Overview
CySEC and MiFID II Framework
CySEC (Cyprus Securities and Exchange Commission) has regulated Cyprus Investment Firms (CIFs) since 2002 and has been the EU's preferred gateway for forex brokers since MiFID I entered force. Today, over 200 CySEC-licensed firms hold forex-related authorizations, making Limassol one of the world's most concentrated forex industry hubs alongside London and Nicosia.
A CySEC CIF license operates under MiFID II (Markets in Financial Instruments Directive II), the EU's comprehensive framework for investment services. MiFID II requires forex brokers to implement best execution policies, record all client communications, apply leverage restrictions (30:1 for major FX pairs, 20:1 for minor pairs under ESMA guidelines), segregate client funds, and maintain clear disclosure of costs and charges.
The single most powerful feature of CySEC regulation is the MiFID II passport: a licensed CIF can provide services to clients in any of the 27 EU member states plus Iceland, Liechtenstein, and Norway, simply by filing a passporting notification with CySEC. This eliminates the need for separate licenses in each EU country — a €125,000 capital investment can unlock access to a 450+ million person market.
License Categories
CIF License Categories & Capital Requirements
CySEC issues CIF licenses across multiple authorization categories based on the investment services and activities the firm wishes to provide. Capital requirements scale with the risk profile and scope of the services:
| CIF Category | Services Permitted | Min Capital | Typical For |
|---|---|---|---|
| Category 1 | Reception & transmission, execution of orders (no client assets) | €125,000 | Introducing brokers, STP with no client money |
| Category 2 | Cat 1 + hold client funds/assets | €200,000 | Full STP forex brokers |
| Category 3 | All above + dealing on own account (market making) | €730,000 | Market makers, ECN operators |
| Category 4 | Underwriting + portfolio management | €730,000 | Asset managers, fund operators |
Note: Most retail forex brokers operate as Category 2 (STP model) or Category 3 (market maker model). The capital figures represent initial paid-up share capital — CySEC also requires an ongoing capital adequacy calculation based on Fixed Overhead Requirement (FOR) or Pillar I capital, whichever is higher.
Requirements
AML, KYC & Compliance Requirements
CySEC imposes comprehensive AML/KYC obligations derived from both EU AML Directives (AMLD5/AMLD6) and local regulations. Key compliance requirements include:
- Appointment of a Cyprus-resident AML Compliance Officer and an Internal Auditor
- Written AML Policy and Procedures Manual approved by the Board
- Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) for high-risk clients
- Suspicious Activity Reporting (SAR) to MOKAS (Cyprus Financial Intelligence Unit)
- Transaction monitoring system with real-time alerts
- Politically Exposed Persons (PEP) screening and sanctions compliance (OFAC, EU, UN)
- Client categorization (retail, professional, eligible counterparty) under MiFID II
- Product appropriateness and suitability assessments
- Best execution policy and annual review
- Trade reporting to EMIR (for OTC derivatives) and MIFIR (transaction reporting)
- Client fund segregation in separate bank accounts designated as client money
- ICF (Investor Compensation Fund) membership — covers retail clients up to €20,000
Application Process
Step-by-Step CySEC Application
1
Corporate Structure & Pre-Application
Incorporate a Cyprus limited company (Ltd), open a Cyprus bank account, deposit initial share capital. Appoint at least 2 Cyprus-resident executive directors (preferably with financial services background) and a compliance officer. Engage CySEC-approved external legal counsel.
Month 1–2
2
Business Plan & Compliance Documentation
Prepare a detailed business plan (3-year financial projections, business model description, risk management framework), AML/KYC Procedures Manual, Compliance Manual, Internal Audit framework, best execution policy, conflict of interest policy, and IT/security documentation.
Month 2–3
3
CySEC Application Submission
Submit the complete CIF application through the CySEC online portal. Pay the application fee (€2,000–€5,000 depending on category). Submit KYC documentation for all directors, shareholders (10%+ ownership), and key personnel. Application fee is non-refundable.
