Cyprus crypto licensing: the window closed 210 days ago

Most guides to setting up a crypto business in Cyprus are still written in the future tense. They should not be. The licensing window under MiCA opened and closed this year, and the dates have passed.

The calendar, plainly:

• 27 February 2026: the deadline for existing providers to file a MiCA application with CySEC. That was 210 days ago.
• 1 July 2026: the end of the transition for firms that filed in time. That was 86 days ago.
• Today: only a CySEC-issued MiCA CASP licence permits crypto-asset services from a Cyprus base.

That is the single most useful fact about Cyprus right now and it is the one least often stated. Authorisation comes from the Cyprus Securities and Exchange Commission, and the regime covers exchanges and trading platforms, custodial wallets, advisory and portfolio management, placement and transfer services, and issuers of asset-referenced and e-money tokens. Minimum capital runs at €50,000, €125,000 or €150,000 depending on which of those a firm does.

Two correct tax answers

The tax picture is where readers most often go wrong, because two correct answers look contradictory. Profits from disposing of crypto-assets are taxed at a flat 8% under Article 20E of the Income Tax Law. A Cyprus tax resident with non-domiciled status may nonetheless owe nothing on the same gains: crypto is not immovable property so capital gains tax does not apply, investment activity is not trading income, and the special defence contribution is waived under the non-dom exemption. Which answer applies depends on status and on whether the activity is investing or trading, and that distinction is decided on facts rather than on preference.

One number quietly changed for companies. Cyprus built its reputation on a 12.5% corporate rate; from 1 January 2026 the headline rate is 15% under this year's tax reform, a 20% increase in relative terms. A crypto firm incorporating in Cyprus in 2026 is choosing the jurisdiction for its regime and its access to the EU market, not for the rate it used to be known for.

“Cryptocurrency changes the route of money, but does not erase its biography.”

— Yaroslav Meretskyi, Jurisprudential Consulting Group

Yaroslav Meretskyi, writing for this publication on how tax authorities find undeclared crypto income

A licence is a permission, reporting is a pipe

Reporting is the part that outlasts any licence decision. DAC8 took effect across the EU on 1 January 2026, 267 days ago, and requires crypto-asset service providers to report their users' transactions to tax authorities, which then exchange that information automatically between member states. Cyprus is inside that perimeter like every other member. We published a full guide to how those points of contact actually work, and the short version is that a licence is a permission while reporting is a pipe.

What to watch next is European rather than Cypriot. ESMA has made tokenization a supervisory priority from 2027, which means national regulators including CySEC will be mapping where it is emerging and checking a sample of firms. Cyprus does not yet have a page in our regulation map, and on the evidence above it has earned one: an EU member with a closed licensing window, an 8% headline rate, a non-dom exemption and a corporate rate that just rose.

Informational material, not tax or legal advice. Rates and thresholds are those published for 2026 and depend on residency status, the nature of the activity and individual facts.