What a Cyprus CASP licence actually means.

1 · What it takes to operate

The legal standard is MiCA Title V: the home Member State — here Cyprus, through CySEC — authorises per service, and the licence names exactly which of the ten crypto-asset services the firm may provide (Art. 59–63). What this means in practice for a Cyprus filing:

The clock (Art. 62–63): CySEC acknowledges receipt within 5 working days, assesses completeness within 25 working days, and decides within 40 working days of a complete file — the clock stops while answers are awaited. Statutory time is a floor, not a promise: a well-prepared Cypriot application is commonly reported at four to six months end-to-end, and the observed range depends on how complete the file is on first submission. We do not publish a single “typical” number because CySEC publishes no completion statistics; treat claims of guaranteed speed with caution.

Financial entities (Art. 60): a credit institution, investment firm, e-money institution or other listed financial entity already authorised in Cyprus can notify instead of applying afresh — a separate route with its own fee and a 40-working-day advance-notice period, keeping its existing own-funds regime rather than taking a MiCA one.

2 · What it costs

Cyprus is the only EU jurisdiction whose entire CASP charge schedule is fixed by an official instrument — CySEC Directive DI 73-2009-04 (Markets in Crypto-Assets, Charges and Fees, 2024) — with a separate row for each service. The application charge and the annual fee add up per service, so the licence scope decides the price. Figures below are from the directive as published; verify the current instrument before relying on them.

Turnover surcharge: on top of the annual fixed component, once crypto-service turnover exceeds €500,000: 1% from €500k to €1m; 0.4% from €1m to €5m; 0.3% from €5m to €10m; 0.1% above €10m — total annual fee capped at €500,000, payable within four months of the financial year-end (two months where operations cease), pro-rated for a part-year, and computed from audited statements that show crypto turnover separately. An Article 60 notification carries its own one-off charge of €10,000.

Two details that matter: an unpaid application charge means the application is treated as not submitted — the clock never starts; and the statutory fee is not the full cost. Budget realistically for professional work — legal and compliance advice, the AML programme, audit and reporting setup — which is not fixed by any regulator and is quoted per engagement. This page does not publish estimates for those because they are market prices, not rules; get them in writing before committing.

3 · What it gives you competitively

One authorisation, the whole Union (Art. 65): once authorised in Cyprus, a CASP notifies the Member States where it intends to provide services; cross-border provision may begin after the file is communicated, at the latest 15 calendar days after submitting the notification. A Cypriot licence passports to the EEA, and the passported countries appear in the register data.

Cyprus’ position in the field: Cyprus chose the full 18-month transitional window under Art. 143(3), and CySEC moved the legacy national-register firms onto MiCA authorisation (with a 27 February 2026 filing deadline for existing national-register CASPs). The live CySEC register and the MiCA Radar show the resulting field and its authorisation dates — check both, because the register changes weekly.

Tax framing is separate: the licence itself carries no tax advantage — a Cypriot CASP is an ordinary Cyprus company and faces the normal corporate tax and reporting regime. Treating “licence plus tax structure” as one decision is where jurisdictions get compared on something other than MiCA fees; that comparison belongs in a jurisdiction analysis, not in this guide.

The honest caveat: passporting is in the statute; the commercial reality of serving clients in another Member State includes local AML expectations, marketing rules and the possibility of host-state attention (Art. 65–66). A licence is market access, not market.

4 · What keeps the licence alive

Authorisation is a standing obligation, not an event. The continuing compliance load for a Cyprus CASP, from the fee instrument and MiCA:

The transitional footnote: the Art. 143(3) grandfathering window closed on 1 July 2026. A national-registration-era firm without a MiCA authorisation (or an accepted Art. 60 route) has no grandfathered right to keep operating — a pending application is not permission. ESMA separately lists non-compliant entities reported by NCAs; the Radar reproduces that list with its source date.