Cyprus has been the jurisdiction of choice for European CFD and forex broker licensing for over a decade, and that position has not changed in 2026. What has changed is the regulatory environment in which a Cyprus Investment Firm (CIF) licence now operates. CySEC in 2025 was a noticeably more active regulator than it was in 2022 — more inspections, more enforcement actions, more licence suspensions, and a broader set of compliance obligations landing on firms' desks. For anyone applying for a new CIF licence or managing an existing one this year, the landscape deserves an honest assessment.
CySEC CIF Capital Requirements — 2026
The minimum initial capital is the first practical question every applicant asks. Here are the confirmed 2026 figures under the Investment Services Law 87(I)/2017:
| License tier | Capital required | Who needs it |
|---|---|---|
| Class 3 — Advisory, RTO, non-dealing | €75,000 | Introducing brokers, investment advisors, agents who do not hold client funds |
| Class 2 — STP, execution with client funds | €150,000 | STP/ECN brokers that hold client funds or financial instruments |
| Class 1 — Market maker, dealing on own account | €750,000 | Market makers, principal dealers, underwriters, MTF/OTF operators |
Capital must be paid-up in cash and held in a Cyprus-licensed credit institution. Capital cannot be substituted with crypto-assets, property, or illiquid instruments — it must be liquid and verified by CySEC at application stage.
Source-of-funds documentation is assessed at application. Every qualifying shareholder holding 10%+ of the applicant entity must provide source-of-funds documentation demonstrating the legitimate origin of the capital. CySEC rejected a material number of applications in 2024–2025 on source-of-funds grounds — this is not a formality.
CySEC application fee: €7,000 at the time of application submission (for standard CIF services). The fee can increase to €25,000 depending on the scope of investment services requested. This fee is non-refundable whether the application is approved or rejected.
The Numbers First — Who Got Licensed, Who Got Fined
CySEC approved 47 new CIF licences in 2025, bringing the total number of supervised entities under the regulator's umbrella to 808. Assets under management in collective investment schemes reached €11.4 billion, with a significant portion invested domestically. The pipeline of new applications remained healthy — Cyprus is not losing its appeal as a licensing base.
The enforcement picture tells a parallel story. Administrative fines and settlements imposed in 2025 totalled approximately €2.3 million, bringing the three-year cumulative total to €7.3 million. CySEC conducted roughly 600 on-site and off-site inspections across CIFs, asset managers, collective investment entities, and market infrastructures. The focus areas were professional conduct, capital adequacy, data quality, AML controls, MiFID II compliance, DORA preparedness, and — increasingly — sanctions compliance.
The complaint picture is worth noting too. Complaints against brokers registered in Cyprus increased by 46% in 2024 relative to the previous year. CySEC Chairman George Theocharides has been explicit that Cyprus-based brokers represent approximately one-third of cross-border retail trading within the European Union, serving around 3.6 million clients — and that the regulator intends to match the scale of that market with the intensity of its supervision.
Recent Enforcement Actions — Names Worth Knowing
A number of specific enforcement actions in 2025 and early 2026 have been widely discussed in the Limassol brokerage community and are worth understanding in context.
Triangleview Investments Ltd(CIF 384/20) had its licence suspended in full at CySEC's March 17, 2025 board meeting, citing violations of anti-money laundering rules, deficiencies in board and management requirements, and failures to meet organisational obligations. The firm was given two months to remediate and was prohibited from accepting new clients or entering new business transactions for the duration of the suspension.
Conotoxia Ltdwas fined €3,650 at CySEC's July 21, 2025 board meeting for non-compliance with the AML/CFT Directive (Directive 157/2019), specifically paragraphs 5(d) and 11. The fine itself was modest — but it came alongside a broader licence suspension that had been running for some time, making the cumulative regulatory position for the firm considerably more significant.
