Panayiotis Rougalas
The implementation of the Markets in Crypto-Assets (MiCA) Regulation on July 1, 2026, marked a new chapter for Cyprus' crypto-asset market, with all related services now limited to providers that hold the required authorization.
On July 10, the Cyprus Securities and Exchange Commission (CySEC) reminded investors and service providers that Cyprus' transition period under the European Union's Markets in Crypto-Assets Regulation had ended. Since July 1, 2026, crypto-asset services may only be offered in accordance with MiCA.
CySEC also warned that customers using unauthorized providers do not benefit from MiCA's safeguards, including protections for client assets, and urged investors to verify companies through the European Securities and Markets Authority's (ESMA) register.
Twenty-two licensed providers
How many companies had secured authorization by July 1, 2026, when the full MiCA framework took effect?
According to data collected by Kathimerini from CySEC, based on figures as of June 30, 2026, a total of 22 companies had been licensed as Crypto-Asset Service Providers (CASPs) under MiCA.
The same data show that:
- 22 applications were still under review.
- Of the 22 licensed companies, 10 had previously operated under Cyprus' national regulatory framework.
- Only one company that had operated under the national regime chose not to apply for a MiCA license and has since stopped offering crypto-related services.
Increased regulatory scrutiny
On July 10, CySEC issued Circular C790, titled "ML/TF Risks Following the End of the MiCA Transitional Period," for Cyprus investment firms and other supervised entities.
The timing of the circular, released before the public reminder, shows that the regulator views the end of the transition period as more than a licensing issue. It also considers it an important anti-money laundering and counter-terrorist financing supervisory event.
For Cyprus-based CASPs, firms that integrate crypto functionality, payment companies, and white-label providers, the commercial question is no longer whether existing national registrations can bridge the regulatory gap.
Distribution, onboarding, marketing, and custody arrangements must now be tied to legal entities authorized under MiCA. Companies that continue relying on non-EU or unauthorized entities face greater risks of customer transfers, orderly wind-downs, and regulatory action.
Compliance teams should expect close scrutiny of customer migration processes, source-of-funds checks, crypto exposure through subsidiaries, interactions with unhosted wallets, sanctions screening, and the handling of customers previously served by entities that did not obtain MiCA authorization.
For many firms, the immediate priority is to maintain well-documented risk assessments and a clear, defensible decision-making process for any continuing crypto-related activities.
More intensive compliance checks
ESMA has said that wind-down arrangements must comply with all applicable European Union and national conduct requirements.
Crypto-Asset Service Providers should maintain effective controls throughout the wind-down process, including customer due diligence, transaction monitoring, sanctions screening, suspicious transaction and activity reporting, record-keeping, and overall regulatory compliance.
ESMA and the European Supervisory Authorities (ESAs) are also working with the European Banking Authority (EBA) and the new Anti-Money Laundering Authority (AMLA) to strengthen oversight across the sector.
What is MiCA?
Regulation (EU) 2023/1114 of the European Parliament and of the Council, adopted on May 31, 2023, established a harmonized framework for transferable crypto-assets that are not classified as financial instruments or otherwise excluded from the Regulation's scope.
MiCA applies to individuals, legal entities, and certain other organizations involved in issuing crypto-assets, offering them to the public, admitting them to trading, or providing crypto-asset services within the European Union.
The Regulation covers three categories of crypto-assets:
First are Asset-Referenced Tokens (ARTs), a regulatory category that generally corresponds to asset-backed stablecoins and is governed under Title III of MiCA.
Second are Electronic Money Tokens (EMTs), regulated under Title IV. Because these tokens function similarly to electronic money, they fall outside CySEC's supervisory responsibilities.
Third are all other crypto-assets that are neither ARTs nor EMTs. These fall under Title II of MiCA and make up the Regulation's residual category.
