Digital asset regulation and tokenization in Cyprus

In Cyprus, a project safeguarding or transferring tokens may need to examine both crypto-asset and payment rules. The Cyprus Securities and Exchange Commission, CySEC, and the Central Bank of Cyprus, CBC, act according to the functions performed.

That distinction is particularly important for electronic money tokens, or EMTs. This guide follows asset classification through permissions, custody and project preparation, while distinguishing tokenized securities and their infrastructure.

Which assets and services fall within MiCA

MiCA governs crypto-assets and services within its perimeter. Cyprus did not adopt a specific MiCA implementing law: CySEC and the Central Bank of Cyprus were designated as competent authorities by a notification of the Minister of Finance (Κ.Δ.Π. 199/2025, Official Gazette of July 4, 2025), issued under the laws governing both supervisors and published only in Greek. CySEC also maintains a MiCAR entity register, separate from the former national register. The legal classification of the token and the function actually performed determine the requirements. Incorporating a Cypriot company or holding a historical registration is not enough to establish current authorization.

CySEC set February 27, 2026, as the deadline for providers under the national regime to submit their MiCA application and required an orderly wind-down plan from those that did not. It had earlier applied the transitional conditions of Article 143(3) of MiCA in its Circular C674 of December 30, 2024. Its July Circular C790 confirms that this regime ended on July 1, 2026. The application deadline and the cut-off for continued operation serve different purposes: a pending application must not be presented as an indefinite permission to operate or as an EU passport.

When CySEC and the Central Bank are involved

CySEC handles CASP authorizations within its remit. The Central Bank of Cyprus, CBC, explains that certain electronic money token operations may constitute payment services: transfers on behalf of clients and custody or administration within the specified conditions. Firms must assess actual operations, including account functionality and relationships with third parties.

CySEC Circular C756 refers to this assessment and potential CBC payment authorization unless admissible arrangements are made with an authorized payment service provider. MiCA authorization does not automatically replace PSD2. Firms providing cross-border payment services should check the corresponding notifications alongside any applicable MiCA passport procedure.

Which permissions EMT services need

CASP applications must define services, resources, governance, shareholders, controls and operating policies under MiCA. Permission belongs to a particular entity and specified activities. Membership in a group licensed elsewhere does not transfer authorization to every company, brand or commercially deployed platform.

For EMT services, updated CBC guidance distinguishes already authorized operators, pending applicants meeting conditions and entities required to cease affected activities. Conditional continuity for certain applicants excludes new customer acquisition and marketing of those services. The regime should not be reduced to universal cessation of all operations on March 2, 2026, or automatic extension.

What tokenized securities infrastructure requires

CySEC Policy Statement PS-02-2025 confirms a DLT pilot infrastructure procedure for eligible existing operators and new entrants. Specific permission supplements relevant sectoral authorization. Published forms and criteria establish an administrative route, not authorization for every platform or issuance or removal of infrastructure conditions.

Tokenized financial instruments retain securities regulation. Issuance, investment services and market operation must be distinguished: issuing an instrument does not automatically make its issuer an investment firm. The DLT framework does not replace assessment of entitlement, transferability and liability. Documentation must connect technology positions to enforceable rights and address insolvency consequences.

How to manage custody and client migrations

Circular C790 relays an advisory note from the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) on the risks arising from provider exits and customer migration. Receiving CASPs should assess risks on an individual basis and maintain sufficient control capacity. The approach neither endorses indiscriminate rejection solely because customers came from a former provider nor permits acceptance without reviewing information and activity patterns.

August 2026 Circular C794 communicates EU supervisory action on digital resilience in custody. This requires coordination of DORA, asset protection and third-party oversight. The Transfer of Funds Regulation adds originator and beneficiary information within its scope, which must be integrated with due diligence and record-keeping. For tax purposes, Law 38(I)/2026, which transposes the EU directive on administrative cooperation applicable to crypto-assets (DAC8) with effect from January 1, 2026, requires providers to identify their clients' tax residence and report their transactions to the tax authority. The first return, covering 2026, must be filed by June 30, 2027, at the latest.

How to prepare a project in Cyprus

Before applying, map asset and money movements: who holds keys, receives instructions and enables payments or transfers of EMTs for clients. That description supports assessment by CySEC and, where relevant, CBC.

Next, identify each entity’s permissions, cross-border notifications and payment or custody provider contracts. Securities infrastructure needs its own DLT pilot assessment. Technical design should address asset recovery, reconciliation and incident response in line with each participant’s responsibilities.

To understand how this framework applies to your project, discuss your case with our team.