Coredo

In 2026 the CySEC license becomes not just a formal tool for entering the European market, but a strategic asset for financial companies seeking international growth. According to the latest data from the European Commission, the volume of transactions in digital assets and investment services supervised by the Cypriot regulator has increased by more than 40% over the past three years.

Why does obtaining a Cypriot license raise questions?

What will you find in the article?

In this article I, Nikita Veremeev, share the practical experience of COREDO: from analyzing requirements and preparing documents to strategies for minimizing risks and accelerating the process. If you are looking not for theory but for working solutions – read to the end. Here you will find not only answers to key questions, but also tools for successfully launching a business with a CySEC license in 2026.

What is a CySEC license and why is it needed in 2026?

CySEC: the Cyprus Securities and Exchange Commission, a recognized regulator of the financial sector that, since 2004, ensures Cypriot companies comply with EU standards, and since 2012 has been a key player in the regulation of crypto-assets and fintech services.

For companies from the EU, Asia and the CIS, a Cypriot license for financial firms opens access to the European Union market thanks to CySEC’s EU passporting mechanism. This means that, having obtained a license in Cyprus, a company can legally provide investment and financial services in all EU countries without needing to obtain separate licenses in each jurisdiction.

COREDO’s experience confirms: having a Cypriot license significantly increases trust from banks, payment systems, institutional clients and partners from Europe, Asia and the CIS. This is especially relevant for companies working with digital assets, investment products and fintech solutions.

Key CySEC requirements for licensing in 2026

The key CySEC requirements for licensing in 2026 are associated with tightened supervision, ensuring financial resilience and investor protection. Companies seeking to obtain a license must not only comply with organizational and operational standards but also meet strict capital and financial metrics.

Requirements for capital and business resilience

In 2026, CySEC’s capital requirements have become even more differentiated. The following minimum capital levels apply to different license categories:

Requirements for company structure and shareholders

CySEC imposes strict requirements on ownership structure transparency. All shareholders and ultimate beneficial owners undergo thorough vetting: documents are provided confirming the source of funds, absence of criminal records and sanctions, as well as compliance with ESG principles. For international companies and firms from Asia and the CIS, special attention is paid to the legality of capital origin and the transparency of the corporate structure.

This approach not only speeds up the licensing process but also facilitates subsequent account opening and international settlements.

Internal policies and procedures

In 2026, internal AML and KYC policies have become particularly important. CySEC requires the implementation of comprehensive client identification procedures, transaction monitoring and reporting of suspicious operations. For CASPs (crypto asset service providers) and fintech companies, cybersecurity procedures are mandatory in accordance with Circular C462 and GDPR standards.

CySEC supervision includes regular inspections, audits and mandatory reporting, which requires continual improvement of internal processes.

Obtaining a CySEC License in 2026

procedure for obtaining a license CySEC in 2026 begins with strict compliance with regulatory requirements and the preparation of a comprehensive package of documents for the application. At each stage it is important to strictly follow the established steps and confirm the company’s readiness to meet CySEC standards, which ensures operational transparency and investor confidence.

Preparation of documents for submitting the application

Key stage: assembling a complete package of documents. For different types of licenses the list varies, but it basically includes:

• Financial statements and confirmation of minimum capital
• A detailed business plan with a risk analysis and an AML strategy
• Shareholder and beneficiary documents (KYC, proof of source of funds)
• Internal policies and procedures on AML, KYC, and cybersecurity
• Confirmation of qualified personnel (director, compliance officer, MLRO)

Stages of submitting the application

The process of submitting an application to CySEC is fully digitalized: documents are uploaded via the online portal. After the initial review there may be requests for clarification or provision of additional data. The timeframes for obtaining a CySEC license in 2026 range from 3 to 9 months depending on the complexity of the structure and the type of license.

