid-five figures and can move well into six figures depending on scope. Exchange and custody models are typically the most expensive. RUE provides a tailored feasibility estimate rather than a generic headline quote.
The practical answer is usually 6-9 months end-to-end, including preparation, filing, review, RFIs, and go-live remediation.
A common timing structure is:
Delays usually come from weak documentation, unclear outsourcing, poor substance, or slow responses rather than from the formal clock alone.
Legacy Cyprus CASP/VASP structures do not remain a permanent substitute for MiCA authorisation. Transitional treatment depended on the national and EU timing framework, with a ceiling that could run up to 1 July 2026 in some cases.
In 2026, the practical approach for legacy firms is:
If a business is still operating on a legacy logic without a valid MiCA path, it should obtain jurisdiction-specific legal advice immediately.
Sometimes yes, sometimes no. MiCA covers certain issuer activities and CASP services, but not every blockchain activity fits neatly inside it.
The right answer depends on factual control, custody, client intermediation, and token rights. A product memo is usually required before choosing the Cyprus licensing path.
MiCA does not apply where the token is a financial instrument within the meaning of MiFID II. This can happen with tokenised shares, bonds, fund interests, and some rights-bearing or profit-linked instruments.
The boundary is assessed by substance, not branding. Regulators will look at:
This is one of the most important threshold questions in a Cyprus MiCA project because the wrong perimeter choice can invalidate the entire application strategy.
Operating an in-scope crypto business without the required authorisation can lead to severe regulatory consequences, including cease-and-desist measures, administrative sanctions, reputational damage, banking termination, and personal exposure for directors.
The exact enforcement route depends on the facts, but the commercial consequences are often immediate:
If a business may already be in scope, the safest step is to stop expansion, preserve records, and obtain urgent legal advice on authorisation strategy.
