🇨🇾Cyprus Investment Firm (CIF): the CySEC Licence

Concept

A Cyprus Investment Firm (CIF) is a Cypriot company licensed by the Cyprus Securities and Exchange Commission (CySEC) to provide investment services: receiving and executing client orders, managing portfolios, giving investment advice, dealing on own account or underwriting issues. Its legal basis is the Investment Services and Activities and Regulated Markets Law 87(I)/2017, through which Cyprus transposed MiFID II. The EU-wide mechanics of the regime — firm classes, K-factors, the passport — are covered in “Investment Firm under MiFID II”. What Cyprus adds sits in its national laws, CySEC's fees and supervisory practice.

Who gets the licence

The status exists because investment services are a reserved activity in the EU. Only a company established in the Republic of Cyprus can obtain a CIF licence (s.7(1)). Foreign firms work in Cyprus differently: firms from other EEA states under the passport, and third-country firms serving retail or elective professional clients through a branch authorised by CySEC (s.40). The CIF itself receives the European passport: one CySEC licence plus notifications replaces a separate licence in every EEA state (see “EU Passporting”).

The combination of a local company, access to the whole EEA and moderate fees drew many retail brokers to Cyprus in the 2010s, above all in contracts for difference (CFDs). CySEC itself describes them as firms many of which traditionally passported their services across the rest of the EEA.

What the model offers

Three features shape how founders use the licence.

The Cypriot specifics sit in the detail. CySEC's application fee starts at €7,000, the law obliges the regulator to answer within six months of a complete application, and Cypriot courts apply the common law and equity alongside national legislation (s.29 Courts of Justice Law 14/1960). Corporate income tax has been 15% since 2026.

The limits are built in as well. At least two people must effectively direct the firm, retail CFDs were under a dedicated CySEC supervisory plan from 2015, and part of the market is leaving: of the 247 firms on CySEC's list as of 28.09.2026, 19 are under examination for voluntary renunciation of their licence.

Key parameters

The parameters are set by the law, CySEC's fee rules and the regulator's register.

The key variable in both tables is the set of services: it drives capital, fees and whether the firm takes on client-asset obligations.

Three capital tiers

The licensing law does not state the amounts itself: s.16 of Law 87(I)/2017 refers to s.9 of Law 165(I)/2021 on the prudential supervision of investment firms, which transposed the IFD. The tier depends on whether the firm holds client assets and whether it puts its own balance sheet at risk.

Initial capital is only the entry threshold. After that, Art. 11 IFR applies: own funds must at all times be at least the highest of three amounts — a quarter of fixed overheads, the permanent minimum and the K-factor requirement. Once fixed overheads exceed initial capital more than fourfold, a quarter of overheads exceeds the permanent minimum and required own funds rise above the tier. How the three bases are calculated is covered in “Regulatory Capital”.

CySEC fees

Fees combine a one-off application fee with several annual charges; most are set by fee directive DI87-03, and the DORA fee by a separate CySEC decision of 2025.

The annual levy of an ordinary firm is therefore capped, while a trading-venue operator's charges grow with revenue without an upper limit.

How CySEC grants the licence

The statutory procedure is short, and most of the work sits in the application pack. The stages are set by ss.7–16 of Law 87(I)/2017:

1. The founders incorporate a company in Cyprus — only a Cypriot company can obtain a CIF licence (s.7(1)).
2. The company files an application with a programme of operations describing the planned services and organisational structure (s.7(2)) and pays the fee.
3. CySEC assesses the management (ss.9–10), shareholders with qualifying holdings (s.11), initial capital (s.16) and participation in the investor compensation scheme (s.15).
4. CySEC communicates its decision within six months of a complete application (s.7(3)).

The clock runs from a complete application, so correspondence on completeness does not count towards it. The licence must be used within 12 months: otherwise, as after six months without providing services, CySEC may revoke it (s.8(1)(a)).

Buying a ready-made firm

A licensed firm can be bought, and the buyer goes through the same assessment as a founder. Anyone who decides to acquire a qualifying holding (10% or more), or to raise it to 20%, 30% or 50%, must notify CySEC in writing in advance, and the regulator assesses the acquirer (ss.12–14). The mechanics of such a deal are covered in “Change of Control and Buying a Licensed Company” and “Qualifying Holdings and Fit & Proper”.

