🇪🇺EU investment firm: Cyprus, Malta, Bulgaria or Lithuania

Cyprus, Malta, Bulgaria and Lithuania issue the same licence: the prior authorisation that Directive 2014/65/EU (MiFID II) requires of any firm providing investment services on a professional basis, covering the nine services and activities of Annex I, from reception and transmission of orders to operating a multilateral (MTF) or organised (OTF) trading facility, with a passport to the whole European Economic Area (EEA). The three figures a comparison usually starts from are therefore identical in all four. Initial capital is €75,000, €150,000 or €750,000 depending on the services and on whether the firm may hold client money and instruments: the amounts come from Art. 9 of the Investment Firms Directive 2019/2034 (IFD), and none of the four adds a national top-up. The regulator must give its decision within six months of a complete application (Art. 7(3) MiFID II). The minimum compensation for a client whose money or instruments a failed firm cannot return is €20,000 under Directive 97/9/EC.

The differences sit wherever EU law leaves the decision to the member state, and on those axes each country has a distinct profile. Cyprus has the deepest investment-firm market, retail rules on contracts for difference (CFDs) that expressly extend to clients in third countries, and the most expensive hour of finance-sector labour of the four. Malta runs a staged procedure with an "in principle" approval, charges high fees to firms that deal on own account and, since August 2026, requires every firm with retail clients to join its compensation scheme. Bulgaria has the shortest clock on paper, an annual supervision fee measured in hundreds of euros per service and a 10% corporate tax, but a quarter of the capital is paid in when the application is filed and the country remains on the FATF grey list. Lithuania pays investors the most, up to €22,000, and requires a collegial management board.

What settles the question before the comparison

Four conditions decide the file before any figures are weighed. Two of them remove all four countries at once, one adds a burden to Bulgaria and one points to Lithuania.

Retail CFDs at leverage above the European limits. All four regulators restrict the sale of CFDs to retail clients on the model of the European Securities and Markets Authority (ESMA): leverage from 30:1 on major currency pairs down to 2:1 on crypto-assets (ESMA measures). The Maltese and Lithuanian measures, as recorded in ESMA's opinions, apply to sales in or from the country (Malta, Lithuania), and in Bulgaria Decision 918-ИП of the Financial Supervision Commission (FSC) imposes the same restrictions. Cyprus goes further: Directive DI87-09 of the Cyprus Securities and Exchange Commission (CySEC), as amended by KDP 270/2025, applies the limits to a Cyprus Investment Firm's (CIF) retail clients in third countries as well, and Circular C534 adds a procedure for entering a third country. Retail leverage above the European limits is therefore unavailable in Cyprus even for clients in third countries, and in Malta and Lithuania for any sale made from the country. The Cypriot regime is detailed in “Cyprus Investment Firm (CIF): the CySEC Licence”, and the offshore alternative and its limits in “Offshore Broker Licences: Seychelles, BVI and Cayman”.

Management located outside the licensing country. EU law sets this test, so it too removes all four: a legal-person investment firm keeps its head office in the member state of its registered office (MiFID II Art. 5(4)(a)), and at least two persons effectively direct the business (Art. 9(6)). ESMA's opinion of 13 July 2017 adds that senior managers and key compliance and risk staff should be located in the home state with real decision-making powers, failing which authorisation may be refused or withdrawn. The national statutes repeat the rule — Law 87(I)/2017 in Cyprus, Cap. 370 in Malta, the Markets in Financial Instruments Act (ZPFI) in Bulgaria and the Law on Markets in Financial Instruments in Lithuania — and add their own. Malta applies the "dual control" principle (Part BI R1-1.4.3 of the rules of the Malta Financial Services Authority (MFSA)) with an MFSA-approved compliance officer outside operations and an MFSA-approved money laundering reporting officer (MLRO) who should be a senior employee or executive director. Lithuania requires a collegial board (valdyba) alongside the chief executive and refuses a licence where the firm's permanent management body is located abroad. How the same test applies when functions are handed to service providers is covered in “Outsourcing at a Licensed Firm: EBA Rules, Third Countries and the Letterbox Test”.

Counterparties that read the FATF list. Bulgaria has been on the FATF list of jurisdictions under increased monitoring since October 2023. In June 2026 the FATF made the initial determination that the action plan is substantially complete, which triggers an on-site assessment; no delisting had been decided as of September 2026. For an investment firm this is above all a question for the banks that hold its capital and its clients' money, whose onboarding policies may take the list into account. What the listing means is set out in “The FATF: Standards, Mutual Evaluations and the Black and Grey Lists”.

