Cyprus is moving to strengthen oversight of its cryptocurrency market, with proposed legislation providing for penalties of up to €15 million for serious breaches and expanded enforcement powers for the Central Bank of Cyprus (CBC) and the Cyprus Securities and Exchange Commission (CySEC).
The Markets in Crypto-Assets Bill of 2026, submitted to the House of Representatives on October 8, seeks to establish the national enforcement framework for the European Union’s Markets in Crypto-Assets Regulation, known as MiCA.
The proposed legislation follows its approval by the cabinet on September 10 and forms part of efforts to introduce more consistent supervision of digital assets, strengthen investor protection and address misconduct in a sector that has expanded considerably in recent years.
According to parliamentary records, the bill was formally tabled alongside other financial legislation, bringing Cyprus closer to completing its domestic arrangements for enforcing the EU rules.
A central feature of the framework is the introduction of substantial financial penalties for companies and individuals that fail to comply with regulatory requirements.
Under Article 111 of MiCA, serious market-abuse infringements involving insider dealing, unlawful disclosure of inside information and market manipulation can attract fines of at least €15 million or 15 per cent of annual turnover, depending on the applicable calculation, for companies.
The European framework also provides for penalties of up to €5m for individuals involved in certain market-abuse violations.
However, the €15m figure does not represent a blanket ceiling on penalties. Depending on a company’s turnover and the nature of the infringement, financial sanctions may be higher.
Other regulatory breaches, including failures involving authorisation, disclosure and the provision of crypto-asset services, are subject to separate penalty provisions.
Under the EU regulation, companies may face penalties linked to 3 per cent, 5 per cent or 12.5 per cent of annual turnover, depending on the obligations breached. Authorities must also have the power to impose fines of at least €5 million for specified categories of corporate infringements.
Beyond financial sanctions, the supervisory framework provides for investigations, inspections, compliance orders and restrictions on business activities, allowing regulators to intervene where companies fail to meet their obligations.
In serious circumstances, enforcement action may include the suspension or withdrawal of authorisation to provide crypto-asset services. Individuals responsible for certain violations may also face temporary restrictions on holding management positions.
The framework further addresses market manipulation, including practices intended to create misleading impressions about the supply, demand or price of crypto-assets.
For Cyprus, the legislation is particularly relevant to businesses providing trading, custody and other crypto-asset services, as well as companies seeking to operate across the European single market.
The CBC and CySEC have already been designated as the country’s competent authorities for MiCA, as confirmed by a Finance Ministry notification published in November 2024.
Their respective responsibilities are set out within the European regulatory framework, with the Central Bank exercising functions relating to certain categories of asset-referenced and electronic-money tokens, while CySEC oversees other crypto-asset activities and service providers within its remit.
The securities regulator has already introduced licensing applications, supervisory guidance and procedures for providers seeking authorisation under MiCA.
The EU regulation establishes common requirements for the issuance, public offering and trading of crypto-assets, as well as the conduct and governance of companies providing related services.
It also introduces specific provisions for stablecoins, including tokens linked to official currencies or other assets, with additional requirements intended to address risks to consumers and financial stability.
Although MiCA’s main provisions have applied across the EU since December 30, 2024, member states must maintain domestic arrangements enabling their authorities to exercise the required supervisory and enforcement powers.
The latest Cyprus bill addresses that national legislative dimension rather than introducing an entirely new European regulatory regime.
At the same time, the rules carry implications for companies seeking access to clients elsewhere in the EU. Businesses authorised under MiCA can provide eligible services across member states through the regulation’s cross-border arrangements, subject to the relevant requirements.
Consequently, compliance is becoming increasingly important for firms seeking to use Cyprus as a base for European operations.
The legislation will now proceed through the parliamentary process before it can become law, with its final provisions subject to scrutiny and possible amendments.
For the island’s crypto-asset industry, the proposed changes place regulatory accountability, investor protection and tougher enforcement at the centre of the next stage of market supervision.