# EU investment firm: Cyprus, Malta, Bulgaria or Lithuania

> Cyprus, Malta, Bulgaria or Lithuania for a MiFID II firm: capital is the same, so fees, the clock, investor compensation, CFD rules, staff costs and tax decide.

Author: Gordey Bolotko — Partner, Corporate & Commercial (https://wiki.private.law/en/authors/bolotko)
Last modified: 2026-09-29T00:00:00.000Z
Canonical: https://wiki.private.law/en/investment-firm-eu-comparison
Publisher: wiki.private.law (https://wiki.private.law)
Version: 78698db13fa164031a787c2faf132a8b1685c935e176176cd713c5142d73c578
Cite as: EU investment firm: Cyprus, Malta, Bulgaria or Lithuania. wiki.private.law. https://wiki.private.law/en/investment-firm-eu-comparison. Version 78698db13fa164031a787c2faf132a8b1685c935e176176cd713c5142d73c578.
Topics: investments
Jurisdictions: cyprus, malta, bulgaria, lithuania, eu
Functional tags: license
Product tags: license-mifid, investment, compliance, custody, tax-regime
Semantic tags: license, license-mifid, investment, compliance, custody, tax-regime

---

Cyprus, Malta, Bulgaria and Lithuania issue the same licence: the prior authorisation that Directive 2014/65/EU (MiFID II) requires of any firm providing investment services on a professional basis, covering the nine services and activities of Annex I, from reception and transmission of orders to operating a multilateral (MTF) or organised (OTF) trading facility, with a passport to the whole European Economic Area (EEA). The three figures a comparison usually starts from are therefore identical in all four. Initial capital is €75,000, €150,000 or €750,000 depending on the services and on whether the firm may hold client money and instruments: the amounts come from [Art. 9 of the Investment Firms Directive 2019/2034 (IFD)](https://eur-lex.europa.eu/eli/dir/2019/2034/oj), and none of the four adds a national top-up. The regulator must give its decision within six months of a complete application ([Art. 7(3) MiFID II](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20260606)). The minimum compensation for a client whose money or instruments a failed firm cannot return is €20,000 under [Directive 97/9/EC](https://eur-lex.europa.eu/eli/dir/1997/9/oj).

The differences sit wherever EU law leaves the decision to the member state, and on those axes each country has a distinct profile. Cyprus has the deepest investment-firm market, retail rules on contracts for difference (CFDs) that expressly extend to clients in third countries, and the most expensive hour of finance-sector labour of the four. Malta runs a staged procedure with an "in principle" approval, charges high fees to firms that deal on own account and, since August 2026, requires every firm with retail clients to join its compensation scheme. Bulgaria has the shortest clock on paper, an annual supervision fee measured in hundreds of euros per service and a 10% corporate tax, but a quarter of the capital is paid in when the application is filed and the country remains on the FATF grey list. Lithuania pays investors the most, up to €22,000, and requires a collegial management board.

**Identical in all four**

The nine MiFID II services, capital of €75,000 / €150,000 / €750,000, a decision within six months of a complete file, the EEA passport by notification, compensation of at least €20,000, ESMA-model leverage limits for retail CFDs.

**Set by the member state**

Application and supervision fees, milestones inside the six-month clock, when capital is paid in, who joins the compensation scheme and its cap, the reach of CFD measures, management requirements beyond two persons, corporate tax.

**Set by the market**

Depth of the register and of the talent pool, the hourly cost of finance-sector labour, how banks read the licensing country, the regulator's record on revocations.

> 🧭 The EU rules themselves — the list of services, the classes under the Investment Firms Regulation 2019/2033 (IFR), the passport, reverse solicitation — are covered in [“MiFID II Investment Firm: Services, IFR/IFD Capital Classes and the Passport”](https://wiki.private.law/en/mifid-investment-firm). The national mechanics of Cyprus are in [“Cyprus Investment Firm (CIF): the CySEC Licence”](https://wiki.private.law/en/cysec-cif-license) and those of Bulgaria in [“Investment Firm in Bulgaria: FSC Licence under MiFID II”](https://wiki.private.law/en/bulgaria-investment-firm). The same choice between Lithuania and Bulgaria for a payments business is covered in [“EMI in Lithuania or Bulgaria: A Comparison”](https://wiki.private.law/en/emi-lithuania-vs-bulgaria), regimes outside the EU are compared in [the investment firm licence map](https://wiki.private.law/en/investment-firm-license-map), and where an investment firm sits among the other authorisations is shown in the hub [“Financial Licences: How to Choose, Obtain and Maintain One”](https://wiki.private.law/en/financial-licenses).

