Cyprus Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Cyprus Securities and Exchange Commission, Central Bank, EU Council
Primary Legislation: Directive (EU) 2015/849 (4AMLD): The foundational directive, establishing the ri, Directive (EU) 2018/843 (5AMLD): Crucially extended the scope of EU AML rules to, Directive (EU) 2018/1673 (6AMLD): Harmonized the definition of money laundering, Regulatory Administrative Act 342/2021, Regulation (EU, e.g., Foreign Direct Investment Screening Law, AML Directive, Law 87(I, An older but relevant link detailing the law: https://www.cysec.gov.cy/en-GB/leg, Directive 2014/65/EU
Travel Rule: Adopted — Threshold: €1,000
Tax Reporting: Cyprus introduced a dedicated crypto tax framework via new Article 20E of the Income Tax Law, effective January 1, 2026, replacing the previous application of existing tax laws by analogy.. Tax treatment in Cyprus is determined by objective 'substance over form' rules requiring genuine economic activity and demonstrated management & control, rather than by the holder's subjective intention (e.g., short-term vs. long-term trading).. Not Legal Tender: Cryptocurrencies are not recognized as legal tender in Cyprus.. Under Cypriot law implementing the EU MiCA framework, certain crypto-assets may be classified as financial instruments if they qualify as transferable securities or financial instruments under MiFID II, while general cryptocurrencies not meeting that threshold remain outside that classification. The blanket statement that cryptocurrencies are generally not financial instruments is outdated due to MiCA implementation and CySEC's 2026 regulatory regime.. Scope: Capital Gains Tax in Cyprus applies exclusively to gains arising from the disposal of immovable property situated in Cyprus, and does not apply to shares, securities, or crypto assets.

Key Facts

aml Natural Persons: Full name, date and place of birth, nationality, permanent residential address, unique identification number (e.g., passport or ID number). Verification requires reliable, independent source documents and/or data. Legal Entities: Company name, legal form, registration number, registered address, names of directors and company secretary, articles of association, and proof of legal existence. Identification of Beneficial Ownership: For legal entities, identifying and verifying the ultimate beneficial owner (UBO) who directly or indirectly holds 225% or more of the shares or voting rights, or otherwise exercises control. Understanding the Purpose and Nature of the Business Relationship: CASPs must understand why the customer wants to use their services and the expected type and volume of transactions. Source of Funds (SoF) / Source of Wealth (SoW): Especially for higher-risk clients or significant transactions, CASPs must take reasonable measures to establish the source of the funds and/or wealth involved. Simplified Due Diligence (SDD): May be applied in limited, specific low-risk situations, but generally, the inherent risks associated with virtual assets make SDD rare. Enhanced Due Diligence (EDD): Must be applied in high-risk situations, including: Business relationships with Politically Exposed Persons (PEPs), their family members, or close associates.
custody Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): June 29, 2023: MiCA entered into force. June 30, 2024: Rules for asset-referenced tokens (ARTs) and e-money tokens (EMTs) will apply. December 30, 2024: Rules for all other crypto-assets and CASPs (including custody providers) will apply. CASPs offering "custody and administration of crypto-assets on behalf of clients" will require authorization as a CASP under MiCA. CySEC will be the competent authority for authorizing and supervising CASPs in Cyprus. Existing CASPs in Cyprus will need to adapt their operations and potentially re-apply or notify for authorization under MiCA. Article 67: CASPs providing custody services must hold crypto-assets on behalf of clients separately from their own assets. They must ensure that client crypto-assets are not used for their own account and are identifiable from the CASP's own crypto-assets. This means dedicated accounts or mechanisms to ensure client ownership is protected, particularly in case of the CASP's insolvency.
enforcement Entity Targeted: eToro (Europe) Ltd (a major global trading platform also offering crypto services). Violation Type: Non-compliance with regulatory requirements related to organizational requirements, safeguarding clients' funds, and prevention of money laundering and terrorist financing (AML/CFT). This included deficiencies in operational risk management, internal controls, and measures taken to prevent money laundering and terrorist financing. Outcome: Imposition of an administrative fine. eToro (Europe) Ltd stated it has taken corrective measures. Entity Targeted: Bitpanda GmbH (a well-known European digital investment platform operating as a registered VASP in Cyprus). Violation Type: Non-compliance with the AML/CFT Law, specifically regarding internal controls and measures for the prevention of money laundering and terrorist financing, and deficiencies in customer due diligence procedures. Outcome: Imposition of an administrative fine. Bitpanda GmbH took corrective measures. Outcome: Imposition of an administrative fine. eToro (Europe) Ltd stated it has taken corrective measures.
