Cyprus -- Regulatory Status Regulatory Overview

Cyprus has taken a proactive and comprehensive approach to regulating virtual assets, primarily driven by EU Anti-Money Laundering (AML) directives, and is preparing for the upcoming EU Markets in Crypto-Assets (MiCA) regulation.

Regulatory Approach

Cyprus's regulatory approach is comprehensive, focusing heavily on Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) requirements for Virtual Asset Service Providers (VASPs). It aims to provide clarity and oversight for entities operating in the crypto space, classifying them within existing financial regulatory frameworks where applicable, or creating new categories (like VASPs) when necessary.

Primary Regulatory Bodies

1. Cyprus Securities and Exchange Commission (CySEC)

   • Role: The primary regulator responsible for supervising and registering Virtual Asset Service Providers (VASPs) under the AML/CTF framework. It ensures compliance with AML directives, assesses the fitness and propriety of VASP management, and oversees operational requirements.
   • Website: https://www.cysec.gov.cy/

2. Unit for Combating Money Laundering (MOKAS)

   • Role: Cyprus's Financial Intelligence Unit (FIU), responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other information regarding potential money laundering and terrorist financing activities. While not a direct regulator of VASPs, it is central to the AML/CTF ecosystem.
   • Website: https://www.mokas.gov.cy/

Key Legislation Names and Dates

Cyprus's current virtual asset regulatory framework is built upon the transposition of EU Anti-Money Laundering Directives into national law.

1. The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (L. 188(I)/2007), as amended.

   • Date: Originally enacted in 2007, but significantly amended over time, particularly in 2021, to transpose the 5th Anti-Money Laundering Directive (AMLD5) and bring VASPs under its scope. These amendments defined "Virtual Assets" and "Virtual Asset Service Providers" (VASPs) and designated CySEC as the supervisory authority.
   • Key Provisions: Requires VASPs to register with CySEC, implement robust AML/CTF measures (KYC, transaction monitoring, risk assessments), report suspicious activities, and adhere to internal control procedures.

2. CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Regulatory Administrative Act No. 466/2021)

   • Date: Issued by CySEC in June 2021.
   • Key Provisions: This directive provides the detailed operational requirements and guidelines for VASPs registered with CySEC. It covers:
     • Registration requirements and process.
     • Categorization of VASP services (e.g., exchange between virtual assets and fiat, transfer of virtual assets, safekeeping, initial coin offerings).
     • Specific AML/CTF obligations (customer due diligence, record-keeping, risk management, internal controls, reporting obligations).
     • Organizational requirements (management, capital adequacy, professional indemnity insurance).
   • Information/Register: You can find details and the VASP Register on CySEC's website: https://www.cysec.gov.cy/en-GB/supervised-entities/vasps/register/

3. EU Markets in Crypto-Assets (MiCA) Regulation (EU) 2023/1114

   • Date: Adopted by the EU in May 2023.
   • Impact: MiCA will be the overarching, harmonized regulatory framework for crypto-assets across the EU, including Cyprus. It will replace the existing national AML-driven frameworks for certain aspects and introduce comprehensive rules for crypto-asset issuance, operation, and services.
   • Application Dates:
     • Rules concerning asset-referenced tokens (ARTs) and e-money tokens (EMTs) will apply from 30 June 2024.
     • Rules concerning other crypto-assets and crypto-asset service providers (CASPs) will apply from 30 December 2024.
   • URL: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114
   • Cyprus's Stance: CySEC is actively preparing for the implementation of MiCA, which will streamline the regulatory landscape and shift certain aspects from an AML-only focus to a broader prudential and market integrity framework.

Current Stance on Crypto Trading and Exchanges

• Permitted and Regulated: Crypto trading and the operation of crypto exchanges (classified as VASPs) are permitted in Cyprus, provided they are properly registered and supervised by CySEC.
• Registration Requirement: Any entity wishing to offer services related to virtual assets in or from Cyprus must apply for registration with CySEC as a VASP.
• Compliance Obligations: Registered VASPs are subject to stringent AML/CTF requirements, including:
  • Customer Due Diligence (KYC): Verifying the identity of their customers.
  • Transaction Monitoring: Monitoring transactions for suspicious patterns.
  • Risk Assessments: Conducting regular risk assessments related to money laundering and terrorist financing.
  • Reporting: Reporting suspicious transactions to MOKAS.
  • Operational Requirements: Adhering to organizational, governance, and capital adequacy requirements set by CySEC.
• Consumer Protection: While the current framework is heavily AML-focused, CySEC's oversight aims to instill a degree of market integrity and consumer protection through the fitness and propriety assessment of management and operational controls. MiCA will significantly enhance consumer and investor protection.

In summary, Cyprus has established a clear regulatory framework for virtual assets, particularly through its robust AML regime under CySEC's supervision. This proactive stance positions it well for the full implementation of the EU's MiCA regulation, which will further formalize and harmonize the crypto-asset landscape across the European Union.