Cyprus Fiduciary & ASP Licence 2026: The CySEC-Regulated Corporate Services Regime

Almost every foreign-owned Cyprus company touches a regulated fiduciary somewhere — the firm that supplies its registered office, its nominee director, its company secretary, or holds shares on trust. In 2026 that activity remains tightly regulated: providing administrative services by way of business in or from Cyprus requires an authorisation under the Law Regulating Companies Providing Administrative Services and Related Matters, Law 196(I)/2012.Law Regulating Companies Providing Administrative Services, N.196(I)/2012

This guide answers the questions company owners and would-be service providers actually ask: what the ASP licence is, who needs one, what it covers, which regulator supervises it, and what it takes to hold one. If you are simply forming and running your own company, see the full Cyprus company registration guide— the licensing question below is about the professionals who serve you, not about you.

What is a Cyprus Administrative Service Provider (ASP) licence?

An ASP licence is the authorisation that lets a firm provide corporate, administrative and fiduciary services to third parties by way of business in Cyprus — things like acting as or arranging a director, secretary, nominee shareholder, registered office or trustee. The regime was created by Law 196(I)/2012 to bring the previously loosely regulated “trust and company service provider” sector under formal supervision.

Before 2012 much of this work sat outside any dedicated licensing framework. Law 196(I)/2012 — since amended several times, most recently in 2025 — closed that gap by defining “administrative services” and requiring anyone who supplies them commercially to be authorised and supervised.N.196(I)/2012, as amended (incl. amending laws to 2025) The point is investor protection and anti-money-laundering control: the people who create, staff and administer companies and trusts are gatekeepers to the financial system, so Cyprus regulates them as such.

Who needs an ASP authorisation to provide fiduciary services?

You need an ASP authorisation if you provide administrative or fiduciary services to other people by way of business. You do notneed one to own, direct or run your own company, or to act for your own group. The line is “by way of business for third parties”.

• Needs authorisation: a firm offering nominee directors, corporate secretaries, registered offices, nominee shareholders, company formation-and-management packages, or trustee services to a portfolio of external clients.
• Does not need authorisation: a beneficial owner who sits on the board of their own company, a group holding company administering its own subsidiaries, or an individual acting as a one-off director of a company they own.
• Special routes: certain regulated entities (and their subsidiaries) and members of the professional bodies provide these services under their own supervisory frameworks rather than a separate standalone CySEC licence.

The practical takeaway for a company owner is simple: you almost certainly do not need a licence, but the firm you hire to hold your registered office or supply a nominee director does. Always ask a prospective provider under which authority they are authorised.

What services does the ASP licence cover?

Law 196(I)/2012 defines “administrative services” broadly. The core covered activities are the formation, management and administration of companies and other legal entities, the provision of officers and registered offices, nominee arrangements, and trustee and fiduciary services.

These are the everyday building blocks of an internationally owned Cyprus structure. When you engage a corporate services firm to “set up and run” a company, most of what they do falls inside this definition — which is exactly why the provider must be authorised even though you, the client, need no licence.N.196(I)/2012, Art. 4 (definition of administrative services)

Which regulator supervises ASPs: CySEC, ICPAC or the Bar?

All three. Law 196(I)/2012 names three competent authorities. The Cyprus Securities and Exchange Commission (CySEC) authorises and supervises standalone ASP firms; ICPAC supervises its member accountants; and the Cyprus Bar Association supervises advocates and law firms providing these services.

CySEC maintains the public register of authorised ASPs and publishes the applicable regulatory framework and fees.Cyprus Securities and Exchange Commission — Administrative Service Providers Accountants who hold an ICPAC practising certificate and advocates regulated by the Cyprus Bar can provide administrative services under their own professional supervision rather than by obtaining a separate CySEC licence. This tri-partite design is deliberate: it channels each provider to the supervisor that already knows its profession, while keeping a single statutory rulebook and a common anti-money-laundering standard across all three.Prevention and Suppression of Money Laundering Activities Law, N.188(I)/2007

What are the capital, insurance and fit-and-proper requirements?

