Crypto Audit Requirements in Cyprus

Key takeaways

Cyprus companies file audited financial statements under the Companies Law; holding crypto does not exempt you, it just makes the audit harder.
The evidence problem is specific: auditors must verify existence, ownership, valuation and completeness of assets no bank can confirm.
CASPs face a second layer: CySEC supervisory expectations under MiCA on safeguarding and own funds.
Since 1 January 2026, crypto activity has direct tax consequences in Cyprus: 15% corporate income tax and a flat 8% on crypto disposals under Article 20E.
Preparation, above all reconciliation of the chain to the ledger, decides whether an audit takes weeks or quarters.

The question we hear most from crypto businesses in Cyprus is some version of "do we actually need an audit?" The short answer is that if you operate through a Cyprus company, you almost certainly do, because Cyprus requires it of companies generally. The longer answer, the one that matters for planning, is about which layer of requirements applies to you and what evidence your auditor will need that a traditional client never has to think about.

The Baseline: Every Cyprus Company Is Audited

Under the Cyprus Companies Law (Cap. 113), companies prepare financial statements under IFRS and have them audited by a licensed statutory auditor. Audited accounts also underpin the corporate tax return. There is a narrow carve-out introduced in recent years allowing the smallest companies (net turnover up to EUR 200,000 and total gross assets up to EUR 500,000) to obtain a review engagement instead of a full audit, but a crypto business that custodies assets, trades, or raises outside capital will rarely sit inside it, and banks, investors and regulators generally expect the audit regardless.

In Cyprus, a statutory audit opinion can only be issued by an audit office licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus. That is why our own audit work is structured as a partnership: the statutory audits we deliver run with CYAUSE Audit Services Ltd, the ICPAC-licensed office that issues the opinion, while Ondology Labs produces the on-chain evidence the opinion rests on.

Why Crypto Makes the Audit Hard

Audit standards ask the same questions of every material asset: does it exist, does the company own and control it, is it valued correctly, and is the record complete? For a bank balance, one confirmation letter answers all four. For crypto there is no bank to write to, so each assertion needs its own evidence:

Existence: balances read directly from the chain at the reporting date, not from a screenshot of a wallet interface or an exchange dashboard.
Ownership and control: cryptographic proof that the company controls the claimed addresses, typically a signed message or a microtransaction from each wallet, covering the actual signing arrangements including multi-sig and custodial setups.
Valuation: a defensible fair value at the reporting date from documented price sources, with an accounting policy that deals with the awkward fact that IFRS treats most crypto holdings as intangible assets (IAS 38) or, for broker-traders, inventory (IAS 2).
Completeness: confidence that the wallets presented are all the wallets, which is where forensic techniques such as tracing flows out of known addresses earn their place in an audit file.

Most stalled crypto audits stall on the last point plus reconciliation: the on-chain activity does not agree with the accounting ledger, and nobody can explain the difference. That is a bookkeeping problem, not an audit problem, and it is fixable before the audit starts with transaction reconciliation.

Requirements by Entity Type

**Table:** Crypto assurance requirements in Cyprus by entity type, as at September 2026
Entity	What is required	Who demands it
Cyprus Ltd holding crypto (treasury, investments)	Statutory audit of the financial statements, with crypto-specific evidence over existence, control, valuation and completeness.	Companies Law; Tax Department (the return rests on audited accounts); banks and counterparties.
CASP authorised under MiCA	Statutory audit plus ongoing supervisory evidence: safeguarding and segregation of client assets, own-funds coverage, and records CySEC can test.	Companies Law; CySEC under MiCA.
Fund or fund manager with digital assets	Audited financial statements plus position verification the administrator and depositary can rely on at each reporting date.	Fund legislation and CySEC; administrators, depositaries and investors.
Exchange or custodian publishing proof of reserves	A reserves attestation: cryptographic wallet-control verification and a liability commitment customers can check. An attestation, not an audit.	Customers and the market; increasingly expected after the 2026 wave of exchange attestations.
Foreign company with a Cyprus subsidiary	The Cyprus entity is audited locally; group auditors typically need component evidence over any crypto it holds.	Companies Law; the group auditor.

The Tax Layer Nobody Should Ignore

From 1 January 2026, Cyprus taxes gains on the disposal of crypto-assets at a flat 8% under Article 20E of the Income Tax Law, for companies and individuals alike, while the corporate income tax rate rose to 15%. Both changes make the quality of your crypto records a tax matter, not just an audit matter: the 8% applies per disposal, which includes crypto-to-crypto exchanges, so a complete acquisition and disposal history is now the foundation of the return. The full picture, including DAC8 reporting on your users, is in our reference guide to crypto reporting obligations in Cyprus.

What the Audit Actually Involves

A crypto audit engagement in Cyprus typically runs in four stages. Scoping agrees the wallets, exchange accounts, chains and ledgers in scope, and surfaces the accounting-policy questions early. Evidence collection reads balances from the chain at the reporting date and verifies control of each address cryptographically. Reconciliation matches on-chain and exchange activity to the ledger and resolves the breaks. Reporting turns all of it into working papers a statutory auditor can rely on, or, in the full statutory engagement, into the audited financial statements themselves.

Timelines depend almost entirely on the state of the records. A business that reconciles monthly can be audit-ready in weeks. A business handing over three years of unreconciled DeFi activity should expect the preparation to take longer than the audit. Fees follow the same logic, which is why we scope fixed fees only after seeing the wallet count, chains and volumes involved.

If You Already Have an Auditor

Keep them. The most common engagement we run is crypto audit support: your incumbent auditor keeps the engagement and the opinion, and we deliver the specialist digital-asset procedures inside it, from wallet-control verification to reconciliation working papers. Audit firms engage us directly on the same basis for their own crypto clients. Independence rules are respected in both directions: we do not audit records we prepared, and we say so up front when a scoping conversation heads that way.

How to Prepare: The Short Checklist

Inventory every wallet and exchange account, including dormant ones; completeness questions start here.
Reconcile on-chain activity to your ledger monthly, not annually.
Document who can sign for each wallet and how keys are controlled.
Fix an accounting policy for classification and valuation before year-end, not during the audit.
Keep acquisition records: dates, amounts and cost basis now drive the Article 20E computation too.

How Ondology Labs can help: We deliver statutory crypto audits with CYAUSE Audit Services, our ICPAC-licensed audit partner, provide crypto audit support to incumbent auditors and their clients, and get records audit-ready through transaction reconciliation. Exchanges and custodians can add proof of reserves attestations. This page is general information, not audit, tax or legal advice for any specific situation.

Crypto Audit Requirements in Cyprus: Who Needs One and What It Involves