CySEC Grants Four-Service License to Collect & Exchange

By Elena Vasquez

What did Cyprus authorize?

CySEC registered Collect & Exchange CY Ltd on Sept. 22, 2025, authorizing four defined crypto-asset services under license CASP003/25. The Cyprus Securities and Exchange Commission’s approval is tied to the activities listed in the license, which limits what the registration establishes. Those four services are:

• Custody and administration of crypto assets.
• Exchanging crypto assets for funds.
• Exchanging crypto assets for other crypto assets.
• Transfers on behalf of clients.

For a customer or counterparty, that list defines the permitted operating perimeter; it does not identify eligible tokens, customer locations, transaction limits or asset volumes because the supplied material contains none of those details. The records also do not state whether the company operated every approved service after registration.

Under the European Union’s Markets in Crypto-Assets Regulation, or MiCA, authorization covers the services specified in the approval. Providers seeking to operate across EU borders must submit required information to their home authority. In plain terms, Cyprus approved four named activities, and nothing in the record establishes broader authority.

What did AFSA permit?

The Astana Financial Services Authority (AFSA) granted Collect & Exchange Ltd a separate FinTech Lab permission that took effect Aug. 21, 2023. Its scope contains three activities:

• Money services relating to digital assets.
• Dealing in investments as an agent.
• Arranging investment deals.

The FinTech Lab permits participants to test services under a streamlined framework before seeking full authorization. That creates a staged path rather than a single terminal status. The supplied record does not say whether Collect & Exchange Ltd later obtained full authorization, whether the tested service reached production, or whether customers were onboarded.

Unlike the Cyprus registration, the AFSA material is framed around testing permission rather than final authorization. Its practical effect is permission for three defined activities inside a lab framework, not evidence that the full authorization stage was completed.

How do the permissions differ?

The agency records identify two differently named entities: Collect & Exchange CY Ltd in the CySEC license and Collect & Exchange Ltd in the AFSA permission. The supplied material treats the actions as separate, but it does not provide an ownership chart, explain whether the companies share control, or say that one permission replaced or converted into the other.

The activity lists also serve different regulatory purposes. CySEC covers operational crypto-asset functions, including custody, administration, exchange against funds or other crypto assets, and client transfers. AFSA covers money services relating to digital assets, investment dealing as agent, and arranging investment deals. A compliance team therefore cannot treat the two approvals as interchangeable descriptions of one activity set.

MiCA adds the cross-border dimension. Its authorization covers only services named in the approval, while a provider seeking to operate across EU borders must submit required information to its home authority. The source does not claim the Cyprus registration creates unrestricted access to every EU jurisdiction. These are separate permissions, with different dates, named entities and listed scopes.

What does the record leave unanswered?\n

The records answer what each regulator authorized, but not how large or mature the business is. They provide no customer count, transaction volume, assets under custody, fee schedule, capital figure, audit result, eligible-token list or client-location breakdown. Their silence does not prove those controls or metrics are absent; it means the permissions alone cannot substantiate them.

They also contain no enforcement action, launch deadline or timetable for full authorization. The dates establish regulatory milestones only: a permission took effect in 2023 and a registration was made in 2025. They do not establish when trading began, when client transfers started or whether either service generated activity.

Operationally, the AFSA route points to a test-then-full-authorization sequence, while MiCA requires cross-border applicants to prepare information for their home authority. The next material checkpoint is whether the lab permission progresses to full authorization and whether expansion brings further regulatory filings; neither record sets a deadline.