An EU MiCA licence gives you market access. It does not automatically give you a credible board, workable governance, banking readiness, or an operating base that investors can understand.
Cyprus gives crypto businesses the infrastructure behind the licence: CySEC authorisation within an established financial-services market, with English-based legal practice and a cross-border operating environment.
Protegra takes you from Cyprus entity design and MiCA scope through authorisation, DORA readiness, banking preparation, and EU passporting.
A Cyprus CASP application is not won by producing more documents. It is won by making the business model, board, local management, financial projections, AML framework, ICT controls, and client-asset arrangements work together before CySEC starts testing the gaps.
We turn a Cyprus CASP application into a business that can operate after approval.
Start your application →Not separate legal, governance, and compliance workstreams. We work across exchange, custody, transfer, brokerage, advisory, portfolio management, trading platforms, AML, DORA, governance, and EU passporting.
A crypto business can look like one thing commercially and fall into a different MiCA service category once custody, wallet control, exchange activity, order flow, transfer services, or platform functionality are assessed. We define the service scope before the own-funds requirement, CySEC fee scope, and application architecture are fixed.
A Cyprus company needs more than a registered office and named directors. CySEC expects a governance structure that can demonstrate effective management, clear responsibilities, suitable key people, and meaningful oversight of the regulated activity. We structure the board, management responsibilities, AML ownership, risk, compliance, and decision-making around the business you will actually operate.
ICT governance, cybersecurity, outsourcing, incident response, access controls, business continuity, and third-party risk do not begin after authorisation. We build the DORA-related controls around your product, systems, providers, and transaction model before the file is submitted.
Cyprus introduced an 8% flat tax for qualifying profits from the disposal of crypto-assets from 2026. This treatment is separate from the general corporate-income-tax rate and does not automatically apply to every type of CASP operating revenue.
CySEC’s MiCA fees are service-based. Exchange of crypto-assets for funds or other crypto-assets is listed at €5,000 per service; custody and trading-platform operation carry higher fees.
A Cyprus-authorised CASP can provide its permitted services across the 27 EU Member States plus Iceland, Liechtenstein, and Norway after the relevant MiCA notification process.
The MiCA passport matters. But the company behind it must also work as an operating, governance, banking, and investor structure after authorisation.
MiCA defines three EU-wide CASP classes by service scope and minimum own-funds requirement. Cyprus applies the same framework as every other EU Member State. Identify your class below—then use the calculator to map your full Year 1 cost. Getting the class wrong at the start can mean costly reclassification later.
Advice, portfolio management, reception and transmission of orders, execution of orders, placing, and transfer services. The right starting point for firms not planning to hold client crypto-assets, offer exchange services, or operate a trading venue.
The most commercially relevant class for active crypto businesses. Covers exchange activity and custody—the natural fit for firms handling client assets, offering crypto-to-fiat or crypto-to-crypto exchange, or building a broader MiCA operating model.
The highest MiCA class, intended for firms planning to operate a crypto-asset trading platform. The right route for businesses building market infrastructure rather than offering individual crypto services.
The MiCA own-funds requirement is only one part of the Cyprus CASP project. A realistic Year 1 estimate includes legal preparation, CySEC service-based fees, Cyprus entity setup, board and key personnel, AML/CFT, DORA and ICT security, accounting, audit, banking readiness, and ongoing operations.
One licence, three levels — the regulator asks for exactly the same file in all three, and what changes is how much of it sits with you. The middle level is the default here: every price on this page is quoted at it, and the selector above the total switches between them. Moving up or down changes our fee and nothing else — not the capital, not the state fees, not the statutory clock. Carrying a file to the decision is not a promise of approval: no adviser can give one, and an adviser who does is selling you something other than advice.
A Cyprus CASP project is staged so that service scope, own funds, governance, local management, AML, DORA, banking preparation, and application evidence develop in the right order.
We map the services the company intends to provide: Exchange. Custody. Transfer. Reception and transmission of orders. Execution of orders. Placing. Advice. Portfolio management. Trading-platform operation. We then determine the appropriate MiCA class, own-funds category, CySEC fee scope, target markets, initial company structure, and governance design.
The Cyprus company is incorporated and the registered office is secured. The governance structure is designed around effective management and accountability, including: Executive management. Board structure and oversight. Cyprus-based decision-making. MLRO and AML responsibility. Compliance and risk ownership. ICT and DORA governance. Fit-and-proper documentation. Beneficial ownership and shareholder information.
