Cysec Mica CASP Authorisation in Cyprus Eligibility, Process, Costs & Timelines

Cyprus has cemented its position as one of the European Union’s most established jurisdictions for crypto-asset regulation. For businesses seeking CySEC MiCA CASP authorisation in Cyprus, the island offers a mature securities regulator, a well-documented application pathway and critically full EU passporting rights once authorised. The Markets in Crypto-Assets Regulation (MiCA) has replaced a patchwork of national regimes with a single, harmonised framework, and the Cyprus Securities and Exchange Commission (CySEC) is the designated competent authority for CASP authorisations on the island.

Urgency is no longer abstract. The MiCA transitional period concluded on 1 July 2026, meaning firms that were operating under legacy national registrations without having secured MiCA authorisation have lost their right to provide crypto-asset services in the EU. For new market entrants and firms still evaluating jurisdictions, the practical imperative is clear: submit a complete, well-prepared application to CySEC as early as possible.

This guide is written for founders, CEOs, compliance officers and in-house counsel who need a reliable, step-by-step overview of the CySEC MiCA CASP application covering eligibility criteria, required documents, governance and AML frameworks, technology and security standards, realistic timelines, costs and EU passporting mechanics.

What a CySEC MiCA CASP Authorisation Allows You to Do

Once authorised by CySEC under Regulation (EU) 2023/1114, a Crypto-Asset Service Provider may carry out one or more of the following regulated activities across the EEA:

• Custody and administration of crypto-assets on behalf of clients including safeguarding private cryptographic keys.
• Operation of a trading platform for crypto-assets matching multiple third-party buying and selling interests.
• Exchange of crypto-assets for funds or other crypto-assets principal or agency-basis trading.
• Execution of orders for crypto-assets on behalf of clients.
• Placing of crypto-assets marketing newly issued tokens to investors.
• Reception and transmission of orders routing client orders to other CASPs or trading platforms.
• Providing advice on crypto-assets personalised recommendations.
• Providing portfolio management of crypto-assets.
• Providing transfer services for crypto-assets on behalf of clients.

CySEC maps these activities into classes (Class 1, Class 2, Class 3) that carry differing capital, governance and operational requirements. After authorisation, the firm may notify CySEC and use MiCA’s passporting mechanism to provide the same services across all EEA member states a significant advantage discussed further in the post-authorisation section below.

Step-by-Step Process to Obtain CySEC MiCA CASP Authorisation

The end-to-end journey from initial scoping to operational launch typically moves through ten distinct stages. The timeline and workload at each stage depend on the scope and complexity of the intended services. Below is a detailed roadmap referenced to CySEC’s published CASP guidance and the MiCA legislative text.

Step 1 Pre-Application Assessment & Legal Structure (1–2 Weeks)

Before engaging with CySEC, the applicant must make foundational decisions:

• Entity type: Incorporate or re-domicile a limited company under Cyprus law with a registered office and effective head office on the island.
• Local substance: Appoint at least two Cyprus-resident executive directors, designate an AML Compliance Officer (AMLCO) and a Risk Manager.
• Shareholder structure: Map ultimate beneficial owners (UBOs) and qualifying shareholders who will require fit-and-proper assessment.

Step 2 Regulatory Classification & Scope (1 Week)

Map intended activities to CySEC’s class framework. Each class carries specific minimum capital thresholds for example, custody and operation of a multilateral trading facility sit in the higher-capital categories. This classification determines the depth of governance, the prudential requirements and the level of technical documentation required. The CySEC CASP portal sets out the class-based requirements in detail.

Step 3 Governance & Officers (2–6 Weeks)

• Board composition: Ensure the board includes independent, non-executive expertise in risk and compliance.
• Fit-and-proper declarations: Prepare detailed CVs, criminal record extracts, financial-standing evidence and declarations for all directors, senior managers and qualifying shareholders.
• Internal policies: Draft remuneration, conflicts-of-interest, outsourcing and business-continuity policies.

Step 4 AML/KYC Framework & FATF Compliance (2–6 Weeks)

• AML manual: Develop a comprehensive Anti-Money-Laundering and Counter-Terrorist-Financing (AML/CFT) policy aligned with Cyprus AML laws and CySEC circulars.
• Transaction monitoring: Implement automated screening tools (sanctions, PEPs, adverse media) and suspicious-transaction-reporting procedures.
• Travel Rule compliance: Ensure procedures for originator/beneficiary data transfer under MiCA and EU Transfer of Funds Regulation requirements.

