.png)
Your A to Z guide on how to become a Crypto Asset Service Provider in Cyprus
What is a Crypto-Asset?
Cryptocurrency (or Crypto-Asset) is a digital currency based on blockchain technology secured by cryptography that is not controlled by any central institution. The blockchain works as a ledger of transactions, enforced by a disparate network of computers and ensures the integrity of the transactional data. Due to the fact that crypto is not controlled by central authorities, it also eliminates the middleman (i.e. bank) and allows the counterparties to transact directly between each other and thus, transaction fees are significantly lower if not none.
The first and most famous cryptocurrency is Bitcoin, that was launched in January 2009. On May 2010 one of the first transaction in Bitcoin was carried out to buy two Pizzas for 10,000 Bitcoins valued at 8Euro. The same transaction today will be valued at over 500 million Euro.
CySEC’s definition of a Crypto Asset can be found in Directive 269/2021 and summarized below as:
“a digital representation of a value which is not issued by a central bank or public authority or guaranteed, is not necessarily linked to a legally circulating currency and does not have the legal status of currency or money, but is accepted by individuals as a means of trading or investment and can be transferred, stored or circulated electronically and is not
(a) fiat currency; or
(b) electronic money, or
(c) financial instruments as defined in Part III of the First Annex to the Investment Services and Activities and Regulated Markets Law;”
What is a Crypto Assets Service Provider?
While Crypto Assets as mentioned above are not controlled by any central institution, i.e. decentralized finance, nonetheless companies that offer Crypto Asset Services are regulated or are becoming regulated in the European Union and in most developed countries.
It is evident that there is a focus internationally, to increase transparency in various industries and to restrict anonymity or possible pseudonymity associated with virtual assets and wallet providers and therefore regulation of crypto assets became a necessity.
According to CySEC a Crypto Asset Service Provider is:
“a person who provides or exercises one or more of the following services or activities to another person or on behalf of another person, which do not fall under the services or activities of the obliged entities mentioned in paragraphs (a) to (h) of article 2A:
(a) Exchange between crypto assets and fiat currencies;
(b) Exchange between crypto assets;
(c) Management, transfer, holding and/or safekeeping, including custody, of crypto assets or cryptographic keys or means which allow the exercise of control on crypto assets;
(d) Offering and/or sale of crypto assets, including the initial offering; and
(e) Participation and/or provision of financial services regarding the distribution, offer and/or sale of crypto assets, including the initial offering” *
* “Financial Services Relating to the Distribution, Offering and/or Sale of Crypto-Assets” means the following services and activities relating to crypto-assets:
a) Reception and transmission of orders;
b) Execution of orders on behalf of clients;
c) Dealing on own account;
d) Portfolio management;
e) Provision of investment advice;
f) Underwriting and/or placing of crypto assets with a firm commitment;
g) Placing of crypto-assets without a firm commitment;
h) Operation of a multilateral system, which brings together multiple third-party buying and selling interests in crypto assets in a way that results in a transaction."
The Regulatory Framework
Earlier this year, Cyprus finally became fully harmonized with the 5th AML Directive and on 25/06/2021 CySEC issued a Directive (R.A.A. 269/2021) for the regulation & registration of Service Providers concerning Crypto Assets pursuant to the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007, Law 188(I)/2007, as amended.
CySEC has been appointed as the supervisory authority that will regulate CASPs as well as the creation, maintenance and update of CASP registrar. Additionally, CySEC will be the authority supervising the conditions and requirements for the registration of CASPs in the aforementioned registrar. Even though Crypto Assets are not fully regulated in Cyprus, the Republic has taken the first steps to regulate the services around crypto assets.
In addition to the aforementioned Directive, CySEC has also issued a thorough Policy Statement (PS-01-2021) on the Registration and Operations of a CASP to create a framework for CASPs. Through its Policy Statement CySEC gives greater information to the sector about CySEC's opinions on the various forms of crypto assets available. Crypto-assets is a wide-ranging term that covers a diversified group of assets that use encryption and Distributed Ledger Technology (DLT).
The regulator underlines that crypto-assets may be:
Financial instruments under the Investment Services and Activities and Regulated Markets Law, transposing MiFID II
Electronic Money under the Electronic Money Law transposing EMD2 or
A digital representation of value that is neither issued nor guaranteed by a central bank or a public authority, it is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored, and traded electronically, and it does not qualify neither as fiat currency, nor as Electronic Money or Financial instruments (as above)
Through its policy statement clarifies that the CASP regime is focused on registering and regulating businesses engaged in services/activities as envisages in point (iii) above.
Which businesses are eligible and must acquire a CASP registration?
The following service providers are required to acquire a CASP registration:
CASPs who supply or carry out professional services or operations from Cyprus, irrespective of whether the services or operations they provide are registered in another Member State's register.