A CySEC-authorised ASP must be a properly organised company run by fit-and-proper people, with sound internal controls, robust anti-money-laundering procedures, adequate own funds and professional indemnity insurance. CySEC prescribes the detailed thresholds by directive, so the exact figures are set at the regulator level rather than fixed loosely in commercial guides.

• Corporate form and governance: the applicant is a company with a clear ownership chain and management structure, applying the “four-eyes” principle so the business is directed by at least two competent persons.
• Fit and proper: directors, managers and beneficial owners must satisfy good-repute, competence and integrity tests — assessed on qualifications, experience and clean regulatory and criminal records.
• Own funds: the firm must maintain minimum own funds sufficient for its activities. The specific level is set by CySEC directive; confirm the current figure directly with CySEC or your adviser rather than relying on a headline number.
• Professional indemnity insurance: cover proportionate to the services provided is required, to protect clients against errors and liabilities.
• AML framework: a designated compliance officer, customer due-diligence procedures, ongoing monitoring and record-keeping under Law 188(I)/2007. N.188(I)/2007 (AML/CFT obligations for obliged entities)

Because these tests are continuing rather than one-off, a licensed ASP is materially different from an unregulated agent: it is audited, supervised and answerable to a regulator that can suspend or withdraw its authorisation.

How do you apply for an ASP licence?

Authorisation is an application to the relevant competent authority — CySEC for a standalone firm — supported by a full documentation pack, followed by an assessment of the firm, its owners and its systems, and payment of the prescribed fees. It is a regulated licensing process, not a simple registration.

1. Incorporate the applicant company and design its governance, ownership and management so it meets the four-eyes and fit-and-proper standards.
2. Build the compliance infrastructure — internal operations manual, AML/CFT policies and procedures, a compliance officer, and professional indemnity cover.
3. Prepare and submit the application to CySEC with questionnaires for directors, managers and beneficial owners, a business plan, and proof of own funds and insurance.
4. Respond to CySEC's review and any further-information requests; the regulator assesses repute, competence, organisation and controls.
5. On approval, receive the authorisation, appear on the public register of ASPs, and begin operating under continuous supervision. CySEC — ASP authorisation and register

For accountants and advocates using their professional-body route, the equivalent step is registration and supervision through ICPAC or the Cyprus Bar Association rather than a standalone CySEC file.

What ongoing obligations do licensed ASPs face?

A licensed ASP is permanently supervised. It must keep meeting the authorisation conditions, run full anti-money-laundering procedures, maintain a compliance function, submit regulatory returns, and — as a regulated entity — have its own financial statements fully audited every year.

Regulated status has a knock-on that catches many people out: an ASP can never use the small-company review-engagement option, because regulated entities always require a full statutory audit under International Standards on Auditing. That is set out in the Cyprus audit requirements guide. Beyond the audit, an ASP must maintain its professional indemnity cover, keep client due-diligence records, monitor and report suspicious activity, and notify the regulator of material changes in ownership or management. Continuing to satisfy the own-funds and fit-and-proper tests is not optional — failure can lead to conditions, suspension or withdrawal of the licence.

Why does ASP regulation matter when you form a Cyprus company?

Because the quality and licensing of your service provider directly affects your company's banking, compliance and reputation. Using an authorised, supervised provider gives you a regulated counterparty, proper due diligence and continuity; using an unregulated one exposes you to legal, banking and AML risk.

Cyprus companies pay corporate tax at the reformed 15% rate from 1 January 2026, and a well-run structure depends on clean, well-kept corporate records — exactly what a licensed provider delivers.Income Tax Law N.118(I)/2002 (as amended for 2026) Banks and payment institutions increasingly expect the registered office, directors and secretary to be supplied by a properly authorised firm, and will scrutinise structures that are not. The tax mechanics themselves are covered in our Cyprus corporate tax guide; the point here is that the operator behind your company should be regulated.

This is where Zeno's model fits. Zeno is not a law firm and not itself a CySEC-licensed ASP. It coordinates your formation and annual compliance and connects you with independent Cyprus Bar-licensed advocates, ICPAC-licensed accountants and, where a regulated fiduciary is needed, authorised administrative service providers — each delivering the regulated service directly to you under their own licence and supervision.