In April 2026, CySEC published a decision regarding Otkritie Broker Ltd— examining the influence exercised by Otkritie FC Bank over the CIF's sound and prudent management. The Russia-connected ownership angle continues to generate regulatory scrutiny, consistent with CySEC's intensified monitoring of firms with Russian-linked beneficial ownership structures that began following the 2022 sanctions wave and has not abated.
CySEC also issued decisions in April 2026 suspending trading in shares of Toxotis Investments, A. Tsokkos Hotels, Dome Investments, and Karyes Investment— Cyprus Stock Exchange-listed companies that failed to submit required financial reports, acting under a CySEC directive. While these are listed companies rather than investment firms, the willingness to intervene publicly and promptly is consistent with the regulator's current posture across all supervised entity categories.
The New Sanctions Compliance Regime — August 2025
The compliance obligation that has generated the most operational work for CIF compliance teams in the second half of 2025 is the new sanctions regime that entered into force on 1 August 2025. Implementing EU Directive 2024/1226, the framework makes sanctions breaches a criminal offence, creates the National Sanctions Implementation Unit (NSIU) within the Ministry of Finance, and extends whistleblower protections specifically to sanctions violations.
For CFD brokers specifically, the new regime requires: real-time screening of customers, beneficial owners, intermediaries, and counterparties against EU, UN, and US sanctions lists before onboarding and on an ongoing basis; immediate escalation frameworks integrating sanctions, AML, and market abuse monitoring; and comprehensive documentation of screening results including false positives. CySEC has been explicit that CFD brokers — given their digital onboarding, cross-border distribution, affiliate and IB chains, and growing crypto payment functionality — sit at the intersection of multiple FATF red flags and will be scrutinised accordingly.
Firms that were caught unprepared by the August 2025 deadline have been working through remediation since. New applicants in 2026 are expected to demonstrate a sanctions compliance framework that meets the new standard at the point of application, not as an afterthought post-licensing.
ESMA CSA 2026 — On-Site Inspections Are Running Now
The European Securities and Markets Authority's Common Supervisory Action (CSA) for 2026 is currently underway, with CySEC conducting on-site inspections and desk-based reviews of CFD brokers as part of the coordinated EU-wide exercise. The inspection focus areas include staff compensation practices, digital platform design, and potential conflicts arising between firms' revenue goals and client interests.
CySEC also issued Circular C770 in April 2026 requiring CIFs to submit 2025 statistical data through the Transaction Reporting System by 8 May 2026, with strict penalties for missed deadlines and no reminders to be issued. Firms that failed to register their email addresses with CySEC by 18 February 2026 for the ESMA cross-border reporting exercise may already be in a compliance gap.
What the Application Process Actually Looks Like in 2026
The CIF licence application process has not become simpler. If anything, the combination of enhanced AML/CFT requirements, the new sanctions framework, MiFID II IFR/IFD capital requirements, DORA digital resilience obligations, and the MiCA transitional provisions for firms with crypto-adjacent products has increased the documentation burden relative to 2022–2023.
A complete CIF licence application in 2026 requires: a detailed regulatory business plan covering all proposed investment services and activities; a comprehensive AML/KYC and sanctions compliance programme; a fit and proper assessment for all directors, shareholders with qualifying holdings, and key function holders; evidence of the minimum share capital (€75,000 for reception and transmission or execution of orders; €150,000 for portfolio management; €750,000 for firms that deal on own account or underwrite financial instruments); a technology and cybersecurity framework consistent with DORA; and a minimum of three Cyprus-resident directors for full board representation, or at least one CySEC-approved senior manager for smaller structures.
CySEC currently takes between six and twelve monthsfrom submission of a complete application to licence issuance, depending on the complexity of the business model, the quality of the application, and the regulator's current caseload. Applications with incomplete documentation, unclear ownership structures, or poorly drafted compliance frameworks are returned for amendment — and each amendment cycle adds months to the timeline.
CySEC has also moved to reject applications outright where it has concerns about the applicants' fitness or the proposed business model's integrity. This is a meaningful shift from earlier years when the regulator was more likely to request amendments than to reject. The "open for business but only for the right businesses" message from Chairman Theocharides is being operationalised at the application review stage.