An adviser that needs no passport. A Lithuanian financial advisor company may provide investment advice and reception and transmission of orders in Lithuania, in transferable securities and fund units, together with ancillary services, provided it holds no client money or instruments and transmits orders only to licensed firms (Art. 4(7) of the Law). The IFR prudential regime does not apply to it; instead it needs professional liability insurance of at least €29,000 per claim and €145,000 a year. It has no passport, so clients elsewhere in the EEA need an investment firm licence; how the passport works is set out in “EU Passporting: How a Financial Licence Works Across the EEA”.

The four regimes side by side

Entry conditions agree on capital and diverge on fees, on milestones inside the six-month clock and on management requirements.

Operating conditions diverge further: supervision fees, compensation, the reach of CFD measures and market depth.

Capital and own funds

Initial capital does not separate the four. The national texts repeat the IFD figures without a top-up: Cyprus in s. 16 of Law 87(I)/2017 as amended by Law 165(I)/2021, Malta in R9-9.3.1 of Part A of the MFSA Rules, Bulgaria in ZPFI Art. 10 and Lithuania in Art. 14 of its Law. Malta carries one qualification: its thresholds turn on the right to "hold or control" client money, and control includes a mandate over the client's bank account or a power of attorney over the client's assets (R4-4.3.2 of Part A). A portfolio manager holding such a power of attorney falls into the €150,000 row. Beyond initial capital, IFR Art. 11 everywhere requires own funds of at least the highest of three amounts: a quarter of the previous year's fixed overheads, the permanent minimum capital and the K-factor requirement. A firm holding client money cannot be a small and non-interconnected Class 3 firm and is at least Class 2. The calculation is set out in “Regulatory Capital: How Regulators Calculate It”.

The clock and cash at filing

All four statutes say six months, but they place different milestones inside it. Bulgaria's FSC decides within three months of confirming completeness, or within one month of the reply to its request, but at least 25% of the initial capital is paid in when the application is filed and the rest after the FSC's notice that it intends to grant the licence. Malta runs the procedure in three phases (Part A of the MFSA Rules): a recommended preliminary meeting with a written description of the proposed business; review of the draft application, after which, once the draft licence conditions are agreed, the MFSA issues an "in principle" approval valid for three months to close outstanding matters; and post-licensing conditions that may be set before the firm starts. The MFSA does not process an incomplete application or one that fails to identify every key-position holder; the six months under Cap. 370 Art. 6(6) run from a properly completed application with the requisite documents. Lithuania counts six months from the submission of all required documents and information (Art. 6(4) of the Law) and requires the applicant to insure its liabilities to investors before licensing: not belonging to the insurance scheme is a mandatory ground for refusal. Cyprus applies the general six-month period of s. 7(3) of Law 87(I)/2017.

Regulators' fees

Fees are the first axis where the gap is a multiple. On application CySEC charges €7,000 for any of services 1–7, dealing on own account and underwriting included (Directive DI87-03 as amended by KDP 298/2025). The MFSA charges €4,250 to €15,000 by class, and where several application fees are due all but the highest are reduced by 25% (S.L. 370.52). The FSC charges its fee on grant of the licence — €4,090.34, €6,135.50 or €10,225.84 by capital tier (FSC fees). The Bank of Lithuania charges a state levy of €947.

CySEC's annual fee is a fixed €6,500, €8,000 or €10,000 by capital tier plus a turnover increment above €500,000 and €3,000 for CFD services, all capped at €150,000. An MTF operator pays €7,000 a year plus 11% of the venue's revenue every six months outside the cap and an OTF operator only the 11%, and since 15 August 2025 CySEC has also charged a separate supervision fee under the Digital Operational Resilience Act (DORA) of €2,000–20,000 a year. In Malta the scale follows net revenue: for class (a) a minimum of €4,000 plus €700 for every further €50,000 up to €17,300, for class (c) €7,600–20,900 and for class (d) €17,500 to €30,800. The scale is legislated to rise every year to 2029, when class (d) reaches €22,500–40,200. In Bulgaria a fixed component is summed across the licensed services — €102.26 for reception and transmission, €255.65 for execution, €818.07 for dealing on own account, €409.03 for portfolio management, €204.52 each for advice and safekeeping, €3,067.75 each for an MTF and an OTF — plus 0.03% of total annual revenue up to the cap set under Art. 72(3) of Ordinance No 76 (FSC tariff in force from 1 January 2026).