Step 5 Technical & Security Readiness (4–8 Weeks)

• Custody model: Document hot/cold wallet architecture, key-management procedures and segregation of client assets.
• Operational resilience: Prepare disaster-recovery plans, business-continuity testing records and incident-response protocols.
• Third-party assurance: Commission penetration testing, vulnerability assessments and, where appropriate, SOC 2 or equivalent independent attestations.

Step 6 MiCA White Paper / Disclosures (Parallel Task)

If the applicant intends to offer or place crypto-assets, a MiCA-compliant white paper must be drafted, reviewed and notified to CySEC prior to publication. This is a parallel workstream that does not gate the CASP application itself but must be completed before relevant services go live.

Step 7 Application Packing: Forms & Appendices (1–3 Weeks)

Compile the full submission dossier. CySEC’s application forms page hosts Form 188-01 and its annexes. A complete application pack typically includes:

• Form 188-01 and all required annexes.
• Business plan with three-year financial projections.
• Governance and organisational chart.
• CVs and fit-and-proper evidence for all notified persons.
• AML/CFT manual and procedures.
• IT/security architecture diagrams and penetration-test reports.
• Outsourcing and custody agreements.
• Independent auditor confirmation letters (where required).

A downloadable CySEC CASP application checklist covering every annex is a valuable tool for ensuring completeness before submission.

Step 8 Submission & Payment of Application Fee (Immediate)

Submit the completed dossier to CySEC and pay the application/examination fee. The Central Bank of Cyprus provides IBAN details for fee payments in cases involving overlapping payment-service permissions. Retain proof of payment for the application file.

Step 9 CySEC Review, Q&A & Inspection (8–24 Weeks)

CySEC will acknowledge receipt and begin a substantive review. During this phase the regulator typically:

• Issues rounds of written questions often two to four rounds focusing on AML adequacy, IT custody resilience, governance, capital and outsourcing.
• Conducts on-site or virtual inspections verifying physical presence, systems and personnel in Cyprus.
• Requests supplementary documentation common shortfalls include inadequate IT-security evidence, incomplete fit-and-proper packages and insufficient financial-projections detail.

The responsiveness and quality of the applicant’s replies directly determines whether the timeline stays at the shorter or longer end of the range.

Step 10 Decision & Post-Authorisation Onboarding (2–8 Weeks)

Upon a favourable decision, CySEC issues the MiCA CASP authorisation and enters the firm on the public register. Post-authorisation tasks include:

• Passporting notifications: File host-state notifications with CySEC for each EEA jurisdiction where services will be offered.
• Supervisory reporting: Set up ongoing periodic reporting (financial, AML, complaints, incident) per CySEC’s schedules.
• Public disclosures: Publish white papers, fee schedules and complaint-handling procedures as required.

Key Requirements & Eligibility for CySEC MiCA CASP Cyprus

Before investing in the application process, prospective applicants should confirm they meet the threshold eligibility criteria. CySEC assesses every application against the following pillars:

• Legal presence and substance in Cyprus: The applicant must be a legal entity incorporated in Cyprus (or an EU equivalent re-domiciled to Cyprus) with a genuine head office, local directors and operational staff on the island.
• Fit-and-proper management: Directors, senior managers and qualifying shareholders must demonstrate integrity, competence and financial soundness. CySEC requires CVs, criminal-record certificates, declarations of interests and evidence of relevant experience.
• Minimum capital by activity class: Capital requirements scale with the risk profile of the intended services. Custody, operation of trading platforms and exchange services attract higher thresholds. The CySEC CASP portal sets out the applicable ranges and prudential buffers.
• AML/CFT framework: A fully documented and operationally tested AML/KYC programme, including an appointed AMLCO, must be in place before submission. CySEC has published specific policy statements and circulars addressing crypto-specific AML expectations.
• Technology and security readiness: The applicant must evidence a robust custody model, segregation of client assets, key-management protocols, disaster-recovery testing and incident-response procedures. Independent third-party assurance (penetration tests, security attestations) significantly strengthens the application.
• Outsourcing and continuity: Where critical functions are outsourced, the applicant must demonstrate adequate oversight, contractual protections and contingency arrangements all documented and available for CySEC review.

