Regulatory AlertsCyprus: fintech & payments regulation
RegulatedCySEC governs crypto under MiCAR; CbC regulates payments & FX
- Lead regulator
- CySEC (crypto) / Central Bank of Cyprus (payments)
- Also involved
- NFIU (AML reporting) · NDPC (data protection)
- Core law
- MiCAR (2023) / Payment Services Law 12(I)/2018
- Entry capital
- EUR 50,000 (E-money)
- Approval timeline
- 3-6 months (CbC); 6-12 months (CySEC MiCAR)
- Customer assets
- Segregated accounts required; no commingling
- Data protection
- GDPR / Law 125(I)/2018 · NDPC
- Sandbox
- Yes - CbC Regulatory Sandbox
Cyprus operates a dual-regime for fintech. The Central Bank of Cyprus (CbC) supervises traditional payment institutions, e-money institutions, and foreign exchange services under EU Payment Services Directive 2 and E-Money Directive. The Cyprus Securities and Exchange Commission (CySEC) regulates crypto-asset service providers (CASPs) under the EU MiCAR regulation, which became fully applicable in December 2024. Founders must identify whether their model is fiat-based (CbC) or crypto-based (CySEC) to determine the correct licensing path.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Payment processing / gateway | LicencePayment Institution Licence[1] Requires physical presence and local management | EUR 20,000 (initial) / EUR 50,000 (ongoing) | 3-6 months | Central Bank of Cyprus |
| E-money & wallet issuance | LicenceE-Money Institution Licence[1] Issuance of electronic money requires specific authorization | EUR 50,000 | 3-6 months | Central Bank of Cyprus |
| Domestic money transfer | LicencePayment Institution Licence[1] Domestic transfers fall under payment service provider rules | EUR 20,000 (initial) / EUR 50,000 (ongoing) | 3-6 months | Central Bank of Cyprus |
| Cross-border remittance | LicencePayment Institution Licence[1] Cross-border fiat transfers require PI authorization | EUR 20,000 (initial) / EUR 50,000 (ongoing) | 3-6 months | Central Bank of Cyprus |
| Agent network | LicencePayment Institution Licence[1] Agents must be appointed by the licensed entity | EUR 20,000 (initial) / EUR 50,000 (ongoing) | 3-6 months | Central Bank of Cyprus |
| Open banking / account information | LicencePayment Institution / AISP[1] Account Information Service Providers require authorization | EUR 20,000 | 3-6 months | Central Bank of Cyprus |
| Foreign-exchange services | LicenceBureau de Change Licence[1] Immediate buying/selling of foreign currency requires prior authorization | — | 2-4 months | Central Bank of Cyprus |
New — what changed recently
- 2024-12-31MiCAR Transitional Period — CySEC requires pre-existing crypto providers to submit evidence of prior activities to operate under transitional rules until July 2026.[2]
- 2024-07-31MiCA Article 60 Notification — CySEC mandated notification for entities intending to provide crypto-asset services under MiCA by August 2024.[3]
- 2024-06-26Circular C648 Issuance — CySEC issued guidance on notifying crypto-asset services under Article 60 of MiCA to regulated entities.[4]
Market-entry checklist
- 1Determine Regulatory ScopeIdentify if services are fiat (CbC) or crypto (CySEC) to apply to the correct regulator.
- 2Secure Local PresenceEstablish a physical office and appoint local management in Cyprus as required by CbC.
- 3Prepare Capital ProofDemonstrate EUR 50,000 for E-money or EUR 20,000 for Payment Institutions in segregated accounts.
- 4Submit MiCA NotificationIf offering crypto services, submit Article 60 notification to CySEC within the transitional window.
- 5Register with NFIURegister as a reporting entity with the Cyprus Financial Intelligence Unit for AML compliance.
Sources
- Bureaux de Change Businesses Directive 2014 · 2018-04-11
- Transitional period for crypto-asset service providers under MiCAR Article 143(3) · 2024-12-31
- Notification of crypto asset services under article 60 of MiCA · 2024-07-31
- CySEC Notification of Crypto Asset Services Under Article 60 of MiCA · 2024-06-26