Buy-side CASP acquisition · Cyprus
Buy a CASP in Cyprus: MiCA-authorised crypto licence
CySEC granted Revolut Cyprus licence number 2/25 on 23 October 2025, signalling that Cyprus is now the EEA crypto-asset hub the largest fintech operators are anchoring to under MiCA. The authorised CASP pool is small, the supervisor’s reputation is institutional, and the qualifying-holding mechanic under Article 83 is the cleanest route for an acquirer who wants a Cyprus-supervised entity with a working passport across the 30 EEA states.
Why Cyprus
A credible CASP regime under CySEC supervision
The Cyprus Securities and Exchange Commission (CySEC) is the competent authority for crypto-asset service providers under Article 62 of Regulation (EU) 2023/1114. Supervisory dialogue runs in working English, and CySEC’s Investment Firms and CASP directorate handles substantive review while coordinating the AML/CTF assessment with the Anti-Money Laundering Unit. The legacy Cyprus CASP regime ran under the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007; CySEC stopped accepting new applications under that regime on 17 October 2024, and every authorisation moving forward sits under MiCA Title V.
The transition cadence sets the deal calendar through 2026. Existing legacy-register CASPs must submit a complete MiCA application by 27 February 2026, and the transitional period for legacy-regime activity ends on 1 July 2026 (or earlier if CySEC determines the file is non-conforming). Where a CASP also offers services on e-money tokens that qualify as payment services, a parallel application to the Central Bank of Cyprus is required by 20 February 2026. The acquirer who diligences a Cypriot target in 2026 is therefore reading a file that is mid-transition by definition, which makes the application status at CySEC the binding diligence question, not the legacy registration.
The credibility signal sharpened in October 2025, when CySEC issued Revolut a MiCA-CASP authorisation as Cyprus licence number 2/25. The takeaway for an acquirer is what the headline confirms more than the headline itself: CySEC’s review apparatus works on tier-1 operators serving cross-border crypto retail at scale, the Article 62 dossier expectations are now visible in practice, and the resulting authorisation is recognised across the EEA without further notification beyond Article 65 passporting. The authorised pool remains narrow, which is what makes a buy-side mandate work: scarcity of supply, a credible supervisor, and an institutional acquirer profile in the bidding population.
What a CySEC MiCA-CASP authorisation permits
Title V scope, Article 67 capital, and the obligations the buyer inherits
A Cypriot CASP authorisation is granted under MiCA Title V and unlocks the full menu of crypto-asset services scoped at Annex I: custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, execution of orders, placing of crypto-assets, reception and transmission of orders, advice on crypto-assets, portfolio management of crypto-assets, transfer services for crypto-assets, and operation of a trading platform. Each service in scope is named explicitly in the authorisation; adding a service post-issue requires an Article 64 modification with CySEC, not a fresh authorisation.
Permanent minimum own funds sit at three classes under Article 67. Class 1 services (advice, reception and transmission of orders, transfers, portfolio management, placing) are floored at EUR 50,000. Class 2 (execution, exchange of crypto-assets for funds or for other crypto-assets, custody) raises the floor to EUR 125,000. Class 3 (operation of a trading platform) takes it to EUR 150,000. The permanent minimum is a floor only; the binding figure is the higher of the floor and one quarter of the previous year’s fixed overheads. On a mature target the overheads test almost always sets the level, and many Cypriot CASPs trend mature because most converted from PSMLA-registered operators with a real revenue base.
Article 75 requires segregation of clients’ crypto-assets from the CASP’s own holdings, with reconciliation discipline and clear contractual disclosures. Article 68 sets the prudential governance frame: at least two fit-and-proper executive directors with crypto-relevant experience, at least half of the board as independent non-executives under CySEC’s substance test, locally executed decision-making, organisational structure proportionate to the service mix, internal control and compliance functions resourced to do their job, and a documented business continuity plan. DORA (Regulation (EU) 2022/2554) layers ICT risk management on top from January 2025, and the Travel Rule under Regulation (EU) 2023/1113 governs originator and beneficiary information on crypto-asset transfers. The acquirer inherits all of this at completion, including any open CySEC correspondence and any in-flight conversion file.
What we broker here
The Cypriot CASP files we work with
The Cyprus CASP book is mid-sized by EU standards but the genuinely investable population is shallow, which is exactly why a buy-side mandate beats a public listing search. Our Cyprus mandates fall into a few patterns: CIF firms (Cypriot investment firms regulated by CySEC under MiFID) running CASP-conversion projects who have decided their crypto operation needs different ownership; greenfield Cypriot entities that obtained a fresh MiCA-CASP authorisation explicitly with an exit thesis; PSMLA-registered operators who completed (or will complete by July 2026) the MiCA conversion and are exiting on the back of a strategic review at parent level; and Cypriot subsidiaries of foreign crypto-banking or fintech groups whose parent is restructuring the licence stack and divesting one node.
Our diligence gates on every Cyprus file are banking continuity (the EU credit institution holding segregated client crypto-asset proceeds and the timeline to re-paper it post-completion, which is a chronic friction point for Cypriot CASPs serving non-EU customer cohorts), the AML programme under Cyprus’s PSMLA implementation and MiCA Title V (transaction monitoring, sanctions screening, the MLRO’s seniority and replaceability), the substance pillar (Cyprus-resident management, half-independent NEDs, locally executed decision-making, and the support functions CySEC expects under its real-presence test), and the technology stack (custody architecture, key-management arrangements, and the third-party providers inside the audit perimeter). We do not list the same target with multiple acquirers, and we will not present an entity we have not personally diligenced against CySEC’s published expectations.
