Cyprus

The most significant development in this cycle concerns the Article 143(3) national transitional regime -- the mechanism that had allowed crypto-asset service providers operating under pre-MiCA Cypriot law to keep serving clients while their MiCA authorisation applications were pending. That transitional window has now concluded. ESMA's own statement on the end of transitional periods under MiCA confirms the EU-wide backstop expired on 1 July 2026, and Cyprus-specific reporting adds operational detail: CySEC set 27 February 2026 as the deadline for providers relying on the transitional relief to submit a MiCA authorisation application, required a formal wind-down plan from any provider that had not applied by that date, and issued a post-deadline AML circular on 9 July 2026 addressing the compliance state of providers moving through or past the transition. Read together, these facts establish that Cyprus's transitional period is a closed chapter rather than a live one: any entity providing crypto-asset services to EU clients without a MiCA licence after 1 July 2026 is now in breach of EU law and must either have ceased those services or be actively executing an approved wind-down plan.

This closure sits alongside continued licensing activity on the other side of the ledger. CySEC has granted MiCA CASP authorisations to major platforms including Revolut and eToro, each of which is now positioned to offer regulated crypto services across the EEA on the strength of its Cypriot authorisation -- a concrete illustration of MiCA's passporting design operating as intended and of Cyprus's role as an EEA-wide licensing gateway for at least some large platforms. One caution from this cycle's review process is worth flagging explicitly: Taurus, a crypto custodian previously associated with Cyprus in some reporting, holds a MiFID II licence rather than a MiCA CASP authorisation, and should not be read as evidence of MiCA-operative licensing activity. The distinction matters because MiFID II and MiCA authorisations carry different scopes, obligations, and supervisory consequences, and conflating the two would overstate the breadth of CySEC's MiCA-licensed population.

Outlook

The crypto-licensing picture in Cyprus is now best read as settled-and-enforced rather than transitional. The open question going forward is less about the rules themselves -- which are fully in force -- and more about compliance outcomes: how many providers that relied on the Article 143(3) transitional window actually completed wind-down versus converted to full MiCA authorisation, and whether CySEC's 9 July 2026 AML circular signals a broader supervisory posture toward post-deadline non-compliance. Continued monitoring of CySEC's authorisation register and enforcement actions over the coming quarters should clarify both points. No change to the green traffic-light rating is indicated by this cycle's findings, but the shift from transition pending to transition concluded and enforced is itself the substantive development worth carrying forward into subsequent cycles.

A concrete consumer-facing consequence of the EMT classification is the redemption right: holders of e-money tokens have the right to redeem their tokens at full face value, in the currency to which the token is pegged, directly from the issuer. This is confirmed both at the general MiCA level and specifically for Cypriot consumers through the same Joint ESAs factsheet, and it functions as one of the clearest investor-protection guarantees built into the EMT category.

Non-fungible crypto-assets receive distinct treatment under this taxonomy. Where the relative value of a unique, non-fungible crypto-asset cannot be identified by comparison to an existing market or to equivalent fungible assets, it may fall outside MiCA's standard fungible-token categories altogether. This carve-out matters for Cyprus's growing NFT-adjacent market activity, since it means such assets are not automatically captured by the EMT/ART/other-crypto-asset framework that governs fungible tokens.

Outlook

Because this taxonomy is directly imported from binding EU law rather than shaped by Cypriot discretion, no jurisdiction-specific developments are expected here absent a change at the EU level. The item worth continued attention is how NFT-adjacent products marketed in or from Cyprus are treated in practice as the market matures -- particularly where issuers attempt to structure fungible-token-like products with NFT wrappers to avoid MiCA's classification thresholds. No change to the green traffic-light rating is indicated.

Market practice offers an illustrative data point rather than a regulatory one: Revolut's CySEC-authorised MiCA entity offers zero-fee staking with advertised rewards, structured as an activity ancillary to its licensed crypto services rather than as a separately licensed line of business. This is consistent with the absence of a dedicated staking licensing category and should be read as evidence of how existing CASP authorisation is being stretched to cover staking services, not as evidence that staking itself has become a licensed activity in its own right.

At the EU policy level, the joint EBA/ESMA report under MiCAR Article 142 examines DeFi adoption and lending, borrowing, and staking business models as emerging crypto-market trends, but does so analytically and without proposing binding rules -- consistent with an unregulated-gap status for DeFi activity across the EU, including Cyprus. Separately, whether mining, node-operation, or validator activity in Cyprus is addressed by MiCA or by any CySEC guidance was not resolved in this research pass; this should be read as an unresearched gap rather than as confirmation that no such rules exist.

Outlook

This module's amber rating reflects a genuine absence of dedicated rules rather than any ambiguity in what does exist. The key forward-looking marker is the EBA/ESMA Article 142 report, which -- while non-binding today -- is the most likely vehicle through which any future EU-wide proposal on DeFi, staking, or lending regulation would first surface. Confirming whether mining and validator activity in Cyprus is addressed by any guidance not yet located remains a priority for the next research pass, given the current evidentiary basis here is thin.

