Crypto Asset Service Providers

Services related to crypto-assets (a.k.a. virtual assets) have seen a tremendous growth during the last few years. The Cyprus Securities and Exchange Commission (CySEC), in line with the European Securities and Markets Authority (ESMA) guidance on Initial Coin Offerings (ICO) and Cryptocurrencies, has determined that money laundering is one of the most significant risks identified in this sector. CySEC, like ESMA, believes that all crypto assets and related activities should be subject to AML provisions. The Financial Action Task Force (FATF) has also concluded that Distributed Ledger Technology (including Blockchain) presents new opportunities for criminals and terrorists to launder proceeds or finance illicit activities, adding to the consensus. 

On 19 June, 2018, the European Parliament announced the adoption of the Fifth Anti-Money Laundering Directive 2018/843 (the “AMLD5 Directive”). 

In an effort to prevent the exploitation of platforms that offer virtual currencies for money laundering and terrorist financing purposes, the AMLD5 Directive expands the scope of previous directives. Virtual currencies are now legally defined, while providers engaged in the exchange services between virtual currencies and fiat currencies, as well as custodian wallet providers, now fall under the scope of the AMLD5 Directive. The virtual currencies market is now forced to implement adequate anti-money laundering control frameworks and comply with the standards imposed to the rest of the market. Anonymity offered through virtual currency networks becomes limited and the use of such networks is closely monitored. 

Following the recommendations of ESMA and FATF mentioned above, a number of European Member States decided to extend the scope of their AML laws beyond the provisions of the AMLD5 Directive in order to also include in the scope of the AML/CFT obligations activities such as the exchange between crypto assets and crypto assets, transfer of virtual assets and the participation and/or provision of financial services related to the distribution, offering and sale of crypto assets. 

On the 23rd of February 2021 L.13(I)/2021 was published on the official Gazette of the Government of Cyprus, which revises the Cyprus AML Law bringing it in line with the EU’s AMLD5 Directive. 

As regards crypto-asset service providers (CASPs) / virtual-asset service providers (VASPs), the activity brought into scope of the revised Cyprus AML Law covers the following: 

• Cryptocurrency exchanges (crypto-to-crypto and fiat-to-crypto and vice versa). 

• Management, administration, transmission, transfer, retention, custodianship and safekeeping of crypto-assets or cryptographic keys or means which allow for the exercise control in crypto-assets. 

• Offering and/or sale of crypto-assets, including the initial offering. 

• Participation and/or provision of financial services related to the distribution, offering and/or sale of crypto-assets, including the initial offering.‘Financial services related to the distribution, offering and/or sale of crypto-assets’ covers the following services and activities: 

• Reception and transmission of orders. 

• Execution of orders on behalf of clients. 

• Dealing on own account. 

• Portfolio management. 

• Provision of investment advice. 

• Underwriting and/or placing of crypto-assets on a firm commitment basis. 

• Placing of crypto-assets without a firm commitment basis. 

• Operation of a multilateral system where multiple third-party buying and selling trading interests in crypto-assets are able to interact in the system in a way that results in a transaction. 

In Cyprus, CySEC is the authority assigned to regulate Providers of Services related to crypto-assets / virtual-assets as well as to maintain a register of such providers. 

EU’s MiCA Regulation: A New Era for Crypto Markets 

In June 2023, the EU published Regulation (EU) 2023/1114, known as the Markets in Crypto Assets (‘MiCA’) Regulation, along with Regulation (EU) 2023/1113, concerning information accompanying transfers of funds and certain crypto-assets (‘TFR’). 

MiCA’s rules on the issuance and offering of stablecoins will apply from 30 June 2024, while other provisions relevant to the provision of services related to crypto-assets will apply from 30 December 2024. TFR is also set to apply from 30 December 2024. 

It is anticipated that MiCA will supersede the bespoke national regimes currently in place in various EU member states, including the existing Cyprus regime for crypto-asset service providers as described further above. 

The EU’s adoption of MiCA Regulation marks a significant milestone in regulating the burgeoning crypto-assets market. MiCA aims to bring clarity, security, and harmonisation across the EU in this rapidly evolving sector. 

MiCA applies to natural and legal persons and certain other undertakings that are engaged in the issuance, offer to the public and admission to trading of crypto-assets or provide services related to crypto-assets in the EU. 

For more information on MiCA, please visit our dedicated MiCA webpage. 

With a team of more than 100 multidisciplinary financial services consultants, Complyport is the leader in the field of CySEC and EU authorisation and licensing for a variety of financial institutions, including Crypto-asset service providers (a.k.a. Virtual-asset service providers). 

All our licensing services include: 

• Consulting on the form of a group’s presence in Cyprus and the rest of the EU; 

• Advisory support towards the authorisation and registration of an EU financial institution (including (including CASP / VASP license); 

• Preparation of the Application File in accordance with current regulatory requirements to include the following activities, among others: 

• Design and build the corporate and organisational structure based on your needs (in a cost-efficient way); 

• Prepare a custom-built Operations Manual in the most efficient manner and based on your needs; 

• Prepare the Anti-Money Laundering Manual (AML) and the Know Your Client (KYC) policies and procedures in the most efficient manner and based on your needs; 

• Prepare the business plan; 

• Complete the application form to be submitted to the relevant EU regulatory authority; 

• Review the questionnaires of the shareholders, directors and heads of departments of the proposed firm; 

• Locate qualified executive and non-executive directors (if needed); 

• Complete the relevant checklists; 

• Prepare necessary justifications to be submitted to the relevant EU regulatory authority, as applicable; 

• Prepare the letter(s) to accompany the application in the event that any exception may be requested; 

• Guide you in providing all the necessary documentation and certificates; 

• Answer any relevant questions concerning the application process, and; 

• Respond on your behalf to the authority’s queries and suggestions relating to the application. 

In addition to the above, our clients trust us for: 

• Day-to-day operational issues and support on various regulatory topics such as AML any many other; 

• Changing shareholders and directors; 

• Structuring and restructuring units and departments; 

• Procedures, Manuals and policies drafting, updating and/or redrafting; 

• Client Account Opening Questionnaires drafting and/or reviewing; 

• Compliance Monitoring Programme drafting and/or review; 

• Evaluation and analysis of systems and controls; 

• Adjustments and changes to the organisational structure; 

• Suitability assessment of prospective personnel; 

• Reporting to and dealing with the Regulator; 

• Assistance and guidance with the preparation of annual/quarterly/monthly reports; 

• General strategic advice (related to regulatory matters); 

• Onsite inspections; 

• Assistance with clients’ complaints; 

• Regulatory update notifications; 

• Website and marketing material compliance reviews; 

• Assistance with updating regulatory Electronic Records; 

• Calculation of regulatory Annual Fees; 

• Compliance Gap analysis and impact assessment; 

• Security controls; 

• Business continuity and disaster recovery; 

• Compliance Health Checks; and 

• Thematic assurance reviews. 

For more information, please feel free to contact us.