Month 3
4
CySEC Review & Queries
CySEC reviews the application and issues clarification requests (typically 2–4 rounds of queries). Respond promptly and comprehensively to each query. CySEC may conduct an onsite visit to verify office substance and operational readiness.
Month 3–7
5
Approval & Authorization
CySEC grants conditional approval, followed by final authorization upon confirmation of capital deposit, ICF membership, PI insurance, and completion of any outstanding conditions. CySEC issues the official CIF authorization certificate.
Month 6–9
6
EU Passporting (Optional)
Submit passporting notifications for target EU/EEA countries via CySEC. For each country, specify the investment services to be provided and whether through a branch or cross-border basis. Host regulator acknowledges within 1–3 months, after which you may commence marketing in that jurisdiction.
Month 7–12
Cost Breakdown
Cyprus CIF License Costs 2025
| Cost Item | Amount (EUR) | Notes |
|---|---|---|
| Share capital (Cat 1) | €125,000 | Minimum regulatory capital — remains in company |
| CySEC application fee | €2,000–€5,000 | Non-refundable, depends on category |
| Legal / advisory fees | €30,000–€70,000 | Application prep, documentation, representation |
| Company incorporation | €2,000–€4,000 | Cyprus Ltd formation, stamps, notarization |
| Office setup (12 months) | €15,000–€40,000 | Rent, furniture, IT — Limassol average |
| Director / compliance staff | €50,000–€100,000 | Year 1 salary budget |
| PI Insurance | €5,000–€15,000 | Professional indemnity, required by CySEC |
| Banking setup | €3,000–€8,000 | Cyprus bank account, client money account |
| Technology / trading platform | €20,000–€80,000 | MT4/MT5 license or white-label, CRM, PSPs |
| Total Year 1 (Cat 1 STP) | €252,000–€447,000 | Incl. min capital + operating costs |
| Total Year 1 (Cat 3 MM) | €900,000–€1,200,000 | Incl. €730K capital + operating costs |
Annual ongoing costs: CySEC supervision fee ~€5,000, ICF contributions (0.5% net revenue), compliance officer €40K–€70K, external audit €8K–€20K, ICIS/MiFIR reporting infrastructure, and office running costs. Expect €80,000–€200,000 per year in ongoing compliance/operational costs excluding capital.
◆ KEY METRICS
Cyprus Forex License at a Glance
€730,000
Min. Capital Requirement
8–12 Weeks
Processing Timeline
€2,500–€5,000
Initial Application Fee
0%
Corporate Tax (Profits)
CySEC
Regulatory Authority
EU Passporting
Key Benefit (2026)
◆ LICENSING JOURNEY
5-Step Path to Authorization
1
Week 1–2
Pre-Application Consultation
Engage CySEC, determine CIF category (Category 1–3), assess capital & governance requirements
2
Week 3–5
Documentation & Submission
Compile business plan, financial projections, AML/KYC policies, shareholder info, management CVs; submit formal application
3
Week 6–8
CySEC Initial Review & Queries
CySEC conducts completeness check; may request clarifications on compliance, governance, or financial projections
4
Week 9–10
Capital Deposit & Final Checks
Place minimum capital (€730k–€1.5M depending on category) in CySEC-approved bank; submit proof of funds
5
Week 11–12
License Issuance & Registration
CySEC issues CIF license; firm enters CySEC register; EU MiFID II passporting rights activated
FAQ
Frequently Asked Questions
CySEC minimum capital depends on the CIF category: €125,000 for reception and transmission / execution of orders only (non-dealing desk / matched principal), €200,000 for Category 2 (holding client assets), and €730,000 for full market maker / dealing on own account. Most STP forex brokers require €125,000–€200,000 initial capital.
Yes. A CySEC CIF license grants full MiFID II passporting rights across all 27 EU member states plus Iceland, Liechtenstein, and Norway. After CySEC approval, you submit a passporting notification for each target EU country. Passporting is typically acknowledged within 1–3 months per jurisdiction.
