Policy Statement on the Registration and Operations of Crypto-Asset Service Providers

The Cyprus Securities and Exchange Commission (“CySEC”) has issued a Policy Statement on the Registration and Operations of Crypto Asset Services Providers (“CASP”) – PS-01-2021 in an effort to regulate more effectively the cryptocurrency industry. The CySEC is attracting and paving the way for more companies to operate in the field of cryptocurrencies in Cyprus as CASPs under its supervision.

With its Policy Statement CySEC outlines the necessary rules under the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007, (the “AML/CFT Law”), the CySEC Directive for the prevention and suppression of money laundering and terrorist financing – Register of Crypto Asset Services Providers (the “CASP Registration Directive”) and the CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (collectively the “Cumulative CASP Rules”). CASPs are considered obliged entities and they must therefore fully abide to their obligations stemming from the Cumulative CASP Rules.

Registration Requirements for CASPs

Each applicant must submit the “CASP Application Form” issued by CySEC for registration in the CySEC CASP register. Regarding the management of the CASP, the persons that hold managerial position must have a good reputation, knowledge, skills and experience and devote sufficient time to the performance of their duties. In case of the Board of Directors, the Board of Directors shall be comprised of at least four (4) members, two (2) of which must direct the business activities of the CASP and two (2) must be independent members. The management must provide to CySEC clean criminal record in relation to “relevant offences” as defined in the CASP Registration Directive, as well as information in relation to any past or ongoing regulatory, administrative or criminal proceedings against them. The beneficiaries of CASPs must also satisfy CySEC about their good reputation and their ability to maintain the strong financial position of the CASP.

It should be noted that a fully owned and exclusively used website must be maintained by CASPs in order to ensure their smooth operation and all the websites through which they will be operating shall be disclosed. In addition to the above, each CASP must establish appropriate policies, procedures, systems, sound administrative and accounting procedures, effective risk assessment and internal control mechanisms to ensure their prudent operation, including minimizing the risk or theft or loss of their clients’ crypto-assets. Page 28 of the Policy Statement lists some best practices in relation to minimizing these risks. Special attention should be paid to the security of the CASPs’ systems. Sound mechanisms to guarantee the security and authentication of the means of transfer of information, minimize the risk of data corruption and unauthorized access and to prevent information leakage must be implemented.

Own Funds

A quite important matter is own funds. CASPs must have sufficient own funds comprised of fixed and variable component. In accordance with paragraph 14 of the CASP Registration, CASPs are required to maintain at all times, own funds that are at least equal with the greater amount of the following:

1. The amount of the initial capital that the respective Applicant is required to possess, or

2. The quarter (1/4) of the CASP’s fixed expenses of the previous years, that is based on a transitional basis, starting from 30% of the 1/4 of fixed expenses from 1 January 2022, 60% of the said fixed expenses from 1 January 2023, and 100% of the said expenses from 1 January 2024 and thereafter

Payable Fees

For the evaluation and assessment of the CASP’s application the registration fees are €10.000 Successful applicants will not be required to pay an additional fee for the first year of their registration. For the purposes of renewal of registration per year the fees are €5.000.