These are two industries with one shared problem: the licence and the money are usually in different places. Cyprus is used as the EU contracting, IP and treasury layer, and the licensing question is answered separately on its own facts.
Key facts
Corporate income tax
15 percent from 1 January 2026
Affiliate and marketing revenue
Ordinary trading income
Proprietary software and platforms
May fall within the IP Box where the company funded the development
Payment and e-money licensing
Supervised by the Central Bank of Cyprus
Investment services licensing
Supervised by CySEC
Gaming operator licensing
A separate regime from the corporate structure, decided per target market
Separate the licence question from the structure question
iGaming and fintech are grouped here because they share a structural feature rather than a market. In both,
the regulated activity and the profitable activity are frequently not the same thing, and are frequently
best held in different entities.
Take the two most common cases.
An affiliate business sends traffic to licensed operators and is paid a revenue share or a fee. It
takes no bets, holds no player funds and does not need a gaming licence. What it has is a marketing
operation, contracts with operators across several markets, and often a proprietary platform for tracking
and attribution. Structurally, it is a high-margin international services business with software inside it.
A licensed operator takes bets or holds client money. That requires authorisation in each market it
serves, and the authorisation carries capital, segregation and reporting obligations that dictate where the
regulated entity sits.
The mistake is treating these as one exercise. A group that combines them puts regulated capital behind
unregulated marketing revenue and makes both harder to run.
What Cyprus is used for
For most groups in these sectors, Cyprus is the contracting, intellectual property and treasury layer
rather than the licensed entity.
Contracting. An EU company with an established treaty network is a straightforward counterparty for
operators, networks and payment providers across the single market. Freedom of establishment applies, and
the entity is recognisable to compliance teams in a way an offshore vehicle is not.
Intellectual property. Tracking platforms, risk engines, payment orchestration layers and player
analytics are software. Where the Cyprus company funded that development, the
IP Box can apply to the income attributable to it,
bringing the effective rate on that portion to 3 percent. This is frequently the largest single item in a
fintech structure and it is routinely overlooked in an affiliate one.
Treasury and holding. Dividends from qualifying participations are exempt on receipt, gains on
securities sit outside the corporate charge, and there is no withholding on distributions to non-residents.
Where a group holds licensed entities in several markets, that is the layer above them.
Where licensing does sit in Cyprus
For fintech specifically, Cyprus is a licensing jurisdiction in its own right.
Payment institutions and electronic money institutions are authorised and supervised by the Central Bank of
Cyprus. Investment firms are authorised by CySEC. Both are EU authorisations, which means passporting
across member states rather than a market-by-market build.
For gaming, the position is different. Operator licensing is decided by the market being served rather than
by where the group is incorporated, and the licensing strategy is a separate exercise from the corporate
structure. A Cyprus holding company sitting above licensed entities in several markets is a common and
workable arrangement; a Cyprus company as a substitute for a market licence is not.
Substance and banking
Both sectors attract closer scrutiny than average, from regulators and from banks, and both are
well served by getting the substance right rather than by minimising it.
That means directors here who genuinely decide, a real operating footprint, and a clear separation in the
accounts between regulated and unregulated activity.
Substance is what supports the tax treatment and, for
the licensed entities, it is a condition of the authorisation itself.
Banking follows the same logic. Payment and gaming-adjacent businesses are asked more questions than
others. A clear ownership chain, a documented source of funds, and an unambiguous statement of what is and
is not licensed is what shortens that process.
Common questions
Do iGaming affiliates need a gaming licence?
Ordinarily not, where the business sends traffic to licensed operators and is paid a revenue share or
fee without taking bets or holding player funds. The position depends on the specific activity and on
the rules of each market being served.
Can an affiliate business use the Cyprus IP Box?
Where it owns proprietary software, such as a tracking or attribution platform, and funded the
development itself, the income attributable to that software can fall within the regime. Revenue that is
purely commission for traffic is ordinary trading income.
Can I get a payment or e-money licence in Cyprus?
Yes. Payment institutions and electronic money institutions are authorised and supervised by the Central
Bank of Cyprus, and the authorisation permits passporting across EU member states.
Does a Cyprus company let me serve gaming markets without local licences?
No. Operator licensing is decided by the market being served. A Cyprus company is used as the holding,
contracting and IP layer above licensed entities rather than as a substitute for a market licence.
Most Cyprus companies need no licence. The question turns on what the company does and for whom. Investment services to clients, crypto asset services to others, accepting bets and issuing or handling electronic money each sit under a licensing regime. Selling your own software, services or goods is not by itself a licensable activity.
Thirty minutes with the person who will run your file.
Cookies, briefly
No third party loads until you say so. Accepting turns on Google Analytics, so we can see which guides get read, and the Cal.com calendar on our contact page. Declining is fine, and everything else works exactly the same. See the privacy policy.