Cyprus Gaming License 2026: Betting Only Scope

Betting licenses in Cyprus are issued by the National Betting Authority under the Betting Law of 2019, L.37(I)/2019. That statute replaced the Betting Law of 2012. Class A covers land-based betting and Class B covers online betting. Both classes cost €30,000 for one year or €45,000 for two. Licensed bookmakers pay 10% betting tax plus a 5% statutory contribution on net betting revenue. One condition separates this jurisdiction from every other European option: online casino gambling in Cyprus is prohibited outright, alongside slot machines and electronic horse racing.

Operators choose Cyprus when they want an EU member-state regulator without EU-scale compliance contributions. An online gambling license in Cyprus buys credibility rather than breadth. Banking partners, payment processors and affiliate networks read it as a European credential, not an offshore one. A sportsbook can run its full online sports betting product on a turnkey platform under one Class B bookmaker’s license, while a casino-led brand gains nothing and must license elsewhere. That decision belongs at the start of a roadmap, not at technical review.

Cyprus License Quick Facts

1. 01

   Regulator — National Betting Authority (NBA), Nicosia

2. 02

   Primary law — The Betting Law of 2019, L.37(I)/2019, as amended

3. 03

   Scope — Betting only: Class A (land-based) and Class B (online); online casino, slots and electronic horse racing are prohibited

4. 04

   License fee — €30,000 for one year or €45,000 for two; same schedule on renewal, filed at least three months before expiry

5. 05

   Gaming tax — 10% betting tax plus 5% statutory contribution, both on net betting revenue, paid monthly

6. 06

   Corporate tax — 15% from 1 January 2026; no withholding on dividends paid to non-residents

7. 07

   Applicant — Company limited by shares, Cypriot or foreign branch, with €500,000 issued and paid-up share capital

8. 08

   Bank guarantee — €550,000, valid six months past license expiry

9. 09

   Hosting — Backup server inside Cyprus, connected in parallel to the main server

10. 10

    Domain — Betting services only via .com.cy addresses

11. 11

    Player funds — Segregated clients' account; deficits covered within three days

12. 12

    Review timeline — No statutory deadline; a complete file is typically decided in months, not weeks

13. 13

    Reform — Draft bill would add B2B supplier licensing

What Is the Cyprus Gambling License?

Only a company limited by shares may apply, incorporated in Cyprus or registered as a foreign branch. Registration follows Chapter 113 of the Cyprus Companies Law, and the main activity must be managing bets. Issued and paid-up share capital must reach €500,000. The Authority must also be satisfied that no director, beneficial owner or holder of a significant interest has been convicted of a relevant offense. It then tests accounting controls, player-protection terms and the minimum reserves set by the National Betting Authority.

One Class B license covers the entire online betting product: pre-match, in-play, cash out and esports, across sports and other events involving human participants. Malta approves verticals individually and will license casino alongside a sportsbook product. Cyprus strictly limits the product instead. Unlicensed gambling in Cyprus is considered a felony rather than a regulatory breach, with penalties reaching five years or €300,000 for running an online casino. Casino gaming exists here only as a land-based monopoly under a separate regulator.

• Class A bookmaker’s license — betting conducted at licensed premises, excluding online betting and horse racing.
• Class B bookmaker’s license — electronic betting, excluding slot machines, online casino games and electronic horse racing.
• Class A authorized agent’s license — an agent in Cyprus must be appointed to take bets for a Class A bookmaker, at €2,000 per year.
• Premises license — use of a specific location for Class A services, free for the first premises.

Cyprus Gambling License Costs in 2026

License fees here are set by duration alone. They do not scale with turnover, player numbers, sports coverage or the size of the platform behind them, which is unusual among European regimes. Payment falls due when the application is filed, not when the license is granted. If the Authority refuses the application, 75% is returned, so a rejected filing at the one-year rate still costs €7,500. Both rates sit in the schedule published at nba.gov.cy.

License type	One year	Two years	What it covers
Class B bookmaker	€30,000	€45,000	Full remote betting product on a .com.cy domain
Class A bookmaker	€30,000	€45,000	Land-based betting at approved premises
Class A authorized agent	€2,000	€3,000	Taking bets for a Class A bookmaker
Additional premises	€2,000	€3,000	Each location after the first, which is free

Financial obligations such as license fees are the smallest part of the budget. Before trading, €500,000 of share capital must be issued and paid up, and a €550,000 bank guarantee must be in place. That guarantee carries an annual bank commission and usually a cash or asset cover requirement. Add a Cyprus bank account for segregated client funds, colocation for the backup server, and a clearing-house agreement. Annual audit and filing fees follow, plus corporate income tax that rose to 15% on 1 January 2026. A two-year filing starts near €45,000 in fees, with roughly €1.05m of capital and guarantee funding held separately, and professional costs on top.

