MiCA Authorisation in Cyprus: The Guide

Key takeaways

Since 1 July 2026, providing crypto-asset services from Cyprus without MiCA authorisation is unauthorised activity; the transitional period is over.
CySEC is the competent authority. New applications remain open; the February 2026 deadline applied to firms relying on the transitional regime.
Minimum capital depends on your service class: EUR 50,000, 125,000 or 150,000, and own funds must also cover a quarter of last year's fixed overheads if that is higher.
The hardest parts of the file are evidence, not paperwork: safeguarding of client assets, management body suitability, and shareholder source of wealth.
One Cyprus authorisation passports the services across the entire EU on notification.

MiCA, the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), replaced the patchwork of national crypto registrations with a single authorisation that works across the Union. For Cyprus that transition is complete: the Article 143(3) transitional period ended on 1 July 2026, and a firm providing crypto-asset services from Cyprus today either holds a CASP authorisation, has an application under assessment after applying in time, or is operating unlawfully.

This guide walks through the authorisation as it actually runs in Cyprus: who needs it, what it costs in capital, what goes in the file, how long it takes, and what changes after the licence arrives. It is written for founders and compliance officers planning an application, and it is deliberately blunt about the parts applicants underestimate. It is not legal advice, and a real application should be prepared with counsel; our role in these projects is the evidence layer, which we describe at the end.

Who Needs CASP Authorisation

Authorisation is required for providing any of the ten crypto-asset services in MiCA Article 3 to clients in the EU as a business: custody and administration of crypto-assets; operating a trading platform; exchanging crypto for funds or for other crypto-assets; executing orders; placing crypto-assets; reception and transmission of orders; advice; portfolio management; and transfer services. If your revenue model touches client crypto in any of those ways, assume you are in scope and work backwards from there.

Two groups regularly get this wrong. Pure software providers whose users self-custody generally fall outside the services list, but the analysis turns on facts, not on what the marketing page says. And non-EU firms serving EU clients cannot rely on reverse solicitation beyond its genuinely narrow meaning: a client who found you through your own promotion was solicited.

Capital: What Each Class Requires

MiCA Article 67 sets prudential safeguards as the higher of a permanent minimum and a quarter of the preceding year's fixed overheads. The permanent minimum depends on the class of services (Annex IV):

**Table:** MiCA minimum capital by CASP service class (Annex IV)
Class	Services covered	Minimum capital
Class 1	Execution of orders, placing, reception and transmission, advice, portfolio management, transfer services	EUR 50,000
Class 2	Any Class 1 service plus custody and administration, exchange of crypto-assets for funds or other crypto-assets	EUR 125,000
Class 3	Any Class 2 service plus operating a trading platform	EUR 150,000

Treat the minimum as a floor, not a plan. The fixed-overheads test binds as soon as the business has any real cost base, and CySEC expects the programme of operations to show capital adequacy on projected, not just current, numbers.

What Goes in the Application

The Article 62 application is a business file, not a form. In practice the Cyprus file breaks into five blocks:

The business: programme of operations, service classes, target clients, three-year financials, and the fee model.
The people: management body suitability under Article 68 against the joint EBA and ESMA guidelines, covering competence, reputation, time commitment and collective knowledge, plus identity and source-of-wealth evidence for every qualifying shareholder (10% or more).
The controls: governance arrangements, AML/CFT framework, complaints handling, conflicts, outsourcing, and ICT risk management aligned with DORA.
The assets: custody policy and proof that clients' crypto-assets and funds are segregated from the firm's own, the single area where supervisors most want evidence rather than narrative.
The exit: a wind-down plan showing client assets can be returned in an orderly failure.

The blocks that stall applications are the evidence-heavy ones: suitability, source of wealth, and safeguarding. A policy saying client assets are segregated is an assertion; wallet architecture plus on-chain proof that client and proprietary assets never commingle is evidence. That distinction is most of the difference between a smooth review and a long one, and it is the core of our MiCA readiness service.

Process and Timeline in Cyprus

Applications go to CySEC as the Cyprus competent authority. MiCA gives the authority 25 working days to confirm the file is complete and then 40 working days to assess it, but the clock stops whenever questions go back to the applicant, and questions always go back. Realistic planning for a well-prepared file is measured in months, with the applicant's own response speed the biggest variable. Incomplete safeguarding evidence and unresolved suitability questions are the classic clock-stoppers.

Firms that applied by CySEC's 27 February 2026 cut-off under the transitional regime and are still under assessment should treat supervisory correspondence as the priority queue it is. Everyone else applying fresh should assume full scrutiny with no transitional goodwill.

Passporting: Cyprus as the EU Entry Point

A Cyprus CASP authorisation is an EU authorisation. Under Article 65, expanding into other member states is a notification, not a new licence: the firm informs CySEC of the states and services, the information is transmitted to the host authorities, and the firm can provide services cross-border shortly after. For groups choosing a base, that makes the real comparison between member states one of supervisory quality, ecosystem and tax, and Cyprus scores on all three for digital-asset businesses, including the 15% corporate rate and the professional infrastructure that has grown around CySEC-regulated firms. Greece, notably, becomes a notification away.

After Authorisation: The Part Everyone Underestimates

The licence starts obligations rather than ending them: ongoing own-funds coverage, safeguarding that holds every day rather than on application day, incident and complaints records, and supervisory reporting to CySEC. Cyprus has already shown enforcement appetite across the EU's new framework, and the first MiCA fines elsewhere in Europe landed in 2026. The firms that find supervision easy are the ones whose evidence cycle runs continuously: reconciliation, reserve attestation, and segregation proof produced on a cadence rather than reconstructed on demand. That ongoing cycle, not the application, is where most of our MiCA work happens.

MiCA Readiness Checklist

Run this before engaging anyone, including us. It maps the file blocks above to yes/no questions:

Have you fixed the exact service classes you need, and sized capital against both the Annex IV minimum and a quarter of fixed overheads?
Can every management body member evidence competence, reputation and time commitment against the EBA/ESMA suitability guidelines?
Can every 10%+ shareholder document source of wealth, including any crypto-origin wealth with an on-chain trail?
Does your wallet architecture separate client from proprietary assets, and can you prove it on-chain today?
Do your books reconcile to the chain at month-end without manual heroics?
Is there a written wind-down plan that returns client assets in an orderly failure?
Are AML/CFT, complaints, outsourcing and ICT (DORA) frameworks written AND operating, with records to show it?
Do you have counsel for the legal drafting and an evidence partner for the on-chain proof?

Anything answered "no" is application work. Anything answered "yes, but we could not show it quickly" is also application work.

How Ondology Labs can help: We are the evidence layer of a MiCA application, working alongside your legal counsel: gap assessments against the CASP obligations, cryptographic wallet-control verification, on-chain proof of client asset segregation, reserve attestations, Article 68 suitability assessments and shareholder source-of-wealth evidence, plus the ongoing supervisory evidence cycle after authorisation. We are not a law firm and this guide is not legal advice.

MiCA Authorisation in Cyprus: The Complete Guide