Cyprus CySEC CASP Practitioner Guide: What's Different in 2026

Why Cyprus shifted from VASP to MiCA

Cyprus migrated from its national VASP register — operated by CySEC since September 2021 under the AML/CFT Law and a dedicated CySEC Directive — to MiCA CASP supervision over the 2024-2026 transitional window. MiCA itself applied EU-wide from 30 December 2024; Cyprus stopped accepting new applications under the local CASP Regime in October 2024 and gave existing registrants until 27 February 2026 to file a MiCA authorisation application, with continuing-services grandfathering under MiCA’s transitional regime until 1 July 2026.

The transitional design matters because Cyprus has deliberately positioned itself as the lighter-substance EU jurisdiction — a counter to Estonia, Malta, and Ireland that have applied increasingly strict supervisory expectations since 2024. CySEC’s pitch is consistent: same MiCA passport, lower operational footprint required, faster decisions for well-prepared applications. The pitch holds for some applicant profiles but not all.

What does CySEC expect in a 2026 CASP application?

The substantive expectations cluster into seven workstreams. None is unusual; the proportions and language emphasis differ from peer regulators.

Initial capital and prudential setup

The MiCA floors apply unchanged: €50,000 for Class 1, €125,000 for Class 2, €150,000 for Class 3. CySEC accepts mixed-currency capital where USD or USDC reserves match the EUR equivalent on a documented basis — the rule is flexible relative to Estonia where EUR-denominated cash is preferred.

The wind-down plan requirement that flows from the own-funds requirement MiCA prudential rules is read literally by CySEC reviewers. Plans without specific liquidation triggers and timelines — generic language referencing “applicable law” — are treated as a substantive deficiency in supervisory practice.

Substance: residency and senior management

Cyprus requires:

• Two senior managers Cyprus-resident, of whom one must be a Cyprus citizen or have permanent residency
• Registered office in Cyprus, not a virtual address
• Locally-based MLRO with AML qualification (CAMS, ICA International Diploma, or equivalent)
• Documented operational presence — staff, leases, IT setup

Compared to Estonia (which expects a resident director, locally-based MLRO, and full operational substance), Cyprus is materially lighter on senior-management headcount but equally strict on registered office and MLRO location.

Governance arrangements

The the governance arrangements governance file is where most 2026 applications consume time. CySEC reviewers want:

• Board composition and meeting cadence (minimum monthly for Class 3)
• Three-lines-of-defence documentation (compliance, risk, internal audit)
• Conflict-of-interest registers with concrete examples for the proposed business model
• Complaints-handling procedure aligned with EBA guidelines

The most common deficiency is Big-Four-template language without Cyprus-specific or business-model-specific adaptation. CySEC reviewers want to see the firm’s own thinking, not generic compliance language.

AML/CFT framework

The 5AMLD-aligned framework remains familiar: customer-due-diligence procedures, transaction monitoring, suspicious-transaction reporting to MOKAS (the Cyprus FIU). What’s new in 2026 is the explicit MiCA Title V expectation that the AML framework integrates self-hosted-wallet and chain-analytics tooling for crypto-specific risk typologies. Applicants without documented chain-analytics provisioning (Chainalysis, Elliptic, TRM, or equivalent) receive an information request.

ICT resilience under DORA

Cyprus applies DORA in line with the broader EU framework. The 2025 Q4 ESMA Q&A made it explicit that DORA applies to CASPs from authorisation, not from operational launch. CySEC reviewers expect an ICT resilience plan referencing actual third-party providers (cloud, custody-tech, exchange-tech) and specific risk treatments — template plans without specifics are flagged.

White paper for in-scope tokens

If the CASP also issues or intends to issue a crypto-asset that triggers the Title II/III obligation (asset-referenced tokens, e-money tokens, or other crypto-assets requiring a published white paper), the white paper file is filed in parallel with the CASP authorisation. This is the single largest source of additional time in 2026 applications for issuer-CASPs. Pure service-provider CASPs (no own issuance) avoid this workstream.

Banking arrangement

The single weakest link in Cyprus practice. Domestic Cyprus banks remain reluctant to onboard CASPs even post-authorisation. The realistic banking arrangement for a Cyprus CASP in 2026 is one of:

• A Cyprus-domiciled crypto-friendly EMI (limited inventory)
• An EU EMI in Lithuania or Estonia with cross-border services
• A non-bank custody and settlement provider with EUR rail access

Applicants who have not negotiated banking before authorisation find themselves licensed but unable to onboard clients for two to four months. Plan banking earlier than the regulatory file.

How does the application timeline work in 2026?

A typical Cyprus CASP application splits into four phases over 4-6 months:

1. Pre-application engagement (2-4 weeks). CySEC accepts pre-application meetings with proposed senior management. The conversation surfaces gating issues — substance, business model, AML approach — before the formal file. Counsel without recent Cyprus practice often skips this step; it materially de-risks the file.

2. Formal filing and completeness check (2-3 weeks). The full file is submitted via the CySEC online portal. The completeness check is an administrative review — completeness, not merits. Files that fail completeness are returned without substantive engagement.

3. Substantive review and information requests (10-14 weeks). The bulk of the timeline. CySEC issues information requests in batches; turnaround on responses materially affects total time. Well-prepared files typically receive two to three information-request rounds; weaker files can run to five or six.

4. Final decision and notification (2-4 weeks). Authorisation is granted by board decision. CySEC publishes authorised CASPs on its register and notifies ESMA for the consolidated CASP register.

Cyprus vs other EU jurisdictions in 2026

Cyprus sits between the lighter-substance non-EU options (UAE, Switzerland) and the stricter EU jurisdictions (Estonia, Malta, Ireland). In rough comparison terms:

• Cyprus vs Estonia: Cyprus is ~30% cheaper to set up and operate, ~1 month faster for a clean application, but has weaker downstream banking access. Estonia has stronger supervisory reputation that helps with EU banking and counterparty access.

• Cyprus vs Malta: Cyprus is materially lighter on substance — Malta requires functional separation of MLRO and Compliance Officer for firms above the small-firm threshold; Cyprus does not. Cyprus is faster.

• Cyprus vs Lithuania: Lithuania is faster (4 months vs 4-6) but has tightened in 2026 — class-based FTE floors that Cyprus does not impose. Lithuania has stronger bank-of-Lithuania-direct relationship for prudential matters.

Working with counsel on a Cyprus CASP file

Cyprus practice is dominated by a small number of firms with CySEC track record. The diagnostic question is whether counsel has filed at least three CASP applications since the law took effect in 2025 — practice is recent enough that counsel without that count is still calibrating. The firms in our index that have processed multiple Cyprus CASP files are listed below.