## What settles the question before the comparison

Four conditions decide the file before any figures are weighed. Two of them remove all four countries at once, one adds a burden to Bulgaria and one points to Lithuania.

**Retail CFDs at leverage above the European limits.** All four regulators restrict the sale of CFDs to retail clients on the model of the European Securities and Markets Authority (ESMA): leverage from 30:1 on major currency pairs down to 2:1 on crypto-assets ([ESMA measures](https://www.esma.europa.eu/press-news/esma-news/esma-adopts-final-product-intervention-measures-cfds-and-binary-options)). The Maltese and Lithuanian measures, as recorded in ESMA's opinions, apply to sales in or from the country ([Malta](https://www.esma.europa.eu/sites/default/files/library/esma-35-43-1994-_esma_opinion_under_article_432_mifir_mt_cfd.pdf), [Lithuania](https://www.esma.europa.eu/sites/default/files/library/esma-35-43-1916-esma_opinion_under_article_432_mifir_lt_cfd.pdf)), and in Bulgaria Decision 918-ИП of the Financial Supervision Commission (FSC) imposes the same restrictions. Cyprus goes further: [Directive DI87-09 of the Cyprus Securities and Exchange Commission (CySEC)](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=54ca8a87-83d4-4c92-b6d1-5cd3cdc03310), as amended by KDP 270/2025, applies the limits to a Cyprus Investment Firm's (CIF) retail clients in third countries as well, and [Circular C534](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=7ebdd295-3073-4a20-9b17-c0e0e69cf273) adds a procedure for entering a third country. Retail leverage above the European limits is therefore unavailable in Cyprus even for clients in third countries, and in Malta and Lithuania for any sale made from the country. The Cypriot regime is detailed in [“Cyprus Investment Firm (CIF): the CySEC Licence”](https://wiki.private.law/en/cysec-cif-license), and the offshore alternative and its limits in [“Offshore Broker Licences: Seychelles, BVI and Cayman”](https://wiki.private.law/en/offshore-broker-licenses).

**Management located outside the licensing country.** EU law sets this test, so it too removes all four: a legal-person investment firm keeps its head office in the member state of its registered office (MiFID II Art. 5(4)(a)), and at least two persons effectively direct the business (Art. 9(6)). ESMA's [opinion of 13 July 2017](https://www.esma.europa.eu/sites/default/files/library/esma35-43-762_opinion_to_support_supervisory_convergence_in_the_area_of_investment_firms_in_the_context_of_the_united_kingdom_withdrawing_from_the_european_union.pdf) adds that senior managers and key compliance and risk staff should be located in the home state with real decision-making powers, failing which authorisation may be refused or withdrawn. The national statutes repeat the rule — [Law 87(I)/2017](https://www.cylaw.org/nomoi/enop/non-ind/2017_1_87/full.html) in Cyprus, [Cap. 370](https://legislation.mt/eli/cap/370/eng) in Malta, the [Markets in Financial Instruments Act (ZPFI)](https://www.fsc.bg/wp-content/uploads/2026/08/zpfi_dv_71_2026.pdf) in Bulgaria and the [Law on Markets in Financial Instruments](https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/TAIS.291835/asr) in Lithuania — and add their own. Malta applies the "dual control" principle ([Part BI R1-1.4.3 of the rules of the Malta Financial Services Authority (MFSA)](https://www.mfsa.mt/wp-content/uploads/2025/09/Part-BI-Rule-Appliable-to-Investment-Services-Licence-Holders-which-Qualify-as-MIFID-Firms.pdf)) with an MFSA-approved compliance officer outside operations and an MFSA-approved money laundering reporting officer (MLRO) who should be a senior employee or executive director. Lithuania requires a collegial board (valdyba) alongside the chief executive and refuses a licence where the firm's permanent management body is located abroad. How the same test applies when functions are handed to service providers is covered in [“Outsourcing at a Licensed Firm: EBA Rules, Third Countries and the Letterbox Test”](https://wiki.private.law/en/outsourcing-licensed-firms).

