Cyprus: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) directly applicable; national supervision by the Cyprus Securities and Exchange Commission (CySEC) with the Central Bank of Cyprus competent for e-money tokens. Pre-existing CySEC CASP Register under the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (as amended) remains in force through the MiCA transitional period.

Crypto-assets are legal in Cyprus and comprehensively regulated under the directly-applicable EU MiCA Regulation, with CySEC as the primary national competent authority. MiCA's regime for asset-referenced and e-money tokens applies since 30 June 2024 and the full CASP authorisation regime since 30 December 2024; CySEC has set 27 February 2026 as the deadline for legacy CASPs to apply for a MiCA licence, with the national transitional regime ending 1 July 2026. A dedicated 8% flat tax on crypto-asset disposal profits took effect on 1 January 2026 as part of the 2026 tax reform.

Framework: EU AI Act (Regulation (EU) 2024/1689) directly applicable; Commissioner of Communications designated as Market Surveillance Authority, Notifying Authority, and Single Point of Contact; Deputy Ministry of Research, Innovation and Digital Policy as coordinating body

Cyprus is governed by the EU AI Act (Regulation (EU) 2024/1689), which applies directly as an EU Regulation without requiring national transposition. The Council of Ministers designated competent authorities in January 2025 and established a National AI Taskforce to develop a new national AI strategy targeting AI-first governance by 2028. Cyprus holds no standalone domestic AI statute; the EU AI Act, partially in force since February 2025, constitutes the comprehensive legal framework.

Framework: GDPR (Regulation 2016/679) directly applicable; national supplementing legislation: Law 125(I)/2018 (Protection of Physical Persons Against the Processing of Personal Data and Free Movement of Such Data); Law 44(I)/2019 for law-enforcement processing (Directive 2016/680). Supervisory authority: Office of the Commissioner for Personal Data Protection (Nicosia).

As an EU member state, Cyprus applies the GDPR directly and has enacted Law 125(I)/2018 to exercise permitted national derogations and specify the powers of its independent supervisory authority, the Commissioner for Personal Data Protection. The Commissioner enforces GDPR rights and obligations, including transparency, data-subject rights, DPO appointment, DPIA requirements, and 72-hour breach notification, and has issued over €1 million in cumulative fines since 2018. A new Commissioner, Maria Christofidou, was appointed by the Council of Ministers in September 2025.

Framework: Provision and Use of Payment Services and Access to Payment Systems Laws of 2018-2025 (PSD2 transposition); Electronic Money Laws of 2012 & 2018; supervised by the Central Bank of Cyprus (CBC)

Cyprus has a fully operational, PSD2-compliant licensing regime for Payment Institutions (PIs) and Electronic Money Institutions (EMIs), administered by the Central Bank of Cyprus (CBC). The CBC issues authorisations, maintains public registers, and conducts prudential supervision including on-site inspections. Cyprus is actively preparing for the transition to PSD3/PSR following the EU-level provisional agreement of November 2025.

Framework: Cyprus Digital Nomad Visa Scheme, administered by the Deputy Ministry of Migration and International Protection (Migration Department), under the Aliens and Immigration Law (Cap. 105, as amended). EU/EEA nationals rely on EU freedom of movement. Residency-by-investment governed by Regulation 6(2) of the Aliens and Immigration Regulations.

Cyprus operates a dedicated Digital Nomad Visa Scheme for non-EU/EEA nationals who work remotely for employers or clients located abroad. The scheme issues temporary residence permits valid for one year, renewable for up to two additional years, subject to an annual quota (raised to 1,000 places in October 2025). A separate Permanent Residency by Investment (Golden Visa) program offering permanent residency from €300,000 runs in parallel.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) + Cyprus Law of 2025 on DSA Implementation (CYDSA); Digital Services Coordinator: Radio Television and Digital Services Authority (RTDSA); co-competent authorities: OCECPR and Commissioner for Personal Data Protection

Cyprus transposed the EU Digital Services Act into national law on 11 July 2025 via three legislative instruments, designating the renamed Radio Television and Digital Services Authority (RTDSA) as the national Digital Services Coordinator. Prior to this, the European Commission had initiated infringement proceedings against Cyprus for delayed implementation; those proceedings were closed in November 2025 following the adoption. Cyprus additionally benefits from the directly applicable EU DSA framework covering very large online platforms and search engines supervised at EU level.

Framework: Network and Information Systems Security (Amendment) Law of 2025, Law 60(I)/2025 (amending Law 89(I)/2020); supervised by the Digital Security Authority (DSA) and CSIRT-CY under EU NIS2 Directive 2022/2555

Cyprus transposed the EU NIS2 Directive into national law via Law 60(I)/2025, published 25 April 2025, extending mandatory cybersecurity risk-management and incident-reporting obligations to a significantly wider set of essential and important entities across 18 sectors. The Digital Security Authority (DSA) and the National CSIRT (CSIRT-CY) jointly serve as the competent authorities for implementation and enforcement. The European Commission issued a reasoned opinion on 7 May 2025 for incomplete transposition notification, indicating outstanding implementing measures remain pending.

Framework: Companies Law, Cap. 113 (Cyprus); Department of Registrar of Companies and Intellectual Property (companies.gov.cy); Business Facilitation Unit (BFU) under Ministry of Commerce, Industry and Tourism for foreign-interest companies

Cyprus permits 100% foreign ownership of private limited companies with no statutory minimum share capital, and the incorporation process is largely online via the eFiling system operated by the Department of Registrar of Companies and Intellectual Property. A standard private limited company (Ltd) can be registered in approximately 5-10 business days for a fee of €165 (or €265 with the expedited option); stamp duty on incorporation documents was abolished from 1 January 2026 under Law 239(I)/2025. Non-EU nationals who wish to hire third-country staff under a fast-track immigration scheme may additionally register as a Foreign Interest Company through the Business Facilitation Unit (BFU), which imposes a €200,000 minimum capital injection but guarantees a ≤10-business-day registration decision.