general CySEC registers, supervises, and enforces AML/CFT rules for CASPs and related crypto-asset service providers, including under MiFID II licensing for crypto custodians. It issues directives, guidelines, and conducts on-site inspections, but the regulatory framework has evolved to include broader investment services licensing. Under MiCAR, CySEC no longer maintains a dedicated CASP register at the old URL; authorization and registration for crypto-asset service providers is now governed by EU-level regulation and linked from CySEC's MiCAR page. Unit for Combating Money Laundering (MOKAS): MOKAS is the central national authority responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other information related to money laundering and terrorist financing.
licensing Directive (EU) 2015/849 (4AMLD): The foundational directive, establishing the risk-based approach, beneficial ownership registers, and enhanced due diligence. Directive (EU) 2018/843 (5AMLD): Crucially extended the scope of EU AML rules to include crypto-asset exchanges and custodian wallet providers, requiring them to be regulated and subject to AML/CFT obligations. Directive (EU) 2018/1673 (6AMLD): Harmonized the definition of money laundering offences and associated penalties across EU member states. The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (as amended) remains the foundational law, but CySEC has issued additional strengthened anti-money laundering guidelines beyond the original text, incorporating new risk requirements. CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Regulatory Administrative Act 342/2021) for CASPs. This specific directive, issued by CySEC, outlines the detailed AML/CFT obligations for CASPs, including registration, operational requirements, and specific procedures. Exchange between crypto assets and fiat currencies. Management, transfer, holding, and/or safekeeping of crypto assets or cryptographic keys or means which allow the exercise of control over crypto assets. Offering and/or selling of crypto assets, including the initial offering.
securities The Cyprus Securities and Exchange Commission (CySEC) oversees the regulation of cryptocurrencies and digital assets, ensuring compliance with financial market rules. CySEC classifies certain crypto assets as financial instruments, subjecting them to licensing and regulatory oversight. The regulatory framework includes guidelines for digital asset securities, requiring adherence to disclosure and investor protection standards. Entities offering crypto-related services must obtain a license from CySEC, demonstrating compliance with application requirements such as capital adequacy and governance standards. Licensing processes involve scrutiny of the entity’s business model, risk management practices, and alignment with regulatory guidelines. CySEC mandates robust Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures for crypto service providers to prevent illicit financial activities. Compliance includes customer identity verification, transaction monitoring, and reporting suspicious activities in line with Circulars AML/CFT guidelines. CySEC has the authority to impose penalties on non-compliant entities, including fines and suspension of licenses, for violations of regulatory standards.
stablecoin E-money Tokens (EMTs) are crypto-assets referencing a single fiat currency, but in Cyprus, they are now treated under a transitional regulatory regime that distinguishes them from traditional e-money, with specific guidance from the Central Bank of Cyprus addressing the interplay between MiCA and PSD2. Legal Reference: MiCA Regulation (EU) 2023/1114, Article 3(1)(5) and Title III (Articles 43-58). URL: MiCA Regulation (EUR-Lex) Asset-Referenced Tokens (ARTs): These are crypto-assets that purport to maintain a stable value by referencing any other value or right, or a combination thereof, including one or several official currencies, one or several commodities, or one or several crypto-assets (e.g., a stablecoin referencing a basket of currencies, gold, or other crypto-assets like DAI, if it were issued in the EU). Stablecoins that fall under the definition of financial instruments (e.g., shares, bonds) as per MiFID II are regulated under existing securities laws in Cyprus. MiCA now covers crypto-assets not already covered by existing financial services legislation, meaning most stablecoins designed as payment or value-transfer mechanisms fall under MiCA, not MiFID II. Cyprus has already begun implementing MiCA's stablecoin rules, as evidenced by CySEC circulars issued in Q1 2025. While Directive 2014/65/EU on markets in financial instruments remains the foundational reference for MiFID II in Cyprus, the Cypriot legal framework has been updated, with Law 183 (I)/2025 transposing a revised MiFID II Directive into the national Investment Services and Activities Law. URL: MiFID II (EUR-Lex) 1:1 Backing: Issuers of ARTs and EMTs must always maintain a reserve of assets equal to at least 100% of the nominal value of the outstanding stablecoins.