**Counterparties that read the FATF list.** Bulgaria has been on the [FATF list of jurisdictions under increased monitoring](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2026.html) since October 2023. In June 2026 the FATF made the initial determination that the action plan is substantially complete, which triggers an on-site assessment; no delisting had been decided as of September 2026. For an investment firm this is above all a question for the banks that hold its capital and its clients' money, whose onboarding policies may take the list into account. What the listing means is set out in [“The FATF: Standards, Mutual Evaluations and the Black and Grey Lists”](https://wiki.private.law/en/fatf).

**An adviser that needs no passport.** A Lithuanian financial advisor company may provide investment advice and reception and transmission of orders in Lithuania, in transferable securities and fund units, together with ancillary services, provided it holds no client money or instruments and transmits orders only to licensed firms (Art. 4(7) of the Law). The IFR prudential regime does not apply to it; instead it needs professional liability insurance of at least €29,000 per claim and €145,000 a year. It has no passport, so clients elsewhere in the EEA need an investment firm licence; how the passport works is set out in [“EU Passporting: How a Financial Licence Works Across the EEA”](https://wiki.private.law/en/eu-passporting).

## The four regimes side by side

Entry conditions agree on capital and diverge on fees, on milestones inside the six-month clock and on management requirements.

| Entry | Cyprus | Malta | Bulgaria | Lithuania |
| --- | --- | --- | --- | --- |
| Regulator and statute | CySEC; Law 87(I)/2017 | MFSA; Investment Services Act (Cap. 370) and MFSA Rules | Financial Supervision Commission (FSC); ZPFI | Bank of Lithuania; Law on Markets in Financial Instruments |
| Who may hold the licence | Company established in Cyprus with its head office there | Body corporate with head office and registered office in Malta | AD or OOD with seat and head office in Bulgaria | Financial brokerage firm with its seat in Lithuania |
| How licences are classed | By services and capital tier | Fee classes (a)–(d) under S.L. 370.52; the old "categories" are repealed | By ZPFI Art. 10(1)–(3) and (7) | By Art. 14 of the Law; separate financial advisor company |
| Initial capital | €75,000 / €150,000 / €750,000 | €75,000 / €150,000 / €750,000 | €75,000 / €150,000 / €750,000 | €75,000 / €150,000 / €750,000 |
| Statutory decision period | 6 months from a complete application | 6 months from a properly completed application; "in principle" approval valid 3 months | 3 months after completeness is confirmed, or 1 month after a reply; 6 months at most | 6 months from all documents |
| Application or licence fee, 2026 | €7,000 for services 1–7; €25,000 for an MTF or OTF | €4,250–15,000 by class; €5,000–19,000 from 2027 | €4,090.34–10,225.84 on grant of the licence | State levy of €947 |
| Management | Two persons effectively directing | Dual control; MFSA-approved compliance officer and MLRO | Two persons, joint management and representation | Chief executive and collegial board |

Operating conditions diverge further: supervision fees, compensation, the reach of CFD measures and market depth.

| Operating | Cyprus | Malta | Bulgaria | Lithuania |
| --- | --- | --- | --- | --- |
| Annual regulator's fee, 2026 | €6,500–10,000 fixed plus a turnover increment; €150,000 cap; separate DORA fee of €2,000–20,000 | From €4,000–17,300 for class (a) to €17,500–30,800 for class (d), scaled on net revenue | Sum per service (from €102.26 for reception and transmission) plus 0.03% of revenue | No verified figure |
| Investor compensation | ICF: the lower of 90% of claims and €20,000 | ICS: the lesser of 90% of claims and €20,000; since L.N. 224/2026 Classes 1, 1 minus, 2 and 3 participate | Investor Compensation Fund: 90% of the claim, up to €20,000 | Investor-liability insurance: up to €22,000 with no 10% haircut |
| Retail CFDs | DI87-09: ESMA limits, third-country clients included; Circular C534 | Measures identical to ESMA's; transaction data held at the Maltese head office | Decision 918-ИП on the ESMA model; binary options banned (841-ИП) | Measures identical to ESMA's |
| Register depth | 247 CIFs on the CySEC list, 19 of them renouncing | 81 head-office entries in the ESMA register, banks included | 34 non-bank intermediaries and 19 banks (end-2025) | 17 brokerage firms in the investor-insurance scheme |

