DeFi regulation & security
DeFi regulation in Cyprus
Cyprus requires an entity-specific MiCA route. EMT custody and transfers can also raise payment-services questions for the Central Bank of Cyprus.
- Sources checked
- Published
- Prepared by
- DeFi Security Alliance
Scope: Republic of Cyprus MiCA application and EMT payment-service boundaries. This guide does not extend EU rules to areas where the acquis is suspended or give a complete payment licensing checklist.
Separate CySEC and Central Bank responsibilities
The Cypriot designation of competent authorities assigns ordinary CASPs to CySEC while the Central Bank of Cyprus (CBC) handles specified supervised financial institutions and EMT responsibilities. Determine the applicant's existing status, token type and requested service together.
Article 60 is available only to the eligible institution and services identified by MiCA. A payment-institution license does not automatically establish that route. For a DeFi product, inventory customer contracts, execution, custody and interface control before selecting the filing.
Keep the CySEC application and attachments traceable
CySEC Form 2 under Article 62 asks applicants to retain the questions, explain non-applicable items and preserve the numbered attachment references in Part D. Its instructions call for a Word-format form. Information previously supplied or publicly available should not be assumed to be known to the reviewer.
Build an attachment index before assembling policies. Record the document owner, version and form reference. An incomplete file can be returned. Changes to an existing authorization require their own assessment and supporting material.
Assess EMT payment functions separately
The CBC's guidance on CASPs and limited payment services discusses EMT custody and transfers on behalf of clients, including wallets that allow payments to third parties. Depending on the activity, a payment-institution authorization or an arrangement with an authorized payment-service provider may be needed. The payment passport is separate from the MiCA passport.
Pharos Production's crypto custody risk guide supports the technical description of signing, recovery and contract permissions. It cannot decide the payment-law classification. This DeFiSec worksheet supports that discussion and is not an official form.
| Decision | Evidence to prepare | Review question |
|---|---|---|
| Institution type | Existing authorization and corporate identity | Does CySEC or CBC handle the relevant activity? |
| Form references | Numbered attachments and document versions | Can the reviewer find the current evidence? |
| EMT movement | Client instructions, beneficiaries and wallet capabilities | Does this function also constitute a payment service? |
| Supplier permissions | Custody and payment contracts with their service scope | Are both regulatory routes covered where required? |
Check the current permission and territorial scope
CySEC's transition notice requires the relevant MiCA basis after 1 July 2026. Earlier application deadlines or a pending application do not by themselves establish current operating permission.
Article 1(1) of Protocol No 10 on Cyprus suspends the EU acquis in areas where the Republic's government does not exercise effective control. A translated guide does not change that territorial rule. See the EU transfer-data guide for the separate Travel Rule analysis.
Continue your research
Sources and further reading
Legislation and regulator publications establish the legal basis. Technical resources explain implementation. Source checks cover the passages cited in this guide.
- MiCA — Regulation (EU) 2023/1114European Union ·
- Smart contract risk in crypto custodyPharos Production ·
- Form 2: application under MiCA Article 62CySEC ·
- CASPs and limited payment servicesCentral Bank of Cyprus ·
- MiCA transition arrangementsCySEC ·
- 2003 Accession Treaty, Protocol No 10 on CyprusEuropean Union ·