License costs and renewal fees

The cost of a CySEC license consists of several components:

• Registration fee (from 7,000 to 25,000 euros depending on the license type)
• Annual supervisory fees (for example, for CASP: from 5,000 euros)
• CySEC license renewal fees, which may be adjusted depending on the volume of operations and the license category

Licensing of financial companies: categories and requirements

licensing specifics for different categories of financial companies directly depend on the type and specifics of their activities, as well as the requirements of regulators in the chosen jurisdiction. Different categories of financial organizations face unique procedures, standards and conditions for obtaining licenses, which is reflected in the required documents, capital level and risk management measures.

CySEC license for Forex brokers

For Forex companies, a CySEC license is the industry standard. Main requirements include a minimum capital of EUR 125,000, qualified personnel and the implementation of comprehensive risk management procedures. CySEC supervision provides for regular inspections, audits and mandatory reporting on transactions and client funds.

CySEC license for crypto-assets

Since 2024, registration and licensing of crypto-asset service providers (CASPs) in Cyprus are regulated under MiCA standards. This means new capital requirements (from EUR 15,000 for basic operations up to EUR 150,000 for custodial and exchange services), enhanced AML controls and mandatory implementation of cybersecurity.

CySEC license for investment advisors and fintech

For investment advisors the minimum capital starts at EUR 15,000. On the other hand, a key factor is the professional experience and qualifications of key personnel. For fintech companies and digital asset providers, CySEC imposes additional requirements on IT infrastructure, data protection and the implementation of innovative AML solutions.

How to obtain a CySEC license in 2026

1. Choosing the license type: Analyze your business model and development strategy to select the optimal type of license (CASP, forex, investment services, etc.). COREDO’s solution – conducting a preliminary audit and modeling growth scenarios.
2. Preparing a business plan: A detailed business plan with risk analysis, financial models and an AML strategy significantly increases the chances of the application being approved.
3. Compliance with AML and ESG: Implement automated KYC/AML systems, train staff, and integrate ESG principles into corporate culture.
4. Document preparation: Check the completeness and accuracy of all documents, taking into account specifics for companies from Asia and the CIS (proof of legal source of funds, transparency of structure).
5. Interaction with CySEC: Ongoing communication with the regulator, timely responses to requests and revisions are key to accelerating the licensing process.
6. Choosing a partner: COREDO’s experience shows that a reliable legal and consulting partner minimizes risks and provides comprehensive support at all stages.

Key takeaways and steps for entrepreneurs and executives

Key takeaways and practical steps for entrepreneurs and executives form the basis for decision-making in a rapidly changing market. To properly structure work and achieve sustainable results, it is important to take current requirements and deadlines into account in a timely manner.

Summary table of requirements and deadlines

Checklist for licensing preparation

• Conduct an audit of the business model and choose the license type
• Prepare the full document package (KYC, AML, business plan, capital confirmation)
• Implement internal policies on AML, KYC, ESG and cybersecurity
• Appoint qualified directors and compliance officers
• Submit the application through the CySEC online portal
• Prepare for possible requests and revisions

Recommendations and advice

Solutions implemented by COREDO for international clients prove: comprehensive support, deep analysis of requirements and flexibility in adapting internal procedures allow not only obtaining a license but also creating a foundation for long-term growth.

For companies operating in the EU, this is not only a legal obligation but also a key factor of trust from partners, banks and investors. The practice of COREDO confirms: the absence of transparent Customer Due Diligence (CDD) procedures and an ineffective risk-based approach lead to account freezes, denial of service and even criminal liability.

Key concepts of AML, KYC, Compliance

At the core: KYC procedures (Know Your Customer), including identification, verification and ongoing monitoring of clients. Compliance in Europe: it is not only about meeting formal requirements, but also about creating an internal culture where risk management is integrated into every business operation.

Objectives of countering money laundering in the EU

To this end, the EU implements unified standards, guided by FATF recommendations and strengthens control over cross-border transactions, crypto-assets and new digital services.

EU Regulatory Requirements on AML 2025–2027

At the center of these changes are tighter controls and the harmonization of processes based on updated legislative acts, such as 6AMLD and the new AML Regulation.

Key legislative acts: 6AMLD and the AML Regulation

From 2025, key changes come into force: 6AMLD (Sixth Anti-Money Laundering Directive) and the new AMLR (EU Single Rulebook). These documents unify rules for all EU countries, introduce clear criteria for identifying beneficiaries, expand the list of obliged entities and strengthen requirements for the compliance regulatory framework.