### Capital and own funds

Initial capital does not separate the four. The national texts repeat the IFD figures without a top-up: Cyprus in s. 16 of Law 87(I)/2017 as amended by [Law 165(I)/2021](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=7f44e19e-f8a1-4550-a7f9-7f1435297a3d), Malta in [R9-9.3.1 of Part A of the MFSA Rules](https://www.mfsa.mt/wp-content/uploads/2024/11/MFSA-Investment-Services-Rule-for-Investment-Service-Providers-Part-A-The-Application-Process.pdf), Bulgaria in ZPFI Art. 10 and Lithuania in Art. 14 of its Law. Malta carries one qualification: its thresholds turn on the right to "hold or control" client money, and control includes a mandate over the client's bank account or a power of attorney over the client's assets (R4-4.3.2 of Part A). A portfolio manager holding such a power of attorney falls into the €150,000 row. Beyond initial capital, [IFR Art. 11](https://eur-lex.europa.eu/eli/reg/2019/2033/oj) everywhere requires own funds of at least the highest of three amounts: a quarter of the previous year's fixed overheads, the permanent minimum capital and the K-factor requirement. A firm holding client money cannot be a small and non-interconnected Class 3 firm and is at least Class 2. The calculation is set out in [“Regulatory Capital: How Regulators Calculate It”](https://wiki.private.law/en/regulatory-capital).

### The clock and cash at filing

All four statutes say six months, but they place different milestones inside it. Bulgaria's FSC decides within three months of confirming completeness, or within one month of the reply to its request, but at least 25% of the initial capital is paid in when the application is filed and the rest after the FSC's notice that it intends to grant the licence. Malta runs the procedure in three phases (Part A of the MFSA Rules): a recommended preliminary meeting with a written description of the proposed business; review of the draft application, after which, once the draft licence conditions are agreed, the MFSA issues an "in principle" approval valid for three months to close outstanding matters; and post-licensing conditions that may be set before the firm starts. The MFSA does not process an incomplete application or one that fails to identify every key-position holder; the six months under [Cap. 370 Art. 6(6)](https://legislation.mt/eli/cap/370/eng) run from a properly completed application with the requisite documents. Lithuania counts six months from the submission of all required documents and information (Art. 6(4) of the Law) and requires the applicant to insure its liabilities to investors before licensing: not belonging to the insurance scheme is a mandatory ground for refusal. Cyprus applies the general six-month period of s. 7(3) of Law 87(I)/2017.

> ⚠️ Six months is the statutory maximum for a file the regulator accepts as complete; in none of the four does it serve as an estimate of how long a real application takes. The [FSC's annual report for 2025](https://www.fsc.bg/wp-content/uploads/2026/05/godishen-otchet-na-kfn-2025-.pdf) reports licensing flows without actual processing times. The [MFSA's annual report for 2025](https://www.mfsa.mt/wp-content/uploads/2026/06/MFSA-Annual-Report-2025.pdf) records 1,094 authorisation applications processed across all sectors, 1,023 approved and 71 withdrawn, and likewise gives no processing-time statistic. The clock starts only from a complete file, so an incomplete application lengthens the process without any statutory deadline being missed.

### Regulators' fees

Fees are the first axis where the gap is a multiple. On application CySEC charges €7,000 for any of services 1–7, dealing on own account and underwriting included ([Directive DI87-03 as amended by KDP 298/2025](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=6a48c562-5e91-4717-a8ce-1c111c1d9591)). The MFSA charges €4,250 to €15,000 by class, and where several application fees are due all but the highest are reduced by 25% ([S.L. 370.52](https://legislation.mt/eli/sl/370.52/eng)). The FSC charges its fee on grant of the licence — €4,090.34, €6,135.50 or €10,225.84 by capital tier ([FSC fees](https://www.fsc.bg/investitsionna-deynost/taksi-investiczionna-dejnost/)). The Bank of Lithuania charges a state levy of €947.

