A Cyprus Investment Firm (CIF) licence from CySEC is a MiFID II authorisation that can be passported across the EEA. Firms dealing on their own account — as most CFD brokers do — need at least €750,000 of initial capital, real substance in Cyprus, and systems that enforce ESMA retail protections such as leverage limits of 30:1 on major currency pairs, negative balance protection and a 50% margin close-out.
Cyprus is the EU's best-known home for forex and CFD brokers. A CySEC licence opens the European market, but it also brings some of the most detailed conduct and reporting rules in the industry. Here is what to expect.
The CIF licence
A Cyprus Investment Firm is authorised by the Cyprus Securities and Exchange Commission (CySEC) under the law implementing MiFID II. Once authorised, a CIF can passport its services into other EEA countries by notification.
Initial capital
Under the EU investment-firm rules (IFR/IFD), initial capital depends on the services you provide:
- €750,000 — dealing on own account or underwriting (typical for market-making CFD brokers),
- €150,000 — services such as execution of orders or portfolio management, without holding client money in some cases,
- €75,000 — limited services such as reception and transmission of orders without holding client money.
Ongoing own-funds requirements can be higher than the initial capital, depending on your size and risk.
Substance
CySEC expects real presence in Cyprus: an office, at least two executive directors, and functioning compliance, risk management, AML and internal audit arrangements. Limassol offers a mature pool of experienced staff and service providers.
ESMA retail protections
For retail clients, EU brokers must apply:
- leverage limits from 30:1 on major currency pairs to 2:1 on crypto CFDs,
- a 50% margin close-out rule per account,
- negative balance protection,
- restrictions on incentives, and
- standardised risk warnings showing the percentage of retail accounts that lose money.
Reporting and record keeping
A CIF must handle transaction reporting under MiFIR, trade reporting under EMIR, best-execution monitoring, recording of client communications and long-term record keeping. Most of the work is data: if your platform, CRM and back-office produce consistent, complete data, reporting becomes manageable.
Crypto under MiCA
Crypto-asset services in the EU are now licensed under MiCA, with CySEC as the competent authority in Cyprus. A CIF that wants to offer crypto-asset services (not just crypto CFDs) needs the relevant authorisation.
The technology a CySEC firm needs
- MT5 groups configured for ESMA leverage, margin close-out and negative balance protection — see our MT5 solutions,
- a CRM with appropriateness tests, client categorisation and audit trails,
- risk management and execution routing with best-execution data, and
- regulatory and management reporting.
We also supply system documentation for your CySEC application. See our Cyprus market guide or request a proposal.
This article is general information reviewed in October 2026, not legal advice. Regulations change, so always confirm your business model with qualified local counsel.