Cyprus Gaming License 2026: NBA Betting License Requirements, Costs and Process

The Two Regulators: NBA vs. CGCSC

NBA vs. CGCSC Cyprus has two distinct gambling regulatory bodies with non-overlapping mandates. Understanding the division is the starting point for any licensing strategy. The National Betting Authority governs all sports and other events betting activity in Cyprus, both land-based and online, under the 2019 Betting Law and its amendments. The NBA issues Class A and Class B bookmaker’s licenses, maintains the national blacklist of unauthorised operators (notifying internet service providers to implement a blocking system), and conducts technical audits of computerised systems. This page addresses the NBA track exclusively. The Cyprus Gaming and Casino Supervision Commission (CGCSC) governs physical casino operations, currently limited to the City of Dreams Mediterranean casino resort. CGCSC licensing is not open to online casino operators and is not a route to online iGaming authorisation.

Legal Basis: Betting Law 37(I)/2019 and Supporting Frameworks

The primary legal instrument is the 2019 Betting Law, which governs who may apply, what activities are permitted, how applications are assessed, and what conditions apply to licensed operators. Supporting frameworks include the Companies Law Cap. 113 (governing the Cyprus corporate structure required for applicants), the Law on Prevention and Suppression of Money Laundering Activities 188(I)/2007 as amended (aligning Cyprus with FATF standards and EU AML directives), and GDPR and the Law on Processing of Personal Data (Protection of the Individual) (governing player data processing and documentation requirements). The NBA holds statutory power to publish and update a blacklisted sites list and notify internet service providers covering operators without authorisation or in breach of license conditions. Active enforcement against the blacklist signals that Cyprus is not a passive licensing jurisdiction. 

Class A vs. Class B Licenses: Scope, Restrictions and Key Differences

Both license classes require NBA authorisation. Neither permits online casino games, RNG products, slot machines, poker, betting exchanges, spread bets, dog racing bets, horse racing betting, or crypto-denominated wagering. 

For operators building online sportsbook products, Class B is the relevant instrument. All further requirements on this page apply to Class B applicants.

Cyprus offers a combination of EU regulatory standing and a competitive tax environment that few member states match at this price point.

• EU membership. A Cyprus-licensed operator holds authorisation from an EU member state regulator. This carries reputational and banking access advantages that offshore licenses do not provide. EU membership does not, however, grant automatic mutual recognition or cross-border gambling rights under current EU law. Each member state retains authority over gambling regulation within its territory. Operators targeting German, Dutch, or Swedish players must separately satisfy those national licensing requirements;
• Corporate tax rate. Cyprus applies a 12.5% corporate income tax rate, one of the lowest among EU member states. This is a structural advantage for companies using Cyprus as an operating entity or a group holding structure;
• Double taxation treaty network. Cyprus has signed over 60 double taxation treaties (DTTs). This network drives Cyprus’s widespread use as a holding jurisdiction for international groups, including operators whose license sits elsewhere;
• English-law legal system. The Cyprus legal system is based on English common law principles, giving international operators and their legal teams a familiar framework for contracts, corporate governance, and dispute resolution;
• Banking access. Cyprus-incorporated and Cyprus-licensed entities generally maintain access to reputable European banking relationships. This is a material advantage over operators holding licenses in non-EU offshore jurisdictions, where correspondent banking relationships are increasingly difficult to secure.

Corporate Structure, Local Presence and Personnel

The NBA requires applicants to be a company limited by shares, incorporated either in the Republic or outside the Republic, which complies with Part VIII of the Companies Law. The application must identify the identity details and the place of residence of the beneficial owner, officer, and holder of a significant interest, with full documentation for each. Directors and key management must demonstrate suitability through background checks, including a criminal record clearance from the Republic, their country of nationality/residence, and where they carry out their main business, as well as disclosure of financial and other interests. Non-EU founders and UBOs face additional source-of-wealth scrutiny. 

Financial Capacity: Share Capital and Bank Guarantee

Two distinct financial thresholds apply. These are hard requirements, not guidance.

• Minimum authorised share capital: EUR 500,000. This must be paid up and evidenced at the time of application. Documentary proof of source of funds for the capital is required, not just a bank statement showing the balance;
• Bank guarantee: EUR 550,000, issued by a financial institution authorised to operate in Cyprus and approved by the NBA. The guarantee functions as a player fund protection mechanism, placing the credit institution under an irrevocable obligation to pay amounts owed to a player who won, to the Republic as betting tax, to the Authority as contribution, or any other debts to the Republic. Its validity must extend to a period which ends six (6) months after the expiration date of the bookmaker’s licence requested. It must be in place before the application is deemed complete. Competitors frequently omit this requirement or understate it. EUR 550,000 is the current figure, and it is separate from and additional to the share capital requirement. Furthermore, if the guarantee does not cover ten percent (10%) of the licensed bookmaker’s annual turnover, the Authority may request an increase up to that 10% figure.

Together, these two requirements mean that a Cyprus Class B applicant must have documented access to approximately EUR 1.05 million in verifiable funds before the license application process begins.

Technical Infrastructure: Servers, Domain and Platform Requirements

Cyprus imposes specific technical conditions for Class B license holders that most competitors fail to address in detail.

• Domain. The licensed betting interface must operate under a .com.cy domain. This is a regulatory requirement, not an option;
• Server colocation. A local backup server in Cyprus is mandatory, meeting NBA technical audit standards. The NBA conducts a technical audit of the platform before the license is granted. Submitting an application before the technical infrastructure is in place is a documented cause of delays and rejections;
• Platform audit scope. The NBA technical audit covers logging architecture, access controls, reconciliation processes, uptime and failover capability, and the integrity of the betting engine. RNG certification is not required because this is a fixed-odds sportsbook license, not a casino license. Operators should treat the technical audit as a billable workstream, not a checkbox, and begin platform preparation in parallel with legal and compliance work.

AML/KYC, Responsible Gambling and GDPR

These are conditions of the license, not post-launch additions. The NBA reviews the compliance framework as part of the application assessment.

• AML/KYC. The applicant must have documented AML policies, KYC procedures, transaction monitoring protocols, and a sanctions screening workflow covering applicable lists (EU, OFAC, UN). An appointed MLRO with appropriate qualifications is required. The Authority oversees the implementation of preventive measures to combat money laundering, in accordance with the Law on the Prevention and Suppression of Money Laundering Activities;
• Responsible gambling. The platform must offer functions where the player, by means of an electronic notice, may set limits on the amount which can be bet for a specific time period, set limits on the amount which can be lost for a specific time period, set the duration of the time period during which he can place bets, and exclude himself from betting for a specific or indefinite period of time. The NBA expects evidence of how these tools are implemented in the platform architecture, not just a policy document;
• GDPR. Data processing agreements with all third-party vendors must be in place. A data flow map, a privacy policy meeting GDPR standards, and a documented data breach response procedure are all required as part of the application package. Additionally, keeping a secure electronic list of registered players is mandatory, and any disclosure of all or part of player information shall be a criminal offence under the Law on Processing of Personal Data (Protection of the Individual).