CySEC's annual fee is a fixed €6,500, €8,000 or €10,000 by capital tier plus a turnover increment above €500,000 and €3,000 for CFD services, all capped at €150,000. An MTF operator pays €7,000 a year plus 11% of the venue's revenue every six months outside the cap and an OTF operator only the 11%, and since 15 August 2025 CySEC has also charged a separate [supervision fee under the Digital Operational Resilience Act (DORA)](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=0c5c5c74-1398-419b-8e52-01e00f1a449a) of €2,000–20,000 a year. In Malta the scale follows net revenue: for class (a) a minimum of €4,000 plus €700 for every further €50,000 up to €17,300, for class (c) €7,600–20,900 and for class (d) €17,500 to €30,800. The scale is legislated to rise every year to 2029, when class (d) reaches €22,500–40,200. In Bulgaria a fixed component is summed across the licensed services — €102.26 for reception and transmission, €255.65 for execution, €818.07 for dealing on own account, €409.03 for portfolio management, €204.52 each for advice and safekeeping, €3,067.75 each for an MTF and an OTF — plus 0.03% of total annual revenue up to the cap set under Art. 72(3) of Ordinance No 76 ([FSC tariff in force from 1 January 2026](https://www.fsc.bg/wp-content/uploads/2026/02/tarifa_kfn_2025-evro_v-sila-ot-1.1.2026.xls)).

### Investor compensation

The Cyprus [Investor Compensation Fund (ICF)](https://www.cysec.gov.cy/en-GB/investor-protection/tae/information/), Malta's [Investor Compensation Scheme (ICS)](https://legislation.mt/eli/sl/370.9/eng) and Bulgaria's Investor Compensation Fund ([Art. 77g of the Public Offering of Securities Act](https://www.fsc.bg/wp-content/uploads/2026/09/zppck_dv_88_2026.pdf)) pay 90% of the claim, up to €20,000. Lithuania's investor-liability insurance pays the value of the instruments and money the firm cannot return [up to €22,000 per investor](https://www.iidraudimas.lt/lt/investiciju-draudimas/draudimo-objektas-0/), with no 10% haircut. For an applicant the more important change is Maltese: [L.N. 224 of 2026](https://legislation.mt/eli/ln/2026/224/eng), published on 18 August 2026, replaced the list of scheme participants. Previously only "Category 2 or Category 3" licence holders took part, meaning firms authorised to hold or control client money; now holders of IFR Class 1, Class 1 minus, Class 2 and Class 3 licences participate. A firm with retail clients that never holds client money must join and, from its second year after licensing, pay at least the €5,000 Class 3 fixed contribution. Firms serving only non-retail investors remain exempt but may opt in. The contrary footnote in the 2024 version of Part A of the MFSA Rules is superseded. Schemes across regimes are mapped in [“Client Asset Protection Map: Deposits, Safeguarding and Investor Compensation”](https://wiki.private.law/en/client-asset-protection-map).

### Market depth and supervisory record

The [CySEC list](https://www.cysec.gov.cy/en-GB/entities/investment-firms/cypriot/), accessed on 28 September 2026 (page header "as of 04 May 2026"), has 247 Cyprus investment firms, 19 of them under examination for voluntary renunciation of the licence — by far the deepest register of the four. Bulgaria had 53 licensed investment intermediaries at the end of 2025, 19 banks and 34 non-bank firms; the FSC revoked no licence in 2025. The Lithuanian [investor-insurance participant list](https://www.iidraudimas.lt/lt/investiciju-draudimas/dalyviu-sarasas/) names 17 financial brokerage firms, among them Revolut Securities Europe UAB, Robinhood Europe UAB and UAB DriveWealth Europe. For Malta the comparable figure comes from the [ESMA register](https://registers.esma.europa.eu/publication/searchRegister?core=esma_registers_upreg), which on 29 September 2026 listed active head-office "investment firm" entries for Cyprus (265), Malta (81), Bulgaria (49) and Lithuania (24); the Maltese, Bulgarian and Lithuanian counts include banks registered for investment services and indicate an order of magnitude.

Since 2017 [CySEC](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3042853e-6965-40db-a7cc-8858664f9132) has limited leverage for non-professional clients, banned bonuses and revoked nine CFD licences. In the investment services sector, which in its reporting includes fund managers, the MFSA in 2025 cancelled 6 licences, issued 5 directives, concluded 10 settlements and imposed 22 administrative penalties totalling €225,143.