Role of the European Anti-Money Laundering Agency and launch timelines

From 2026, control over compliance will transfer to the European Anti-Money Laundering Agency (AMLA), which will become the centralized supervisory authority. The solution developed by COREDO for clients already takes into account new procedures for interacting with AMLA, including preparation for centralized inspections and unified reporting.

Expansion of persons and sectors under AML supervision

Now under AML control are not only banks and payment organizations, but also crypto platforms, marketplaces, digital wallet providers, as well as services working with digital identification. In a recent COREDO project for a fintech company from the Czech Republic we integrated cross-border compliance taking into account the new requirements for providers of virtual assets.

Impact of MiCA on AML in crypto-assets

With the adoption of the MiCA Regulation (Markets in Crypto-Assets), crypto companies are required to implement full KYC/KYT procedures, transaction monitoring and automated risk analysis. Our experience at COREDO has shown: adapting internal policies to MiCA and AMLR not only helps avoid fines but also increases trust from European banks.

KYC procedures 2025: how to meet the requirements

It becomes critically important for businesses to comply with the new KYC requirements in order to preserve reputation, avoid fines and operate successfully in the market amid increasing international regulation.

Overview of KYC procedures in AML compliance

KYC procedures: the fundamental element of AML compliance for businesses. They include collecting and verifying client data, analyzing sources of funds, monitoring transactions and detecting suspicious activity. Without clear KYC processes it is impossible to ensure compliance with the new EU standards.

New KYC standards 2025: eKYC and onboarding

From 2025 the focus shifts to eKYC and digital onboarding: digital identification, remote verification of clients and integration with state registers (eIDAS). Solutions implemented by the COREDO team for clients in Estonia and Slovakia allow reducing verification time from several days to hours, cutting costs and increasing conversion.

Enhanced due diligence: risk-based approach

For clients from high-risk jurisdictions or when working with large transactions Enhanced Due Diligence (EDD) is applied. This is an in-depth check of sources of funds, ownership structure and links to politically exposed persons. In one of COREDO’s case studies for a British investment platform we implemented a risk-based approach with automatic reassessment of the risk level whenever the client’s profile changed.

KYC automation and analytics integration

Modern KYC procedures are impossible without automation.

At COREDO we assess the ROI from implementing such solutions by reducing manual errors and accelerating compliance processes.

Transaction monitoring and AML: practical aspects

Transaction monitoring and fulfilling AML reporting obligations are key elements of the system to combat financial abuse in modern business. Practical aspects of this work include continuous risk assessment, monitoring of transactions, and preparing reports in accordance with regulators’ requirements. Below we review the main requirements for transaction monitoring and identifying suspicious activity.

Transaction monitoring and detection of suspicious activity

Transaction monitoring: the key to timely detection of suspicious transactions. In 2025 the requirements for automated analysis are rising: systems must not only flag anomalies but also explain the logic behind their decisions (explainable AI). In COREDO’s work for a platform in Dubai we deployed a module that uses graph neural networks to uncover complex chains of transactions among related parties.

AML obligations: deadlines, forms, liability

Companies must file reports on suspicious activities (Suspicious Activity Reporting) to national FIUs (Financial Intelligence Units) within 24–48 hours of detection.

COREDO’s solution includes automation of report generation and integration with government portals.

Use of graph neural networks and confidential machine learning

The implementation of confidential machine learning (FHE) and continual learning enables analysis of large volumes of data without exposing personal data, which is critical for GDPR compliance. For example: for an international payment provider, the COREDO team implemented a collaborative risk analysis with partners from different countries without transferring raw data, using homomorphic encryption technologies.

Interaction with FIUs and sanctions control

At COREDO we set up automatic checks of customers and transactions for matches against sanctions lists, minimizing the risk of inadvertent violations.

