Crypto License in Cyprus

The legality of cryptocurrency business in Cyprus

After being in a gray zone for some time and tolerated for Alternative Investment Funds, cryptocurrency business has been made officially legal in Cyprus in 2021. With the passing of the Directive on the Register of Cryptoasset Service Providers by the Cyprus Securities Exchange Commission (CySEC), a new framework was created: the registration of Crypto Assets Service Providers (“CASP”).

Registering as a CASP is the sine qua non condition to conduct a crypto business in and from Cyprus. No foreign crypto company is allowed to provide its services to the residents of Cyprus without having registered to the CySEC as a Crypto Asset Service Provider.

“The Directive” describes the entirety of the CASP framework:

• Definition of which entities are liable to register as a CASP;
• The process and conditions to successfully register as a CASP;
• The organizational and operational requirements assessed by the CySEC;
• The charges and fees applied by the CySEC to applicants.

The legality of cryptocurrency business in Cyprus falls within the AML-CFT laws of the country. The Directive on the Register of CASP has been passed as a consolidation of the Law on the Prevention and Suppression of Money Laundering Activities.

Cryptocurrency regulation in Cyprus

The cryptocurrency regulation in Cyprus is a Directive, which entered the AML-CFT laws of the country. The legislation is enforced by the Cyprus Securities and Exchange Commission (CySEC). The Directive assesses what is a crypto asset service provider and what are its requirements.

This regulation is directed toward businesses, entities willing to provide services related to cryptocurrency. There is no regulation specific to crypto outside of the business applications of running crypto services. Virtual assets are not considered legal tender in Cyprus.

Cyprus Virtual Cryptocurrency Registry

The Cypriot legal framework for cryptocurrency companies explicitly states that crypto asset services providers must be registered to the CySEC in order to operate lawfully. Subsequently, the CySEC holds a virtual registry of cryptocurrency companies in Cyprus.

The registry is publicly available and divided into three parts: the active CASPs, the deregistered CASPs and the CASPs registered outside of Cyprus in the European Economic Area.

The register contains information about the company: its address, registration date and number, contact information and website URL. Each company has a dedicated page which lists the crypto activities it is authorized to perform, as well as the financial activities related to crypto.

Crypto-authorization process in the Cyprus Virtual Currency Registry

The crypto authorization process in Cyprus is straightforward. The CySEC has a lot of experience in supervising various financial activities. Therefore, when it set up the Cyprus virtual currency registry, it made use of its knowledge of managing regulated activities in order to provide a comprehensive framework.

In concrete terms, this means that the Cyprus crypto license is granted upon fulfilling a processing path that is very straightforward.

The registration of Cyprus Company in Register of crypto currency companies

Registering a company into the Cyprus register of crypto currency companies can be done either with a Cypriot company or with a licensed company registered in the European Economic Area.

The applicant must submit an application form with questionnaires and a set of documents required by the CySEC. This file must be sent by post in a physical way and a copy should be sent by email to the regulatory authorities.

The application is accompanied by the payment of a non-refundable application fee. The amount of the fee depends on the license’s Class chosen by the applicant. There are three classes, allowing for different levels of service provision.

In the case of a non-Cyprus company, they must be registered in a country of the European Economic Area and hold a crypto license in their country of registration. For example, if a crypto company based in Poland wants to provide services in Cyprus, it must register as a CASP by sending a notification to the CySEC.

Governmental Statements on Crypto in Cyprus

Cyprus is a world famous country for business in the financial sector, including fintechs and now crypto. The Mediterranean country has been increasingly betting on crypto, first by allowing crypto companies to operate unregulated until 2021. Then by creating the CASP framework, the Ministry of Finance gave the “keys” of the subject of crypto to the CySEC, a worldwide famous and reputed institution in the fintech industry.

Since then, the framework has evolved slightly in order to integrate new FATF recommendations pertaining to anti money laundering and countering the financing of terrorism.

Other topics are being discussed in the offices of Cyprus’ regulators and lawyers, regarding the future of the crypto framework. For example: the implementation of the travel rule, the future MiCA regulation and also the necessity to require EEA licensed companies to get a CASP license in order to provide their services to Cypriots.

These statements from governmental institutions show a maturation of the crypto industry in the Republic of Cyprus.