### People and tax

An hour of labour in financial and insurance activities cost, [according to Eurostat](https://ec.europa.eu/eurostat/databrowser/view/lc_lci_lev/default/table), €42.6 in Cyprus, €28.7 in Lithuania, €27.4 in Malta and €16.1 in Bulgaria in 2025, against an EU-27 average of €58.6. The headline corporate income tax rate is 15% in Cyprus from 1 January 2026, up from 12.5% ([Law 244(I)/2025](https://www.cylaw.org/nomoi/arith/2025_1_244.pdf)), 35% in Malta ([Cap. 123 Art. 56(6)](https://legislation.mt/eli/cap/123/eng)), 10% in Bulgaria ([Corporate Income Tax Act Art. 20](https://nra.bg/wps/wcm/connect/nra.bg25863/ed10ff12-b25a-4b07-827c-915979acef42/%D0%97%D0%9A%D0%9F%D0%9E.pdf?MOD=AJPERES)) and 17% in Lithuania from 2026 ([State Tax Inspectorate](https://www.vmi.lt/evmi/documents/20142/391071/Mokes%C4%8Di%C5%B3+%C4%AFstatymo+pakeitimai+nuo+2026-01-01.pdf/)); small Lithuanian entities with income up to €300,000 may qualify for 0% or 7% under conditions. Shareholder refunds and, since [L.N. 188 of 2025](https://legislation.mt/eli/ln/2025/188/eng), an optional 15% final-tax election change Malta's effective burden; the mechanics are set out in [“Malta Holding: 6/7 Refund System and Effective 5% Rate”](https://wiki.private.law/en/company-malta), the Cyprus reform in [“Cyprus Tax Reform from 2026: Company, Individual, Crypto-Assets”](https://wiki.private.law/en/cyprus-tax-reform-2026) and the Bulgarian company in [“Company in Bulgaria (EOOD/OOD): 10% Tax, 5% Dividends and Substance”](https://wiki.private.law/en/company-bulgaria). Currency no longer separates Bulgaria and Lithuania: Bulgaria [adopted the euro on 1 January 2026](https://www.ecb.europa.eu/press/pr/date/2026/html/ecb.pr260101~c830245e42.en.html) at 1.95583 leva to the euro, and Lithuania has used the euro since 1 January 2015.

## Malta's licence categories today

The labels "Category 1a", "Category 2" and "Category 3" come from earlier Maltese law: they were defined in regulation 6(1) of the fee regulations, [S.L. 370.03](https://legislation.mt/eli/sl/370.3/20100722/eng). Regulation 6(1) was deleted by [Legal Notice 20 of 2022](https://legislation.mt/eli/ln/2022/20/eng), and S.L. 370.03 itself was repealed by L.N. 370 of 2024. The current fee law, S.L. 370.52 (L.N. 370 of 2024 as amended by L.N. 61 of 2025), keeps the same four MiFID classes without the labels, while capital and compensation-scheme participation turn on the description of services, on the right to hold or control client money and on the IFR class.

| Former category | Fee class today and 2026 application fee | Initial capital | IFR class | ICS fixed contribution |
| --- | --- | --- | --- | --- |
| 1a: reception and transmission, advice, placing, no client money | (a); €4,250 | €75,000 | 3 if every IFR Art. 12(1) condition is met; otherwise 2 | €5,000 for Class 3 or €7,000 for Class 2, from the second year |
| 1b: the same for professional clients and eligible counterparties only | (b); €5,000 | €75,000 | 3 or 2 | Participation optional; a firm that opts in pays only the fixed contribution |
| 2: any service with client money except dealing on own account, underwriting and an MTF | (c); €7,250 | €150,000 | At least 2 | €7,000 |
| 3: services including dealing on own account or underwriting, with client money | (d); €15,000 | €750,000 | 2; Class 1 at consolidated assets of €15bn or more, Class 1 minus at the regulator's discretion from €5bn | €22,000 for Class 2; €40,000 for Class 1 and Class 1 minus |

Fee class (a) names only reception and transmission, advice and placing without a firm commitment, while the €75,000 capital row also covers execution and portfolio management; a firm that executes orders or manages portfolios without client money should settle its fee class at the preliminary meeting with the MFSA. Operating an MTF or OTF and acting as trustee or custodian fall outside classes (a)–(d).