MiCA and CySEC CIFs — The Article 60 Advantage
One of the most commercially significant 2026 developments for CySEC CIF licensees is the MiCA Article 60 simplified notification pathway — and it directly affects existing CIF holders and applicants planning to offer crypto-asset services.
Under MiCA Article 60, a CySEC-authorized investment firm (CIF) can add the following crypto-asset services to its existing authorization through a simplified notification to CySEC — not a full CASP application:
- Reception and transmission of orders for crypto-assets
- Execution of orders for crypto-assets on behalf of clients
- Placing of crypto-assets
- Providing advice on crypto-assets
- Portfolio management of crypto-assets
The notification is submitted to CySEC at least 40 working days before the intended start of the crypto-asset service. If CySEC does not object within the 40-working-day period, the CIF is authorized to provide the notified service and is added to the ESMA CASP register.
What Article 60 does NOT cover: Exchange of crypto-assets for fiat, exchange between crypto-assets, custody and administration of crypto-assets, and operation of a crypto-asset trading platform require a full MiCA CASP authorization — not just an Article 60 notification.
For applicants building crypto-adjacent forex brokers in 2026: applying for a CySEC CIF and using the Article 60 notification to add crypto advisory and execution services simultaneously is significantly more efficient than sequential applications. Zitadelle AG manages coordinated CIF application + Article 60 notification from our Limassol headquarters with direct CySEC access.
MiCA CASP License →Cyprus PI License →
The M&A Route — Acquiring an Existing CySEC CIF
For operators who cannot wait 9–14 months for a new CIF license, an alternative exists: acquiring a Cyprus Investment Firm that already holds a valid CySEC authorization. Zitadelle AG lists available CySEC CIF entities on Financial License Market — our dedicated marketplace for licensed financial businesses.
Why operators choose acquisition over new application:
Speed: A change-of-control acquisition can be completed in 3–6 months including CySEC approval — significantly faster than the 9–14 months for a new application from scratch.
Operational history: An existing CIF has a CySEC track record, established banking relationships, existing ICF membership, and operational compliance infrastructure already in place.
Cost efficiency: The total acquisition cost (purchase price + CySEC change-of-control approval fee + legal costs) can be comparable to or lower than the total cost of a new CIF application when total time-to-market is factored in.
Key considerations in CIF acquisition:
Change of control notification: CySEC must be notified and must approve any change of qualifying shareholding (10%+) in a CIF. The change-of-control approval process involves CySEC reviewing the new shareholders and senior management for fit-and-proper compliance.
Due diligence: An acquired CIF carries its regulatory history — any outstanding compliance issues, CySEC queries, fine history, or pending enforcement actions are inherited by the buyer. Thorough regulatory due diligence before completion is essential.
Services scope: The acquired CIF is authorized for the specific investment services in its license. If the buyer needs additional services (e.g., adding crypto services, upgrading from Class 3 to Class 2), a change-of-scope application to CySEC is required after the change of control is approved.
Zitadelle AG has completed multiple CIF acquisition mandates for international clients and manages the full transaction from due diligence through CySEC change-of-control approval.