We prepare the full MiCA application package: Business plan. Three-year financial projections. Own-funds analysis. Governance framework. AML/CFT policies and enterprise risk assessment. KYC, sanctions, and transaction-monitoring controls. Client-asset and custody arrangements. Outsourcing and vendor-governance framework. DORA-aligned ICT risk-management structure. Cybersecurity and incident-response procedures. Business-continuity plan. Client disclosures and complaint-handling procedures. Every document is built from the facts you give us: we describe the business you actually run, in the depth a supervisor reads it at.
The completed application is submitted to CySEC with the appropriate service-based fees. The authority receives one consistent picture of the company: the product, ownership, board, financial plan, client safeguards, AML controls, ICT environment, and operating model must all align.
CySEC reviews the application for completeness under the MiCA timetable. The authority has 25 working days to assess whether the file contains the required information. If material is missing or incomplete, CySEC can request additional information.
After the application is complete, the MiCA framework provides a 40-working-day decision period for the competent authority to grant or refuse authorisation. In practice, application readiness, information requests, governance questions, complex custody or platform features, ICT controls, and document revisions can affect the total project timeline.
After authorisation, the company can activate the MiCA passporting process for its priority EU and EEA markets. The business then moves into live operations with its AML, DORA, governance, custody, client-protection, reporting, and banking arrangements working from day one.
Authorisation is the beginning of supervised operations. We remain involved as the business moves from regulatory readiness to daily regulated activity.
Transaction monitoring, customer-risk review, sanctions controls, suspicious-activity escalation, and policy updates.
ICT risk management, incident response, vendor oversight, cybersecurity, access controls, operational resilience, and evidence maintenance.
Review of custody arrangements, client disclosures, crypto-asset information, marketing materials, complaints handling, and service changes.
Regulatory reporting, material-change notifications, supervisory communication, and support for passporting into additional EU and EEA markets.
Cyprus has financial-services infrastructure, but a MiCA application is still a detailed operating assessment. The most expensive delays occur when the licence scope, board, local management, AML controls, DORA framework, banking plan, and tax structure are treated as separate projects.
See how we work →A business can appear to be a simple exchange while its real model includes custody, client-wallet control, transfers, execution, or platform functionality. Each of those elements can affect the MiCA class, CySEC fees, own-funds category, governance requirements, and documentation required.
A registered office and named directors do not automatically demonstrate effective management. CySEC may assess whether responsibilities are clear, directors are fit and proper, decisions are made through the right governance structure, and key functions have genuine authority.
The statutory MiCA assessment clocks do not include every part of the real project. Entity formation, own-funds planning, management appointments, AML documentation, DORA readiness, outsourcing evidence, translations, clarification requests, and remediation can all add time.
Authorisation does not automatically produce a bank account, payment institution relationship, fiat settlement route, or reliable client-money process.
No. ICT governance, cybersecurity, outsourcing, incident response, and operational resilience are central to the application and remain ongoing obligations after approval.
Cyprus’s 8% regime relates to qualifying profits from crypto-asset disposals. It should not be treated as a universal 8% tax rate for every type of CASP revenue.
Select a challenge to see how a Cyprus CASP project moves from an attractive EU plan to a company ready for CySEC review and supervised operations.
“We described the business as an exchange, but our custody, wallet, transfer, and order-flow features meant the MiCA scope was more complex than we expected.”
“The service model was mapped before we committed capital. We knew what had to be included in the application, which costs applied, and why.”
“We had a Cyprus entity and directors on paper, but no clear explanation of where management decisions were made or who owned compliance, risk, and ICT controls.”
“The company became a real operating structure. The board, key functions, local responsibilities, and decision-making process all supported the same business model.”
“We were preparing the authorisation application separately from banking, technology, vendor management, and DORA controls.”
“The licence, operating systems, compliance framework, and launch plan were developed together. Authorisation did not leave us with a second implementation project.”
Reference: the Crypto-Asset Service Provider (CASP) authorisation under MiCAR Article 63 in the Licensing Atlas.
Leave your details and we will assess your business model, likely MiCA service scope, Cyprus governance requirements, and the first steps toward CySEC authorisation. You will receive a personalised Cyprus CASP licensing plan within 24 hours.
Poland used to be one of Europe’s most active crypto markets. Its virtual-currency register contained 1,841 businesses, ranging from small peer-to-peer operators…
The AFM published its MiCA expectations before applications opened. What Dutch CASP licensing really takes: two regulators, real substance, class choice.
Brussels reopened MiCA on 20 May 2026, months after its transition ended, while Brazil writes its first crypto rulebook. What both mean for 2026 plans.