MiCA & CASP Licensing in Cyprus: When Crypto Firms Need a Payment Institution Licence under PSD2

The interaction between the EU Markets in Crypto-Assets Regulation (“MiCA”) and PSD2 has become an important issue for Crypto-Asset Service Providers (“CASPs”) in Cyprus.

A MiCA or CASP authorisation does not necessarily cover all services provided by a crypto business. Certain activities involving electronic money tokens (“EMTs”) may also constitute payment services under PSD2, potentially requiring additional authorisation as a Payment Institution (“PI”) or Electronic Money Institution (“EMI”).

For international crypto and FinTech businesses considering Cyprus as an EU regulatory base, it is therefore important to determine whether the business requires a MiCA/CASP licence, PI or EMI licence – or a combination of regulatory permissions.

When does a Cyprus CASP also need a PI or EMI licence?

The European Banking Authority (“EBA”) addressed the interaction between MiCA and PSD2 in its No Action Letter of 10 June 2025.

The EBA considers certain activities involving EMTs to constitute payment services, including:

• the transfer of EMTs on behalf of clients; and
• the custody and administration of EMTs on behalf of clients.

A custodial wallet may also constitute a payment account under PSD2 where it enables clients to send and receive EMTs to and from third parties.

However, certain activities are outside the relevant PSD2 scope, including the exchange of crypto-assets for funds, the exchange of crypto-assets for other crypto-assets and intermediation in the purchase of crypto-assets using EMTs.

The distinction depends on the actual business model and services provided, rather than simply how the business describes its activities.

What should Cyprus CASPs do?

The Central Bank of Cyprus (“CBC”) requires CASPs to assess whether their crypto-asset services also qualify as payment services.

Where payment services are being provided, a CASP may need to obtain the appropriate Payment Institution or EMI authorisation in Cyprus. Alternatively, depending on the business model, the relevant services may be provided through an appropriately authorised Payment Service Provider (“PSP”).

A regulatory assessment should therefore consider:

• The services provided to clients;
• How EMTs and client assets move through the platform;
• Whether EMT transfers or custody services are provided;
• How client wallets operate;
• Whether third-party PSPs are involved; and
• Whether services are provided cross-border within the EU.

Position following the end of the transitional period

The EBA transitional arrangements ended on 1 March 2026.

Broadly, CASPs providing EMT-related payment services now fall into one of three situations:

• Authorised or partnered: the CASP has obtained the required PI/EMI authorisation or works with an appropriately authorised PSP.
• Application pending: the CASP has applied for authorisation but has not yet received it. Subject to the applicable EBA conditions, certain existing activities may continue, although restrictions apply, including in relation to marketing and onboarding new clients for the relevant services.
• No qualifying application: the CASP may be required to cease providing EMT services that constitute payment services and offboard affected clients.

Existing CASPs should therefore ensure that their operating model complies with both MiCA and PSD2 requirements where applicable.

Applying for a Payment Institution licence in Cyprus

The Central Bank of Cyprus is responsible for licensing Payment Institutions and Electronic Money Institutions in Cyprus.

A Cyprus PI or EMI licence application may require detailed documentation covering the business plan, governance, shareholders and management, AML/CFT, safeguarding, outsourcing, risk management, ICT and operational arrangements.

The appropriate regulatory structure should therefore be determined before submitting an application.

Depending on the business, this may involve obtaining a PI licence, EMI licence or partnering with an existing authorised PSP.

MiCA passporting and payment services

International crypto businesses should also consider their cross-border structure carefully.

A MiCA passport should not automatically be regarded as covering activities that separately constitute payment services under PSD2.

Where a Cyprus CASP also operates as a Payment Institution and provides payment services elsewhere in the EU, the relevant PSD2 passporting requirements may also apply.

What does this mean for international crypto businesses?

The key point is straightforward:

A MiCA licence does not necessarily cover the entire regulatory perimeter of a crypto business.

Businesses seeking a Cyprus MiCA licence or CASP authorisation should assess whether their activities also trigger requirements under PSD2, particularly where their services involve EMT transfers, custody or payment functionality.

For international crypto and FinTech groups considering Cyprus as an EU regulatory base, undertaking this analysis early can avoid regulatory issues and costly restructuring after launch.

How Spencer West Cyprus can assist

Spencer West Cyprus advises international crypto, FinTech, payments and financial-services businesses on establishing and operating regulated businesses in Cyprus and across the EU.

Our team can assist with:

• Cyprus MiCA and CASP authorisation;
• Payment Institution (PI) licensing in Cyprus;
• Electronic Money Institution (EMI) licensing in Cyprus;
• MiCA and PSD2 regulatory perimeter assessments;
• structuring of crypto and payment-services businesses;
• regulatory applications to CySEC and the Central Bank of Cyprus;
• EU passporting; and
• ongoing Cyprus and EU financial-services regulatory advice.

For further information regarding MiCA, CASP, PI or EMI licensing in Cyprus, please contact Theo Antoniou.