Cyprus Crypto & Digital Asset Regulation

Crypto Licensing

Cyprus's Markets in Crypto-Assets Regulation transitional period closed on 1 July 2026, marking the end of the full eighteen-month national grandfathering window that began on 30 December 2024. Cyprus adopted this transitional window in full, the maximum period permitted under the regulation, and the Cyprus Securities and Exchange Commission set 27 February 2026 as its internal cut-off for existing national-registrant crypto-asset service providers to file a complete application for authorisation. A pending, incomplete application did not extend the right to continue operating past the 1 July 2026 deadline; non-filers were required to submit wind-down plans. This is now a settled, in-force feature of the Cyprus licensing landscape rather than a live development, but it frames the baseline against which the current legislative move should be read.

The current live development is the Markets in Crypto-Assets Bill of 2026, submitted to the House of Representatives on 8 October 2026 following Cabinet approval on 10 September 2026. The bill would formalise the domestic enforcement architecture underpinning the regulation, granting the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission powers to investigate, conduct inspections, issue compliance orders, and restrict, suspend, or withdraw a crypto-asset service provider's authorisation. The proposed penalty structure is significant in scale: corporate fines of at least five million euro for specified infringements, rising to fifteen million euro or more on a turnover-linked basis for serious market abuse, with individual fines of up to five million euro and the possibility of temporary management restrictions for responsible individuals. No primary bill text or House of Representatives committee record has been retrieved this cycle, so the figures and powers described here should be read as the bill as tabled in press reporting, not as settled, enacted law; the final version may differ following parliamentary scrutiny.

Separately, Cyprus's standing licensing architecture continues to operate via two parallel routes: Article 63 authorisation by the Cyprus Securities and Exchange Commission for new crypto-asset service providers, and an Article 60 notification route available to entities already regulated under another licence, such as existing investment-firm, electronic-money-institution or payment-institution authorisation holders. CySEC maintains separate registers for each route. This structure is unchanged this cycle and continues to govern market entry independently of the pending enforcement bill.

Outlook

The Markets in Crypto-Assets Bill of 2026 is expected to progress through further House of Representatives stages, though no specific enactment date is confirmed; the regulatory horizon estimate places material impact around the first quarter of 2027, with a half-year uncertainty band reflecting the absence of a confirmed legislative timetable. Confidence in the bill's final scope, including the precise fine thresholds, will firm once the official parliamentary text and any committee-stage amendments become available. In the meantime, the existing Article 63 and Article 60 licensing routes, and the July 2026 transitional-period closure, remain the settled baseline for market access in Cyprus.

Crypto Licensing

The defining event in Cyprus's crypto-licensing regime this cycle is the complete expiry of the MiCA Article 143(3) national transitional window on 1 July 2026. This transitional regime had permitted crypto-asset service providers that were operating under Cyprus's prior national registration framework to continue doing so for a limited period while pursuing full MiCA authorisation. The mechanism required a complete MiCA authorisation application to be submitted to CySEC by 27 February 2026; entities that did not file by that date were required to submit a wind-down plan and cease CASP operations by 1 July 2026. For entities that did file, continued operation under the national framework was permitted only until CySEC reached a decision, approval or refusal, or until 1 July 2026, whichever came first. That final cutoff has now passed, meaning the transitional pathway is entirely closed: only full MiCA authorisation or an Article 60 cross-border notification now provides a lawful basis for CASP activity in Cyprus.

This closure is structurally significant because it eliminates an entire category of lawful operating basis rather than incrementally raising a compliance bar. A CASP that relied on the transitional window and did not secure either full authorisation or an Article 60 notification by the deadline has, as a matter of law, no remaining basis to continue operating under the prior regime from 1 July 2026 onward. The general prohibition on unauthorised provision of CASP services under MiCA Article 111 applies to any such firm continuing to operate post-deadline, though the exact Cyprus-specific administrative fine maxima implementing Article 111 were not located this cycle; the national fine-maxima table and CySEC's own implementing directive remain a research gap.

Own-funds requirements for Cyprus CASPs follow the standard MiCA tiered structure under Article 67 and Annex IV: approximately EUR 50,000 for firms providing reception and transmission of orders, EUR 125,000 for firms providing execution of orders or exchange services, and EUR 150,000 for firms operating a trading platform for crypto-assets. These figures derive from vendor and consultancy commentary rather than from CySEC's own authorisation directive, which was not independently retrieved this cycle, so they should be treated as probable rather than confirmed pending primary-source verification.