status Cyprus has established a comprehensive regulatory framework for cryptocurrencies and digital assets, overseen by the Cyprus Securities and Exchange Commission (CySEC). The framework aims to ensure market integrity, investor protection, and compliance with anti-money laundering (AML) and counter-terrorism financing (CFT) regulations. Cyprus country profile - BBC News To operate as a cryptocurrency exchange or wallet provider in Cyprus, entities must obtain a license from CySEC. The licensing process involves submitting detailed business plans, demonstrating compliance with AML/KYC requirements, and proving adequate capital reserves. Cyprus Securities and Exchange Commission | Regulatory ... Cyprus requires cryptocurrency businesses to implement robust AML/KYC procedures. This includes customer due diligence (CDD), ongoing monitoring of transactions, and reporting suspicious activities to the relevant authorities. The regulations align with the European Union's Fifth Anti-Money Laundering Directive (5AMLD). Laws & Regulations of the Republic of Cyprus CySEC has the authority to impose fines, suspend or revoke licenses, and take other enforcement actions against non-compliant entities. Recent enforcement actions have targeted cryptocurrency platforms for violations related to AML/KYC compliance and market manipulation. Application status electronic service - Gov.cy Income derived from cryptocurrency transactions in Cyprus is subject to standard income tax rates, which range from 0% to 35%, depending on the taxable amount. Capital gains from the sale of cryptocurrencies are also taxed at a rate of 10%. The government has not introduced specific tax incentives for cryptocurrency businesses but encourages compliance with existing tax obligations. Check Application Status - Cyprus Government Services Despite the regulatory framework, key gaps and risks remain, including potential delays in licensing processes, evolving international standards on cryptocurrencies, and cybersecurity threats targeting digital asset platforms. The government continues to monitor these challenges and may introduce further regulations to address emerging issues. Cyprus Residence Permits & Citizenship in 2026 Comparison Cyprus country profile - BBC News Cyprus Securities and Exchange Commission | Regulatory ...
tax Cyprus introduced a dedicated crypto tax framework via new Article 20E of the Income Tax Law, effective January 1, 2026, replacing the previous application of existing tax laws by analogy. Tax treatment in Cyprus is determined by objective 'substance over form' rules requiring genuine economic activity and demonstrated management & control, rather than by the holder's subjective intention (e.g., short-term vs. long-term trading). Not Legal Tender: Cryptocurrencies are not recognized as legal tender in Cyprus. Under Cypriot law implementing the EU MiCA framework, certain crypto-assets may be classified as financial instruments if they qualify as transferable securities or financial instruments under MiFID II, while general cryptocurrencies not meeting that threshold remain outside that classification. The blanket statement that cryptocurrencies are generally not financial instruments is outdated due to MiCA implementation and CySEC's 2026 regulatory regime. Scope: Capital Gains Tax in Cyprus applies exclusively to gains arising from the disposal of immovable property situated in Cyprus, and does not apply to shares, securities, or crypto assets. Immovable property located in Cyprus. Shares in companies that directly or indirectly own immovable property located in Cyprus. Rate: The CGT rate is 20% on the taxable gain.
travel rule The EU Travel Rule, mandated by the Financial Action Task Force (FATF), requires virtual asset service providers (VASPs) to transmit relevant transaction information to counterparties for cross-border transfers exceeding €1,000. Travel Agency Cyprus aligns with EU directives through the Financial Services Supervisory Authority (FSSA), ensuring VASPs comply with AML/KYC obligations and reporting requirements. Crypto Travel Rule Explained: FATF Requirements for VASPs Non-custodial wallets face specific challenges under the EU Travel Rule, necessitating enhanced transparency measures to satisfy regulatory standards. Non-Custodial Wallets and the EU Travel Rule CySEC’s circular on the EBA public consultation underscores the importance of timely adaptation to evolving travel rule guidelines. CySEC Circular: EBA public consultation on Travel Rule ... Implementation gaps, such as technological integration and compliance monitoring, pose risks that require proactive mitigation strategies. Non-Custodial Wallets and the EU Travel Rule Tax treatment of virtual asset transactions remains under scrutiny, with potential implications for VASP operations in Cyprus. Travel Rule Compliance What You Must Do - Govern Cyprus implements the EU Travel Rule through directives enforced by the FSSA, ensuring VASPs adhere to stringent AML/KYC protocols. Travel Rule Compliance What You Must Do - Govern The FATF’s global standards set a baseline for transaction reporting, obligating VASPs to disclose sender and recipient details for cross-border transfers. Crypto Travel Rule Explained: FATF Requirements for VASPs

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-22. View full profile