Browse licensed CIF entities for sale →M&A Advisory Services →
CySEC CIF vs Other Tier-1 Investment Licenses — 2026
| Feature | CySEC (Cyprus) | FCA (UK) | ASIC (Australia) | SFC Type 9 (HK) |
|---|---|---|---|---|
| Regulator | CySEC | FCA | ASIC | SFC |
| Framework | MiFID II (CIF) | FSMA 2000 | Corporations Act | SFO |
| Capital (advisory/RTO) | €75,000 | £75,000 | AUD $1M NTA | HKD $100K (no custody) |
| Capital (dealing) | €150,000–€750,000 | £150K–£730K | AUD $1M NTA | HKD $5M (with custody) |
| EU Passporting | Yes — 30 EEA states | No (post-Brexit) | No | No |
| CIT | 15% (2026) | 19–25% | 25–30% | 16.5% |
| Application fee | €7,000 | £1,500–£25,000+ | AUD $1,465 | HKD $4,720 |
| Annual supervision fee | €5,000–€25,000 | Activity-based | Activity-based | Activity-based |
| Timeline | 6–12 months | 12–18 months | 6–12 months | 6–12 months |
| Physical presence | Cyprus office required | UK office required | Australia required | HK office required |
| Crypto via notification | Yes — MiCA Art. 60 | FCA crypto register | No direct equivalent | VATP regime |
| ICF client protection | €20,000/client | FSCS £85,000 | No equivalent | SFC's ICF |
| IP Box | Yes — ~2.5% | No | No | No |
| Zitadelle HQ access | Direct (Limassol) | Remote | Remote | Remote |
| Best for | EU retail/institutional, crypto-adjacent | UK market, FCA credibility | APAC institutional | Asia asset management |
FCA Appointed Representative (UK) →ASIC AFS License →Hong Kong SFC License →
Free Initial Consultation
Need guidance on licensing or company formation?
Our team at Zitadelle AG provides a free initial assessment — covering jurisdiction selection, structure, timeline, and costs. No commitment required.
Get a Free Consultation →The Offshore Counterpart — Why Most EU Brokers Run a Parallel Structure
One pattern that has become near-standard practice among established European CFD and forex groups is maintaining the CIF licence for EU client-facing operations and regulatory passporting while running a separate offshore licensed entity for non-EU clients and more commercially flexible book management. The EU regulatory constraints — leverage caps at 1:30 for retail, prohibition on inducements, negative balance protection, ESMA product intervention powers — are appropriate for EU-regulated retail markets but commercially limiting for global client bases.
The two most commonly used offshore counterparts among Cyprus-based groups in 2026 are Mauritius and Seychelles. The Mauritius Investment Dealer Licence from the FSC — particularly the Full Service Dealer category at USD 500,000 minimum capital — carries strong institutional credibility, access to 46+ double taxation agreements including India, South Africa, France, and the UAE, and an effective corporate tax rate of approximately 3% on foreign income. The Seychelles FSA Securities Dealer Licence offers a faster, lower-cost entry point — typically USD 50,000 minimum capital, lower compliance overhead, and a streamlined application process — making it the preferred structure for groups that need an operational offshore entity quickly without the capital commitment of a Mauritius Full Service Dealer.
The choice between Mauritius and Seychelles for the offshore counterpart typically comes down to the target client geography and the level of institutional credibility required. For groups with significant Asian, Indian Ocean, or African client books, Mauritius is generally the stronger choice — IOSCO compliance and the 2022 FATF grey list exit matter to institutional counterparties in those markets. For groups primarily serving clients in Eastern Europe, the Middle East, or Latin America where the primary credibility signal is the EU-regulated CIF entity, Seychelles provides a cost-efficient operational base.
Cyprus EU Presidency — What It Means for the Regulatory Calendar
Cyprus holds the Presidency of the Council of the European Union in the first half of 2026 — and CySEC has been actively positioning itself as a contributor to EU capital markets policy development during this period. The regulator hosted meetings of ESMA's Management Board and Board of Supervisors in April 2026. Legislative files being progressed under the Cyprus Presidency include the Market Infrastructure Package, the Retail Investment Strategy, and the revision of the Sustainable Finance Disclosure Regulation.
For firms applying for or managing CIF licences, the practical implication of the EU Presidency is that CySEC's leadership and senior staff are more visible on the European stage in 2026 than in a typical year. This has not slowed application processing — the regulator has been explicit that business-as-usual supervision and licensing continues in parallel with Presidency activities — but it does reinforce the direction of travel: CySEC is investing in its reputation as a credible, internationally engaged regulator, and that means the bar for the firms it licences continues to rise.