Investor compensation

The Cyprus Investor Compensation Fund (ICF), Malta's Investor Compensation Scheme (ICS) and Bulgaria's Investor Compensation Fund (Art. 77g of the Public Offering of Securities Act) pay 90% of the claim, up to €20,000. Lithuania's investor-liability insurance pays the value of the instruments and money the firm cannot return up to €22,000 per investor, with no 10% haircut. For an applicant the more important change is Maltese: L.N. 224 of 2026, published on 18 August 2026, replaced the list of scheme participants. Previously only "Category 2 or Category 3" licence holders took part, meaning firms authorised to hold or control client money; now holders of IFR Class 1, Class 1 minus, Class 2 and Class 3 licences participate. A firm with retail clients that never holds client money must join and, from its second year after licensing, pay at least the €5,000 Class 3 fixed contribution. Firms serving only non-retail investors remain exempt but may opt in. The contrary footnote in the 2024 version of Part A of the MFSA Rules is superseded. Schemes across regimes are mapped in “Client Asset Protection Map: Deposits, Safeguarding and Investor Compensation”.

Market depth and supervisory record

The CySEC list, accessed on 28 September 2026 (page header "as of 04 May 2026"), has 247 Cyprus investment firms, 19 of them under examination for voluntary renunciation of the licence — by far the deepest register of the four. Bulgaria had 53 licensed investment intermediaries at the end of 2025, 19 banks and 34 non-bank firms; the FSC revoked no licence in 2025. The Lithuanian investor-insurance participant list names 17 financial brokerage firms, among them Revolut Securities Europe UAB, Robinhood Europe UAB and UAB DriveWealth Europe. For Malta the comparable figure comes from the ESMA register, which on 29 September 2026 listed active head-office "investment firm" entries for Cyprus (265), Malta (81), Bulgaria (49) and Lithuania (24); the Maltese, Bulgarian and Lithuanian counts include banks registered for investment services and indicate an order of magnitude.

Since 2017 CySEC has limited leverage for non-professional clients, banned bonuses and revoked nine CFD licences. In the investment services sector, which in its reporting includes fund managers, the MFSA in 2025 cancelled 6 licences, issued 5 directives, concluded 10 settlements and imposed 22 administrative penalties totalling €225,143.

People and tax

An hour of labour in financial and insurance activities cost, according to Eurostat, €42.6 in Cyprus, €28.7 in Lithuania, €27.4 in Malta and €16.1 in Bulgaria in 2025, against an EU-27 average of €58.6. The headline corporate income tax rate is 15% in Cyprus from 1 January 2026, up from 12.5% (Law 244(I)/2025), 35% in Malta (Cap. 123 Art. 56(6)), 10% in Bulgaria (Corporate Income Tax Act Art. 20) and 17% in Lithuania from 2026 (State Tax Inspectorate); small Lithuanian entities with income up to €300,000 may qualify for 0% or 7% under conditions. Shareholder refunds and, since L.N. 188 of 2025, an optional 15% final-tax election change Malta's effective burden; the mechanics are set out in “Malta Holding: 6/7 Refund System and Effective 5% Rate”, the Cyprus reform in “Cyprus Tax Reform from 2026: Company, Individual, Crypto-Assets” and the Bulgarian company in “Company in Bulgaria (EOOD/OOD): 10% Tax, 5% Dividends and Substance”. Currency no longer separates Bulgaria and Lithuania: Bulgaria adopted the euro on 1 January 2026 at 1.95583 leva to the euro, and Lithuania has used the euro since 1 January 2015.

Malta's licence categories today

The labels "Category 1a", "Category 2" and "Category 3" come from earlier Maltese law: they were defined in regulation 6(1) of the fee regulations, S.L. 370.03. Regulation 6(1) was deleted by Legal Notice 20 of 2022, and S.L. 370.03 itself was repealed by L.N. 370 of 2024. The current fee law, S.L. 370.52 (L.N. 370 of 2024 as amended by L.N. 61 of 2025), keeps the same four MiFID classes without the labels, while capital and compensation-scheme participation turn on the description of services, on the right to hold or control client money and on the IFR class.

Fee class (a) names only reception and transmission, advice and placing without a firm commitment, while the €75,000 capital row also covers execution and portfolio management; a firm that executes orders or manages portfolios without client money should settle its fee class at the preliminary meeting with the MFSA. Operating an MTF or OTF and acting as trustee or custodian fall outside classes (a)–(d).

Beyond the fixed contribution, a participant in the Maltese scheme after L.N. 224 of 2026 pays a variable contribution of 0.1% of the annual increase in investment-services revenue into a pledged scheme reserve that must be worth at least 0.1% of that revenue and never less than €698.81. It also holds an Emergency Drawdown Reserve of 1% of the same revenue in cash or cash equivalents, which is not reduced when revenue falls. In exceptional circumstances the scheme may call an Extraordinary Contribution of 0.15% of revenue. The fixed contribution is payable by 31 July each year.

Choosing by business model

The licence is the same instrument in all four countries, so the business model decides which national axis matters.

