New VASP licensing rules affecting recovery in Cyprus

New VASP licensing rules in Cyprus are reshaping how recovery specialists can compel disclosure and freeze stolen digital assets in that jurisdiction. If funds have moved on-chain to a Cyprus-registered virtual-asset service provider, the regulatory changes that took effect in early 2026 alter both the obligations of that provider and the legal leverage available to claimants.

Cyprus has transposed the EU's updated virtual-asset regulatory regime, placing new licensing obligations on every virtual-asset service provider operating from or into the jurisdiction. For recovery purposes, this matters because licensed VASPs now carry stronger statutory compliance duties – including enhanced know-your-customer records and transaction monitoring – that can be compelled through a disclosure order against a VASP or a Bankers Trust order coordinated with local counsel in Cyprus.

This alert covers what changed, who is affected, and what to do now if stolen crypto has reached a Cyprus VASP.

What Changed in Early 2026?

Cyprus moved from a provisional-registration regime to a full licensing system for VASPs, aligning with EU-wide rules on crypto-asset markets. Every VASP offering services to Cyprus residents or operating from Cyprus must now hold a formal licence and maintain auditable customer and transaction records. Unlicensed providers face regulatory sanction, and their ability to continue operating is materially constrained.

For asset-recovery work, two practical shifts follow. First, licensed VASPs have clearer compliance obligations and are more reliably reachable by legal process. Second, the regulator now holds a register of licensed entities – a choke-point map that didn't exist in its current form before. We have seen, in our experience, that regulatory registers of this kind materially shorten the identification phase of a tracing exercise.

There is a third, less welcome shift. Some smaller or non-compliant operators have migrated out of the Cyprus perimeter, moving assets to less regulated nodes. That means the window for catching funds at a Cyprus-based choke point may be shorter than it was in 2024 or 2025.

Who Is Affected?

The licensing changes are directly relevant to three groups.

• Fraud victims whose stolen funds were routed on-chain to an exchange or wallet-custody service operating from Cyprus. On-chain tracing can often confirm whether a receiving wallet is associated with a licensed Cyprus VASP.
• Insolvency practitioners dealing with an insolvent estate that held digital assets on a Cyprus-based platform. Access to records held by a licensed VASP may require a formal legal process but the pathway is now cleaner.
• Referring lawyers and funders assessing the viability of a crypto-fraud matter where Cyprus appears in the on-chain trail. Licensing status of the receiving VASP is now a material due-diligence question at the outset.

If your matter involves any of these positions and Cyprus features in the blockchain trail, the new rules change what is achievable – and how fast. We coordinate closely with admitted local counsel in Cyprus; local procedure governs the filing of any disclosure or freezing application.

To assess whether a Cyprus VASP is reachable on your facts, contact info@axiomtracel.com for a confidential case review.

What to Do Now

Speed remains decisive. A freezing or disclosure application is typically made without notice to avoid tipping off the defendant, and the window before funds move again is measured in hours to days, not weeks.

Three immediate steps matter.

• Preserve the on-chain record. Blockchain data is public and immutable, but your own evidence – transaction confirmations, wallet addresses, exchange communications – can be lost or overwritten. Capture everything now.
• Confirm the VASP's licensing status. Whether the receiving platform holds a Cyprus licence determines which legal instruments are available. A disclosure order against a VASP operates differently depending on whether the target is a regulated entity subject to local law.
• Instruct recovery counsel without delay. In Cyprus, a proprietary injunction or a disclosure order coordinated through local counsel can compel a licensed VASP to freeze a balance and produce identity and transaction records. The new licensing regime makes that process more predictable – but it still requires an urgent application and correctly filed papers. Local admitted counsel must act on the ground; Axiom Trace coordinates the cross-border and on-chain strategy around them.

Is the money really gone? In our experience, movement on a public blockchain is rarely the end of the trail. It is a continuation of it – and the Cyprus licensing changes give claimants a better-anchored legal lever at the cash-out point.

For a confidential read on whether your matter is actionable under the new Cyprus VASP rules, contact us at info@axiomtracel.com.

Related Reading

• Crypto Asset Recovery – practice overview and on-chain tracing methodology
• Cyprus jurisdiction guide for asset recovery
• UBO register access changes in the British Virgin Islands – recovery implications

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. Our work in digital-asset matters combines on-chain tracing with the legal instruments that convert a blockchain trail into enforceable relief. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Cyprus; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.