CASPs which provide professional services or operations in Cyprus, with the exception of persons who provide services or operations in Cyprus in regard to crypto-assets and who are registered in a Member State's register for the services or activities they provide.
Based on the crypto asset description analysed above the CASP registration concerns the following cases (not exhaustive):
A. Cryptocurrency exchanges such as online markets where someone can buy and sell crypto assets, NFTs and other intangible tokens and/or digital assets.
B. Businesses that provide management, administration, transmission, transfer, custodianship, and safeguarding of crypto-assets or cryptographic keys, as well as anybody who provides methods to exert control over crypto-assets (Crypto Wallet providers).
C. All initial offerings including; Initial Coin Offering (ICO), Security Token Offering (STO), Initial Exchange Offering (IEO), Initial Dex Offering (IDO) as well as the participation and/or provision of financial services regarding the distribution, offer and/or sale of crypto assets, including the initial offering
Registration Requirements
All CASP candidates must complete and submit the application form, as well as any required questions and supporting paperwork. A CASP must also meet the following conditions for registration and operation in order to effectively get and retain their crypto-assets services provider registration:
Capital requirements based on the CASP Classes (found below)
The capital requirement varies in range depending on the specific class of the CASP from 50,000 EUR to 150,000 EUR.
Own Funds
CASPs need to have available own funds at any time, be equal or greater than the maximum of:
Their initial capital as per their CASP class
¼ of the CASP’s fixed overhead of previous years. The provision of this will be employed as follows:
From January 1, 2022, 30%
From January 1, 2023, 60%
From January 1, 2024, 100%
Directors & Shareholders &Functions
UBOs, directors, and those in management positions must have a good reputation and be competent (to fill these positions). Furthermore, beneficiaries with a qualifying holding in the CASP must be financially able.
The CASP board must include at least four directors, two of which are executive directors and the other two are independent non-executive directors. The majority of the board members must be permanent residents of Cyprus. It is also necessary for the employees of the CASP to have the necessary knowledge, experience, and competence to carry out their obligations.
No conflict of interest
The close links between the applicant and other natural or legal persons do not preclude the effective monitoring, evaluation and supervision by CySEC. Where the natural or legal person with whom the applicant has a close connection is in a Third Country, the laws, regulations or administrative provisions of the Third Country shall not impede the effective performance of the supervisory functions
Appointment of an AML Compliance Officer who will belong to the senior management of the CASP
Internal Auditor Function may be required depending on its nature, scale and complexity of the CASP
Policies
CASP applicants need to have appropriate policies and procedures in accordance with the law and applicable directives
Good governance framework that is clear and transparent
Adequate systems and control mechanisms to reduce the risk of data theft or loss relating to its clients' crypto-assets;
Adequate administrative and accounting procedures, internal control mechanisms, effective risk assessment methods, and electronic data processing system control and security measures;
Adequate security procedures to confirm and verify the legitimacy of the means of transferring information, reducing the risk of data loss and unauthorized access, and avoiding information leakage, ensuring that data confidentiality is always maintained.
Appropriate and adequate AML and Risk procedures
Website
If the CASP is operating online it must have a website that is only owned and operated by the CASP itself, with no prospect of anybody else using it.
Application Package
CySEC Application form
Due Diligence and KYC on Directors, Shareholders/UBOs & Higher Management
AML Manual
Operations manual
Organizational structure
Internal Policies
For the review of the application for a CASP applicant a fee of 10,000 EUR must be submitted to CySEC and the annual renewal fee is set at 5,000 EUR
CASP Classes
How we can assist
Flexi can offer all-inclusive licensing and post licensing services through our dedicated team and our experience in submitting applications to several authorities in Cyprus for various industries. Allow us to take care of the regulations of your CASP registration in a simple manner.
*DISCLAIMER: This article and its publication are intended to provide a brief introduction and act as a general guide. This is provided for information purposes only and cannot be utilized as a substitute for professional advice. This document does not represent a legal opinion and one must not rely on it without receiving independent advice based on the particular facts of its own case. No responsibility is accepted by the author or the publishers for any loss suffered from acting or refraining from acting based on the contents of this publication.
We are a team of experienced professionals, all sharing a unique drive for learning and development through teamwork. The Group utilizes its various core activities to implement customized solutions for its clients. Our collective experience spans the areas of Global Corporate & Fiduciary Services, Assurance & Advisory Services, Fund Administration, Tax Advisory, Corporate Governance, Financial Services, Private Wealth Services and Compliance.
Start a conversation with us today to find out how you can benefit from a relationship with Flexi Group.
Please get in contact with our Head of Business Development:
Mrs Daniella May / Head of Business Development
Tel.: + 357 7000 2 5555 / + 357 22 87 57 55
We also organize calls using Skype. Our flexi Skype ID is web@flexi-group.net