CASP Audit Requirements Under MiCA in Cyprus: Statutory Audit, Own Funds and Safeguarding Evidence

Most CASPs think of the statutory audit as a filing obligation and the MiCA prudential requirement as a compliance obligation. Article 67 connects them, and firms that run them as separate projects find out in the wrong order.

A question we are asked often enough to write down: now that we hold a CASP authorisation, what exactly has to be audited?

The answer is less dramatic than most firms expect, and the consequences are larger. MiCA does not impose a new audit regime on crypto-asset service providers. What it does is give the accounts you were already required to file a second reader with a different purpose, and connect one of your continuing authorisation conditions directly to a number inside them.

Layer One: The Companies Law Baseline

A company registered in Cyprus must prepare annual financial statements, have them audited by a licensed audit firm, and file them with the Registrar of Companies alongside its tax return. This obligation attaches to the company, not to what the company does. Operating a crypto exchange, issuing a token, or running a custody business does not create the obligation and does not exempt you from it.

What being a digital-asset business changes is not whether you are audited but what the audit has to examine, and that is where crypto-native firms routinely miss deadlines. The obligation is ordinary; the evidence is not. An auditor testing a bank balance writes to the bank. An auditor testing a wallet balance has nobody to write to, and has to establish control of a private key instead. We have written separately about how that is actually done.

Only a firm licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus, may sign a statutory audit here. The register is public, and checking it before engaging anyone is five minutes well spent. On joint engagements we work with CYAUSE Audit Services, who hold the licence and sign the opinion, while we perform the on-chain examination behind the digital-asset balances.

Layer Two: Article 67 and the Fixed Overhead Test

This is the layer that surprises people, and it is the reason a CASP cannot treat its audit as a back-office formality.

Article 67 of Regulation (EU) 2023/1114 requires a CASP to hold prudential safeguards at least equal to the higher of two amounts: the permanent minimum capital set for its class of services, and one quarter of the fixed overheads of the preceding year, reviewed annually.

Read that second limb carefully. Your continuing authorisation condition is pegged to a figure derived from last year's cost base, and that figure has to come from somewhere defensible. In practice it comes from your audited financial statements, because that is the only version of your cost base that a third party has examined.

Three consequences follow, and all three are avoidable.

A growing firm's requirement rises behind it. If you scaled up headcount and infrastructure last year, the fixed overhead quarter computed on that year may exceed the class floor you have been comfortably clearing since authorisation. Firms that never recompute discover this when a supervisor does.

A late audit delays a compliance calculation, not just a filing. If the audited accounts are not finalised, the overhead figure supporting your current prudential position is unaudited. That is an uncomfortable position to explain, and it is the point at which an audit stalled on unverifiable crypto balances stops being an accounting problem.

Own funds must actually be own funds. Holding the required amount in the same account as operating cash, or in client-facing balances, is a common and entirely avoidable finding. The funds have to be identifiable as own funds, and you have to be able to show it.

Layer Three: Safeguarding and Segregation Evidence

Article 70 requires a CASP holding clients' crypto-assets, or the means of access to them, to make adequate arrangements to safeguard clients' ownership rights, particularly in the event of the provider's insolvency, and to prevent the use of clients' assets for its own account.

This is not an audit requirement and it is not satisfied by the annual audit. It is a continuing operational state, which means the question a supervisor asks is not whether you were segregated at the reporting date but whether you were segregated throughout. A single year-end snapshot answers the first question and not the second.

What holds up, in our experience, is a documented mapping of which addresses hold client assets and which hold the firm's own, verification of control over both sets, a reconciliation of on-chain client holdings to the internal client balance ledger at a regular cadence, and a record of exceptions and how they were resolved. Because the audit examines the same wallets and the same movements, the sensible arrangement is to build this once and let both obligations draw from it. Running them separately produces two descriptions of the same year that rarely agree in every detail, and explaining the difference is an expensive way to spend an inspection.

The timing is live. ESMA's Common Supervisory Action on CASPs' digital operational resilience in relation to custody activities runs from the second half of 2026 into the first half of 2027, and CySEC communicated it to Cyprus firms by circular in August 2026. Custody arrangements are the focus of supervisory attention right now.

What CySEC Reads in Your Audited Accounts

A supervisor does not read financial statements the way a shareholder does. The specific things a CASP's accounts are read for:

• The fixed overhead base feeding the Article 67 calculation, and whether the classification of costs as fixed is reasonable.
• Whether client assets appear on your balance sheet, and whether the accounting treatment is consistent with the segregation you claim operationally.
• The audit opinion itself. A qualification or a disclaimer over digital assets is a direct statement that your holdings could not be independently verified, which is awkward for a firm whose authorisation rests on safeguarding those holdings.
• Going concern. A CASP that cannot fund its own wind-down is a supervisory problem before it is a commercial one, which is why Article 74 requires a wind-down plan at all.
• Related party transactions, particularly any movement of assets between the firm, its owners and connected entities.

Asset-Referenced and E-Money Token Issuers

If you issue an asset-referenced token or an e-money token, there is a further layer. The reserve backing the token is subject to its own requirements on composition, custody and segregation from the issuer's assets, and it must be capable of meeting redemption at par.

Establishing that is a distinct exercise from the statutory audit: it examines whether the reserve exists, whether it is held where the issuer says and under the issuer's control, whether its composition matches the commitment in the whitepaper, and whether it covers tokens actually in circulation rather than tokens issued on paper. That work is proof of reserves and reserve of assets, and it typically runs on a far shorter cycle than an annual audit.

A Timeline for a Newly Authorised CASP

The first supervised year is the one where most of the avoidable problems are created, usually by treating the licence as the end of a project rather than the start of a cycle.

• On authorisation. Establish the wallet inventory separating client from own assets, and prove control of both sets while the people and keys are current.
• First quarter. Set the reconciliation cadence between on-chain client holdings and the client balance ledger. Monthly is defensible; annual is not.
• Before year-end. Reconcile the year to date, so the audit starts from tied records rather than a reconstruction project.
• At the reporting date. Capture balances at a recorded block height, with custodian confirmations requested in parallel.
• On signing the accounts. Recompute the Article 67 requirement against the newly audited fixed overheads, and document the result before anyone asks for it.

The Checklist

• Is your auditor ICPAC-licensed, and have you checked the register rather than taken it on trust?
• Can your auditor independently verify the digital-asset balances, or have they told you they cannot?
• Do you know your current Article 67 requirement, computed on the latest audited fixed overheads?
• Are own funds held separately and identifiably, rather than mixed with operating cash?
• Can you produce last quarter's client asset segregation evidence today, without rebuilding it?
• If you issue an ART or EMT, when was the reserve last examined by someone independent?

A firm that can answer all six has a supervisory conversation that is short. The gap between authorisation and the first real supervisory contact is the cheapest time to close them, and it is the window most firms spend on something else.

How Ondology Labs can help: Statutory audits for Cyprus CASPs run through statutory crypto audits with CYAUSE Audit Services, our ICPAC-licensed partner, who issue the opinion while we verify the chain behind it. Pre-authorisation gap work is MiCA readiness, the post-authorisation cycle is MiCA ongoing compliance, and reserve examinations are proof of reserves.

Related reading: MiCA obligations after authorisation · MiCA authorisation in Cyprus · Who needs a crypto audit in Cyprus