Fines for AML non-compliance: how to avoid them

Failure to comply with AML requirements entails serious fines and risks for businesses — from financial sanctions to a complete suspension of activity. To avoid sanctions, it is important to understand what types of liability are provided by law and how they are applied in practice.

Main fines for AML violations in the EU

Since 2025 the minimum fine for violating AML in the EU is €1 million or 10% of the company’s annual turnover, depending on which amount is higher. For repeat violations, executives may face criminal liability.

Examples of global investigations and cases

COREDO’s practice shows: regular compliance regulatory audits and stress-testing of internal procedures make it possible to identify vulnerabilities before regulators take interest.

The impact of 6AMLD on stricter liability

6AMLD expands the list of predicate offences, introduces the concept of “aiding and abetting,” and tightens the standards for proving guilt. Liability now extends not only to the company but also to specific employees involved in violations. At COREDO we adapt clients’ internal regulations to the new standards, reducing the risk of personal liability for executives.

Managing compliance risks in business

Effective compliance risk management requires not only the implementation of technology but also regular staff training, procedure reviews, and independent audits. COREDO’s solution includes checklists for assessing the maturity of the compliance system and tools for rapid incident response.

Implementing AML compliance in a company: recommendations

Implementing AML compliance in a company requires a systematic approach and a clear understanding of current regulatory requirements. Practical recommendations will help adapt internal regulations to the new EU rules and the 6AMLD, ensuring effective anti-money laundering and legal compliance.

Adapting regulations to EU requirements and the 6AMLD

The first step is reviewing and adapting internal policies in accordance with the 6AMLD and AMLR. The COREDO team develops tailored compliance programs, taking into account industry specifics, business structure and the geography of operations.

Scaling and automation of compliance processes

Scalability is a key challenge for fast-growing companies. Automation of KYC, transaction monitoring and reporting reduces costs and increases the speed of response to incidents. In one of COREDO’s projects for an international marketplace we implemented a compliance workflow integration module, which made it possible to process three times more clients without increasing headcount.

Training staff in a culture of compliance

Effective compliance training: not a one-off event, but an ongoing process. At COREDO we pay special attention to developing a compliance culture: regular training sessions, incident simulations, and experience sharing between departments. This reduces the risk of human error and fosters a responsible approach to risk management.

ROI of implementing AML systems: cost savings and risk reduction

Implementing modern AML systems is an investment with measurable ROI. In COREDO’s case for a payment provider from Cyprus, the automation of KYC and monitoring reduced operating costs by 40% and cut client processing time from 2 days to 30 minutes. But most importantly, the minimization of the risk of fines and account blocks, which ensures business resilience in the long term.

AML compliance in the EU: key steps

In the context of tightening regulatory requirements, AML compliance in the EU is becoming a key issue for businesses. New directives, the digitalization of procedures and greater transaction transparency require not only formal fulfillment of obligations but also real implementation of advanced compliance standards. Below are the key findings and practical steps that will help entrepreneurs and executives prepare for changes and ensure the sustainable development of the company.

Recommendations for entrepreneurs and managers

• Conduct an audit of current procedures and identify gaps in compliance with 6AMLD and AMLR.
• Implement digital KYC and automated transaction monitoring.
• Organize regular staff training and stress-testing of the compliance system.
• Use modern analytics platforms to detect complex money laundering schemes.

Heading analysis

Preparing for new AML requirements

1. Assess the maturity of the compliance system using the COREDO checklist.
2. Update internal regulations and implement eKYC, digital onboarding.
3. Integrate automated monitoring and reporting tools.
4. Set up cooperation with FIUs and sanctions lists.
5. Regularly review procedures taking into account changes in EU legislation.

How to choose a partner for legal support and compliance?

When choosing a partner, pay attention to experience with international projects, availability of case studies on AML system implementation, expertise in adapting to different jurisdictions and the ability to integrate technologies (Chainalysis, Elliptic, GNN). COREDO’s practice is not only consulting, but also comprehensive end-to-end implementation of compliance processes.

Useful resources and AMLA contacts

• Official AMLA portal: current requirements, reporting forms, recommendations for businesses.
• EU Beneficial Owners Register: for checking ownership structures.
• Platforms for monitoring sanctions and risks: Chainalysis, Elliptic, international FIUs.