Requirements for companies engaged in crypto activities in Cyprus

The requirements for companies engaged in crypto activities in Cyprus are defined by the CySEC. They must be fulfilled before carrying out the application to the regulator.

The application itself must include all the information pertaining to the company requesting for a VASP license in Cyprus: corporate details such as the address and registration data, and a detailed description of the services to be provided.

The share capital of the company should be set depending on the Class license it is applying for:

• Class 1: 50.000 EUR
• Class 2: 125.000 EUR
• Class 3: 150.000 EUR

The personnel of the company will be examined by the regulatory authorities. They must demonstrate good reputation, sufficient knowledge, skills and experience, and provide a clear criminal record. The board of directors should consist of at least four different individuals, two of which being responsible for managing the activities of the CASP.

The crypto project must be fully compliant with the CASP rules and the AML-CFT laws of Cyprus. In addition to all the policies and procedures, the CySEC expects applicants to redact an Internal Operations Manual to summarize all the good practices (including in terms of recruitment of fit & proper personnel, for example).

Additionally, a senior executive manager must be appointed as a Money Laundering Reporting Officer, whose role is to monitor client activity and report any suspicious operation to the CySEC.

The crypto company in Cyprus must disclose its crypto addresses, the virtual assets it will include in its services and activities, the profits of its clients, if it intends to offer payment services in crypto assets, etc.

The applicant must demonstrate that it has set sound administrative and accounting procedures, internal controls, risk management and record keeping.

The CySEC also expects to see a business continuity plan and a recovery plan.

Once everything is ready to be sent to the CySEC, the crypto startup must pay a non-refundable application fee of 10.000 EUR. This fee also includes the annual fee for the first year of operation.

The process of setting up a company for a cryptocurrency business in Cyprus

Cyprus is a famous business-friendly country. Incorporating a company in Cyprus is simple, thanks to a dynamic environment. Cyprus is very popular among startups, FinTechs and law firms.

Setting up a company for a cryptocurrency business in Cyprus, before the license application, takes 1-2 business weeks only. The company registration can be done online by providing documents pertaining to the beneficial owners of the company.

It should also be disclosed from the incorporation stage that the company is aiming to perform cryptocurrency related activities, as the company register requires indicating the business object of the newly registered company.

Taxation for cryptocurrency companies in Cyprus

In Cyprus, cryptocurrency is considered tax-wise as an usual trade. Therefore, the taxation of cryptocurrency companies in Cyprus is the same as for any other line of business.

The taxation system of Cyprus is very simple: all companies are liable to pay a tax of 12,5% of their corporate profits. Trading and investing in cryptocurrency is equally taxed as income, with the same rate of 12,5%.

Obligations for crypto companies in Cyprus

A crypto licensed company in Cyprus has obligations to follow at all times.

The crypto company shall maintain a deposited share capital the highest of the initial share capital during application or 25% of the company’s fixed costs of the previous year of operation (from the second year).

An annual license renewal fee shall be paid every year. The fee is 5.000 EUR.

Assessments on the company operations and activities shall be conducted on a regular basis, including but not limited to:

• Making sure that the employees’ incentives are not generating a conflict of interest with the clients’ interests;
• Annual risk assessment and risk matrixes of all possible risks for the company;
• Monitoring and evaluation of the adequacy and effectiveness of the AML-CFT policies and procedures, in addition to full compliance with the law;
• Hold clear and readily available records of the company activities and business relationships.

Sanctions for violating Cyprus crypto-business obligations

The CySEC is competent to punish violators of the Cyprus crypto business obligations. Different sorts of sanctions are planned by the law, depending on the nature of the offense.

The supervisory authority will also consider different elements before pronouncing the sanction:

• The gravity and the duration of the breach;
• The degree of responsibility of the natural or legal person held responsible;
• The financial situation of the company and/or responsible person;
• The unlawful benefit derived from the violation;
• The losses or damages caused by the violation;
• If the responsible of the violation does cooperate with the supervisory authority;
• If the responsible of the violation did commit offenses in the past.

Subsequently, there may be administrative sanctions such as:

• Fines of up to 1 million EUR or twice the benefit derived from the violation;
• Additional fines for each additional day before the stopping of the violation;
• Amendment, suspension or withdrawal of the crypto license of the company;
• Temporary ban against the responsible individual or individuals.

The company will also be required to make a public statement to disclose their wrongdoings and to take measures against the persons responsible for the breach.