MiCA set a single rulebook for crypto-asset services across the EU. Cyprus was one of the first member states to position itself as a primary licensing gateway. What that means in practice is now clear.
How the transition unfolded
MiCA (EU Regulation 2023/1114) became the single legal framework for crypto-asset service providers across all 27 EU member states in December 2024. It replaced 27 separate national regimes with one rulebook, one licence structure, and one passport.
For Cyprus, the transition happened in two stages. The first was a grace period: firms already registered as CASPs under the prior Cyprus national framework had until 27 February 2026 to apply for a MiCA licence with CySEC. Those that filed in time could keep operating under their existing registration until CySEC decided their application, or until 1 July 2026, whichever came first.
The second stage is the hard cutover: 1 July 2026. From that date, any firm providing crypto-asset services from Cyprus without a granted authorisation is operating unlawfully. There is no further grace period. A firm that missed the February deadline must now wind down and cease services.
What the cutover actually means
Before MiCA, the Cyprus CASP framework was a national one. It had limited reach outside Cyprus and was not recognised in other member states.
From 1 July, that changes. A CySEC-issued CASP authorisation is an EU licence. Once granted, the firm can provide its services in any other EU member state by notifying CySEC, without a separate application, separate capital requirement, or approval from the host country. The host authority is informed; it does not approve.
That is the main commercial reason to go through the process now rather than wait.
The consequences of not doing so are worth stating clearly. Article 111 of MiCA allows fines in the millions for operating without authorisation. Enforcement orders follow. Banking relationships, which are already difficult for crypto businesses, become at risk.
What a Cyprus CASP licence actually requires
The application covers five areas.
Scope of services. MiCA covers ten types of crypto-asset service: custody, trading platform operation, exchange (crypto to cash and crypto to crypto), order execution, order reception and transmission, placing, portfolio management, transfer services, and advice. A firm applies for the specific services it plans to offer. The wider the scope, the more complex the application and the higher the capital requirement.
Capital. The requirement scales with the services: €15,000 for basic services, €50,000 for advice and portfolio management, €150,000 for custody, exchange, and trading. Capital must be paid up and held in a Cyprus bank at the date of application. CySEC can require more if the firm's risk profile warrants it.
Governance. MiCA requires a clear board structure, documented internal controls, and a named AML compliance officer. Management must have a clean record and relevant experience.
AML framework. The application must include a full AML policy, client identification procedures, and a risk-based approach to customer classification.
Business plan. Three-year projections with realistic revenue assumptions and stress scenarios. CySEC reviews these carefully.
CySEC typically takes three to six months to process a complete application. An incomplete submission resets the clock. The quality of the initial filing is the single biggest factor in processing time.
Why Cyprus specifically
CySEC positioned itself early as one of the main EU MiCA licensing authorities, alongside Malta's MFSA, the Central Bank of Ireland, and Lithuania's Bank of Lithuania. The practical difference comes down to three things: speed, familiarity, and tax treatment.
Cyprus processes applications faster than Ireland and more consistently than Malta, where queues have historically been long. Lithuania is efficient but attracts firms mainly on cost.
Substance matters under MiCA in a way it did not under national frameworks. The regulation requires real presence: local management, local decision-making, and a local compliance function. A shell entity will not pass a CySEC review. This works in Cyprus's favour, where the cost of genuine substance is lower than in Dublin or Amsterdam, and where the legal, compliance, and accounting services base is already well developed.
The tax position adds to the case, which the next section covers.
The 8% flat rate and what it changes
The 2026 tax reform introduced Article 20E of the Income Tax Law: a flat 8% rate on profits from the sale of MiCA-defined crypto-assets.
The rate applies to individuals. The same 8% applies whether the activity is treated as investment or trading. Sales include crypto-to-cash, crypto-to-crypto swaps, gifts, and spending. Any transaction that produces a gain is covered.
Three points are worth noting.
Losses. Losses from crypto sales can only be set against crypto gains in the same tax year. They cannot be carried forward and cannot be used against other income. For active traders, this matters when planning positions.
Exclusions. Mining rewards and staking income fall outside Article 20E and are taxed under standard income tax rules. The 8% applies only to disposal profits.
Reporting. The EU's DAC8 directive requires Cyprus financial institutions to report crypto transaction data to other EU tax authorities automatically. Clients who assumed their cross-border crypto holdings were not visible to their home tax authority should update that assumption.
For a Cyprus tax resident: 8% flat on gains, no capital gains tax on securities sales, non-dom status protecting foreign income. It works for someone who has genuinely relocated, not someone who has not.
Who this is actually for
Three types of crypto business find Cyprus useful under the post-MiCA regime.
Businesses that need an EU passport. An exchange, custodian, or trading desk that wants to serve EU clients from one regulated entity. One CySEC licence covers all 27 markets. The cost of running a real Cyprus operation is manageable. The processing time is shorter than Dublin.
Founders and principals who have moved here. A crypto entrepreneur who has relocated to Cyprus, established tax residency, and runs the business from here. The 8% rate applies to personal gains. The company holds the operating licence. Non-dom status covers dividend income from foreign structures. The structure works when the move is real.
Investment vehicles with crypto exposure. A family office or fund that holds crypto alongside other assets. Article 20E clarifies the tax treatment in a way the old rules did not. For a structure already in Cyprus, the question is whether existing documentation needs updating to reflect MiCA scope.
What this is not for: someone who has not relocated, a firm that wants a Cyprus address without real operations, or a business that cannot put genuine local management and compliance in place. CySEC checks these things.
Yes, but you cannot operate while the application is being processed. A firm that did not file in time must have stopped services by 1 July 2026. A fresh MiCA application to CySEC is still possible, but the business cannot restart until authorisation is granted. Allow three to six months.
No. The MiCA passport applies to EU member states only. The US and UK have their own separate frameworks. A Cyprus authorisation does not open those markets.
Yes, subject to CySEC's standard checks. There is no nationality requirement for shareholders or management. Senior staff involved in the regulated activity must be based in Cyprus; shareholders do not need to be residents.
Article 20E is for individuals. A Cyprus company that sells crypto-assets pays corporate income tax at 15% on the gain under the standard rules. The 8% flat rate does not apply to companies.
A CASP licence covers firms that provide crypto services to others: custody, exchange, advice, brokerage. A fund that holds crypto as part of its own portfolio falls under the AIFMD rules, not MiCA. If the fund also offers services to outside clients, both frameworks may apply.
MiCA sets a higher bar for operating a crypto business in Europe. For firms willing to meet it, the reward is real: a single licence that opens every EU market, a clear legal position, and access to banking and institutional partnerships that require regulatory standing. Cyprus offers a practical route to that licence, at lower operating cost than most comparable jurisdictions, with a tax framework that suits relocated individuals. The firms that will find it worth their time are the ones treating Cyprus as a base, not a label.