Amendments to the Cyprus AML Law in light of the Markets in Crypto Assets Regulation (MiCA)

The Markets in Crypto Assets Regulation (MiCA) was approved by all EU member states last May and it is expected to be in full effect by the end of 2024, marking one of the first comprehensive regulatory frameworks for crypto assets in the world. The regulation represents an initial endeavour to harmonise the rules and establish a common framework within the EU market and the EEA economic area, under which crypto trading platforms, crypto related investment activities, traders and token issuers can be licensed and operate.

Each member state is now required to make the necessary adjustments in local legislation and preparation before MiCA’s full implementation. A primary and pivotal requirement under MiCA mandates that member states identify a formal authority where Crypto Asset Service Providers (CASPs) can seek licensing to operate. In Cyprus, the Cyprus Securities and Exchange Commission (CySec) is the designated national competent authority for CASPs to apply for and obtain licences to operate. CySeC will therefore supervise and regulate these entities under MiCA provisions and the Anti-Money Laundering and Counter Financial Terrorism (AML/CFT) related laws and regulations.

The recent amendments to the Anti-Money Laundering Law 188(I)2007 (hereinafter AML Law) in Cyprus define and cover CASPs in line with the MiCA framework. The law, will now be applicable to CASPs that fall into one of the below categories:

(i)                  They have been established in the Republic of Cyprus;

(ii)                They have not been established in the Republic of Cyprus but operate and offer services through the Republic of Cyprus

(iii)               They have not been established in the Republic of Cyprus but operate and offer services to the Republic of Cyprus, unless they have been registered in another member state for the services they offer within the Republic of Cyprus

CASPs falling into these categories must apply for licensing and register within CySec before commencing operations. The register being maintained is publicly available and can be found here: Cyprus Securities and Exchange Commission | CASP REGISTER (cysec.gov.cy)

Another important amendment in the AML law is the imposition of penalties on CASPs failing to comply with the legislation. Those operating or offering services in the Republic without licensing or appearing in CySec’s register can face up to 5 years of imprisonment, administrative fines of up to €350,000, or both.

Beyond the AML/CFT Law, Cyprus’ regulatory framework also includes:

• The CySEC Directive for the register of crypto asset services providers;
•  The CySEC directive for the prevention and suppression of money laundering and terrorist financing.

The regulatory framework encompasses rules, pertaining to:

•  The fitness and probity of the CASP beneficiaries and persons holding a management position;
•  The conditions in relation to CASPs registration;
•  The organisational and operational requirements;
•  Preforming Know Your Client and appropriate due diligence measures;
•  Drawing the economic profile of clients;
•  Identifying the source of client funds;
•  Monitoring the clients’ transactions;
•  Identifying and reporting suspicious transactions;
•  Undertaking a comprehensive risk assessment in relation to clients’ activities and take proportionate measures per client, activity and crypto-asset in question.

CySec categorise CASPs into three classes based on the crypto asset services they offer. Each class also has different initial capital requirements as shown below:

Source: Cyprus Securities and Exchange Commission | CRYPTO ASSET SERVICES PROVIDERS (CASP) (cysec.gov.cy)

Additional fees include €10,000 for the examination of the registration application and €5,000 fee for renewal of registration from the second year and onwards.

CASPs registered within the EEA under another competent supervisory authority of another member state must notify CySec of their intention to provide services in Cyprus. Evidence of their registration and activities with the relevant supervisory authority must be provided to CySec to ensure compliance with registered activities within the EEA.

The MiCA regulation signifies a crucial milestone in establishing a harmonized regulatory framework in Europe for Crypto Asset activities. Simultaneously, Cyprus' legal regime aligns with recent regulatory updates, offering a secure and reliable framework for CASP entities and businesses to register under CySec and transition under the MiCA licensing and compliance requirements, when it is in full effect.

The content of this article is valid as at the date of its first publication. It is intended to provide a general guide to the subject matter and does not constitute legal advice. We recommend that you seek professional advice on your specific matter before acting on any information provided. For further information or advice, please contact Lefteris Eleftheriou, Trainee Lawyer at our Nicosia office, Tel +357 22447777 or email lefteris.eleftheriou@kyprianou.com