Listen to this article
0:00 / 0:00

Key Takeaways

  • A Cyprus company offers crypto businesses an EU-aligned base through VASP registration and the MiCA framework, suited to licensed digital-asset activity.
  • Token issuance, NFTs, Web3 ventures, and holding or trading digital assets can all be structured through a Cyprus entity, with tax treatment depending on the activity.
  • Licensed crypto activity carries economic substance and local presence expectations, alongside regulatory scrutiny and a meaningful compliance burden.
  • Foreign owners should weigh where Cyprus falls short for crypto, using common workarounds, and confirm the setup fits before choosing it over other jurisdictions.

A Cyprus crypto company suits a specific kind of operator: a serious, funded business that wants a single regulated licence to serve clients across the European Union. The governing framework is the Markets in Crypto-Assets Regulation (MiCA), the EU's unified rulebook for crypto-asset service providers, supervised locally by the Cyprus Securities and Exchange Commission. Authorisation here lets a licensed entity passport its services into all 27 member states without separate national approvals.

This article explains what a Cyprus crypto company can and cannot do, the licensing path, the tax treatment of digital assets, the substance you must build, and the points where the jurisdiction is a poor fit. It is most relevant to exchanges, custody providers, portfolio managers, and token issuers targeting EU clients, less so to early-stage or fully decentralised projects.

The corporate vehicle is a standard Private Limited Company under the Companies Law, Cap. 113, with minimum share capital of €1,000 and €200 paid up at incorporation. Names already operating through the regime include eToro, Revolut, and Bitpanda, drawn by the tax position and EU market access. None of this is light-touch; the licence is the product, and it carries a substantial compliance bill.

MiCA (Regulation (EU) 2023/1114) applies directly, without a separate local statute. The rules for asset-referenced and e-money tokens took effect on 30 June 2024, and the full crypto-asset service provider regime applied from 30 December 2024.

The older local registration route is closed. On 17 October 2024, the regulator stopped accepting new applications under the legacy CASP registration tied to the Prevention and Suppression of Money Laundering and Terrorist Financing Law. Every new applicant must now apply under MiCA.

CySEC is the national competent authority for service-provider authorisation and for issuers of asset-referenced and other crypto-assets. The Central Bank of Cyprus supervises e-money tokens. Applications are processed under Articles 60 to 62 of the regulation.

Firms already registered before 30 December 2024 benefit from a transitional window. They may continue providing services until 1 July 2026, or until their MiCA licence is granted or refused, whichever comes first.

CASP authorisation: key parameters
Item Detail
Competent authority CySEC (CASPs, ARTs); Central Bank of Cyprus (EMTs)
Capital requirement €50,000 to €150,000, depending on services
Typical processing time 4 to 6 months
Maximum fine 5% of annual turnover or €5 million per breach

The services MiCA defines cover the full activity range: reception and transmission of orders, execution, dealing on own account, portfolio management, advice, transfer services, placement, and operating a trading platform. Two further obligations bite hard. The Travel Rule under the Transfer of Funds Regulation became enforceable on 30 December 2024 with no grace period, and the Digital Operational Resilience Act (DORA) applies from 17 January 2025 to all licensed crypto firms.

Cyprus

Company Incorporation in Cyprus

Set up your company in Cyprus with Expanship handling registration end to end.

Learn more

MiCA covers cryptocurrencies, stablecoins, and utility tokens. It does not reach security tokens, traditional financial instruments, fully decentralised DeFi protocols, or unique NFTs.

If you issue crypto-assets that are neither asset-referenced nor e-money tokens, you must publish a MiCA-compliant white paper, prepared in the ESMA-mandated iXBRL machine-readable format. Issuers of stablecoin-type tokens face heavier rules: asset-referenced tokens are supervised by CySEC, and e-money tokens by the Central Bank.

A digital asset that qualifies as a financial instrument falls under MiFID II instead. That requires a separate CySEC investment firm licence, not a crypto-asset service provider authorisation, so classification of your token matters before you build anything.

For Web3 ventures developing genuine blockchain technology, the IP Box regime can exempt up to 80% of qualifying profits from corporate tax, reducing the effective rate on that income to roughly 3%. This is the strongest tax feature for a protocol or infrastructure developer rather than a pure trader.

Unique NFTs sit outside MiCA, and there is no Cyprus NFT licensing regime. The classification risk runs the other way: if CySEC treats an NFT as a financial instrument, it falls under MiFID II, and no specific guidance yet exists for partially decentralised DeFi structures. Treat both as open questions.

The DLT Pilot Regime for DLT-based market infrastructures has applied since March 2023, but uptake across the EU has been slow because of operational and infrastructure demands.

A dedicated rule changes the picture for traders. From 1 January 2026, Article 20E of the Income Tax Law imposes a flat 8% tax on gains from the disposal of crypto-assets held by Cyprus companies or individuals. These gains are taxed separately and are not added to other taxable income.