How to Get a Cyprus Betting License

Selecting the appropriate type of license comes first: Class A for premises, Class B for online. To obtain a gambling license here, applicants then work through stages rather than a single submission. An initial evaluation checks the supporting documents and certifications, after which the applicant is asked to close any gaps. Final evaluation follows, with background checks on directors and beneficial owners. The Board then decides, and it may invite the applicant to appear in person or with a lawyer before it does.

• Incorporate a Cypriot company or register a foreign branch whose main activity is managing bets.
• Issue and pay up €500,000 of share capital, evidenced at the Registrar of Companies.
• Arrange the €550,000 guarantee from a bank in Cyprus licensed by the Central Bank of Cyprus, or from an EU credit institution.
• Open a segregated clients’ account and obtain the bank’s written undertakings on set-off and consolidation.
• Assemble the Class B technical file: backup server location, storage agreement, clearing-house agreement and system report.
• Register a .com.cy domain and publish the mandatory home-page statement that the operator is regulated by the National Betting Authority.
• Submit the class-specific form with criminal-record certificates from up to four jurisdictions, and pay the fee.
• Request National Self Exclusion Platform credentials and whitelist the IP addresses that will call the API.

No statutory decision deadline exists, so timelines for a Class B bookmaker license depend on file quality. Renewals must be filed at least three months before expiry, which is the one hard date in the process. Slippage usually comes from three places: criminal-record certificates arriving from four different countries, bank guarantee issuance, and an incomplete technical file. The Authority treats a missing technical document as grounds to deem the whole application incomplete at evaluation stage.

The Cyprus Backup Server, Clearing House, and Real-Time Authority Access

Cyprus does not require the main server on the island. It requires a backup server inside the Republic, connected in parallel to the main server, storing data the Authority specifies. The Authority sets the technical specifications and the maximum permitted lag when copying data between the two, and it can revise both by directive. Gaming systems can therefore sit in Frankfurt or Dublin, provided the replication path terminates at a site located in Cyprus and stays inside the permitted lag.

The evidence bundle is where this becomes an architecture problem rather than a hosting invoice. The application must name the physical storage location and produce a monthly invoice from the storage provider. It must include the storage agreement, with the measures preventing unauthorized access spelled out, plus any agreement with the backup system’s provider and an agreement with a clearing house. The heaviest item is the data that gives the Authority real-time access to the betting system through a web portal.

• Named colocation site in Cyprus, with a monthly provider invoice as proof of tenancy.
• Storage agreement documenting physical and logical access controls.
• Clearing-house agreement covering settlement of betting transactions.
• Real-time web portal access to the computerized betting system for the Authority.
• System report: software owner, testing organization, component and credential inventory, communication protocols.
• Disaster recovery plan, architecture description, and the procedure for storing player personal data.
• Secure protocol at registration, password change, login, bet placement, deposit and payout.
• A complete betting-activity log for all registered players, plus a backup copy of that log.

Wiring Into the National Self Exclusion Platform

Cyprus centralized self-exclusion in January 2024, treating gambling addiction as a national responsibility rather than a per-operator setting. The Authority maintains a live exclusion dataset and exposes it to Class B operators through a REST API, with a single GET endpoint on the national exclusion platform. Authentication uses HTTP Basic, with the credential pair Base64-encoded, and every call carries an operator-generated Transaction-Id that the platform echoes back. Requests from IP addresses the operator has not registered with the Authority are not served at all.

Three checks sit in the operator’s build, and each has a different failure path. At every login, the platform checks its local exclusion data first, then queries the live dataset. If the API is unavailable, it falls back to a daily snapshot held on the operator’s side. At registration, a failed call must be retried once before the platform is treated as unavailable and the Authority notified by email. The daily sweep re-checks the entire registered base in batches of no more than 4,000 identification documents, retrying up to five times at two-minute intervals.

Workflow	Trigger	Operational constraint
Login check	Every user login	Runs before any betting activity is permitted
Registration check	Account creation	Two attempts, then notify the Authority
Daily sweep	Scheduled slot set by the NBA	Maximum 4,000 documents per request
Marketing suppression	Before every campaign	Excluded players receive no messages or promotions

The consequence for platform design is that an external dependency now sits on the login critical path, with a latency budget and a documented fallback. Three exclusion datasets have to stay reconciled, and the CRM must read the daily snapshot before any send rather than relying on the live API. Every page of the site also carries a footer link to the national platform. Operators that treat responsible gaming as a CRM flag rather than an integration discover the gap during technical review.

Technical Snapshot: Evidence Expected Before Launch

Cyprus regulations make supervision documentary and continuous rather than a single pre-launch audit. The Authority asks for evidence at application, then again through monthly tax statements and the real-time portal. Article 71 of the Betting Law adds audited annual accounts and an annual report, both due by 30 June. Administrative fines reach €100,000 per finding, and unpaid tax outstanding for more than 60 days can be seized from the €550,000 bank guarantee.

