Cyprus has been the jurisdiction of choice for European CFD and forex broker licensing for over a decade, and that position has not changed in 2026. What has changed is the regulatory environment in which a Cyprus Investment Firm (CIF) licence now operates. CySEC in 2025 was a noticeably more active regulator than it was in 2022 — more inspections, more enforcement actions, more licence suspensions, and a broader set of compliance obligations landing on firms' desks. For anyone applying for a new CIF licence or managing an existing one this year, the landscape deserves an honest assessment.
The Numbers First — Who Got Licensed, Who Got Fined
CySEC approved 47 new CIF licences in 2025, bringing the total number of supervised entities under the regulator's umbrella to 808. Assets under management in collective investment schemes reached €11.4 billion, with a significant portion invested domestically. The pipeline of new applications remained healthy — Cyprus is not losing its appeal as a licensing base.
The enforcement picture tells a parallel story. Administrative fines and settlements imposed in 2025 totalled approximately €2.3 million, bringing the three-year cumulative total to €7.3 million. CySEC conducted roughly 600 on-site and off-site inspections across CIFs, asset managers, collective investment entities, and market infrastructures. The focus areas were professional conduct, capital adequacy, data quality, AML controls, MiFID II compliance, DORA preparedness, and — increasingly — sanctions compliance.
The complaint picture is worth noting too. Complaints against brokers registered in Cyprus increased by 46% in 2024 relative to the previous year. CySEC Chairman George Theocharides has been explicit that Cyprus-based brokers represent approximately one-third of cross-border retail trading within the European Union, serving around 3.6 million clients — and that the regulator intends to match the scale of that market with the intensity of its supervision.
Recent Enforcement Actions — Names Worth Knowing
A number of specific enforcement actions in 2025 and early 2026 have been widely discussed in the Limassol brokerage community and are worth understanding in context.
Triangleview Investments Ltd(CIF 384/20) had its licence suspended in full at CySEC's March 17, 2025 board meeting, citing violations of anti-money laundering rules, deficiencies in board and management requirements, and failures to meet organisational obligations. The firm was given two months to remediate and was prohibited from accepting new clients or entering new business transactions for the duration of the suspension.
Conotoxia Ltdwas fined €3,650 at CySEC's July 21, 2025 board meeting for non-compliance with the AML/CFT Directive (Directive 157/2019), specifically paragraphs 5(d) and 11. The fine itself was modest — but it came alongside a broader licence suspension that had been running for some time, making the cumulative regulatory position for the firm considerably more significant.
In April 2026, CySEC published a decision regarding Otkritie Broker Ltd— examining the influence exercised by Otkritie FC Bank over the CIF's sound and prudent management. The Russia-connected ownership angle continues to generate regulatory scrutiny, consistent with CySEC's intensified monitoring of firms with Russian-linked beneficial ownership structures that began following the 2022 sanctions wave and has not abated.
CySEC also issued decisions in April 2026 suspending trading in shares of Toxotis Investments, A. Tsokkos Hotels, Dome Investments, and Karyes Investment— Cyprus Stock Exchange-listed companies that failed to submit required financial reports, acting under a CySEC directive. While these are listed companies rather than investment firms, the willingness to intervene publicly and promptly is consistent with the regulator's current posture across all supervised entity categories.
The New Sanctions Compliance Regime — August 2025
The compliance obligation that has generated the most operational work for CIF compliance teams in the second half of 2025 is the new sanctions regime that entered into force on 1 August 2025. Implementing EU Directive 2024/1226, the framework makes sanctions breaches a criminal offence, creates the National Sanctions Implementation Unit (NSIU) within the Ministry of Finance, and extends whistleblower protections specifically to sanctions violations.
For CFD brokers specifically, the new regime requires: real-time screening of customers, beneficial owners, intermediaries, and counterparties against EU, UN, and US sanctions lists before onboarding and on an ongoing basis; immediate escalation frameworks integrating sanctions, AML, and market abuse monitoring; and comprehensive documentation of screening results including false positives. CySEC has been explicit that CFD brokers — given their digital onboarding, cross-border distribution, affiliate and IB chains, and growing crypto payment functionality — sit at the intersection of multiple FATF red flags and will be scrutinised accordingly.
Firms that were caught unprepared by the August 2025 deadline have been working through remediation since. New applicants in 2026 are expected to demonstrate a sanctions compliance framework that meets the new standard at the point of application, not as an afterthought post-licensing.
ESMA CSA 2026 — On-Site Inspections Are Running Now
The European Securities and Markets Authority's Common Supervisory Action (CSA) for 2026 is currently underway, with CySEC conducting on-site inspections and desk-based reviews of CFD brokers as part of the coordinated EU-wide exercise. The inspection focus areas include staff compensation practices, digital platform design, and potential conflicts arising between firms' revenue goals and client interests.
CySEC also issued Circular C770 in April 2026 requiring CIFs to submit 2025 statistical data through the Transaction Reporting System by 8 May 2026, with strict penalties for missed deadlines and no reminders to be issued. Firms that failed to register their email addresses with CySEC by 18 February 2026 for the ESMA cross-border reporting exercise may already be in a compliance gap.