The 8% rate sits well below comparable EU treatment, where France applies 30% and Italy 26% to crypto capital gains. The definition of "crypto-assets" tracks MiCA directly, which removes much of the ambiguity that existed under the old rules, when crypto gains generally escaped the local capital gains tax because that tax reaches only Cyprus immovable property.

Not every crypto return qualifies for the flat rate. Gains from assets acquired through mining are excluded and taxed under general income tax rules. Staking rewards, airdrops, and yield farming returns also fall outside Article 20E and are taxed as ordinary income, though a later disposal of those same assets does attract the 8% rate.

One structural drawback deserves weight. Crypto trading losses are ring-fenced: they offset crypto gains only and cannot shelter other income, so an unprofitable year cannot reduce tax in a profitable one. For a volatile trading business with irregular results, this matters.

Fiat-to-crypto and crypto-to-fiat conversions are exempt from VAT, following the European Court of Justice ruling in Hedqvist. Tax residence drives the rest: a Cyprus-resident entity is taxed on worldwide crypto gains, while a non-resident is taxed only on Cyprus-source profits.

No treaty relief for crypto gains

The treaty network of around 65 agreements protects dividends, interest, and royalties flowing into the entity. No treaty caps or exempts crypto disposal gains, which are sourced to the holder's tax residence under general principles.

Cyprus

Ongoing Compliance in Cyprus

Keep your Cyprus entity compliant with filings, returns, and statutory obligations.

Learn more

Banking is the practical bottleneck. Opening a corporate account, especially for a non-resident-owned or complex structure, is a slow process, and the scrutiny applied to crypto firms is heavier still. Some banks block or limit transfers to and from exchanges outright.

A CASP licence improves the position materially. EU banks and electronic money institutions will onboard a licensed entity that brings proper documentation, though the documentation burden does not disappear. The regulator works with crypto businesses, but the banking system's conservatism remains.

Full SEPA membership gives a licensed entity access to SEPA credit transfers and SEPA Instant for euro on and off-ramps. Under a separate framework, all payment service providers, including fintechs, must offer instant euro payments by 2027.

Stablecoin rails carry a specific trap. Custody of e-money tokens can trigger both MiCA authorisation and a payment services licence under PSD2, producing two compliance regimes and double the cost. Where the primary activity is fiat handling rather than full crypto service provision, an EMI or payment institution licence from the Central Bank is often the cleaner route.

A common operational pattern: run the day-to-day account through an EU-passported EMI such as Revolut Business or Airwallex, and keep a local bank account for payroll and regulatory needs rather than transaction volume.

There is no separate "economic substance act" here as in the offshore islands. Substance flows from the licensing conditions and from the tax-residency test of management and control, and for active crypto activity the demands are real.

CySEC expects the company to be established locally and genuinely managed locally. The majority of the board should be based in the country and actively involved in decisions, which also underpins tax residency.

Board composition is prescriptive:

  • At least four directors, two of them executive
  • Executive directors must reside in the jurisdiction
  • At least half the board must be independent non-executive directors
  • All directors must have financial or crypto experience and pass a CySEC qualification check

A physical, staffed office is mandatory; a virtual office will not pass. Staff performing key functions must work locally, and the firm must appoint both a compliance officer and an anti-money-laundering officer (MLRO).

The larger the activity, the heavier the substance. An exchange or custody operation carries the fullest version of these requirements, and there is no reduced-test pathway for a holding-only or pure treasury crypto entity. On top of the people and premises, licensed firms must run continuous monitoring, report regularly to CySEC, maintain capital, and operate a DORA cybersecurity programme.

Cyprus

Cyprus Incorporation Pricing

See transparent pricing to incorporate and maintain a company in Cyprus.

View pricing

The jurisdiction stands in good standing internationally. It is an EU and OECD member, a FATF-aligned jurisdiction through Moneyval, absent from the FATF grey and black lists, and off the EU's grey list of non-cooperative tax jurisdictions since 2019.

What it is not is a soft option. The deliberate strategy is to attract well-capitalised crypto businesses that accept heavy scrutiny in exchange for the tax rate and the EU passport.

The compliance climate is demanding. Regulatory fines across financial firms topped €2.7 million in 2024, and the resulting caution makes banks reluctant to onboard newer or foreign clients. Binance withdrew from the market in 2023, a signal that scale alone does not buy tolerance for non-compliance.

MiCA penalties reach 5% of annual turnover or €5 million per breach, layered with CySEC procedural fines. Reporting overhead is rising too, as MiCA and DAC8 crypto-reporting obligations apply together. Suspicious transactions go directly to MOKAS, the financial intelligence unit.

CySEC brings a strong enforcement record from traditional finance, where the jurisdiction was a major forex and CFD centre. Its crypto supervision is competent but newer than its securities oversight, which is worth factoring into how the regulator may behave on novel questions.

