Crypto Asset Service Providers

15 free CySEC AML Chapter 8 flashcards. Tap a card to flip, or use the arrow keys to move through the deck.

Card 1 of 15Registration

1 / 15

Tap the card to flip · use ← → arrow keys to navigate

All 15 cards in this deck

What is the legal basis for the CASP Register?: Article 61E of the AML/CFT Law — the crypto-specific hook, distinct from Article 54 (MOKAS) and Article 59 (CySEC).
When must a CASP register?: Under the national regime, before providing any service, if established in Cyprus, providing services from Cyprus, or providing services in Cyprus without registration in another Member State. Since 1 July 2026 a CASP needs authorisation under the EU MiCA Regulation instead.
How long does CySEC have to assess a CASP application?: Exam material: six months. Since 17 October 2024 CySEC takes no national applications; under MiCA, since 30 December 2024, completeness is checked within 25 working days and the decision follows within 40 working days of a complete application.
What can happen to a CASP that is inactive for six continuous months?: Exam material: it can be struck off the register, the same six-month figure the exam material gives for CySEC's assessment period. Since 1 July 2026, when only MiCA applies: the authorisation must be withdrawn if the CASP provides no crypto-asset services for nine consecutive months.

What is the minimum CASP board composition?: Exam material: at least four fit-and-proper members, two directing the business and two independent. Since 1 July 2026, when only MiCA applies: no minimum size, but members must be of good repute and competent, and at least one director must be resident in the EU.

What standard applies to a CASP's managers and beneficiaries?: Managers: honest and competent, with good reputation, knowledge, skills, experience and enough time. Beneficiaries: good reputation and the ability to keep the CASP financially sound.

Who can suspend a CASP, and what are the two correction windows?: The Chairman and/or Vice-Chairman of CySEC (Board informed next meeting). 7 days for information correction; 15 days for suspected non-compliance.
What can a suspended CASP not do, and what may it still do?: It cannot accept new clients, offer services, or advertise as registered — but it may wind down for existing clients (e.g. conclude transactions, return assets).

What are the notification deadlines for CASP changes?: Core identity changes: within one month. Operational-information changes: within 15 days. Material changes need prior approval.

What is the penalty for breaching the CASP registration obligation?: Up to 5 years' imprisonment and/or a fine of up to €350,000.

What is Policy Statement PS-01-2021?: CySEC's policy statement on the registration and operations of CASPs under the national regime, alongside the AML/CFT Law and the CySEC directives. That regime ended on 1 July 2026, when MiCA fully took over.

Are CASPs Obliged Entities?: Yes — full Obliged Entities to which all workbook chapters apply: KYC/CDD/EDD, source-of-funds checks, monitoring, and suspicious reporting.

What must a CASP do to protect client crypto-assets?: Run systems and controls that minimise the risk of theft or loss of clients' crypto-assets.

What conduct rules apply to CASP remuneration and client information?: Remuneration must not motivate aggressive selling, and client information (including marketing, clearly identified as such) must be accurate, clear and not misleading.

What does the public CASP register show?: Name, trade name, legal form and LEI; physical address; services and activities; website. The crypto-asset addresses went in the application but were not published. (National regime, replaced by MiCA from 1 July 2026.)