Realistic Year 1 Cost — What CIF Licensing Actually Costs in 2026
One element most CIF guides avoid: the honest total cost. Here is Zitadelle AG's breakdown for a typical Class 2 (STP) CIF application:
| Item | Cost |
|---|---|
| Cyprus company incorporation | EUR 500–1,500 |
| CySEC application fee | EUR 7,000 |
| Minimum paid-up capital (Class 2) | EUR 150,000 |
| Cyprus office (Year 1) | EUR 8,000–15,000 |
| Key personnel (CO, MLRO, Risk, 4 directors) | EUR 40,000–80,000/year |
| AML/CFT manual + compliance framework | EUR 5,000–15,000 |
| DORA ICT risk framework | EUR 3,000–8,000 |
| Annual audit (mandatory) | EUR 5,000–15,000 |
| CySEC annual supervision levy | EUR 5,000–25,000 |
| ICF annual contribution | Up to 0.5% of assets |
| Zitadelle AG advisory fee | Quoted on scope |
| Year 1 total (excl. capital) | EUR 75,000–160,000 |
| Capital (Class 2, held in company) | EUR 150,000 |
| Year 1 all-in (incl. capital) | EUR 225,000–310,000 |
For a Class 1 (market maker) structure: Capital: EUR 750,000. Key personnel and infrastructure costs are higher. Year 1 all-in typically EUR 900,000–1,200,000.
Capital is held in the company — it is not a fee. The biggest recurring cost is key personnel: CySEC requires qualified, EU-resident staff in compliance, risk, MLRO, and internal audit functions. This is the cost that most estimates understate — particularly for offshore founders unfamiliar with EU employment costs.
How Zitadelle AG Assists with CySEC CIF Licensing
Zitadelle AG provides end-to-end support for CySEC CIF licence applications — covering initial regulatory scoping, business plan preparation, AML/CFT and sanctions programme design, fit and proper documentation for directors and shareholders, capital structuring, and full application management through to licence issuance. For groups simultaneously establishing or considering an offshore counterpart in Mauritius or Seychelles, we manage both licensing processes in parallel from our Cyprus and Port Louis offices.
Our team works with the current CySEC application standards — including the August 2025 sanctions framework, DORA requirements, and the 2026 ESMA supervisory priorities — and prepares applications that are designed to pass first review rather than cycle through amendment requests.
Contact Zitadelle AG for a confidential initial consultation on your CIF licence application or to discuss the CIF plus offshore structure that most firms in your position are now running.
Applying for a CySEC CIF License — How Zitadelle AG Helps
Zitadelle AG is based in Limassol, Cyprus — the headquarters of the CySEC CIF ecosystem. Direct CySEC access, established relationships with key function placement specialists via HRFinEase, and a track record across CIF applications and acquisitions.
Our CIF service includes:
Complete application preparation: Business plan, Programme of Operations, AML/CFT manual, conflict of interest policy, sanctions compliance framework, DORA ICT risk framework, organizational structure, fit-and-proper documentation for all directors and qualifying shareholders.
Key personnel placement: Compliance Officer, MLRO, Risk Manager, and Cyprus-resident directors sourced via HRFinEase — our dedicated fintech recruitment platform with CySEC-experienced candidates.
CySEC correspondence management: All CySEC queries handled directly from our Limassol office. Regulatory examiner engagement. Amendment submissions managed.
MiCA Article 60 notification: For applicants planning to offer crypto-asset services alongside the CIF — coordinated notification preparation and submission immediately following CIF grant.
M&A advisory: If timeline is critical — due diligence, acquisition, and CySEC change-of-control approval for existing CIF entities.
Ongoing compliance: Annual audit coordination, CySEC reporting, DORA framework maintenance, AML/CFT annual review, outsourced MLRO and CO services.
Related reading & services
Last updated: June 2026. Sources: CySEC official announcements, Cyprus Mail, Finance Magnates, GRC Report. This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory requirements are subject to change.