On the supervisory-timeline side, the Central Bank of Cyprus has stated an intention to bring its supervisory practice for electronic-money institutions and payment institutions into compliance with ESMA's Title VI guidelines on market abuse by 30 September 2026. Notably, the Central Bank has also indicated there is no current express intention among its regulated entities to begin the kinds of activities those guidelines address, which suggests this compliance target is a readiness measure rather than a response to imminent market activity. Because this milestone has not yet arrived as of this cycle's research date, it should be read as a prospective, not-yet-effective commitment rather than settled supervisory practice.

On the consumer-facing side of stablecoin regulation, e-money token holders in Cyprus retain the MiCA-wide right to redeem their tokens at full face value from the issuer, in the currency to which the token is pegged -- a right that applies uniformly as MiCA is applied domestically and that mirrors the redemption guarantee described in the token-classification module.

Outlook

Two dated markers define this module's near-term trajectory: the Central Bank's 30 September 2026 compliance target for Title VI market-abuse supervision, and the still-unresolved question of exactly how Title IV credit-institution competent-authority responsibility is allocated between CySEC and the Central Bank. Confirmation on either point -- particularly a Central Bank statement resolving the to-be-confirmed allocation -- would likely be sufficient to move this module's rating from amber toward green. Until then, the amber rating reflects genuine, acknowledged gaps in implementation detail rather than any deficiency in the underlying redemption-rights framework, which is fully settled.

The more consequential development this cycle is a correction to the evidentiary basis underlying Cyprus's amber consumer-protection rating. A previously cited ESMA finding -- that CySEC had the highest outgoing cross-border activity and complaint volume among six reviewed national competent authorities, alongside noted supervisory shortcomings -- has been re-examined and found to originate from a March 2022 ESMA peer review of cross-border MiFID II passporting activity, covering supervisory conduct between August 2018 and August 2020. That review predates MiCA entirely and concerns securities-market passporting supervision, not crypto-asset or MiCA-specific supervision. Treating it as current, crypto-specific evidence would have overstated what is actually known about CySEC's present-day MiCA-era supervisory performance. It is retained in this record only as dated, cross-domain context on CySEC's general supervisory capacity -- useful background, but not a substitute for a genuine assessment of how CySEC is currently supervising crypto-asset service providers under MiCA.

Outlook

The substantive consumer-protection rules in force in Cyprus are not in question and require no further monitoring at this time beyond routine confirmation of continued application. What does require attention is sourcing a current, MiCA-era supervisory assessment of CySEC -- whether through a future ESMA peer review specific to crypto-asset supervision, enforcement statistics, or CySEC's own reporting -- to properly ground this module's amber rating going forward. Until such a source is located, the rating should be understood as resting on the strength of the binding rules themselves rather than on any confirmed assessment of supervisory execution.

Similarly, no circular from the Cyprus Inland Revenue Department addressing the income-tax treatment of cryptocurrency-related income was located, and no circular from the Cyprus Tax Department addressing the VAT treatment of crypto-asset exchange transactions was located. In both cases, this reflects a genuine research gap -- an absence of located primary guidance -- rather than an affirmatively confirmed finding that no such guidance exists or that no tax liability arises. It remains possible that relevant guidance exists but was not surfaced in this research pass, and this distinction is treated deliberately in this record rather than collapsed into a false negative.

Outlook

Tax treatment is flagged across this monitor's broader coverage as a structurally under-indexed area, and Cyprus's experience here is consistent with that pattern rather than an outlier. The clear next step is targeted primary-source escalation directly to the Cyprus Tax Department and Ministry of Finance, seeking any existing circulars, rulings, or informal guidance on the capital gains, income tax, and VAT treatment of crypto-asset transactions. Until that escalation produces a result, this module's amber rating and thin evidentiary base should be read as reflecting an active research gap rather than a settled regulatory position, and any downstream conclusions about crypto tax exposure in Cyprus should be treated as provisional.

Separately from information-accompanying-transfer obligations, MiCA's passporting mechanism governs cross-border service provision itself: a MiCA licence granted by CySEC allows a Cyprus-based crypto-asset service provider to offer regulated crypto services across all EEA countries without needing additional national authorisation in each destination market. This is the same mechanism underpinning the EEA-wide expansion of CySEC-licensed platforms such as Revolut and eToro described under crypto-licensing, and it represents one of the more concretely operative and market-tested elements of Cyprus's crypto framework.

Outlook

Both the Travel Rule information requirements and MiCA's passporting mechanism are fully in force and unchanged this cycle; no near-term developments are expected absent a change at the EU regulatory level. The Travel Rule dimension of this module overlaps substantively with AML/CFT supervision and is being tracked jointly with financial-integrity going forward, meaning future updates to this module's Travel Rule content may increasingly originate from that monitor's independent analysis rather than from crypto-native research alone.