A CySEC licence is one of the most recognized forex and CFD authorizations in Europe. It's also one of the most demanding. Unlike the lighter offshore options, it puts you inside the EU's MiFID framework, with the capital, people, product restrictions, and supervision that come with it.
This roadmap walks through the process in order: what the licence is, which capital class you fall into, what substance you need, how the application and timeline really work, and the operating rules that shape a CySEC broker's business model. It's general information, not legal advice. Confirm details with CySEC or Cyprus counsel, because requirements depend on your exact services.
What a CySEC "Forex License" Actually Is
CySEC (the Cyprus Securities and Exchange Commission) authorizes Cyprus Investment Firms (CIFs) under Law 87(I)/2017, which transposes MiFID II. There's no separate "forex licence." Forex and CFD brokerages are authorized as investment firms providing specific investment services, and the licence passports across the EU and EEA.
The prudential framework comes from the EU's Investment Firms Directive and Regulation (IFD/IFR), implemented in Cyprus by Law 165(I)/2021.
Two points to keep clear:
- Passport rights follow your authorization: A CIF can serve clients in EEA countries through the passport. Serving clients in third countries generally requires local authorization there, with notice to CySEC.
- A Cyprus company isn't a CIF: Incorporating a company doesn't authorize investment business.
Step 1: Choose Your Model and Capital Class
Your services decide your initial capital. The figures below are consistent across current law-firm and consultancy overviews, and they come from the IFD framework.
Class | Typical model | Initial capital |
Class 3 | Advisory, reception and transmission of orders, no client funds | €75,000 |
Class 2 | STP / execution models that hold client funds or instruments | €150,000 |
Class 1 | Market maker or dealing on own account, underwriting, trading facilities | €750,000 |
A correction worth making: you'll still find guides quoting older, pre-2021 capital figures. They no longer apply. The tiers above have been in force since the IFD regime began in June 2021.
Two cautions:
- Initial capital is only the entry threshold: Ongoing own-funds requirements under the IFR can exceed it, depending on your activity and size.
- CySEC expects shareholder funds well above the minimum: in practice, and it examines where the money comes from.
Decide whether you're STP or market maker first. It drives your capital, your risk framework, and your application.
Step 2: Build the Substance
CySEC expects a real firm in Cyprus, not a brass plate. Based on published overviews:
- Head office and registered office in Cyprus
- At least two executive directors who run the firm day to day
- Key function holders: typically compliance, risk management, internal audit, and an AML compliance officer, which can sometimes be outsourced depending on size and permissions
- Fit and proper assessment of directors, key function holders, and shareholders with qualifying holdings
- Adequate staffing and systems for the services you want to provide
Some older firm summaries also mention a board majority resident in Cyprus. Check the current expectation with CySEC.
Step 3: Prepare the Application
A complete application typically includes:
Component | What regulators want to see |
Programme of operations / business plan | Services, execution model, markets, and financial projections |
AML/CFT and sanctions programme | Procedures tailored to your clients and markets |
Governance and policies | Conflicts, best execution, client asset, complaints, and outsourcing policies |
Internal capital adequacy assessment | How you'll meet and monitor your capital needs |
Shareholder and source-of-funds evidence | Ownership structure and the origin of the capital |
IT and operational resilience arrangements | Systems, security, continuity, and vendor oversight |
Evidence of initial capital | Paid-in capital held as required |
The application fee is €7,000 for the core investment services, with additional fees for ancillary services and some activities. Fees change, so confirm CySEC's current schedule.
Step 4: Review and Timeline
The law sets a six-month decision period, starting from a complete application. That "complete" qualifier is why published timelines vary so much.
Source view | Range |
Statutory clock | Up to 6 months from a complete application |
Optimistic estimates | About 4–7 months |
Typical end-to-end estimates | About 9–14 months |
Conservative estimates | About 12–16 months |
End-to-end timelines include preparing the application, getting it to "complete," answering CySEC's questions, and setting up the firm. Plan for 9–16 months, and treat anything shorter as a best case.
The most common causes of delay are incomplete business plans, weak AML programmes, and gaps in source-of-funds evidence.
Step 5: After Authorization
- Investor Compensation Fund (ICF) membership: Eligible clients are covered up to €20,000.
- Regulatory reporting and audited accounts on an ongoing basis
- Prudential monitoring against IFR requirements
- Passport notifications for the EEA countries you plan to serve
- Client money and asset safeguarding with documented controls
- Ongoing fit-and-proper and change notifications
See what founders forget about renewal for the ongoing discipline that applies to any licence.
The Rules That Shape Your Business Model
This is where CySEC differs most from offshore. For retail CFD clients, the ESMA and CySEC product-intervention measures apply, and they remain in force.
Rule | What it means |
Leverage caps | 30:1 major currency pairs, 20:1 non-major pairs, gold, and major indices, 10:1 other commodities and non-major indices, 5:1 individual shares, 2:1 crypto |
Margin close-out | Positions must close when funds fall to 50% of the required initial margin |
Negative balance protection | Retail clients can't lose more than their account funds, applied per account |
Ban on benefits | No monetary or non-monetary benefits (including bonuses) to retail clients tied to CFD trading |
Standardised risk warning | Prescribed wording on CFD marketing, including, for established providers, the percentage of retail accounts that lose money |
Binary options | Prohibited for retail distribution |
One 2026 compliance guide notes that the benefits ban extends to affiliate compensation structures that effectively recreate bonuses through the partner channel. That matters if you run an IB programme.