A retail CFD and FX broker works under the same leverage limits in any of the four; ESMA's statement of 24 February 2026 adds that leveraged "perpetual futures", including on crypto-assets, are likely within scope whatever they are called. Malta adds data and staffing requirements: a licence holder offering CFDs or rolling spot forex must keep real-time access to all data on transactions carried out in Malta, fully preserved at its head office (Part BI R1-1.6.15), appoint a compliance officer with a proven track record in regulated firms in that industry and notify the MFSA of changes of liquidity providers.

Dealing on own account and market making require €750,000 everywhere, and the difference in regulatory cost shows on a retail CFD broker offering reception and transmission, execution, dealing on own account and safekeeping of client assets. In Bulgaria its annual fixed component comes to €102.26 + €255.65 + €818.07 + €204.52 = €1,380.50 plus 0.03% of revenue. In Cyprus it is €10,000 fixed plus €3,000 for CFDs and the turnover increment, within the €150,000 cap. In Malta class (d) costs €17,500–30,800 a year in 2026, and from the second year the firm adds the €22,000 ICS contribution of a Class 2 firm dealing on own account, plus the scheme reserves.

A portfolio manager or adviser without client money chooses on running costs: in Bulgaria €409.03 a year for portfolio management or €204.52 for advice plus 0.03% of revenue, in Cyprus from €6,500, in Malta from €4,000 and, with retail clients, at least €5,000 a year to the ICS from the second year.

An MTF or OTF operator chooses between the FSC's fixed fees and CySEC's 11% of venue revenue. Capital is €150,000 for an MTF operator that does not deal on own account and €750,000 for an OTF operator that deals or may deal on own account.

Cost and time

Published figures cover only the regulator's price list and the statutory clock. The local team, counsel, audit, IT and the bank are priced by the market.

Fees are already under revision in two of the four. In Cyprus, on 12 January 2026 CySEC opened consultation CP(2026-01) on replacing the DI87-03 fee grid. The draft proposes an application fee of €2,000 plus €8,000 for each of services 1, 2, 4, 5, 6 or 7, €15,000 for dealing on own account and €30,000 for an MTF or OTF, and an annual fee of €8,000 for each such service, €30,000 for dealing on own account, €20,000 for safekeeping or client funds and 2%, 1%, 0.5% and 0.3% on turnover bands above €500,000; the €3,000 CFD add-on would go and the cap would rise from €150,000 to €600,000. For a retail CFD broker dealing on own account and holding client money, the fixed element would move from €10,000 + €3,000 to €8,000 × 2 + €30,000 + €20,000 = €66,000 before turnover increments. As of 29 September 2026 no amending directive had been issued, and DI87-03 as amended by KDP 298/2025 still applies. In Malta the increase is already legislated in S.L. 370.52: from 2027 the application fee is €5,000, €6,000, €8,000 and €19,000 for classes (a)–(d), and the annual fee runs from €4,700 to €18,000 for (a), €5,500 to €18,800 for (b), €8,800 to €22,100 for (c) and €20,000 to €33,300 for (d); no amending legal notice had been published by 29 September 2026.

The EU sanctions perimeter

An investment firm in any of the four can add crypto-asset services equivalent to its authorisation by notifying its regulator at least 40 working days in advance (MiCA Art. 60(3)); Lithuania's Law (Art. 4(2¹)) and Bulgaria's ZPFI provide for the route expressly, and the full crypto-asset service provider regime is set out in “The MiCA CASP Licence: Procedure, Cost and Choosing a Jurisdiction”. EU sanctions against Russia never decide between the four, because they sit in a regulation that applies identically in each. Regulation 833/2014 does not bar Russian nationals or residents from owning an EU investment firm that provides only MiFID services. Art. 5b(2a) bars them from owning, controlling or sitting on the governing bodies of a firm that provides crypto-asset services — wallet, account or custody services since 18 January 2024 and any MiCA service since 25 August 2026. EU, EEA and Swiss nationals and residence-permit holders there are exempt. Owner and manager vetting is covered in “Qualifying Holdings and Fit & Proper: How Regulators Vet Owners and Managers”, and the wider perimeter in “Sanctions: a Route Map for the Individual, the Bank and the Structure”.

Where the choice goes wrong

Forgetting Bulgaria's 25% at filing. For a firm dealing on own account that is at least €187,500 in the account before the regulator decides.

Treating CySEC's fees as fixed. Consultation CP(2026-01) has not yet been adopted; as proposed it would multiply the fixed annual fee of a broker dealing on own account and holding client money several times over, and the cap fourfold.

Choosing the country before the bank. Capital, client money and settlement all run through banks, and their onboarding policies may take Bulgaria's presence on the FATF list into account.