To implement the 5th Anti-Money Laundering Directive, introduced by the European Union (EU) in February 2021, Cyprus passed the Prevention and Suppression of Money Laundering and Terrorist Financing Laws of 2007 (188(I)/2007) (AML Law) which introduced cryptoassets into the Cyprus legislation. 

Section 2 of the AML Law defines "cryptoasset" as: 

“a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily tied to any officially established currency and does not possess the legal status of currency or money but is accepted by individuals as a means of exchange or investment, and can be electronically transferred, stored, or traded electronically, and it is not (a) fiat currency; or (b) electronic money; or (c) financial instruments as defined in Part III of the First Appendix of the Investment Services and Activities and Regulated Markets Laws of 2017 (87(I)/2017).”

In September 2021, the financial regulatory agency of Cyprus, the Cyprus Securities and Exchange Commission (CySEC), published a Policy Statement in an effort to finalise its rules on the registration and operations of Crypto-Asset Services Providers (CASP) conducting business in Cyprus, as introduced by the AML Law in 2021. 

The Policy Statement considers that cryptoassets may be divided into one of the following categories, inter alia, depending on their structure:

1. Cryptoassets that may qualify as financial instruments under the Investment Services and Activities and Regulated Markets Laws of 2017 (87(I)/2017) (Investment Services Law), i.e., Financial Instrument Tokens (FIT).
2. Cryptoassets that may qualify as electronic money under the Electronic Money Laws 2012 (81(I)/2012) (E-money Law), i.e., E-Money Tokens (EMT).
3. A digital representation of value that is neither issued nor guaranteed by a central bank or a public authority. It is not necessarily attached to a legally established currency and does not possess a legal status of currency or money but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored, and traded electronically, and it does not qualify neither as fiat currency, nor as any of the instruments referred to in points (1) and (2) above.

The categorisation primarily seeks to clarify the regulatory regime under which each category will be governed. FIT should be governed pursuant to the Investment Services Law, EMT by E-money Law and the third category, by the newly introduced CASP regime (see Question 2, below). 

It is worth noting that the Markets in Crypto Assets Regulation (MiCA), soon to be introduced into national law, defines cryptoassets similarly and distinguishes between three types: Utility Tokens, Asset-Referenced Tokens, and E-Money Tokens.

See Question 7, below, for an analysis of how the Cyprus courts may treat cryptoassets. 

Currently, the regulatory framework governing cryptoassets in Cyprus includes:

• the AML Law;
• CySEC Directive for the Register of Crypto Asset Services Providers (CASP Registration Directive); and
• CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (AML Directive).

Inevitably, MiCA is poised to emerge as the primary regulatory framework for cryptoassets by the end of 2024.

The two key regulatory bodies in Cyprus overseeing cryptoassets within the financial services sector are CySEC and the Central Bank of Cyprus (CBC). CySEC is responsible for supervising CASPs, registered pursuant to the AML Law and the CASP Registration Directive. 

It is worth noting that CySEC established an Innovation Hub, which aims to act as a digital and physical platform for both supervised and non-supervised entities to come together and share knowledge, improving business efficacy and enhancing investor protection.

CBC also plays an active role in discussions related to blockchain’s application in banking services and issues notices to warn the public of the risks associated with cryptocurrency transactions.

The Deputy Ministry of Research, Innovation and Digital Strategy, although not a regulator, is another crucial stakeholder, responsible for developing and implementing Cyprus’ national digital policy and fostering an enabling ecosystem for both public and private blockchain use cases.

As stipulated in Question 1, above, the Policy Statement classified cryptoassets based on their inherent characteristics. In the absence of an official regulatory framework for the classification of cryptoassets in Cyprus, international practices and standards for cryptoasset classification will be applied.

FITs, which closely resemble traditional financial instruments, are regulated under existing securities laws and under the jurisdiction of relevant financial instrument regulations. Consequently, FIT offerings are governed by the prevailing securities legislation, inter alia, the Investment Services Law, the Alternative Investments Funds Law of 2018 (124(I)/2018), the Prospectus Regulation 2017 and Crowdfunding Rules.

EMTs are governed by the E-Money Law, ensuring aligned compliance with EU directives, and setting out rules for their issuance and usage.

For NFTs, there is no specific regulatory framework in Cyprus. Similarly, for stablecoins, no specific regulatory framework exists per se. However, since a stablecoin is contingent on the assets to which it is pegged, its regulatory status will be determined on a case-by-case basis. 