Table of changes to AML requirements under the directives

The solutions that the COREDO team implements for clients in Europe, Asia and the CIS not only enable compliance with the new requirements, but also create a resilient, transparent and scalable business ready for future challenges.

Who needs a PSP license?

Over the past years the COREDO team has implemented dozens of projects for fintech companies, startups, payment aggregators, e-money providers and international payment services. PSP license for business is necessary for those who:

• Develop fintech products, payment platforms and aggregators.
• Provide e-wallets, payment gateways and services for digital transfers.
• Are focused on international operations and working with individuals and legal entities worldwide.
• Implement solutions for integration with banks and banking partnerships.
• Conduct transactions involving e-money, cryptocurrencies and digital services.

Benefits of a PSP license

The solution developed by COREDO for international clients demonstrates that a PSP license in the EU provides unique advantages:

• Legality: compliance with strict regulatory requirements.
• Passporting: the ability to operate in all EU/EEA countries without obtaining separate licenses.
• Access to banking partnerships: integration with leading banks and financial institutions.
• Expansion of the customer base: serving individuals and legal entities, scaling the business.
• Reduction of operational costs: process optimization, no need for multiple licenses.

Main requirements for obtaining a PSP license

Financial requirements and minimum capital

In different jurisdictions the minimum capital for a PSP license varies significantly. Below is a table reflecting the current requirements:

Corporate requirements and governance

To register a PSP in most countries, the following are required:

• At least two directors (often one must be a resident of the country).
• A clear corporate governance system.
• Distribution of responsibilities among governing bodies.
• Implementation of procedures to oversee operational risks.
• An official procedure for handling customer complaints.
• An IT monitoring system.

Staff and insurance requirements

Regulators require:

• Hiring qualified staff with experience in financial services.
• Mandatory professional insurance.
• Checks of competence and business reputation of executives.

Reporting and audit requirements

To obtain a license for payment services the following are required:

• Timely financial reporting.
• Audit by a licensed auditor.
• Regular audits and compliance with international standards (IFRS, GAAP).

Documents and Business Plan for a PSP License

Legal Documents

Clients of COREDO receive a detailed checklist that includes:

• Memorandum of Association (MOA), Articles of Association (AOA).
• Certificate of company registration.
• Identity documents of shareholders and directors.
• Information on beneficial owners.
• Professional and personal references for executives.

Financial Documents

In each COREDO case, emphasis is placed on:

• Audited financial statements.
• Proof of sufficient capital (bank statements).
• Demonstration of net asset value.
• Transparency of financial operations.

3-Year Business Plan

The PSP business plan, a strategic document reflecting:

• Description of payment services.
• Methods of service delivery.
• Target markets and customer base.
• Financial forecasts and expected transaction volumes.
• Revenue and cost structure.
• Growth scenarios and risk management.

Program Document and Description of Activities

In each project COREDO prepares a program of activities that includes:

• Methods of service delivery.
• Description of internal procedures and policies.
• Security policy and incident response mechanisms.

AML and KYC Documents

To successfully obtain a PSP license the following are required:

• Detailed AML procedures and CFT.
• Evidence of meeting compliance requirements.
• Risk management plans.

Technological Documents

Special attention is paid to:

• Description of software and technological infrastructure.
• Ensuring the security of payment gateways.
• Data protection and reliability of payment processing.

Obtaining a PSP license by jurisdiction: step-by-step

Obtaining a PSP license in the EU

A PSP license in the EU is an opportunity to operate in all EU/EEA countries thanks to the passporting principle. A unified regulatory framework reduces operating costs and simplifies scaling. In COREDO’s practice the most in-demand jurisdictions for registering PSPs and obtaining a license for cross-border operations are Liechtenstein, Malta and Cyprus.

