Cyprus Crypto Licence — After the Transitional Window

The MiCA transitional window closed on 1 July 2026. Three categories of firms still need a Cyprus crypto licence — and each faces a different path.

New applicants. Any firm that did not hold a national registration before 30 December 2024 has no transitional rights. You apply for a full MiCA authorisation from CySEC from scratch — business plan, governance, capital, client-asset safeguards, the complete package. There is no fast-track. CySEC assesses each application on its merits, and the bar is substantially higher than the old AML registration, which was a register entry, not a prudential licence.

Firms caught mid-process. If you held a national registration and lodged a complete MiCA application by 27 February 2026, you may continue operating under transitional provisions until CySEC reaches a decision. The key word is "complete" — a pending application does not extend the right to operate if the file was deficient. CySEC has been issuing completeness assessments, and firms with gaps have been told to remedy within strict deadlines or cease activity.

Firms passporting in. A firm authorised in another EU member state under MiCA can passport into Cyprus via a notification under Article 63. No separate CySEC authorisation is required, but you must notify CySEC before commencing cross-border services. Host-state conduct rules apply, including CySEC's enforcement powers for breaches affecting Cyprus clients.

The market is small. KPMG counted roughly a dozen Cyprus firms authorised or in the pipeline as the window closed. This is a high-value, specialist market — not a volume play. The firms that succeed treat the authorisation as a regulatory transformation, not a form-filling exercise.

A MiCA authorisation application is not a form. It is a comprehensive regulatory submission that CySEC assesses against the standards in Title V of the regulation. Six pillars must be addressed, each documented, operational, and proportionate to the firm's scale and service mix.

Governance. At least two executive directors resident in Cyprus, a non-executive director, and a board with the collective competence to oversee crypto-asset services. CySEC scrutinises CVs, track records, and time commitment. Nominee arrangements that worked under the old AML regime will not survive assessment.

Capital. Permanent minimum capital ranges from €50,000 for advisory and order-handling services to €125,000 for custody, exchange, and trading-platform services. Own funds must also be at least one-third of the preceding year's fixed overheads, whichever is higher. The capital calculator below shows the requirement for your service mix.

Client-asset safeguards. Crypto-assets held on behalf of clients must be segregated from the firm's own assets, held in separate accounts or wallets, and subject to daily reconciliation. Title must be protected in insolvency. This is the single biggest operational change for firms transitioning from the old registration.

Policies, ICT, and programme of operations. Conflicts of interest, complaints handling, business continuity, risk management, outsourcing, and AML — each documented and operational. A documented ICT framework aligned with DORA, including incident reporting and third-party risk management. And a three-year business plan with projected revenue, costs, capital adequacy, and the rationale for each crypto-asset service.

CySEC has 60 working days from receipt of a complete application to assess it. This can be extended by 30 working days where the application is complex or where additional information is requested. In practice, most applications take four to six months from submission to decision, assuming the file is complete on first submission.

The clock does not start until CySEC confirms completeness. Incomplete applications are returned with a request for additional information, and the assessment period resets once the gaps are remedied. Firms that submit early and engage with CySEC during preparation tend to move faster — informal pre-lodgement meetings are available and worth the time.

A pending application does not extend the right to operate beyond the transitional period. Firms that lodged before 27 February 2026 may continue under transitional provisions until CySEC's decision. Firms that lodged after that date, or that did not lodge at all, cannot rely on a pending application to justify continued activity. The transitional period ended on 1 July 2026 — operating after that date without authorisation or transitional rights is an enforcement risk.

Firms that held a national registration but did not lodge a complete MiCA application by 27 February 2026 were required to submit a wind-down plan to CySEC and cease providing crypto-asset services. The transitional period ended on 1 July 2026. After that date, operating without a MiCA authorisation — or without the benefit of transitional provisions — is an unauthorised activity.

A wind-down plan is not simply "we will close." It must address how clients will be notified, how client crypto-assets will be returned or transferred, how open positions will be settled, how records will be preserved, and how complaints arising during the wind-down will be handled. CySEC expects a realistic timeline — typically six to twelve months — and evidence that the firm has the resources to execute it.

Firms that continue operating without authorisation face enforcement: withdrawal of the registration, administrative fines, and potential criminal referral. Directors and senior managers face personal liability. The better path for firms that missed the window is a structured wind-down followed by a fresh MiCA application — if the business case still holds.