Exchange tokens are primarily used for investment and exchange purposes, devoid of backing or issuance by any central authority. Consequently, they do not fall within the purview of dedicated regulatory frameworks, except for the CASP framework.

Utility tokens provide access to goods or services and thus, may be subject to the CASP regulation in Cyprus. Classification and regulation of utility tokens are predicated on their unique attributes and intended use cases.

In 2021, CySEC introduced the CASP Registration Directive — a new regulatory framework in relation to the operation and management of CASPs operating in Cyprus. CASPs providing one or more of the following services are obliged to be registered with CySEC unless the CASP is established and registered in a member state of the EU. 

Section 2(1) of the AML Law stipulates the services that a CASP may undertake:

• exchange between cryptoassets and fiat currencies;
• exchange between cryptoassets;
• management, transmission, transfer, holding and/or safekeeping of cryptoassets or cryptographic keys;
• offer and/or sale of cryptoassets, including the initial offering; and
• participation and/or provision of financial services regarding the distribution, offer and/or sale of cryptoassets, including the initial offering.

Registering a CASP with CySEC involves the submission of a complete and well-documented application, which requires approximately 12 months to conclude. The application fee for obtaining CASP authorisation is EUR 10,000, which is non-refundable. If the application is successful, CySEC’s annual fees are waived for the first year and amount to EUR 5,000 per annum thereafter. Fees for notifying changes to CySEC, regarding CASP registration details, cost between EUR 1,000 – EUR 5,000, depending on the type of notification required. 

In this context, obtaining a CASP registration demands the following requirements:

• Submission of a Business Plan, indicating clear business objectives, targeted customers, governance arrangements and financial projections.
• Description of the organisational structure, required to fulfil specific conditions.
• Evidence of maintaining the appropriate initial capital and own funds. The initial capital requirement depends on the cryptoasset services proposed to be provided by each CASP. These are divided into three CASP classes, with initial capital requirement as follows:
  • Class 1 – EUR 50,000.
  • Class 2 – EUR 125,000.
  • Class 3 – EUR 150,000.

(See www.cysec.gov.cy/en-GB/entities/crypto-asset-services-providers-casps.)

• Demonstration of adequate Anti-money Laundering and Counter-terrorism Financing (AML/CFT) procedures and controls considering the specific risks of the CASP business model and the proposed cryptoasset services.
• Submission of the Internal Operations Manual, describing policies and procedures to be implemented and followed by the CASP throughout its operations.
• Details on all public addresses of cryptoassets and/or of public keys/digital wallets controlled by the CASP that are used or can be used in the operation of the CASP in relation to each cryptoasset.
• Details of the IT systems, security policies and procedures, including the controls in place for preventing and addressing incidents of theft and fraud.

To obtain a CASP licence in Cyprus, the essential requirements encompass: 

• incorporating a Cyprus-based entity; 
• meeting the aforementioned initial capital requirements;
• appointing a four-member board of directors (two executive and two independent non-executive) of good repute, knowledge, skill, and experience, the majority of which need to be tax residents of Cyprus (i.e., at least three out of four directors).
• developing and implementing comprehensive operational policies and procedures encompassing risk management, conflict resolution, business continuity planning, data archiving, data protection, and information security;
• instituting mechanisms and policies for accounting and internal auditing to ensure financial transparency;
• maintaining an operational office within Cyprus staffed with competent personnel;
• upholding ownership integrity characterised by honesty, integrity and financial stability;
• sustaining a functional website for transparent communication; and
• unwavering adherence to rigorous regulatory standards encompassing anti-money laundering measures, compliance protocols, risk management, corporate governance practices and data protection policies and procedures.

Lastly there are currently eight CASPs registered with CySEC, as of 19 February 2024. 

Cryptoassets categorised as FITs are subject to specific regulations regarding their issuance and marketing, which may involve adherence to rules outlined in the Investment Services Law, Prospectus Regulation (2017/1129) and Crowdfunding Rules, during the offering process.

White paper requirements in Cyprus were initially introduced in the Bill on the Distributed Ledger Technology Law 2021 (DLT Bill), which was withdrawn from enactment due to upcoming MiCA considerations. As indicated, Cyprus will follow MiCA guidelines, stipulating that for the issuing of Asset-Reference Tokens, Electronic Money Tokens and Utility Tokens, issuers are required to draft white papers, satisfying certain requirements.

Further, the Consumer Protection Law of 2021 (112(Ι)/2021) provides conditions for lawful advertising in commercial practices, stipulating conditions for unfair trade practices, deceptive acts, misleading omissions, and aggressive practices. Additionally, section 13 of the AML Directive, stipulates that “all information, including marketing communications, addressed to clients or potential clients, are accurate, clear and not misleading and that marketing communications are clearly identified as such”.