PSP license in Liechtenstein: Guide

Regulator – FMA (Financial Market Authority). The process consists of:

1. Preparation of documentation: operating program, three-year business plan, confirmation of authorized capital, organizational chart, security policy.
2. Submission of the application: gathering the full document package and submitting it to the FMA.
3. Checks and analysis: document assessment, compliance review, analysis of the business reputation of executives.
4. Receiving the decision: issuance of a decision to grant the license.
5. Registration: inclusion in the FMA’s official register.

Obtaining a PSP license in Belize

Regulator: IFSC. The process includes:

1. Company registration with a memorandum of association (MOA) reflecting the activities.
2. Preparation and submission of documents: legal documents, financial statements, business plan, proof of address, references for executives, AML and CFT procedures.
3. Structural requirements: at least two directors (one local), qualified personnel, insurance, a physical office.
4. Financial requirements: €20,000–€125,000 depending on the type of services.
5. Review and approval: IFSC document review, obtaining the license.

Obtaining a PSP license in Dubai

Regulator: Central Bank of the UAE. License categories differ by capital and type of services.

1. Assessment of operational activity: compliance with local laws.
2. Compliance criteria: company registration, infrastructure, capital.
3. Preparation of documents: business plan, confirmation of AML/KYC, incorporation documents, personal data of shareholders and directors.
4. Application submission: sending to the Central Bank.
5. Review and approval: application analysis, obtaining the PSP license.
6. Compliance with requirements: regular audits, reporting, compliance.

PSP license in Mauritius

Regulator: Financial regulator of Mauritius.

1. Preliminary preparation: business model analysis, compliance with requirements, strategic plan.
2. Document collection: business plan, financial statements, information on beneficial owners and directors.
3. Compliance and financial checks: proof of financial stability, capital, risk management, audit.
4. Description of internal procedures: AML/CFT policies, technological infrastructure.
5. Application submission: sending documents, review, obtaining the license.

PSP Licensing by Jurisdiction

Comparison Table of Jurisdiction Parameters

Advantages and Disadvantages of Jurisdictions

• Liechtenstein (EU)
  • Passporting to the EU/EEA, high level of regulation, access to European banks.
  • Significant resources and a complex licensing process are required.
• Belize
  • Low capital requirements, fast process, low costs.
  • No passporting, less international trust, a physical office is required.
• UAE (Dubai)
  • Strategic location, developed infrastructure, high level of regulation.
  • High capital requirements, office maintenance costs, lack of passporting.
• Mauritius
  • Strategic position, developed system, low costs.
  • Limited access to European banks, no passporting.

Choosing a Jurisdiction for Business

• For operating in Europe — Liechtenstein or EU countries.
• For Asia and the Middle East — UAE (Dubai).
• For Africa — Mauritius.
• For startups with limited budgets — Belize.
• For international operations: a combined approach.

Special requirements for payment services

PSP license for money transfers

PSP license for e-wallets

PSP license for payment aggregators and gateways

PSP license for cryptocurrencies

PSP license for individuals and legal entities

Timelines, costs, and mistakes of PSP licensing

Timelines for obtaining a PSP license by country

• Liechtenstein: 3–6 months.
• Belize: 2–4 months.
• UAE: 2–6 months.
• Mauritius: 3–6 months.

Cost of a PSP license and its maintenance

• Government fees: €3,000–€15,000.
• Consulting services: individually.
• Office maintenance, insurance, audit – from $3,000 to $10,000 per year.

Common mistakes when applying for a PSP license

• Incomplete document preparation.
• Insufficient capital.
• Weak business model.
• Inaccurate description of activities.
• Absence of AML/KYC procedures.
• Choosing the wrong jurisdiction.
• Underestimating regulator requirements.

How to avoid a license refusal

• Thorough preparation of documents.
• Consultation with COREDO experts.
• Choosing the optimal jurisdiction.
• Demonstrating financial stability.
• Developing a reliable business model.
• Compliance with all regulator requirements.

PSP license or EMI license: which to choose?

PSP and EMI: what’s the difference?

PSP (Payment Service Provider) — a payment services provider not required to hold clients’ funds. EMI (Electronic Money Institution) — an electronic money institution that can issue and hold electronic money, subject to higher capital and security requirements.

PSP and EMI comparison table