MiCA compliance in Cyprus and across the EU

MiCA is the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), the EU's single rulebook for crypto-asset markets. It has applied in full since 30 December 2024. Firms providing crypto-asset services to EU clients must be authorised as Crypto-Asset Service Providers (CASPs) in one member state, after which they can passport their services across all 27. The authorisation bar is high: governance, capital adequacy, operational resilience, segregation and safeguarding of client assets, complaints handling, and record-keeping are all tested, and the obligations continue for as long as the licence does. Stablecoin issuers face separate, stricter titles covering e-money tokens and asset-referenced tokens.

Yes, for practical purposes. MiCA let each member state set its own grandfathering window under Article 143(3), which is why deadlines varied: the Netherlands, Finland, and Hungary ended theirs in mid 2025, Germany, Ireland, and Lithuania in December 2025, and the longest windows, in France, Italy, Luxembourg, Czechia, and Spain, closed on 1 July 2026. As of today there is no member state where a firm can rely on a pre-MiCA national registration to serve clients. A firm without CASP authorisation serving EU clients is operating outside the regime, and grandfathering rights were always national, so they never covered passporting into other states anyway.

The Cyprus Securities and Exchange Commission (CySEC) authorises and supervises CASPs in Cyprus. An application stands or falls on whether the firm can demonstrate what its policies claim: that client assets are actually segregated and safeguarded, that governance and capital meet the requirements, that systems are resilient, and that records are complete and retrievable. Supervision after authorisation runs on the same logic. Our role is the demonstrable part: we verify wallet control, document segregation on-chain, attest reserves, and reconcile records, so the operational claims in an application or a supervisory response are backed by evidence rather than assertion.

Yes. Enforcement has started. The first published MiCA fine came on 14 August 2026, when Austria's Financial Market Authority penalised Bitpanda EUR 70,000 for late white paper filing, premature marketing, and missing disclaimers. The amount is small; the signal is not. Supervisors have moved from onboarding the industry to testing it, and the early cases show they are willing to act on procedural failures, not just on collapses. Firms whose compliance exists mainly in policy documents should assume the gap between paper and practice is now the thing being examined.

The recurring themes are custody and client asset protection: proof that the firm controls the wallets it claims to control, that client assets are segregated from the firm's own, that reserves cover what is owed to clients, and that the books agree with the chain. These are exactly the questions an on-chain verification answers well and a policy document answers badly. A firm that can produce a cryptographic wallet-control verification, a current reserve attestation, and a reconciliation of ledger to chain is in a different conversation with its supervisor than a firm that needs weeks to assemble the same picture.

We are not a law firm, and this service is deliberately drawn to stop where legal advice starts. The authorisation application, the legal interpretation of MiCA, and regulatory strategy belong to your legal counsel, and we work alongside whoever that is. What we own is the evidence layer: the gap assessment on the operational side, cryptographic verification of custody claims, reserve attestations, and records reconciled to the chain. In practice counsel drafts the application and we make sure the operational statements in it are true and demonstrable, which is the part applications most often stumble on.

They are three regimes drawing on one data foundation. MiCA governs your authorisation and conduct as a CASP, AML law makes you an obliged entity whose controls get audited, and DAC8 makes you a tax reporting entity from January 2026. All three ultimately test whether your records agree with the chain. We build that foundation once: reconciled transactions, verified wallet control, documented client asset segregation. The same dataset then serves the MiCA evidence pack, the AML compliance audit, and the DAC8 crypto report, which is materially cheaper than treating them as three unrelated projects.

Partly, and we are precise about which part. MiCA's e-money token and asset-referenced token titles impose reserve, redemption, and disclosure obligations on issuers, and the reserve side is squarely our work: independent attestation that the reserve exists, is controlled, and covers the tokens in circulation. The legal structuring of an EMT or ART, and the overlap with payment services law where token flows resemble payment processing, are questions for your counsel. If you need both, we slot into the counsel-led engagement as the party that proves the reserve numbers.

If you serve EU-resident clients, assume yes. MiCA allows a narrow reverse solicitation exemption, where a client approaches the firm entirely on their own initiative, and EU supervisors have made clear they read it narrowly: marketing into the EU in any form defeats it. A non-EU platform with a real EU client base needs a CASP authorisation in a member state, and the same platform is very likely also a reporting crypto-asset operator under DAC8. We scope both questions honestly at the start, with your counsel on the legal perimeter, and tell you if the answer is that you are outside the regime.

It depends almost entirely on the state of your records and custody arrangements, which is why the engagement starts with scoping rather than a quote. A firm with clean books, documented wallet control, and existing reconciliation discipline can assemble an evidence pack in weeks. A firm whose client asset segregation exists in spirit but not on-chain, or whose ledger has never been tied to chain activity, is looking at a remediation project first, and the honest sequencing is to fix the foundation before asserting anything to a supervisor. The gap assessment gives you that timeline with reasons, not a number invented to win the work.