Decision
Does Your Cyprus Company Need a Licence?
Does Your Cyprus Company Need a Licence?: short answer
Last reviewed
Most Cyprus companies need no licence. The question turns on what the company does and for whom. Investment services to clients, crypto asset services to others, accepting bets and issuing or handling electronic money each sit under a licensing regime. Selling your own software, services or goods is not by itself a licensable activity.
| Ordinary trading company | No licence. Selling your own software, services or goods is not by itself licensable |
|---|---|
| Investment services to clients | Cyprus Investment Firm authorisation under N.87(I)/2017, supervised by CySEC source |
| Crypto asset services to others | Authorisation under Regulation (EU) 2023/1114, MiCA, supervised by CySEC source |
| Accepting bets | Licensing under the Betting Law N.37(I)/2019, through the National Betting Authority source |
| Electronic money and payments | Authorisation supervised by the Central Bank of Cyprus |
| Doviandi's own gate | The firm's terms exclude any activity requiring a licence the company does not hold, and require prior written consent for gambling, digital assets, funds from the public and high risk card acceptance |
Founders usually ask this question too late, after the structure is drawn. The licence question decides which activities the company may carry on at all, which jurisdiction parts of the business must sit in, and whether a provider may act for it, so it belongs first.
The question is what you do, and for whom
Cyprus does not license companies. It licenses activities. An ordinary company selling its own product, its own software or its own services needs no licence to exist or to trade, and most Cyprus companies fall in that category: holding companies, software businesses, agencies, consultancies, e-commerce sellers.
The perimeter starts where the company acts for others in defined ways: where it holds or manages other people's money or assets, executes their transactions, accepts their stakes, or issues means of payment. The test that sorts most cases quickly is three questions. What does the company actually do? Who is the counterparty? And whose money or assets does it touch?
The four regimes that catch founders
- Investment services. Providing investment services or activities to third parties, receiving and transmitting orders, executing them, managing portfolios, advising on investments, is authorised under the Investment Services and Activities and Regulated Markets Law N.87(I)/2017 and supervised by CySEC. The regulated services are services to others: a company dealing only with its own funds, with no clients, is asking a different question, and whether any service to a third party exists is exactly the point on which such structures should take advice before forming.
- Crypto asset services. Custody, exchange, execution and portfolio services in crypto assets provided to others fall under Regulation (EU) 2023/1114, MiCA, applied in Cyprus under CySEC's supervision. A company passively holding its own digital assets is not thereby providing a crypto asset service, and the line between holding and serving is where these structures need care.
- Betting. Accepting bets is licensed under the Betting Law N.37(I)/2019 through the National Betting Authority, and which products fall inside each licence class is defined by the Law itself. Models with a randomised paid outcome, mystery boxes among them, are treated differently across EU markets, so the licensing answer depends on the model and on every market served, not only on Cyprus. A business on the supply side, providing platforms or content to licensed operators, is a different exercise from operating, and the first question in any such structure is which side of that line the business is on.
- Electronic money and payments. Issuing electronic money and providing payment services are authorised activities supervised by the Central Bank of Cyprus. A business that holds customer balances or moves customer funds as a service is in this territory whatever it calls itself.
Collective investment is its own field: raising funds from investors to invest under a defined policy points at the alternative investment fund framework rather than at an ordinary company, and it is not covered here.
Why a licensed provider asks before it acts
The licence question is also a gate on the provider side, and how a firm handles it tells you how it is run. Doviandi's terms of business exclude acting for any activity that requires a licence the company does not hold, and require the firm's prior written consent, decided case by case, for gambling, for cryptocurrency and digital assets, for taking funds from the public for investment, and for card acceptance on high risk products.
That is stated here because it changes what a well run engagement looks like. The activity question is asked before formation, on the record, rather than discovered by a bank's compliance team in month three. A provider that does not ask is not saving you friction. It is deferring the question to the point where it costs the most, which is the position the licensing perimeter exists to prevent.
How to settle it before forming anything
Write down what the company will actually do in its first year, name the counterparties, and trace whose money or assets it touches at each step. Test that description against the four regimes above. Where the description sits near a boundary, own funds against client orders, holding against custody, skill against chance, the boundary is the advice question, and it is cheaper answered before incorporation than after. Where a licence is genuinely required, the structure follows the licence: the licensable activity sits in the licensed entity and jurisdiction, and the Cyprus company takes the roles that need none.
Common questions
Does a Cyprus holding or software company need a licence?
No. Holding shares or assets for the company's own account, and developing and selling the company's own software or services, are not licensable activities in Cyprus. The perimeter concerns defined services provided to others, principally in investments, crypto assets, betting and payments.
Is trading my own money through a Cyprus company a regulated activity?
The regulated investment services are services provided to third parties. A company dealing only on its own account, with no clients and nobody else's funds, is not providing a service to anyone, but structures in this area drift, funded traders, pooled friends and family money, profit shares, and each drift step moves toward the perimeter. Take the question to advice before forming, with the honest facts.
Are mystery box or prize platforms gambling in Cyprus?
There is no single EU answer. Models with a paid, randomised outcome are treated as gambling in some markets and not in others, and the licensing position depends on the mechanics of the model and on every market served. The Betting Law N.37(I)/2019 defines what is licensable in Cyprus, and the markets question sits alongside it. This is a structure to design around the answer, not ahead of it.
Technical definition
The determination whether a company's intended activity falls within a regulated perimeter in Cyprus, principally investment services under the Investment Services and Activities and Regulated Markets Law N.87(I)/2017, crypto asset services under Regulation (EU) 2023/1114 supervised by CySEC, betting under the Betting Law N.37(I)/2019, and electronic money and payment services supervised by the Central Bank of Cyprus.
Practical implications
The perimeter attaches to the activity, not to the label the business uses for itself. A platform that calls itself technology but holds client funds, executes client orders or accepts stakes on uncertain outcomes is described by what it does. Where a licence is required and will not be held, the activity cannot simply be run from Cyprus without it.
Common misconceptions
That incorporating in Cyprus requires a licence, when ordinary trading companies need none. That trading the company's own funds is the same as investment services, when the regulated services are ones provided to third parties. And that a mystery box, sweepstake or similar randomised model is automatically fine or automatically gambling, when the answer depends on the model and the markets served.