Skip to content
← Legal Guides
The Global Legal Post, Law Over Borders Comparative Guide: Cryptoassets – Cyprus chapter by Christopher Lytras and Thea Kallasidi of Lytras & Associates

Crypto-Assets Law in Cyprus: A Simple Guide

Crypto-assets law in Cyprus in 17 questions: MiCA licensing, advertising, custody, anti-money laundering, property and insolvency, crypto fraud claims, the 8% tax and DeFi.

This guide answers, in plain terms, the questions covered in our Cyprus chapter of the Law Over Borders Cryptoassets Law Guide (Global Legal Post, June 2026). Read the full chapter on Global Legal Post.

(A) Definitions and regulation

What is a crypto-asset under Cyprus law?

  1. Cyprus law uses 2 definitions:

(a) under the Prevention and Suppression of Money Laundering and Terrorist Financing Law 188(I)/2007 (the "AML Law"), a crypto-asset is a digital representation of value that is not issued by a central bank or public authority, has no legal tender status, is used as a means of exchange or for investment, and is not fiat currency, electronic money or a financial instrument; and

(b) under Regulation (EU) 2023/1114 (the "MiCA Regulation"), a crypto-asset is a digital representation of value or of a right that can be transferred and stored electronically using distributed ledger or similar technology.

Which laws and regulators apply?

  1. The main rules are the AML Law, the MiCA Regulation, Regulation (EU) 2023/1113 on the information that must accompany transfers of funds and crypto-assets (the "Transfer of Funds Regulation"), and the directives of the Cyprus Securities and Exchange Commission ("CySEC").
  2. CySEC authorises and supervises crypto-asset service providers ("CASPs"), the Unit for Combating Money Laundering (MOKAS) receives suspicious activity reports, the Central Bank of Cyprus supervises issuers of e-money tokens, and the National Sanctions Implementation Unit monitors compliance with sanctions.
  3. CySEC stopped accepting registrations under the old national regime in October 2024, the MiCA Regulation has applied since 30 December 2024, and the transitional period for CASPs registered under the old regime ended on 1 July 2026, so anyone providing crypto-asset services in or from Cyprus now needs authorisation under the MiCA Regulation.

How does the MiCA Regulation classify crypto-assets?

  1. The MiCA Regulation sets 3 categories:

(a) e-money tokens, which reference a single official currency, are treated like electronic money and may be issued only by credit institutions or electronic money institutions;

(b) asset-referenced tokens, which reference other assets, rights or currencies, and whose public offer needs CySEC authorisation, an approved white paper, reserves and governance safeguards; and

(c) all other crypto-assets, such as utility tokens, whose offer needs a white paper notified to CySEC unless an exemption applies. 6. Non-fungible tokens (NFTs) generally fall outside the MiCA Regulation, unless they are issued in a large series or fractionalised so that they are in substance fungible.

(B) Licensing and conduct

Does a crypto business need a licence?

  1. A business that provides crypto-asset services, such as custody, exchange, operating a trading platform or transferring crypto-assets for clients, needs CySEC authorisation as a CASP, which then allows it to serve clients across the EU.
  2. The applicant must be a Cyprus company with its registered office, management and staff here, fit and proper managers, a business plan, anti-money laundering and risk procedures, and minimum capital of €50,000, €125,000 or €150,000 depending on the services it provides.

What rules apply to advertising?

  1. Marketing must be fair, clear and not misleading, consistent with the white paper and identify the offeror or the CASP, and it must not overstate returns or play down risks, while the Consumer Protection Law 112(I)/2021 also applies, including to influencer marketing.
  2. A retail buyer in a public offer of crypto-assets other than e-money and asset-referenced tokens has 14 days to withdraw, and CySEC can order marketing material to be amended, suspended or withdrawn.

What rules apply to custody?

  1. Anyone holding crypto-assets or private keys for clients is a CASP and must keep client assets segregated from its own, maintain strong security, and have complaints and internal control procedures.

What anti-money laundering rules apply?