Inevitably, MiCA will introduce regulations for crypto platforms, token issuers, and traders, emphasising transparency, disclosure, authorisation, and supervision of transactions. MiCA will require CASPs to obtain a licence for advertising within the EU and obliges the “crypto-asset issuer” to produce a white paper containing information on, inter alia, the issuing entity, the cryptoasset and the rights and obligations attached to it. 

Pursuant to the AML Law, CASP entities (including exchanges and custodial wallets) are considered as obligated entities and are thus required to comply with the AML Law and its relevant reporting obligations. Given this, they must adhere to rules, inter alia, in relation to:

• performing Know Your Client and other client due diligence measures;
• drawing the economic profile of clients;
• identifying the source of client funds;
• monitoring clients’ transactions;
• ongoing monitoring;
• identifying and reporting suspicious activity and transactions; 
• undertaking comprehensive risk assessments in relation to clients’ activities and taking proportionate measures per client, considering the activity and cryptoassets in question.

CASP licence holders must also establish internal AML/CFT policies and procedures, appoint a compliance officer, and report suspicious transactions to the relevant authorities.

CASP licence holders must further adhere to International Financial Reporting Standards, as managing directors must maintain precise accounting records, ensure clarity in financial statements, and provide transaction explanations.

Notably, the Policy Statement also highlights, inter alia, the necessity to implement the “Travel Rule” under the requirement of applying a risk-based approach, which is the obligation to obtain, identify, hold, and monitor information regarding the originator and beneficiary information and if necessary, report suspicious transactions to the financial intelligence agency of Cyprus (MOKAS), take freezing actions (i.e., not action client transactions) and prohibit transactions where appropriate.

The Cyprus legal system is interwoven and principally based on the English common law system. Pursuant to section 29 of the Courts of Justice Law (Law 14/1960), the Cyprus courts, in the absence of contrary legislation, must follow the principles of common law and equity. A fortiori, English case law is extensively applied and provides valuable guidance to the Cyprus courts. 

The quintessential question of whether cryptoassets should be classified as “property” remains unaddressed by the legislator, and in the absence of any reasoned judgment from the Cyprus courts on this matter, it is anticipated that the Cyprus judiciary will align with the precedent set by the English court in the case of AA v. Persons Unknown & Ors [2019] EWHC 3556 (Comm), along with subsequent English decisions, which recognise cryptoassets as property. It is noteworthy that, despite the lack of published reasoned judgments, several interim proprietary and/or freezing injunctions concerning cryptoassets have been issued. This further indicates the propensity of the Cyprus courts to treat cryptoassets as property pursuant to Cyprus Law. 

Considering the analysis above, it is highly probable that cryptoassets will be recognised and treated as property under Cyprus Law, thereby allowing them to be owned, assigned, transferred and/or held in a trust.

The control and ownership of cryptoassets are intrinsically linked to the possession of the private key, for the digital wallet containing the cryptoassets. Possessing the private key may, therefore, establish legal control and ownership. 

From a regulatory perspective, there are no restrictions as to the ownership of cryptocurrencies in Cyprus. Furthermore, other than the AML Law, no other specific restrictions and/or licensing requirements currently apply, making Cyprus a favourable environment for cryptocurrency investments.

Cyprus, like most jurisdictions, does not have a specific legislative regime for DAOs. Thus, the legal status of a DAO remains grey. 

Despite the prevailing uncertainty, a DAO could conceivably be categorised as a partnership, an unincorporated company, or an unincorporated association. With the increasing practical use of DAOs and the inevitable emergence of more issues and disputes, greater clarity is expected to emerge.

The principal provisions governing insolvency and bankruptcy in Cyprus are contained within the Companies Law (Cap.113) and the Bankruptcy Law (Cap.5). 

Presently, no dedicated insolvency/bankruptcy framework exists for addressing cryptoassets. As analysed in Question 7, Cyprus law will arguably treat cryptoassets as property and in the absence of a specialised regulatory regime, it is likely that cryptoassets will be treated akin to other forms of property.

Undoubtedly, the particular character of a cryptoasset, whether it assumes the form of a digital or virtual currency, coin, token, or equity/debt security, may affect its treatment within the ambit of Cyprus insolvency/bankruptcy law.

As referred to above, Cyprus contract law is modelled on English contract law and has been guided ever since by the English legal system. Contract Law (Cap.149) is the key statute governing Cyprus contract law.