Comparison: Cyprus (CySEC) vs Malta (MFSA) for MiCA CASP Authorisation

Jurisdictional selection is a strategic decision. The table below offers a high-level comparison of two of the most active EU member states for crypto regulation. For a detailed, personalised jurisdictional-suitability assessment, a dedicated advisory call is recommended.

Costs & Realistic Timelines for Cyprus CASP Authorisation

Regulator Fees

CySEC’s published fee schedule for crypto-asset service providers sets out the following indicative charges:

• Application / examination fee: €10,000, payable upon submission of the application dossier.
• Annual renewal / registration fee: Approximately €5,000, plus class-based and operational charges that scale with the scope of authorised activities.
• Additional capital costs: Custody and Class 3 activities require higher operational and prudential capital, which should be budgeted separately.

External Professional Costs (Estimated Ranges)

Beyond regulator fees, applicants should budget for legal counsel, compliance consulting, IT security assurance and project-management support. Industry observers report typical ranges of €40,000–€150,000+ depending on complexity, the number of service classes sought and the readiness of existing governance and technology infrastructure. These figures are indicative and should be validated during a scoping engagement.

End-to-End Timeline Scenarios

CySEC had previously published transitional announcements and application-window circulars requiring firms operating under legacy national registrations to submit applications by specified cut-off dates ahead of the 1 July 2026 deadline. New entrants without a legacy registration should plan for the typical or complex timelines above.

Common CySEC Questions & Regulatory Checkpoints

During the review phase, CySEC’s case officers typically probe the following areas in depth. Understanding these common queries in advance can significantly reduce delays:

• AML control adequacy: Is the AML manual comprehensive? Are monitoring rules calibrated to the firm’s risk appetite? Are SAR escalation procedures clearly defined?
• IT and custody resilience: Can the applicant evidence tested disaster-recovery procedures? Have independent penetration tests been conducted within the last 12 months?
• Governance and remuneration: Does the board include genuine independent oversight? Are remuneration structures aligned with long-term risk management?
• Source of funds and initial capital: Can all qualifying shareholders demonstrate a legitimate source of funds for the initial capitalisation?
• Outsourcing agreements: Are third-party service providers subject to adequate contractual oversight, audit rights and contingency provisions?

Common Document Shortfalls That Delay Decisions

The most frequent causes of extended review timelines include: insufficiently detailed AML procedures that lack crypto-specific risk typologies; IT documentation that does not map controls to MiCA operational-resilience requirements; incomplete fit-and-proper packages (missing criminal records from prior jurisdictions of residence); and financial projections that do not stress-test for adverse market scenarios.

How Pre-Application Gap Analysis Helps

A structured pre-application gap analysis covering governance readiness, AML framework maturity, technology documentation and capital planning allows applicants to identify and resolve weaknesses before CySEC’s formal review begins. This typically results in fewer Q&A rounds, faster decisions and reduced professional costs overall.

Closing Summary & Next Steps

Securing CySEC MiCA CASP authorisation in Cyprus positions a crypto-asset business at the centre of the EU’s harmonised regulatory framework, with full passporting access to 30 EEA markets and a supervisory environment that industry observers regard as proportionate and well-established. The process is rigorous but navigable provided the applicant invests early in governance readiness, AML infrastructure, technical documentation and regulatory strategy.

Global Law Experts supports applicants through every stage: from pre-application gap analysis and jurisdictional selection through to Form 188-01 preparation, policy drafting, CySEC liaison and post-authorisation passporting notifications. The practical next step is a scoping call to assess readiness, define timelines and agree a transparent fee structure including access to a downloadable CySEC CASP application checklist and timeline template to guide the engagement from day one.

Sources

• Regulation (EU) 2023/1114 Markets in Crypto-Assets (MiCA), EUR-Lex
• CySEC Crypto-Asset Service Providers (CASPs) Guidance, Register & Classes
• CySEC CASP Application Forms (Form 188-01 & Annexes)
• CySEC Crypto Currency Fees Schedule
• CySEC Policy Statement / Circular on CASP Requirements
• CySEC Transitional Dates & Application Window Announcements
• ESMA Markets in Crypto-Assets Regulation (MiCA) Guidance & RTS Packages
• Central Bank of Cyprus Licensing of Crypto-Asset Service Providers (CASPs)