The Cyprus Securities and Exchange Commission will launch a round of on-site inspections and desk-based reviews of authorized crypto asset service providers starting in the second half of 2026. The checks, which run through mid-2027, will target custody and infrastructure risks.
What CySEC is checking
The regulator is zeroing in on how firms hold client assets and the tech that keeps their platforms running. Custody risks cover everything from private key management to whether a firm actually controls the coins it says it holds. Infrastructure risks are about the systems underneath—servers, databases, backup protocols, and how a company handles an outage or a breach.
This isn't a broad compliance sweep. It's a focused look at two areas that can sink a crypto business if they go wrong. CySEC hasn't spelled out the exact checklist, but firms should expect questions about cold wallet storage, segregation of client funds, and disaster recovery plans.
How the reviews will work
There are two tracks here. On-site inspections mean examiners will physically visit the firms' offices—checking equipment, interviewing staff, and watching how processes work in real time. Desk-based reviews are the paperwork side: CySEC will pull records, audit logs, and policies from a distance, then compare what's written down against what's actually happening.
For a small island regulator, that's a heavy lift. Cyprus has a fair number of crypto firms registered under the EU's Markets in Crypto-Assets regulation, and the MiCA framework is still being rolled out across member states. This inspection cycle looks like an attempt to make sure the firms that chose Cyprus as their home base are actually meeting the standards.
Timeline
The program kicks off in the latter half of 2026 and is scheduled to continue until mid-2027. That's a roughly 12-month window, which gives the regulator room to stagger visits and gives firms a clear heads-up to get their house in order.
CySEC hasn't said which providers it will visit first, or whether it'll publish a schedule. Firms that are behind on custody or infrastructure work might want to start closing gaps now, because an inspector showing up unannounced isn't out of the question—on-site reviews often work that way.
What comes after
The regulator hasn't detailed what it'll do with the findings. It could issue warnings, demand corrective action, or escalate to enforcement if something serious turns up. That's all speculative, but the point of the exercise is to find problems, not just tick boxes.
For crypto firms operating in Cyprus, the message is straightforward: the paperwork phase is over. The next year and a half is when the regulator actually shows up at the door. Firms that haven't stress-tested their custody arrangements or hardened their infrastructure should treat the second half of 2026 as a deadline, not a suggestion.