What this means commercially: a CIF generally can't match the 500:1 leverage or the bonus promotions that some offshore brokers advertise. Its advantages are credibility, banking access, and the EU passport.
Costs
Published estimates differ, so treat these as planning categories, not quotes:
Cost | Notes |
Initial capital | €75,000, €150,000, or €750,000, held, not spent |
Shareholder funds | Often meaningfully above the minimum in practice |
CySEC application fee | €7,000 for core services, plus add-ons |
Cyprus office | An overview estimates roughly €8,000–15,000 in year one |
Staff and key functions | Executive directors, compliance, risk, audit, and AML roles |
Legal and advisory | Business plan, policies, and application |
Technology | Platform, liquidity, CRM, payments, reporting, and resilience |
Ongoing | Annual supervisory fees, audit, ICF contributions, and compliance costs |
The real budget is driven by people and compliance, not the application fee.
Pros and Cons
Pros
- EU and EEA passport
- Strong credibility with banks, partners, and clients
- A clear, mature regulatory framework
- Investor protection features that clients recognize
Cons
- Capital, staffing, and compliance costs are far higher than offshore
- Leverage caps, bonus ban, and marketing restrictions limit product positioning
- A long timeline
- Intense scrutiny of owners and source of funds
- Doesn't authorize solicitation in third countries without local permission
CySEC Compared
CySEC (Cyprus) | Cayman | BVI | Seychelles | |
Framework | MiFID II, IFD/IFR | SIBA (CIMA) | SIBA (FSC) | Securities Act (FSA) |
Capital | €75,000 / €150,000 / €750,000 | CI$100,000 base | No fixed minimum | $100,000 |
Passport | EU/EEA | None | None | None |
Retail leverage | Capped | Not capped by statute | Not capped by statute | Flexible |
Typical timeline | 9–16 months | 3–9 months | 3–6 months | 3–6 months |
Many operators use more than one entity, for example a CIF for European clients and an offshore entity for other markets. See our 2026 regulatory trends guide.
Who CySEC Fits
CySEC tends to suit operators who:
- Want to serve EU and EEA clients under a passport
- Value credibility and banking access
- Have the capital, people, and patience for a long process
- Can build a business that works within the leverage and marketing rules
It's usually not the right first step for a founder testing a market on a small budget.
Common Mistakes
- Using pre-2021 capital figures
- Planning around a six-month timeline that only starts at "complete"
- Choosing market maker versus STP too late
- Weak source-of-funds evidence for shareholders
- Treating key functions as paperwork roles
- Designing products and marketing around offshore-style leverage and bonuses
- Building an affiliate programme that recreates banned incentives
- Underestimating technology and resilience requirements
What's New in 2026
- DORA is in force: The Digital Operational Resilience Act has applied to EU investment firms since 17 January 2025. It requires ICT risk management, incident reporting, resilience testing, and oversight of technology vendors.
- Crypto CFDs stay under MiFID: CFDs on crypto-assets are financial instruments, not crypto-assets under MiCA, so the CFD measures, including the 2:1 cap, apply. A CIF that wants to offer crypto-asset services should check the MiCA route that applies to investment firms.
- EU AML rules are tightening: The EU AML Regulation applies from 10 July 2027, and its technical standards are being finalized.
See our KYC automation guide. - Marketing supervision is active: The CFD measures remain in force, and compliance guides describe close attention to partner and affiliate promotion.
- Ownership scrutiny is high: including for owners connected to sanctioned jurisdictions.
Related Reading
- Cayman Islands CIMA Forex License Guide
- Offshore vs Regulated Forex License — Which Fits Your Budget?
- Forex Brokerage Business Plan: What Regulators Want to See
- 2026 Regulatory Trends Every New Forex Broker Should Know
About FX Launch Pad
The first question we ask founders considering CySEC isn't about capital. It's whether their product and marketing can work within the leverage caps and bonus ban, because that decides whether a CIF fits the business at all. We help founders compare CySEC against other jurisdictions, and plan the entity structure around their markets before they commit.
If you're weighing a CySEC licence against other options, book a free consultation and we'll go through your plan with you.
Frequently Asked Questions
Q-1 What is the minimum capital for a CySEC forex license?
Ans- It depends on your services: €75,000 for advisory or order-transmission models without client funds, €150,000 for STP or execution models that hold client funds, and €750,000 for market makers or Q-1 dealing on their own account. Older figures still circulating online are out of date.
Q-2 How long does it take to get a CySEC licence?
Ans- The law sets a six-month decision period from a complete application, but end-to-end timelines are commonly 9–14 months, and some estimates reach 16 months. Incomplete applications extend the process.
Q-3 Can a CySEC-licensed broker offer 500:1 leverage?
Ans- Not to retail clients. CFD leverage is capped at 30:1 for major currency pairs and lower for other assets, with negative balance protection, a 50% margin close-out rule, and a ban on bonuses and similar benefits.
Q-4 Does a CySEC licence let me serve clients across Europe?
Ans- Yes, through the EU and EEA passport, after the required notifications. Serving clients in third countries generally requires local authorization there.
Q-5 Can I buy a ready-made CIF?
Ans- Acquiring an existing CIF requires notifying CySEC, which assesses the acquirer. It is not an off-the-shelf shortcut. Verify any firm on CySEC's public register first.