Several project types fit badly. Fully decentralised DeFi protocols and unique NFTs fall outside MiCA, and a CASP licence cannot legitimise activity that has no identifiable operator. No bespoke local DeFi framework exists to fill the gap.

The loss treatment is a genuine weakness. Crypto losses cannot be carried forward or set against other income, which penalises trading businesses with uneven profitability.

Cost is the larger barrier. Between minimum capital of €50,000 to €150,000, a staffed office, local directors, an MLRO and compliance officer, an annual audit, a DORA programme, and Travel Rule infrastructure, first-year setup for an exchange-class operation can exceed €200,000.

  • This is not a cost-efficient structure for early-stage or low-revenue projects.

Other friction points and the usual responses:

  • Banking delays: route core payments through an EU-passported EMI and keep the local bank account for payroll and compliance only
  • Stablecoin dual licensing: where activity allows, use an EMI or payment institution licence rather than triggering both MiCA and PSD2
  • Mining: excluded from the 8% rate and taxed as trading income, so the jurisdiction is structurally weaker than low-electricity, no-income-tax locations
  • No light-touch class: any active service provision triggers the full regime, with no simple registration track for a treasury-only entity

The strong cases share a profile. A funded exchange, custody provider, portfolio manager, or transfer-service operator that targets EU retail or institutional clients gets a single passportable licence through an established application process, plus an 8% disposal rate that beats most EU peers and embeds MiCA definitions directly into tax law.

It also works for a Web3 developer building qualifying blockchain IP, who can combine the licence with the IP Box and an effective rate near 3% on qualifying income. An owner-director who can establish local tax residency under the 60-day rule, with Non-Dom status, captures the 8% flat rate on personal crypto disposals. The common requirement across all of these is the budget and operational capacity to carry full substance.

The poor cases are equally clear:

  • DeFi protocols, DAOs, and structures with no identifiable issuer, which sit outside MiCA entirely; consider foundation jurisdictions such as Cayman, Panama, or Switzerland
  • Early-stage or pre-revenue projects seeking low cost, where Lithuania, Estonia, or an offshore VASP regime is cheaper
  • NFT marketplaces or unique-NFT issuers, which gain no licensing advantage here over any other EU state
  • Mining at scale, taxed as trading income at rates rising to 35% above €60,000
  • Any operator needing frictionless banking from day one

The trade here is plain: you exchange a heavy compliance bill and full local substance for an EU-wide passport and one of the lowest crypto tax rates in the bloc. That bargain rewards funded, regulation-ready exchanges, custodians, and managers, and punishes lean, early-stage, or decentralised projects that cannot absorb six-figure setup costs.

Before committing, model your first two years of fully loaded compliance and banking costs against the revenue the EU passport will realistically unlock; if that gap does not close comfortably, a lighter jurisdiction will serve you better.

Expanship supports foreign owners through the full path of standing up a Cyprus crypto company, from forming the Cap. 113 entity to structuring it for a CASP authorisation and meeting the substance, governance, and reporting conditions CySEC expects. The same team covers the wider needs of a foreign-owned firm operating locally.

  • Company formation and structuring of the Private Limited Company
  • Registered agent and a staffed local office that meets substance requirements
  • Support with tax registration and the management-and-control substance position
  • Ongoing compliance management, including MLRO and compliance-officer arrangements
  • Accounting, bookkeeping, and annual audit coordination
  • Introductions to banks and EU-passported EMIs for fiat rails

To discuss whether this structure fits your project, contact Expanship Cyprus.

No. CySEC stopped accepting new applications under the legacy local registration on 17 October 2024, so every new applicant must apply for authorisation under MiCA. Firms registered before 30 December 2024 may rely on the transitional period until 1 July 2026 or until their licence is decided.

The application process averages four to six months, depending on how complete your submission is and CySEC's review timeline. Capital requirements run from €50,000 to €150,000 according to the specific services you intend to provide.

From 1 January 2026, a flat 8% tax applies to gains on the disposal of crypto-assets, charged separately from other income. Gains from mining are excluded and taxed under general income tax rules, and staking, airdrop, and yield-farming returns are also taxed as ordinary income, though their later disposal attracts the 8% rate.

It helps considerably but does not remove it. A licensed entity with proper documentation can be onboarded by EU banks and electronic money institutions, yet account opening remains slow and document-heavy; many operators run core payments through a passported EMI and keep the local bank account for payroll and compliance.

No. MiCA does not cover fully decentralised DeFi with no identifiable operator or unique NFTs, and there is no Cyprus-specific framework for either. A classification risk remains, since an NFT treated as a financial instrument would fall under MiFID II rather than the crypto-asset regime.

CySEC requires a staffed physical office, at least four directors with two executives resident locally, half the board as independent non-executives, and appointed compliance and anti-money-laundering officers. A virtual office is insufficient, and the larger the activity, the heavier the substance expected.

Legal Disclaimer

The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.

Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.

For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.