Tax Summary:

1. Personal income tax – from 0 to 35%
2. Corporate income tax- 12.5%

What law/s governs VASP activities?

1. The Electronic Money Law of 2012 (81(I)/2012)
2. The Prevention and Combating of Money Laundering Law of 2007 (L. 188(I)/2007)
3. Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018)

What activities are included in VASP services?

According to article 2 of the Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018), the activities of crypto asset service providers (CASP) include the following:

1. Exchange between cryptoassets and fiat currencies.
2. Exchange between cryptoassets.
3. Managing, transferring, transferring, holding, and/or custody, including custody, of cryptoassets or cryptographic keys or means that allow the exercise of control over cryptoassets.
4. Offer and/or sale of crypto-assets, including the initial offer.
5. Participation and/or provision of financial services related to the distribution, offering and/or sale of crypto-assets, including the initial offering.

Who is the VASP regulator?

1. The Cyprus Securities and Exchange Commission (CySEC) – mainly supervision of CASPs
2. Central Bank of Cyprus (CBC) – mainly supervision of EMIs

What is the procedure for registering a VASP for a local company?

According to the Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018), companies must get a license to provide CASP`s services, procedure of obtaining license includes the following:

1. Submit an application to the CySec email along with required documents according to subsections 3 and 8, section 5 of the Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018):
   • A programme of operations, setting out in particular the type of payment services envisaged.
   • A business plan including a forecast budget calculation for the first three (3) financial years.
   • Evidence that the payment institution holds initial capital (minimum 125,000 or 150 000 euros if the applicant intends to provide additionally custodial wallet services).
   • A description of the measures taken for safeguarding payment service users’ funds.
   • A description of the applicant’s governance arrangements and internal control mechanisms.
   • A description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints.
   • A description of the process in place to file, monitor, track and restrict access to sensitive payment data.
   • A description of business continuity arrangements including a clear identification of the critical operations, effective contingency plans and a procedure to regularly test and review the adequacy and efficiency of such plans.
   • A description of the principles and definitions applied for the collection of statistical data on performance, transactions and fraud.
   • A security policy document, including a detailed risk assessment.
   • The applicant’s legal status and articles of association.
   • The identity of persons holding in the applicant, directly or indirectly.
   • A description of the applicant’s structural organization.
   • The address of the applicant’s head office.
2. Competent Authority evaluates application based on criteria like:
   • Initial capital requirements (minimum €350,000) (Article 7).
   • Robust governance arrangements, organizational structure, risk management procedures (Article 11).
3. If criteria met, CySec grants operating license to CASP.

Is there any specific authorization required for a VASP from another EU member state to provide services in this jurisdiction?

According to the Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018), CASPs/VASPs from other EU members are not required to additionally authorize or obtain a license in Cyprus to perform their activities.

What is the liability for the activities of a VASP from another EU member state without local registration/authorization in this jurisdiction?

According to section 26 of the Law on the Provision and Use of Payment Services and Access to Payment Systems (31(I)/2018, providing payment services without CASP license is a criminal offense and may be punished with a prison sentence not exceeding 2 years or with a fine not exceeding €85,000 and/or with both of these penalties.

Manimama Legal & Growth Agency provides a gateway for the companies operating as the virtual asset wallet and exchange providers allowing to enter to the markets legally. We are ready to offer an appropriate support in obtaining a license with lower founding and operating costs. We offer KYC/AML launch, support in risk assessment, legal services, legal opinions, advice on general data protection provisions, contracts and all necessary legal and business tools to start business of virtual asset service provider.

The content of this article is intended to provide a general guide to the subject matter, not to be considered as a legal consultation.