System area	Implementation requirement	Evidence the regulator asks for
Hosting	Backup server in Cyprus, parallel to main	Storage location, provider agreement, monthly invoice
Regulator access	Real-time view of the betting system	Web portal credentials and connection data
Player registration	Identity verified within 30 days	Registration records, verification audit trail
Player accounts	One account per person, no credit	Account register retained five years from last transaction
Client funds	Segregated account, no bank set-off	Written undertakings from the credit institution
Payments	Cards, transfer or e-money only, no cash	Payment method configuration, payout within five working days
Self-exclusion	REST integration with the national platform	API logs, daily dataset, marketing suppression records
Tax reporting	Monthly net revenue statement	Annex B statement plus proof of payment, by month end

Replicating a player database to a second physical location is a processing activity, not a backup detail. Under the GDPR, that replication belongs in the Article 30 record of processing, with the Cypriot site named and its access controls documented. Article 33 has required breach notification to the supervisory authority within 72 hours since May 2018, with penalties reaching €20m or 4% of global annual turnover. The betting-activity log and its backup copy both fall inside that scope. Anyone designing the replication path should read Article 33 in full before finalizing the architecture.

ISO/IEC 27001 carries a harder date. Certificates issued against the 2013 edition became invalid after 31 October 2025, and anyone who missed the window now faces a full initial audit. The 2022 revision restructured Annex A into 93 controls across four themes, adding 11 for cloud services, threat intelligence and secure development. For a Cyprus filing the consequence is scope: the statement of applicability must name the Cypriot backup site, the replication link and the exclusion-platform integration. Otherwise the certificate covers a system that is not the one under supervision.

How the Cyprus License Compares With Other Licenses

Comparing jurisdictions by headline fee produces the wrong shortlist. The binding constraint is almost never the invoice; it is what the license permits you to sell, where you may host it, and which acquirer will bank it. A gaming license in Cyprus is inexpensive and reputable, and it will never carry a casino product. Read the list below as a map of constraints, with cost as a secondary filter.

• Isle of Man (GSC) — £5,250 application, then £36,750/yr. 10–12 weeks. Constraint: on-island servers, two resident directors, local client bank account.
• Malta (MGA) — €5,000 application, €25,000/yr, plus €15,000–€375,000 compliance contribution for Type 1. 6–12 months. Constraint: verticals approved individually, €100,000 share capital.
• Curaçao (CGA) — €4,592 application, €47,450/yr. 3–6 months. Constraint: local company, physical office, local hiring.
• Kahnawake — $40,000 year one, then $20,000/yr. 8–12 weeks. Constraint: primary servers inside Mohawk Territory.
• Tobique (TGC) — from $36,000/yr. 4–8 weeks. Constraint: recognition narrow outside North America.
• Anjouan — from €17,000/yr. 4–8 weeks. Constraint: limited acquirer appetite on fiat rails.
• Costa Rica — no gambling-specific license; operators incorporate locally and hold a data-processing permit. Constraint: no gaming regulator, so no regulatory credential to present to banks.

The arithmetic that matters is cost per addressable market, not cost per license. A license from Cyprus buys one product in one EU jurisdiction, but locks up €1.05m across share capital and bank guarantee before a single bet is taken. Malta asks €100,000 of share capital and adds a compliance contribution that scales with revenue, then opens casino, live dealer and sportsbook under one regulator. A sportsbook-only operator will find the Cypriot capital lock cheaper over three years; a brand that also needs an online casino will not.

How NuxGame Helps With the Cyprus License

Cyprus applications stall in two places. The first is the technical file, where the storage agreement, clearing-house agreement and system report have to describe one coherent architecture. The second is banking, where the €550,000 guarantee and the segregated clients’ account with written bank undertakings take longer to arrange than operators plan for. The NuxGame legal team provides services for online gambling operators across company registration or branch filing, beneficial-ownership disclosure, AML/CFT and responsible gaming policies, banking and PSP setup, and submission. A platform-readiness review runs alongside it, so the technical annexes describe a system that already exists.

Deployment for Cyprus is a split, not a migration. Online gambling platforms keep the main stack where latency and cost make sense, while a parallel-replicated backup terminates at a named Cypriot facility. Real-time portal access is configured as a read-only view of the live betting system, and monthly net revenue statements generate in the format the annex expects. Exclusion lookups run from one service holding both the live API call and the cached daily dataset, so an outage degrades to a cached check rather than blocking logins. The AML and KYC stack verifies identity inside the 30-day window and suppresses excluded players from every campaign.

Planning a Cyprus filing and unsure whether your current architecture will survive technical review? The team at NuxGame will map your setup against the Class B requirements and tell you what needs to change — talk to us.