CySEC targets a 6-month processing window from receipt of a complete application, though 7–9 months is more realistic for first-time applicants. The main delays are incomplete documentation, queries on the business plan or shareholder structure, and AML/compliance framework gaps. Experienced Cyprus counsel significantly reduces delays.
Yes, foreign nationals can be shareholders and beneficial owners of a CIF. However, at least two executive directors must be resident in Cyprus and physically present, and the company must maintain a genuine Cyprus office with real operational activity. CySEC scrutinizes substance — shell structures with no real Cyprus operations are not approved.
Annual ongoing costs typically include: CySEC supervision fee (~€5,000), ICF contributions (0.5% of net revenue), compliance officer salary (€40,000–€70,000/year), external auditor (€8,000–€20,000), ICIS/MiFIR trade reporting, and office/operational costs. Total annual running cost: €80,000–€200,000 depending on scale and revenue.
You'll need to provide articles of association, proof of share capital, detailed business plan, organizational charts, CVs of senior management, beneficial ownership declarations, and evidence of premises. CySEC also requires compliance manuals, risk management policies, and AML/CFT procedures tailored to your forex operations. The complete documentation package typically runs 40-60 pages and must be submitted in English.
While CySEC licenses no longer offer direct EU passporting post-Brexit, they still allow you to serve EU clients under MiFID II if you comply with specific requirements, and you maintain full EEA regulatory recognition. The FCA license provides broader UK and non-EU market access but involves higher initial costs (typically 2-3 times more) and stricter capital requirements. For pure EU market focus, CySEC remains more cost-effective, though FCA offers stronger international credibility.
CySEC requires segregated client accounts held with Cyprus Credit Institutions or EU-regulated banks, with mandatory segregation at the bank level. You must maintain a Client Money Safeguarding Policy and hold professional indemnity insurance of at least EUR 730,000 to cover potential shortfalls. Monthly reconciliation reports and annual third-party audits are mandatory, with all documentation submitted to CySEC quarterly.
CySEC licenses must be renewed annually, typically in your anniversary month, with a renewal fee of approximately EUR 2,500-3,500 depending on your turnover bracket. The renewal process requires updated compliance certifications, AML/CFT reviews, and proof of ongoing capital requirements, usually completed within 30 days if all documents are in order. Failure to renew on time results in automatic license suspension and potential fines of EUR 5,000-10,000.
Cyprus offers a 0% corporate tax rate on distributed profits to non-resident shareholders and a competitive 12.5% standard rate on retained earnings, significantly lower than most EU countries. Additionally, there's an exemption on foreign-source income for non-Cyprus-resident investors, making Cyprus particularly tax-efficient for international forex operations. However, EU anti-tax avoidance directives (ATAD) apply, so you must demonstrate genuine business operations in Cyprus, not just a shell structure.
Beyond the EUR 2,500-3,500 annual license fee, budget approximately EUR 15,000-30,000 for compliance staff, EUR 8,000-15,000 for professional indemnity insurance, EUR 5,000-10,000 for annual audits, and EUR 3,000-8,000 for AML/CFT monitoring software. Office space, regulatory training, and banking fees add another EUR 10,000-20,000 annually, bringing total operational costs to roughly EUR 45,000-85,000 per year for a solo operation. Larger firms with multiple departments may incur EUR 100,000+ in annual compliance and operational expenses.
CySEC issues a findings report with remediation timelines typically ranging from 30 to 90 days depending on violation severity, and failure to comply can result in fines of EUR 5,000 to EUR 2,000,000. Minor breaches (documentation gaps, minor process deficiencies) usually require written action plans; major violations (inadequate capital, AML failures) trigger formal investigations and potential license suspension. Repeat violations or unresolved critical issues lead to license revocation, making compliance audits and proactive remediation essential for long-term operation.