CASP License in Cyprus: Where Things Stand After 1 July 2026
Cyprus’s MiCA transition ended on 1 July 2026. A firm now needs MiCA authorisation from the Cyprus Securities and Exchange Commission (CySEC) to provide crypto-asset services from Cyprus, or authorisation in another EU country and the EU passport. The earlier CySEC registration of crypto-asset service providers, held under Cyprus’s anti-money laundering law, no longer lets a firm keep operating.
CySEC supervises CASPs under MiCA. The Central Bank of Cyprus oversees certain asset-referenced and e-money tokens.
CASP License Timeline in Cyprus
| Date |
What happened |
| 17 October 2024 |
CySEC stops accepting new applications under its national CASP registration regime |
| 30 December 2024 |
MiCA’s CASP regime applies |
| 27 February 2026 |
CySEC’s deadline to apply for MiCA authorisation. CASPs that did not apply had to submit a wind-down plan |
| 1 July 2026 |
The transition ends. Registered CASPs could operate until then, or until their application was decided if that came first |
| July 2026 |
CySEC circulates AML guidance to supervised firms and reminds investors to check the ESMA register |
| 8 October 2026 |
The Markets in Crypto-Assets Bill of 2026, which sets national MiCA enforcement powers, is submitted to the House of Representatives. It had not passed as of 15 October 2026 |
What Is a CASP License in Cyprus?
A CASP licence in Cyprus is the authorisation CySEC grants under MiCA to a crypto-asset service provider. It replaces the national CySEC registration and lets the firm passport its services across the EU.
CASP-Regulated Crypto Services Include (H3)
- Custody and administration of crypto-assets for clients
- Operating a trading platform for crypto-assets
- Exchange of crypto-assets for funds or for other crypto-assets
- Execution of orders for clients and placing of crypto-assets
- Reception and transmission of orders, and transfer services for crypto-assets
- Advice on crypto-assets and portfolio management
To check a provider, search the ESMA register of crypto-asset service providers, as CySEC reminded investors in July 2026. In ESMA’s register update of 30 October 2026, 25 Cyprus-based entities were listed as active crypto-asset service providers, including financial entities that notified under Article 60. The register changes often, so check the live ESMA register before relying on this figure.
MiCA and CASP License Compliance Requirements in Cyprus
- Authorisation by CySEC: the application goes to CySEC. MiCA allows 25 working days for the completeness check and 40 working days to assess a complete file, with the clock paused for up to 20 working days for information requests (Article 63).
- EU presence: a registered office in a Member State where the firm provides part of its services, effective management in the EU, and at least one director resident in the EU (Article 59(2)).
- Minimum capital: €50,000, €125,000 or €150,000 by service class, or one quarter of the previous year’s fixed overheads if higher.
- AML/CFT controls: a risk-based approach and customer due diligence under Cyprus’s anti-money laundering law (Law 188(I)/2007).
- Travel Rule: the Transfer of Funds Regulation (Regulation (EU) 2023/1113) has applied since 30 December 2024, with no minimum amount for the information that must travel with a transfer. For transfers above €1,000 to a self-hosted address, the CASP must assess that its customer owns or controls the address. The Travel Rule page covers the full duty.
In July 2026 CySEC told supervised firms to apply a risk-based approach and individual due diligence to customers arriving from unauthorised providers, and not to treat them as high risk solely because of their previous provider.
ESMA’s opinion of 8 October 2026 asks national authorities to expect authorised CASPs to stop providing crypto-asset services for asset-referenced and e-money tokens that do not meet MiCA. Legacy holdings have to be remediated by 8 January 2027 at the latest, and only time-limited exit services (sell-only, conversion, withdrawal and transfer out) stay open. Scorechain explains the ESMA opinion on non-MiCA-compliant stablecoins and how these limits shape stablecoin compliance controls at a CASP.
How Scorechain Supports CASP Compliance in Cyprus
Scorechain is used by 200+ organisations for crypto AML, KYT and Travel Rule compliance.
Transaction Monitoring
Scorechain Transaction Monitoring supports a CASP’s AML/CFT controls with alerts, risk scores and a record of decisions.
- Alert scenarios: combine transaction direction, amount and risk indicators.
- Risk scores: each address gets separate scores for incoming and outgoing funds.
- Audit trail: keep a record of alerts and decisions for AML/CFT reviews.
Alerts can also be built around a firm’s own token eligibility list, which helps apply the stablecoin restrictions above.
Travel Rule Compliance
The Travel Rule API gives CASPs one endpoint to send and receive originator and beneficiary data, routed through partner infrastructure.
- Data exchange: send and receive the data in one integration.
- Counterparty intelligence: assess the risk of the VASP on the other side of a transfer.
- Independent use: available without Transaction Monitoring.
Blockchain Risk Analytics and KYT
KYT reports give compliance teams the on-chain evidence behind a decision.
- One-click reports: produce reports on an address or a transaction with risk scores for incoming and outgoing funds.
- Risk indicators: show the entity and behaviour flags that drove the score.
- Exports: share reports with internal teams or authorities.
Wallet and Sanctions Screening
Wallet screening returns a risk score for an address before a transfer, across 25+ blockchains.
- Risk categories: flag addresses linked to sanctioned entities, darknet markets, scams and other high-risk categories.
- Free Sanctions Screening API: the free Sanctions Screening API checks addresses against OFAC, OFSI, MOFA (South Korea) and NBCTF (Israel) lists.
- EU lists: the API does not cover them, so EU restrictive-measures screening needs a separate source.
Benefits of a CASP License in Cyprus
- EU passport: an authorised CASP notifies CySEC of the Member States and services it plans to serve. CySEC forwards the notice to host authorities within 10 working days, and the CASP can start once CySEC confirms, or from the 15th calendar day after submitting.
- Transition is over: authorisation is now the only route. A pending application does not allow a provider to keep operating.
- Enforcement is expanding: the bill before the House of Representatives would give CySEC and the Central Bank of Cyprus expanded enforcement powers, with penalties of up to €15 million for serious breaches.
Scorechain for Your CASP License in Cyprus
To see how transaction monitoring, Travel Rule and wallet screening work on your own flows and your CySEC application, book a demo with the Scorechain team.