The practical effect of the transitional-regime closure is a narrowing of the Cyprus-domiciled CASP population to those entities that cleared the full MiCA authorisation bar, a materially higher threshold than the prior national registration standard. This narrowing is consistent with the broader EU-wide MiCA rollout pattern, in which national transitional regimes of varying length have been progressively closing across member states through 2026, with Cyprus's 1 July 2026 cutoff representing one of the standard-length transitional windows rather than an outlier.

Outlook

The near-term question for Cyprus's crypto-licensing regime is whether CySEC takes visible enforcement action against any entity that continued CASP operations past 1 July 2026 without having secured authorisation or filed a wind-down plan; no such enforcement action has been identified within this cycle's research. A further open item is confirmation of the Cyprus-specific administrative fine maxima implementing MiCA Article 111, which would give a fuller picture of the enforcement exposure facing any residual unauthorised operator. Firms considering Cyprus as a CASP licensing jurisdiction should now treat full MiCA authorisation as the only available pathway, with no further national grace period remaining.

Crypto Licensing

Cyprus's crypto-asset service provider licensing regime completed its transition to full MiCA authorisation this period. Crypto-asset service providers operating in Cyprus must now hold MiCA authorisation from the Cyprus Securities and Exchange Commission (CySEC); the pre-MiCA national CASP registration regime, which had provided a lawful transitional operating basis, expired on 1 July 2026. Firms registered under that national regime were required to have filed a complete MiCA authorisation application by 27 February 2026 in order to continue operating through to the 1 July 2026 cutover; those that did not file were expected to wind down national-regime activity.

This is a confirmed, T1-sourced development directly from CySEC's own published guidance, and it settles what had previously been a transitional and therefore inherently temporary regulatory position. From 1 July 2026 onward there is no parallel national registration track running alongside MiCA authorisation in Cyprus: MiCA is the only lawful basis for CASP activity. The regime is now settled rather than transitional, which is the basis for a green traffic-light rationale on this module notwithstanding the significant procedural change that occurred to reach that settled state.

Outlook

With the transitional pathway now closed, the near-term watch item is enforcement visibility: whether any national-regime holdouts continued CASP activity in Cyprus without MiCA authorisation past 1 July 2026, and if so, what enforcement response CySEC takes. No such finding has surfaced this cycle.

Consumer Protection

Following the 1 July 2026 expiry of the MiCA Article 143(3) transitional regime, CySEC echoed a statement from the European Securities and Markets Authority (ESMA) warning that clients of unauthorised crypto-asset providers do not benefit from MiCA's client-asset safeguards. This warning is a direct consumer-protection consequence of the licensing-regime closure covered elsewhere in this brief: with the transitional pathway closed, any entity continuing to provide crypto-asset services in Cyprus without full MiCA authorisation or an Article 60 cross-border notification falls outside the perimeter of MiCA's protective framework entirely, meaning clients dealing with such an entity have no recourse to MiCA's client-asset segregation, custody, and safeguarding provisions.

The significance of this warning lies in its timing and its function as a clear-cut consumer-facing signal rather than a technical compliance notice. By issuing it immediately following the transitional-regime expiry, CySEC is drawing a bright line for Cyprus-based or Cyprus-facing crypto-asset clients: the protective value of MiCA's safeguards is now conditional on dealing with a properly authorised entity, and that authorisation status is no longer ambiguous or subject to a transitional grace period. For consumers who may not be aware that a provider's transitional registration has lapsed, this creates a meaningful information gap that the ESMA-echoed warning is intended to close.

Beyond this post-transition warning, no additional Cyprus-specific consumer-protection development, such as new custody or segregation guidance going beyond the text of MiCA Article 75, was located this cycle. The consumer-protection regime in Cyprus continues to rest on the MiCA framework's own protective provisions, supplemented by this cycle's regulatory warning rather than by any new national rule or guidance document.

Outlook

The practical test of this warning's effectiveness will be whether Cyprus-based crypto-asset clients meaningfully shift away from any remaining unauthorised providers in response to it, a shift that is not yet observable from the available record. CySEC's willingness to echo ESMA-level consumer warnings promptly following a regulatory-deadline closure suggests the regulator intends to maintain active consumer-facing communication as the post-transition landscape settles, and further warnings of this kind may follow if unauthorised provision persists.