The Cyprus government is taking steps to bring some clarity to the vague legal framework of the crypto-assets sector. The regulatory incentives, in line with favourable corporate income tax rate (12.5%) seem to attract more investment into virtual assets business. With this in mind, it is worth discussing if recent developments are enough to meet emerging industry standards.

Regulatory measures

Country’s primary financial regulator is the Central Bank of Cyprus (hereinafter referred as:-“CBC”) that supervises and issues licenses for setting up and operation of fintech businesses, including payment and electronic money institutions.

The Cyprus Securities and Exchange Commission (hereinafter referred as:-“CySEC”) administers operations and assures compliance with financial regulations and with the European MiFID financial harmonised law.

The Cyprus government has amended main statutory legislation in the industry – Electronic Money Law (2012) and 2018 consistent with the following EU directives:

• 2009/110/EC of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions; and
• (EU) 2015/2366 of 25 November 2015 on payment services in the internal market.

Registration and authorisation procedure

Accordingly, the electronic money services can only be carried out with the authorisation of the Central Bank of Cyprus or by remaining EU member states’ competent authorities.

The main requirement that has to be met to be granted an authorisation is that an e-money entity must be a legal person incorporated and registered in the Republic of Cyprus with a head office and must conduct part of its e-money service activity and/or provide payment services which are not associated with issuance of electronic money.

As per subsections (3) to (8) of section 5 of The Payment Services and Access to Payment Systems Laws of 2018 and 2019 the following documents are needed to apply:

• company identification details;
• program of operations;
• business plan;
• structural organization of the business;
• evidence of initial capital (€350.000 for Electronic money issuers);
• description of measures to safeguard funds of users;
• governance arrangements and internal controls;
• procedures for monitoring, handling, and following up on security incidents and security-related customer complaints;
• processes for filing, monitoring, tracking and restricting access to sensitive payment data;
• business continuity measures;
• the principles and definitions applicable to the collection of statistical data on performance, transaction and fraud;
• security policy document;
• internal control schemes to comply with obligations relating to money laundering and terrorist financing;
• identity and suitability assessment of persons with qualifying holdings (shareholders) in the applicant
• identity and suitability assessment of directors and persons responsible for the management of the payment institution;
• details of any outsourcing arrangements (auditors);
• professional indemnity insurance or a comparable guarantee for payment initiation services and account information services.

Once the application is filed it takes up to 4 months to receive a decision from CBC.

Except institutions

Meanwhile, the type entities listed below are exempt from applying to authorization by CBC to carry out electronic money business:

• banks licensed by the CBC or by any other EU member state’s competent supervisory authority;
• сooperative credit institutions which have obtained a license from the Authority for the Supervision and Development of Cooperative Societies of Cyprus.
• institutions that provide postal payment services and issue e-money owing to applicable law;
• European Central Bank, National Central Banks when not using their monetary and public powers;
• member states or their regional authorities when not acting in their capacity as public authorities;
• as well as Electronic money institutions authorised to operate by the competent supervisory authorities of other EU member states.

Above mentioned entities have a right to establish or to conduct cross-border e-money business activities on condition that the relevant bodies of their home member state send a notification to the CBC.

Anti money laundering measures and crypto asset service providers directive

Multiple competent authorities supervise activities related to the money laundering and terrorist financing, such as:

• The Central Bank of Cyprus
• The Unit for Combating Money Laundering (MOKAS)
• The Authority for the Supervision and Development of Cooperative Societies
• The Council of the Cyprus Bar Association
• The Council of the Institute of Certified Public Accountants

Pursuant to section 59(1)(a) of Prevention and Suppression of Money Laundering Activities Laws of 2007 and 2019 (hereinafter:- “AML law”) the electronic money, payment and currency exchange operators fall under the supervision of the CBC.

AML law is the only legal framework which recognizes crypto-assets. pursuant to the law, crypto-assets is ‘a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically and is not:

1. fiat currency; or
2. electronic money; or
3. a financial instrument that provides for the provision of investment services, the exercise of investment activities, the operation of regulated markets and other related matters.’

Under 61E(1) of the AML Law, on September 13, 2021, CySEC issued Directive 269/2021 which amended earlier ‘Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Register of Crypto Asset Service Providers)’ from 25th of June 2021.

According to the directive, CySEC establishes statutory requirements for Crypto and Virtual Asset Service Providers (hereinafter referred as:-“CASPs or VASPs”) to comply and to be featured in the register which maintains in its website. The register is open to public and includes the following data of members:

• name, trading name, legal form and registration number (legal entity identifier – ‘’LEI”);
• registered physical address;
• official website;
• services offered by the CASPs or VASPs;

The registration is mandatory for the following entities:

• CASPs providing or carrying out services or activities from Cyprus, despite their registration status in other EU members states to conduct similar service;
• CASPs providing or carrying out services or activities to Cyprus, except for those entities already holding valid registration from other EU member state’s respective registry to provide services or carry out such activities and services.

So, cryptocurrency service providers who are planning to offer any of the above listed activities must register with CySEC for the purposes of anti money laundering and combating terrorist financing.

Application for registration should also contain the following information:

• all public addresses of crypto-assets and/or of public keys/digital wallets controlled by the CASP;
• the crypto assets which the CASP operates or provides services for;
• the class of customers the CASP serves;
• details if the CASP is engaged in business payment of crypto assets;
• crypto asset ATMs, number and locations offered by CASP;
• jurisdictions in which CASP operates;
• registrations and licenses owned by CASP.

The official fee for reviewing applications and registration by CySec is €10,000. Upon successful registration, the first annual fee payment will be waived and subsequent yearly fee in the amount of €5,000 applies henceforth. In addition, the fee amount ranging from €1,000 – €5,000 applies to request changes to existing registration, depending on the nature of notification inquired.

Moreover, article 14 of the directive mandates CASPs to regularly maintain a minimum equity capital as following:

1. CASP that provide investment advice – €50.000;
2. CASP that provide investment advice as per Category 1 and / or any of below mentioned services – €125.000:

• reception and transmission of client orders;
• execution of orders on behalf of clients;
• exchange between crypto-assets and fiat currency;
• exchange between crypto-assets;
• participation and/or provision of financial services related to the distribution, offering and/or sale of crypto-assets, including the initial offering;
• placement of crypto-assets without firm commitment;
• portfolio management.

3.CASP that provides investment advice as per Category 1 or 2 and / or any of the below mentioned services – €150.000:

• administration, transfer of ownership, transfer of site, holding, and/or safekeeping, including custody, of crypto-assets or cryptographic keys or means enabling control over crypto-assets;
• underwriting and/or placement of crypto-assets with firm commitment;
• operation of a multilateral system, which brings together multiple third-party buying and selling interests in crypto-assets in a way that results in a transaction.

However, at the time of writing, CySECs Registry website has not yet been launched and does not seem to be fully operational.

Concluding remarks

All things considered, Crypto-assets have not yet developed into a distinct identity in the eyes of the law to be regulated as a separate type of economic activity. In the short run, it might not be possible to watch the impact of recent directives on economic activity in the internal market, thanks to the entry restrictions which might restrict new applicants. However, there is a hope that the recently proposed Markets in Crypto Assets Directive is believed to establish a universal framework across the EU and as time passes normalizes the widespread adoption of cryptocurrency across the member states.

The content of this article is intended to provide a general guide to the subject matter, not be considered as a legal consultation.

---

photo cource