Substance: people and functions in Cyprus

The law frames presence through people. At least two persons meeting the requirements of ss.9–10 must effectively direct the firm's business (s.9(16)), and the firm notifies CySEC of every change to its board (s.9(15)). The four-eyes principle is therefore a licence condition, and breaching it can cost the licence, as the case below shows.

The control functions are set by Delegated Regulation (EU) 2017/565, which applies directly:

• a permanent, effective and independent compliance function (Art. 22);
• risk management policies and a risk management function (Art. 23);
• a separate, independent internal audit function where proportionate to the scale and complexity of the business (Art. 24).

The Cypriot anti-money laundering law applies separately, and CySEC enforces it against licensees directly: in 2023, for example, CySEC reached a €50,000 settlement with CIF Freedom Finance Europe Ltd under that law. The overall set of control functions of a licensee is covered in “Compliance Stack”.

When substance is missing

The Mind Money Limited decision shows the consequences. On 23.06.2026 CySEC suspended in whole the licence of this CIF (formerly Zerich Securities Ltd, licence 115/10). The regulator cited a suspected breach of s.22(1) of the law and listed four licence conditions which, in its assessment, the firm did not meet:

1. activities outside the scope of the licence (s.5(5));
2. failure to notify CySEC of changes to the board (s.9(15));
3. absence of two persons effectively directing the business (s.9(16));
4. suitability of its shareholder (s.11(1)(b)).

The firm was given one month to comply. While the suspension lasts, it may not provide investment services, accept new clients or advertise itself. Where its clients so wish, it may complete its own and clients' pending transactions and return client money and instruments. As of 28.09.2026 the licence is still shown as suspended in CySEC's register.

Client money and the ICF

The first line of protection is segregation: client money and instruments are held separately from the firm's own assets. The second is the Investor Compensation Fund (ICF), whose membership CySEC verifies at the licensing stage (s.15(1)). The fund covers claims of non-professional clients against a member firm that cannot return their assets, paying the lower of 90% of the cumulative covered claim and €20,000 per client.

The cap is the same for all clients and all services of the firm, so for a large account the ICF covers only a small part of the risk and segregation carries the main load. How deposit guarantees, safeguarding and investor compensation relate is shown in “Client Asset Protection Map”.

Why Cyprus became a brokerage hub

Four reasons worked together to make the island popular with brokers:

• the passport — in 2019 CySEC described its CFD brokers as firms many of which provided services across other EEA states under the passport;
• the cost of entry — an application fee from €7,000 and an annual levy from €6,500 plus a turnover increment;
• the law — courts apply the common law and equity alongside Cypriot statutes;
• tax — a corporate rate of 12.5%, in force until the end of 2025.

The tax part has changed. Since 1 January 2026 corporate income tax has been 15% (Law 244(I)/2025); how the rates on profit distributions and the transitional rules were rebuilt is covered in “Cyprus Tax Reform from 2026”, and the holding side in “Cyprus Holding”.

The nearest EU alternative is Bulgaria: the same IFD capital tiers and the same investor compensation cap, but a flat 10% profit tax and a noticeably smaller licensee market. The comparison is in “Investment Firm in Bulgaria”, and the other regimes for brokers and investment firms are gathered in the “Financial Licences” hub.

Retail CFDs: CySEC's restrictions

The history of the Cypriot market is inseparable from CFDs. In a press release of 30.05.2019 CySEC described past practice plainly: aggressive marketing without adequate risk disclosure, retail leverage in some cases exceeding 1:500, and bonus promotions encouraging trading. Most such transactions ended with the client losing the entire amount invested, and sometimes with a negative balance. From 2015 the regulator ran a dedicated supervisory action plan on CFD brokers, imposed record penalties and revoked nine CFD licences.

The restrictions came in steps.

Current leverage limits

Policy Statement PS-04-2019 explains the rationale, and the operative text is Directive DI87-09 as amended on 05.09.2025. For retail clients it sets the same leverage limits as ESMA.