Acquisition path
Article 83 change-of-control, in practice
The acquisition mechanic for a Cypriot CASP is governed by Article 83 of MiCA. Any proposed acquirer of a qualifying holding (10%, 20%, 30%, or 50% thresholds, or any holding that confers control) must notify CySEC in writing before the transaction completes. The supervisor acknowledges the notification, opens the assessment window of up to 60 working days, and may extend it once by a further 30 working days when it requests further information. Assessment criteria mirror the prudential framework CySEC applies across investment-firm and CIF supervision: reputation of the proposed acquirer, suitability of incoming directors, financial soundness, ability to comply with MiCA on an ongoing basis, and AML/CFT risk.
What shortens the window is a complete dossier delivered with the initial notification, not after CySEC’s first request for additional information. We build that dossier with our acquirers before signing: UBO disclosure, sources-of-funds, group ownership chart, three-year prudential plan, governance arrangements at the target post-completion, and (where the target is a PSMLA-registered or CIF firm mid-conversion) the status of the MiCA file. See the acquisition process for the standing checklist.
Why Cadena
Buy-side only, transactional, fast
We act for the acquirer only. The Cypriot target’s adviser sits across the table from us on every CASP transaction, never on the same side, and the same engagement letter that opens a Cyprus mandate authorises us to extend the search to EU comparables if the Cyprus diligence does not converge. That removes the conflict-of-interest cloud that mixed-mandate brokers carry into a supervisor’s review and gives the acquirer a single advisory thread from sourcing to closing.
What’s in the engagement is concrete. We open with sourced approaches under NDA on the Cyprus targets that match the acquirer’s thesis (size, service mix, customer geography, banking arrangements). We run the regulatory diligence on each candidate in parallel with the qualifying-holding filing at CySEC, which compresses the calendar versus a sequential approach. We structure the SPA around the change-of-control conditions that a CASP transaction actually carries: regulatory non-objection, banking continuity confirmations, key-person retention, and the warranties an acquirer needs on the AML programme and the live correspondence file at the supervisor.
FAQ
Frequently asked: Cypriot CASP and MiCA acquisitions
Can I buy a CASP licence in Cyprus rather than apply de novo?
Yes, when the underlying entity holds a current CySEC authorisation under Article 63 of MiCA, or a complete in-flight conversion file from the legacy PSMLA register that CySEC has accepted. The transaction is a change-of-control under Article 83: you notify CySEC of the proposed qualifying holding, the supervisor runs a fit-and-proper assessment of the acquirer and incoming directors, and the deal completes on the supervisor’s non-objection. We broker only entities whose authorisation is live or whose conversion file is genuinely complete (a distinction the headline registration status does not capture).
What is the difference between a CASP and a MiCA licence in Cyprus?
They are the same authorisation, named two ways. “MiCA licence” is the colloquial term acquirers use because the regulation creates the regime; “CASP authorisation” is what CySEC actually issues, because the authorised entity is a Crypto-Asset Service Provider. The licence text references Title V of Regulation (EU) 2023/1114 and identifies the CySEC licence number (the format CySEC uses, including for the Revolut authorisation in October 2025, is sequential within the year). Both terms point at the same CySEC decision and the same passporting rights.
Can a Cypriot CASP licence passport across the EU?
Yes. Article 65 of MiCA gives any authorised CASP an EEA-wide passport to provide its scoped services in any other EU or EEA member state through a notification rather than a fresh authorisation. The acquirer inherits the Cyprus passporting rights at completion. The passport covers exactly the Title V services named in the original CySEC authorisation; expanding into adjacent services after closing requires an Article 64 modification at CySEC first.
How does Article 83 change-of-control approval work for a Cypriot CASP?
You file a written qualifying-holding notification with CySEC before the transaction closes. The supervisor has 60 working days from acknowledged-complete notification to assess, extendable by 30 working days where it requests further information. Assessment criteria are reputation, suitability of incoming directors, financial soundness, MiCA-compliance capability, and AML/CFT risk. The dossier mirrors what an acquirer would file for a qualifying-holding in a Cypriot investment firm under the IFD/IFR framework, because CySEC calibrates the standard the same way across MiFID and MiCA-supervised entities.
Is buying a Cypriot CASP different from buying one in another EU country?
The MiCA framework is identical across member states; the supervisor and the candidate pool differ. Cyprus has more authorised and conversion-stage CASPs than the smaller EEA jurisdictions, the substance test is real (Cyprus-resident management, half-independent NEDs, locally executed decision-making), and CySEC’s Investment Firm supervisory experience translates into a procedural review with clear file expectations. The Revolut authorisation in October 2025 made Cyprus the headline EEA-crypto-hub story for tier-1 fintech, which sharpens the bidding population. Compare the EU CASP hub for side-by-side reads on Germany, Ireland, Malta, and Lithuania.
What about CIF-to-CASP conversions still in flight?
Cypriot Investment Firms and PSMLA-registered crypto operators that filed (or will file by 27 February 2026) a complete MiCA conversion application are continuing to provide services under the transitional regime through 1 July 2026, or until CySEC takes a decision on the application. For an acquirer the diligence question is whether the MiCA file at CySEC is genuinely complete, what the open queries from the supervisor look like, and how the answers affect the post-completion authorisation perimeter. We track these conversion files as a separate diligence stream from the live-authorisation files because the risk profile is materially different.
Next step
Open a buy-side mandate on Cypriot CASPs
If your acquisition thesis points at MiCA-CASP coverage with CySEC supervision and EEA passporting, send us your acquisition criteria. We come back with the Cypriot targets that match: pre-vetted on CySEC standing, banking continuity, AML programme, conversion-file status where relevant, substance under Article 68, and Article 83 readiness. If Cyprus turns out to be the wrong fit on diligence, the same engagement covers EU CASP comparables in adjacent member states.
