# Digital asset regulation and tokenization in Cyprus

> **Is crypto legal in Cyprus?** Yes. Businesses have regulated routes to operate with crypto-assets, under predictable rules. CySEC publishes MiCA entities and documentation. In the Metlabs Regulatory Index it scores 89/100 and ranks 22 of 76 countries assessed (assessed October 3, 2026).

- **Author:** Javier Yáñez López, Legal & Regulatory at Metlabs
- **Last reviewed:** 2026-10-15
- **Latest regulatory change:** 2026-07-01
- **Metlabs Regulatory Index:** 89/100, rank 22 of 76 countries assessed
- **Web version:** https://metlabs.io/en/blockchain-regulation/cyprus/

Cyprus has a MiCA CASP regime supervised by CySEC and a specific procedure for DLT securities infrastructure. The former national register ceased to support continuity in July 2026. EMT custody and transfer may additionally require payment services entitlement from the Central Bank of Cyprus or a valid arrangement with an authorized provider.

In Cyprus, a project safeguarding or transferring tokens may need to examine both crypto-asset and payment rules. The Cyprus Securities and Exchange Commission, CySEC, and the Central Bank of Cyprus, CBC, act according to the functions performed.

That distinction is particularly important for electronic money tokens, or EMTs. This guide follows asset classification through permissions, custody and project preparation, while distinguishing tokenized securities and their infrastructure.

## Which assets and services fall within MiCA

[MiCA](https://eur-lex.europa.eu/eli/reg/2023/1114/oj) governs crypto-assets and services within its perimeter. Cyprus did not adopt a specific MiCA implementing law: CySEC and the Central Bank of Cyprus were designated as competent authorities by a [notification of the Minister of Finance (Κ.Δ.Π. 199/2025, Official Gazette of July 4, 2025)](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=2756929c-a612-4820-b9df-490525e42e9b), issued under the laws governing both supervisors and published only in Greek. CySEC also maintains a [MiCAR entity register](https://www.cysec.gov.cy/en-GB/entities/Crypto-Assets-Entities-%28MiCAR%29/MiCAR-CASPs/), separate from the former national register. The legal classification of the token and the function actually performed determine the requirements. Incorporating a Cypriot company or holding a historical registration is not enough to establish current authorization.

CySEC set [February 27, 2026, as the deadline for providers under the national regime to submit their MiCA application](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3c2571bc-1e2f-4537-b139-bc6bdc375719) and required an orderly wind-down plan from those that did not. It had earlier applied the transitional conditions of Article 143(3) of MiCA in its [Circular C674 of December 30, 2024](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=101f6018-4cb6-40f0-97c0-321a2e6f56af). Its [July Circular C790](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=e26d5753-bab0-427b-84aa-f0223ce26935) confirms that this regime ended on July 1, 2026. The application deadline and the cut-off for continued operation serve different purposes: a pending application must not be presented as an indefinite permission to operate or as an EU passport.

## When CySEC and the Central Bank are involved

CySEC handles CASP authorizations within its remit. The [Central Bank of Cyprus, CBC](https://www.centralbank.cy/en/licensing-supervision/payment-institutions-and-electronic-money-institutions/licensing/application-submission-and-assessment-stage/licensing-of-crypto-asset-service-providers-casps-for-limited-service), explains that certain electronic money token operations may constitute payment services: transfers on behalf of clients and custody or administration within the specified conditions. Firms must assess actual operations, including account functionality and relationships with third parties.

[CySEC Circular C756](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=339f1b65-098e-4f4c-b80e-a395946d65a4) refers to this assessment and potential CBC payment authorization unless admissible arrangements are made with an authorized payment service provider. MiCA authorization does not automatically replace PSD2. Firms providing cross-border payment services should check the corresponding notifications alongside any applicable MiCA passport procedure.

## Which permissions EMT services need

CASP applications must define services, resources, governance, shareholders, controls and operating policies under [MiCA](https://eur-lex.europa.eu/eli/reg/2023/1114/oj). Permission belongs to a particular entity and specified activities. Membership in a group licensed elsewhere does not transfer authorization to every company, brand or commercially deployed platform.

For EMT services, [updated CBC guidance](https://www.centralbank.cy/en/licensing-supervision/payment-institutions-and-electronic-money-institutions/licensing/application-submission-and-assessment-stage/licensing-of-crypto-asset-service-providers-casps-for-limited-service) distinguishes already authorized operators, pending applicants meeting conditions and entities required to cease affected activities. Conditional continuity for certain applicants excludes new customer acquisition and marketing of those services. The regime should not be reduced to universal cessation of all operations on March 2, 2026, or automatic extension.

## What tokenized securities infrastructure requires

[CySEC Policy Statement PS-02-2025](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=b029a56d-632c-433e-ad16-c93dda3553b1) confirms a DLT pilot infrastructure procedure for eligible existing operators and new entrants. Specific permission supplements relevant sectoral authorization. Published forms and criteria establish an administrative route, not authorization for every platform or issuance or removal of infrastructure conditions.

