Your crypto business may be registered in Cyprus, but is it still authorized to operate?
MiCA regulation in Cyprus now requires businesses providing covered crypto-asset services to hold the appropriate authorization or qualify under another permitted route. The country’s transition from its former national registration system ended on July 1, 2026.
Imagine operating a crypto exchange in Limassol. Your customers are trading, your platform is working, and your MiCA application is still being reviewed. Can you keep offering those services? Not necessarily. An application isn’t a license.
Understanding where your business stands now can help you avoid operating without permission and make more confident decisions about your next move.
July 1, 2026 marked the end of Cyprus’s transitional period for existing crypto-asset service providers. Companies could no longer rely on their former national CySEC registration alone to continue providing regulated services. Before that deadline, eligible existing businesses had temporary permission to operate under the old national rules while moving toward MiCA authorization, and CySEC required their applications by February 27, 2026. What happens next depends on your current position:
You can continue offering the services covered by your authorization, provided your business meets the ongoing requirements.
A pending application alone does not allow you to continue regulated operations after the transition. You must stop providing services for which you lack authorization and address any required client-protection or wind-down arrangements.
Check which services require authorization before accepting customers or beginning regulated activities. Incorporating a Cyprus company does not automatically permit you to provide crypto services.
You can verify regulatory status through the CySEC MiCA register and ESMA’s official register.
MiCA applies to companies that provide specified crypto-asset services, including exchanges, custodians, trading platforms, and businesses that manage or transfer crypto-assets for clients. But not every business working with blockchain technology needs the same authorization.
A company developing software for internal use may be in a different position than a platform holding customers’ crypto-assets or executing trades on their behalf. The deciding factor is the service being provided, not simply the technology involved.
A business seeking to provide regulated crypto-asset services from Cyprus generally needs to apply to the Cyprus Securities and Exchange Commission (CySEC), unless it qualifies for another route under MiCA. The application is more than a registration form: CySEC needs to understand what you intend to offer, who manages the business, how it handles risks, and whether it can protect customers.
Identify exactly what your company plans to do: will customers trade on your platform, will you hold their assets, process transfers, or provide investment-related advice? These carry different responsibilities. Write down what happens from the moment a customer opens an account to the moment they complete a transaction.
CySEC needs to know who runs the business and how important decisions are made, including suitable management, ownership arrangements, and internal controls. NAKLAW’s Cyprus company incorporation services can help with forming the company and establishing its corporate structure. Company registration and regulatory authorization are separate processes.
Under Article 62 of MiCA, applicants must provide information demonstrating how their business will meet the relevant requirements. These documents must match how your company actually works: a policy describing controls offers little reassurance during regulatory review.
MiCA sets different minimum capital thresholds depending on the crypto-asset services a business provides. For example, a company providing crypto advice generally has a lower minimum than one operating a trading platform.
Crypto advice, portfolio management, transfers, and certain order-related services.
Crypto custody and exchange services, including Class 1 services.
Operating a crypto trading platform, including lower-class services.
Minimum is not the whole story. There is an important distinction in what a provider must actually maintain. Under Article 67, prudential safeguards must equal at least the higher of the relevant minimum threshold or 25% of the preceding year’s fixed overheads, calculated under MiCA. New businesses use projected overheads as the regulation specifies.
Authorization is an important milestone, but the business must keep meeting its obligations. A crypto exchange, for example, needs reliable procedures for managing customer assets, handling complaints, and addressing operational problems. These aren’t tasks to complete once and forget. Three areas deserve particular attention:
Businesses holding clients’ crypto-assets must maintain appropriate safeguards, records, and custody arrangements. MiCA includes rules designed to protect customers’ ownership rights and prevent misuse of their assets.
Crypto businesses must meet applicable anti-money laundering requirements, including customer checks and transaction monitoring. Relevant crypto transfer rules still apply.
Appropriate governance, risk controls, complaints procedures, and digital operational resilience are part of running a regulated business.
This is where clear corporate governance becomes useful: a company should know who is responsible for important decisions, how concerns are escalated, and what happens when an operational problem affects customers.
An appropriately authorized crypto-asset service provider can use MiCA’s passporting framework to offer its covered services in other EU member states. This is a practical advantage for Cyprus businesses planning European expansion: instead of seeking a separate CASP license in every member state, an authorized provider can follow the required cross-border notification procedure.
Some may need to consider rules beyond their MiCA authorization. MiCA distinguishes between asset-referenced tokens and e-money tokens, and certain services involving e-money tokens, particularly transfers and custody arrangements, may also fall within EU payment-services rules. If your company transfers e-money tokens on behalf of customers, a MiCA authorization alone may not cover every aspect of that activity.
The best next step depends on whether your company is already authorized, awaiting a decision, or preparing to enter the EU market. Instead of starting with a large set of policies, begin with a practical review of your current position.
Confirm your status and whether it covers every crypto-asset service you provide.
Check whether custody, exchanges, transfers, advice, or token-related activities create additional obligations.
Make sure the business meets the applicable prudential safeguard requirements, including any overhead-based calculation.
Review client protection, AML procedures, cybersecurity, complaints handling, and internal responsibilities.
Before entering another EU market or launching a new service, confirm any passporting, notification, or additional authorization requirements.
The earlier you identify a gap, the easier it is to decide what needs fixing before it affects customers or future growth.
No. The transitional period ended on July 1, 2026. Covered services now require appropriate MiCA authorization or another valid route under the regulation.
A pending application alone does not permit a business to continue regulated crypto-asset services after the transition ended.
No. MiCA’s minimum thresholds depend on the services provided, and the required prudential safeguards may be higher.
Yes, for services covered by its authorization, subject to MiCA’s cross-border notification requirements.
The MiCA transition may be over, but businesses still need to keep their authorization, operations, and customer safeguards aligned with the rules.
For existing providers, that means checking whether every service is properly covered. For new businesses, it means getting the structure and regulatory requirements right before launch.
If you’re considering setting up a Cyprus company or reviewing its corporate arrangements, NAKLAW can help you discuss the relevant corporate legal support and whether specialist MiCA regulatory advice is needed.
Before your next crypto product goes live, here’s a question worth asking: are we authorized to deliver everything we’re promising our customers?