Leverage limits come with a margin close-out when funds fall to 50% of the required margin, negative balance protection per account, a ban on monetary and other inducements and a standardised warning on the share of loss-making retail accounts. All these measures apply to retail clients only; professional clients are outside them.

For a client in another EU state, the measures of that state's regulator apply where it has adopted them; for a third-country resident, the Cypriot measures apply, which equal the ESMA limits. A Cypriot firm therefore cannot offer a retail client outside the EU leverage above 30:1 on major currencies, and para. 5 of the directive prohibits knowingly taking part in circumventing these restrictions.

Popular, but it ends badly

The direct workarounds of the 2010s — 1:500 leverage and bonuses offered by the CIF itself — have been closed by CySEC. A common workaround today looks different: a group keeps a Cypriot CIF and, next to it, an offshore firm under the same or a similar brand. The European firm attracts the client, who is then moved to the offshore company on the claim that the client approached the foreign broker on their own (reverse solicitation). Another route to high leverage is to reclassify a retail client as professional, to whom the retail limits do not apply.

Clients outside the EU are also covered by Circular C534 of 29.11.2022: services in a third country are allowed only after obtaining the local authorisation or a certificate from the local regulator that none is required, with notice to CySEC and a list of such countries on the firm's website. Activity outside the licence is a separate ground for suspension (s.5(5)), and the Mind Money case shows that CySEC uses it. In such a structure the firm risks its licence, and the client risks ICF compensation.

Russian owners and clients after 2022

Law 87(I)/2017 does not test nationality. CySEC assesses a Russian ultimate beneficial owner under the same rules as any acquirer of a qualifying holding (ss.12–14), and shareholder suitability remains a licence condition throughout. Sanctions restrictions come from two EU regulations and, since 2025, are backed by a Cypriot criminal statute.

Asset freeze and criminal liability

The first to apply is Regulation (EU) 269/2014: funds and economic resources of listed persons are frozen (Art. 2). Under the 50% rule, which CySEC explains in its sanctions guidance of 23.03.2023, the freeze extends to a company in which listed persons directly or indirectly hold more than 50% in aggregate, or which they control. If the ultimate beneficial owner is listed and holds more than 50% or controls the firm, the CIF's own assets must be frozen too.

Law 149(I)/2025, published on 25.07.2025, sets criminal liability for breaches of EU sanctions. A legal person faces a fine of up to 5% of worldwide turnover, or up to €40 million where turnover cannot be determined; the court may also revoke the licences used to commit the offence (s.8).

Sectoral bans under Regulation 833/2014

For an investment firm, four provisions of Regulation (EU) 833/2014 matter.

None of the four prohibitions applies to nationals of the EU, EEA or Switzerland or to natural persons holding a temporary or permanent residence permit there (Arts. 5b(3), 5e(2), 5f(2)). For a client or owner holding a Russian passport, a European residence permit is therefore decisive.

For the CIF itself, the ownership ban concerns only the crypto line. If the firm has added crypto-asset services under Art. 60(3) MiCA (see “The MiCA CASP Licence”), from 25.08.2026 its direct and indirect owners, controllers and board members may not include Russian nationals or persons residing in Russia without European status; a holding company in a third country does not shield it from the ban. An ordinary brokerage licence carries no such ban, but Art. 5f directly narrows the product range for clients from Russia.

How CySEC applies sanctions

In its 2023 guidance CySEC relays the Ministry of Finance reading of 27.05.2022: the Art. 5b prohibitions cover Russian nationals and residents and entities established in Russia, but not companies registered in other countries. For Art. 5b(2) that reading still matches the text. However, Art. 5b(1) in its current wording expressly covers companies outside the EU more than 50% owned by Russian nationals or residents, and Art. 5b(2a) prohibits indirect as well as direct ownership.

Through Circulars C489, C501 and C517 CySEC required supervised firms to review relationships with sanctioned persons, report on measures to comply with Arts. 5b, 5f, 5m and 5n and report their exposure. The overall map of restrictions is in “Sanctions: a Route Map”.