There are no established guidelines per se, regarding the extent to which smart contracts are enforceable under Cyprus law. Nevertheless, when smart contracts (a) fulfil all the requirements for the formation of a legal contract (offer, acceptance, consideration, certainty and intention to create legal relations); and (b) do not introduce any novel legal issues concerning their legality and enforceability, there is no reason why they should not be treated the same as any other contract. 

However, given the peculiar nature of smart contracts, enforcement per se is not required, as they inherently facilitate self-enforcement. 

Notably, the Cyprus Government, in collaboration with the House of Representatives, CBC, CySEC, the Cyprus Bar Association, the Cyprus Association of Chartered Accountants and other stakeholders, drafted and published in 2019 the National Strategy on Distributed Ledger Technology. The report recognised and encouraged the use of smart contracts with the aim of promoting the development of this technology through innovation and pilot applications. 

The Cyprus legal system is interwoven with and principally based on the English common law system. English case law and principles are extensively applied and provide valuable guidance to the Cyprus courts.

In recent years, the Cyprus courts have dealt extensively with a plethora of cross-border fraud disputes and have been readily prepared to assist victims of such fraud by, inter alia, issuing interlocutory injunctions on an urgent basis and/or where appropriate. 

It is worth noting that since September 2023, a new set of Civil Procedure Rules (CPRs) have been introduced, which are modelled after the English CPRs. 

As explained in Question 7 above, pursuant to Cyprus law, cryptoassets will most likely be considered as property. Given this, both proprietary and personal claims will be at the disposal of fraud victims. 

A range of potential personal claims may include misrepresentation, deceit, conspiracy, unjust enrichment and conversion. Further, dishonest assistance and knowing receipt may also be of instrumental importance in casting the net of liability to third parties — provided that a breach of trust or fiduciary duty exists, along with their relevant requirements.

Further, the interim reliefs available in the armoury of civil fraud litigation will be at the disposal of victims of crypto fraud, including:

• Proprietary injunctions.
• Freezing orders along with ancillary disclosure orders.
• Chabra orders.
• Disclosure orders: 
  • Norwich Pharmacal orders; and 
  • Bankers Trust orders.
• Imaging and search orders.
• Appointment of an interim receiver. 
• Any appropriate ancillary order to the above.

The issuance of such reliefs requires the fulfilment of certain requirements and invariably resides with the discretion of the courts to consider whether it is fair and just for such an order to be issued.

Although no reported case has been published yet, a number of interim proprietary and/or freezing injunctions have been issued by the Cyprus courts against crypto fraudsters.

It is worth noting that the new Cyprus CPRs enunciate both the (a) over-riding objective; and (b) obligation on reliance on substance over form of the English CPRs, making it highly arguable that the Cyprus courts will readily espouse the principles of Persons Unknown orders, as introduced in the English judgment of Bloomsbury Publishing Group Ltd v. News Group Newspapers Ltd & Others [2003] EWHC 1087 Ch, and issue the much-needed relief of Persons Unknown orders against crypto fraudsters.

Lastly, Cyprus law provides crypto-fraud victims a number of mechanisms to enforce their judgments:

• writ of delivery, ordering crypto-exchange or fraudster(s) to deliver up cryptoassets to the judgment creditor(s);
• a writ of attachment (garnishee order);
• a charging order (and subsequent sale of such charged assets) over the interest of the judgment debtor’s shares, corporate debentures, unit trust and funds in court, owned by the judgment debtor;
• post-judgment disclosure for the purposes of enforcement (under CPR 58.1, which provides for the disclosure of assets and any other disclosure to effect the execution of the judgment); 
• information about the judgment debtor’s assets (by way of an application for asset disclosure under the Civil Procedure Law (Cap.6), which only allows for disclosure of assets (directly or indirectly) owned);
• an order for repayment of the judgment debt in instalments; and
• appointment of a receiver by virtue of equitable execution of the judgment.

As MiCA aims to harmonise cryptoassets regulation across the EU-27, Cyprus is expected to align its legislation with its provisions. Key regulators have already followed MiCA for guidance and its compatibility with Cyprus law should render its adoption an unambiguous task. 

Cyprus has also declared its intention to introduce a taxation-friendly regime, identifying tokens as intangible assets and allowing for amortisation for over a maximum of 20 years. Currently, Cyprus boasts one of the EU’s lowest corporation tax rates, set at 12.5%, with the potential to afford further incentives, which can lead to even lower tax rates, as low as 2.5%, for certain industries.