Who had to register as a CASP in Cyprus, and what has replaced the register?

In 2021 Cyprus brought crypto-asset service providers into its AML/CFT regime. Article 61E of the AML/CFT Law required CySEC to set up, keep and publish a register of CASPs, and CySEC issued its Directive for the register of CASPs (R.A.D. 269/2021) under that article.

The test was a link to Cyprus, not the size of the business. Since an amendment in October 2023 (Law 98(I)/2023), three kinds of provider had to be entered in the register before offering any service: CASPs established in Cyprus; CASPs established elsewhere that provided services on a professional basis from Cyprus, whether or not they were registered in another Member State; and CASPs established elsewhere that provided services in Cyprus, unless they were already registered in another Member State for those services, in which case they had to notify CySEC and prove that registration instead. CySEC, not the Central Bank or an EU body, kept the register.

Since the same 2023 amendment, breaching the duty to register has been a criminal offence: on conviction, up to five years' imprisonment, a fine of up to €350,000, or both. The offence is still in the Law.

The Directive required the public register to show the CASP's name and trade name, its legal form, its legal entity identifier (LEI), its physical address, the services and activities it could provide, and its website, and CySEC marked in it any suspension for suspected non-compliance. CySEC's register page also gave registration numbers and contact details. Bank details and information about clients were not part of the register.

CySEC could remove a CASP from the register if it provided no crypto-asset services for six continuous months, had been registered through false statements or some other irregularity, had stopped all its services and activities, or no longer fell within the duty to register. A CASP could also ask to be removed, with a plan for winding down its business within six months, which CySEC could extend by up to six more.

Some changes were treated as material and needed CySEC's prior approval: any change to the services or activities provided, to the CASP's crypto-asset addresses, to the members of the Board or senior management, to the beneficiaries, or to the website. CySEC approved a material change only if the CASP would continue to meet Article 61E and the rules made under it. Simpler changes are covered in How were changes reported?

The EU's Markets in Crypto-Assets Regulation (MiCA) has applied to crypto-asset service providers since 30 December 2024. Under MiCA, nobody may provide crypto-asset services in the EU unless authorised as a CASP under MiCA or allowed to do so as an already regulated financial entity, such as an investment firm that notifies its regulator. CySEC stopped accepting applications for the national register on 17 October 2024.

Cyprus kept MiCA's full transitional period. CASPs that were lawfully providing services under the national rules before 30 December 2024 could continue until 1 July 2026, or until their MiCA application was granted or refused, if sooner. CySEC set 27 February 2026 as the deadline for applying and required firms that did not apply to submit wind-down plans. The transitional period has now ended: since 1 July 2026, crypto-asset services in or from Cyprus may be provided only under MiCA, and in March 2025 CySEC said it expected to stop maintaining the national register from that date.

Under a notification of the Minister of Finance (R.A.D. 199/2025), CySEC is the competent authority under MiCA for most applicants in Cyprus, while the Central Bank of Cyprus covers banks, electronic money institutions and payment institutions. In 2025 the AML/CFT Law was also amended to use MiCA's definition of a CASP and to remove the provisions on applying to the register. The exam material still tests the national regime, so its rules remain worth knowing.