  1. CASPs are obliged entities under the AML Law and must identify and verify their clients, build an economic profile and establish the source of funds, monitor transactions on a risk basis, apply enhanced due diligence to politically exposed persons and high-risk countries, and report suspicious activity to MOKAS.
  2. They must also have written anti-money laundering policies and a compliance officer, and send and receive with every transfer the information about the sender and recipient that the Transfer of Funds Regulation requires.

(C) Property, ownership and structures

Are crypto-assets property?

  1. In our view crypto-assets are property under Cyprus law, because through section 29 of the Courts of Justice Law 14/1960 the common law forms part of Cyprus law and the courts apply the approach in AA v Persons Unknown [2019] EWHC 3556 (Comm), and the Cyprus courts have already granted proprietary and freezing injunctions over crypto-assets, although no reasoned judgment has yet been published.

Who owns and controls a crypto-asset?

  1. Control follows the private key, so whoever holds the private key for a wallet controls the crypto-assets in it, and where a custodian holds the key for a client, the client remains the owner.

How are DAOs treated?

  1. Cyprus has no law on decentralised autonomous organisations (DAOs), so depending on how it is run a DAO may be treated as a partnership or an unincorporated association, and because the MiCA Regulation requires a CASP to be a legal person, a DAO carrying on regulated activities must do so through a company.

What happens if a CASP becomes insolvent?

  1. Insolvency is governed by the Companies Law, Cap. 113 and the Bankruptcy Law, Cap. 5, with no special regime for crypto-assets, but the MiCA Regulation requires a CASP to keep client crypto-assets segregated, which protects clients if the CASP becomes insolvent.

Are smart contracts enforceable?

  1. A smart contract is enforceable under the Contract Law, Cap. 149 like any other contract, provided there is offer, acceptance, consideration, certainty and an intention to create legal relations, and because it executes automatically there is usually less need to enforce it.

(D) Disputes and enforcement

What can a victim of crypto fraud do?

  1. A victim can bring proprietary and personal claims, including for misrepresentation, deceit, conspiracy, unjust enrichment and conversion, and claims for dishonest assistance or knowing receipt against those who helped, under the Civil Procedure Rules 2023, which are modelled on the English rules.
  2. The court can grant proprietary and freezing injunctions, Chabra orders against third parties holding assets for the wrongdoer, Norwich Pharmacal and Bankers Trust orders requiring exchanges and banks to disclose information, search and imaging orders, and the appointment of receivers, and orders can be made against persons unknown until the wrongdoer is identified.

How are judgments enforced?

  1. A judgment can be enforced by delivery up of the assets, garnishee and attachment orders, charging orders, orders for the debtor to disclose his assets, payment by instalments and the appointment of a receiver.

(E) Tax, data protection and DeFi

How are crypto-assets taxed?

  1. From 1 January 2026, the profits of any person, individual or company, from disposing of crypto-assets are taxed at a flat 8% under the Income Tax Law 118(I)/2002, as amended by Law 244(I)/2025, and a disposal includes selling crypto-assets for money, exchanging one crypto-asset for another and using them to pay for goods or services.
  2. Losses on crypto-assets can be set only against crypto gains of the same year, and crypto-assets acquired through mining fall outside the 8% rate and are taxed under the ordinary rules.

What data protection and cybersecurity rules apply?

  1. CASPs must comply with the GDPR and Law 125(I)/2018, with data protection policies, a data protection officer where required, safeguards for transfers outside the EEA and clear privacy notices, and with the cybersecurity requirements of the MiCA Regulation and the Digital Operational Resilience Act, Regulation (EU) 2022/2554.

Are DeFi, staking and yield farming regulated?

  1. Staking, yield farming and other decentralised finance activities are not specifically regulated in Cyprus, and the MiCA Regulation generally does not reach fully decentralised services with no identifiable operator, but a Cyprus business that holds users' assets, operates a platform or executes transactions for them needs CySEC authorisation as a CASP.

(F) How we can help

Lytras & Associates LLC advises crypto businesses on CASP authorisation under the MiCA Regulation, white papers, anti-money laundering compliance and the 8% tax regime, and acts for investors and companies in crypto fraud and asset recovery claims.

Talk to our crypto team

We reply within 1 working day.

This guide is general information on Cyprus law as at May 2026 and is not legal advice.

Share this article