Self-custodial wallet / non-custodial software in Cyprus
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Cyprus without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
Key Restrictions
- A publisher of self-custodial wallet software does not hold, control, or have access to user private keys or funds, and therefore does not fall within the scope of CASP definitions under MiCA or 5AMLD (which target 'custodian wallet providers' and 'custody and administration of crypto-assets on behalf of clients').
- The operator is not a CASP for purposes of CySEC registration under PS-01-2021 or MiCA and has no registration/licensing obligation.
Key Risks
- Regulatory interpretation risk: If the software publisher exercises any degree of control over keys (e.g., via cloud key management, recovery services, or multi-party computation infrastructure), it could be reclassified as a custodian wallet provider and become subject to full CASP licensing and AML obligations.
- MiCA transitional risk: Post-December 30, 2024, national regulators may adopt a broader interpretation of 'custody and administration of crypto-assets' under MiCA Article 67 that could capture certain non-custodial service models.
- Consumer-protection liability risk: Even without AML/VASP classification, Cyprus consumer protection and e-commerce disclosure laws (transposing EU directives) apply to software publishers, including requirements for clear terms, privacy notices, and commercial communications.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Directive (EU) 2018/843 (5AMLD): Crucially extended the scope of EU AML rules to include crypto-asset exchanges and custodian wallet providers, requiring them to be regulated and subject to AML/CFT obligations.
Management, transfer, holding, and/or safekeeping of crypto assets or cryptographic keys or means which allow the exercise of control over crypto assets.
CASPs offering "custody and administration of crypto-assets on behalf of clients" will require authorization as a CASP under MiCA. CySEC will be the competent authority for authorizing and supervising CASPs in Cyprus.
Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A self-custodial wallet software publisher that never holds, controls, or accesses user private keys is not classified as a VASP/CASP under 5AMLD or MiCA in Cyprus, and faces no licensing or AML obligations, but must comply with general EU consumer protection and e-commerce disclosure requirements applicable to software publishers.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?