What the Application Process Actually Looks Like in 2026
The CIF licence application process has not become simpler. If anything, the combination of enhanced AML/CFT requirements, the new sanctions framework, MiFID II IFR/IFD capital requirements, DORA digital resilience obligations, and the MiCA transitional provisions for firms with crypto-adjacent products has increased the documentation burden relative to 2022–2023.
A complete CIF licence application in 2026 requires: a detailed regulatory business plan covering all proposed investment services and activities; a comprehensive AML/KYC and sanctions compliance programme; a fit and proper assessment for all directors, shareholders with qualifying holdings, and key function holders; evidence of the minimum share capital (€75,000 for reception and transmission or execution of orders; €150,000 for portfolio management; €750,000 for firms that deal on own account or underwrite financial instruments); a technology and cybersecurity framework consistent with DORA; and a minimum of three Cyprus-resident directors for full board representation, or at least one CySEC-approved senior manager for smaller structures.
CySEC currently takes between six and twelve monthsfrom submission of a complete application to licence issuance, depending on the complexity of the business model, the quality of the application, and the regulator's current caseload. Applications with incomplete documentation, unclear ownership structures, or poorly drafted compliance frameworks are returned for amendment — and each amendment cycle adds months to the timeline.
CySEC has also moved to reject applications outright where it has concerns about the applicants' fitness or the proposed business model's integrity. This is a meaningful shift from earlier years when the regulator was more likely to request amendments than to reject. The "open for business but only for the right businesses" message from Chairman Theocharides is being operationalised at the application review stage.
The Offshore Counterpart — Why Most EU Brokers Run a Parallel Structure
One pattern that has become near-standard practice among established European CFD and forex groups is maintaining the CIF licence for EU client-facing operations and regulatory passporting while running a separate offshore licensed entity for non-EU clients and more commercially flexible book management. The EU regulatory constraints — leverage caps at 1:30 for retail, prohibition on inducements, negative balance protection, ESMA product intervention powers — are appropriate for EU-regulated retail markets but commercially limiting for global client bases.
The two most commonly used offshore counterparts among Cyprus-based groups in 2026 are Mauritius and Seychelles. The Mauritius Investment Dealer Licence from the FSC — particularly the Full Service Dealer category at USD 500,000 minimum capital — carries strong institutional credibility, access to 46+ double taxation agreements including India, South Africa, France, and the UAE, and an effective corporate tax rate of approximately 3% on foreign income. The Seychelles FSA Securities Dealer Licence offers a faster, lower-cost entry point — typically USD 50,000 minimum capital, lower compliance overhead, and a streamlined application process — making it the preferred structure for groups that need an operational offshore entity quickly without the capital commitment of a Mauritius Full Service Dealer.
The choice between Mauritius and Seychelles for the offshore counterpart typically comes down to the target client geography and the level of institutional credibility required. For groups with significant Asian, Indian Ocean, or African client books, Mauritius is generally the stronger choice — IOSCO compliance and the 2022 FATF grey list exit matter to institutional counterparties in those markets. For groups primarily serving clients in Eastern Europe, the Middle East, or Latin America where the primary credibility signal is the EU-regulated CIF entity, Seychelles provides a cost-efficient operational base.
Cyprus EU Presidency — What It Means for the Regulatory Calendar
Cyprus holds the Presidency of the Council of the European Union in the first half of 2026 — and CySEC has been actively positioning itself as a contributor to EU capital markets policy development during this period. The regulator hosted meetings of ESMA's Management Board and Board of Supervisors in April 2026. Legislative files being progressed under the Cyprus Presidency include the Market Infrastructure Package, the Retail Investment Strategy, and the revision of the Sustainable Finance Disclosure Regulation.
For firms applying for or managing CIF licences, the practical implication of the EU Presidency is that CySEC's leadership and senior staff are more visible on the European stage in 2026 than in a typical year. This has not slowed application processing — the regulator has been explicit that business-as-usual supervision and licensing continues in parallel with Presidency activities — but it does reinforce the direction of travel: CySEC is investing in its reputation as a credible, internationally engaged regulator, and that means the bar for the firms it licences continues to rise.
How Zitadelle AG Assists with CySEC CIF Licensing
Zitadelle AG provides end-to-end support for CySEC CIF licence applications — covering initial regulatory scoping, business plan preparation, AML/CFT and sanctions programme design, fit and proper documentation for directors and shareholders, capital structuring, and full application management through to licence issuance. For groups simultaneously establishing or considering an offshore counterpart in Mauritius or Seychelles, we manage both licensing processes in parallel from our Cyprus and Port Louis offices.
Our team works with the current CySEC application standards — including the August 2025 sanctions framework, DORA requirements, and the 2026 ESMA supervisory priorities — and prepares applications that are designed to pass first review rather than cycle through amendment requests.
Contact Zitadelle AG for a confidential initial consultation on your CIF licence application or to discuss the CIF plus offshore structure that most firms in your position are now running.
Last updated: April 2026. Sources: CySEC official announcements, Cyprus Mail, Finance Magnates, GRC Report. This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory requirements are subject to change.