Tokenized financial instruments retain securities regulation. Issuance, investment services and market operation must be distinguished: issuing an instrument does not automatically make its issuer an investment firm. The [DLT framework](https://eur-lex.europa.eu/eli/reg/2022/858/oj) does not replace assessment of entitlement, transferability and liability. Documentation must connect technology positions to enforceable rights and address insolvency consequences.

## How to manage custody and client migrations

[Circular C790](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=e26d5753-bab0-427b-84aa-f0223ce26935) relays an advisory note from the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) on the risks arising from provider exits and customer migration. Receiving CASPs should assess risks on an individual basis and maintain sufficient control capacity. The approach neither endorses indiscriminate rejection solely because customers came from a former provider nor permits acceptance without reviewing information and activity patterns.

[August 2026 Circular C794](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=4a3d6895-e493-49d1-91c6-349577f609e2) communicates EU supervisory action on digital resilience in custody. This requires coordination of [DORA](https://eur-lex.europa.eu/eli/reg/2022/2554/oj), asset protection and third-party oversight. The [Transfer of Funds Regulation](https://eur-lex.europa.eu/eli/reg/2023/1113/oj) adds originator and beneficiary information within its scope, which must be integrated with due diligence and record-keeping. For tax purposes, [Law 38(I)/2026](https://www.cylaw.org/nomoi/arith/2026_1_038.pdf), which transposes the EU directive on administrative cooperation applicable to crypto-assets (DAC8) with effect from January 1, 2026, requires providers to identify their clients' tax residence and report their transactions to the tax authority. The first return, covering 2026, must be filed by June 30, 2027, at the latest.

## How to prepare a project in Cyprus

Before applying, map asset and money movements: who holds keys, receives instructions and enables payments or transfers of EMTs for clients. That description supports assessment by CySEC and, where relevant, CBC.

Next, identify each entity’s permissions, cross-border notifications and payment or custody provider contracts. Securities infrastructure needs its own DLT pilot assessment. Technical design should address asset recovery, reconciliation and incident response in line with each participant’s responsibilities.

## Key takeaways

- Historical national registration does not replace MiCA authorization after July 2026; the application deadline was February 27, 2026.
- Certain EMT services require PSD2 assessment alongside MiCA.
- The DLT pilot requires specific permission alongside relevant sectoral authorization.
- Issuing a financial instrument token does not automatically constitute investment services.

## Regulatory milestones

- **2025-06-18** — Domestic DLT pilot policy. CySEC issues PS-02-2025 on specific permissions and their relationship with sectoral authorization. (source: [CySEC · DLT policy](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=b029a56d-632c-433e-ad16-c93dda3553b1))
- **2026-02-16** — Circular on EMT and payment services. C756 refers to CBC requirements for certain payment services. (source: [CySEC · Circular C756](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=339f1b65-098e-4f4c-b80e-a395946d65a4))
- **2026-02-27** — Application deadline. CySEC requires providers under the national regime to submit their MiCA application by that date; those that do not must submit a wind-down plan and may not provide services after July 1. (source: [CySEC · Transitional deadline](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3c2571bc-1e2f-4537-b139-bc6bdc375719))
- **2026-07-01** — Transitional regime ends. The former registration does not, by itself, permit continued operation. CySEC confirms this in C790 and, in an announcement of July 10, reminds investors that since July 1 crypto-asset services may only be provided in accordance with MiCA and invites them to check in the ESMA register whether their provider is authorized. (source: [CySEC · Circular C790](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=e26d5753-bab0-427b-84aa-f0223ce26935), [CySEC · Transitional deadline](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3c2571bc-1e2f-4537-b139-bc6bdc375719), [CySEC · Announcement on the end of the MiCA transitional period](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=ce7a7e74-51f8-42fd-b538-ef657d359792))
- **2026-08-06** — Custody resilience supervision. C794 communicates EU supervisory action on the digital resilience of CASPs providing custody. (source: [CySEC · Circular C794](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=4a3d6895-e493-49d1-91c6-349577f609e2))

## Frequently asked questions

### Does MiCA authorization cover every EMT operation?

No. CBC requires assessment of whether custody or transfer constitutes payment services. Payment authorization or an admissible arrangement with an authorized provider may be needed, with separate conditions and notifications.

### What permission does DLT pilot infrastructure require?

Specific pilot permission supplements the relevant sectoral entitlement. CASP authorization alone is insufficient; exemptions depend on infrastructure type, eligible instruments and permission conditions.

### Does applying for payment authorization allow new EMT clients?

The CBC makes continuity for certain applicants conditional on stopping marketing and onboarding for the affected EMT services. The relevant scenario’s conditions must be met. CBC · EMT and PSD2 services.

### Does former Cypriot registration equal a MiCA passport?

No. The application deadline and transition’s end were separate milestones; continuation after July 1, 2026, requires the relevant entitlement. CySEC · Transitional deadline.

### What does the 2026 custody supervisory exercise examine?

Circular C794 covers governance, key management, transaction controls, incidents, smart contracts and third-party dependencies. It concerns a sample of authorized custodians. CySEC · Circular C794.

## How to cite this guide

Yáñez López, J. (2026, October 15). Digital asset regulation and tokenization in Cyprus. Metlabs. https://metlabs.io/en/blockchain-regulation/cyprus/