Beyond the fixed contribution, a participant in the Maltese scheme after L.N. 224 of 2026 pays a variable contribution of 0.1% of the annual increase in investment-services revenue into a pledged scheme reserve that must be worth at least 0.1% of that revenue and never less than €698.81. It also holds an Emergency Drawdown Reserve of 1% of the same revenue in cash or cash equivalents, which is not reduced when revenue falls. In exceptional circumstances the scheme may call an Extraordinary Contribution of 0.15% of revenue. The fixed contribution is payable by 31 July each year.

## Choosing by business model

The licence is the same instrument in all four countries, so the business model decides which national axis matters.

| Model | What decides it | Which way it points |
| --- | --- | --- |
| Retail CFD and FX broker | Reach of the CFD measures, CFD-specific substance, market depth | Cyprus for the deepest market, with third-country reach written in; Malta with transaction data and an experienced compliance officer on site; leverage limits are the same everywhere |
| Execution-only brokerage app | Investor cover, management requirements, market precedent | Lithuania — €22,000 with no haircut, retail apps among the insurance-scheme participants |
| Portfolio manager or adviser without client money | Annual fees, compensation scheme, need for a passport | Bulgaria on fees; in Malta a retail firm now pays into the ICS; Lithuania for a domestic adviser without a passport |
| Dealing on own account, market making | €750,000 capital everywhere; fees and contributions | Bulgaria and Cyprus on fees while DI87-03 applies; Malta costs more through class (d) and the €22,000 contribution |
| MTF or OTF operator | The regulator's fee model | Bulgaria — fixed fees; Cyprus — 11% of venue revenue |
| Investment firm adding a crypto leg | MiCA notification and the sanctions filter on owners | Equal under EU law; Lithuania and Bulgaria write the route into their statutes |

**A retail CFD and FX broker** works under the same leverage limits in any of the four; ESMA's statement of 24 February 2026 adds that [leveraged "perpetual futures"](https://www.esma.europa.eu/sites/default/files/2026-02/ESMA35-243228190-8024_-_Public_statement_on_derivatives_in_scope_of_the_CFD_product_intervention_measures.pdf), including on crypto-assets, are likely within scope whatever they are called. Malta adds data and staffing requirements: a licence holder offering CFDs or rolling spot forex must keep real-time access to all data on transactions carried out in Malta, fully preserved at its head office (Part BI R1-1.6.15), appoint a compliance officer with a proven track record in regulated firms in that industry and notify the MFSA of changes of liquidity providers.

**Dealing on own account and market making** require €750,000 everywhere, and the difference in regulatory cost shows on a retail CFD broker offering reception and transmission, execution, dealing on own account and safekeeping of client assets. In Bulgaria its annual fixed component comes to €102.26 + €255.65 + €818.07 + €204.52 = €1,380.50 plus 0.03% of revenue. In Cyprus it is €10,000 fixed plus €3,000 for CFDs and the turnover increment, within the €150,000 cap. In Malta class (d) costs €17,500–30,800 a year in 2026, and from the second year the firm adds the €22,000 ICS contribution of a Class 2 firm dealing on own account, plus the scheme reserves.

**A portfolio manager or adviser without client money** chooses on running costs: in Bulgaria €409.03 a year for portfolio management or €204.52 for advice plus 0.03% of revenue, in Cyprus from €6,500, in Malta from €4,000 and, with retail clients, at least €5,000 a year to the ICS from the second year.

**An MTF or OTF operator** chooses between the FSC's fixed fees and CySEC's 11% of venue revenue. Capital is €150,000 for an MTF operator that does not deal on own account and €750,000 for an OTF operator that deals or may deal on own account.

## Cost and time

Published figures cover only the regulator's price list and the statutory clock. The local team, counsel, audit, IT and the bank are priced by the market.

| Item | Cyprus | Malta | Bulgaria | Lithuania |
| --- | --- | --- | --- | --- |
| Initial capital | €75,000 / €150,000 / €750,000 | €75,000 / €150,000 / €750,000 | €75,000 / €150,000 / €750,000; at least 25% at filing | €75,000 / €150,000 / €750,000 |
| Application or licence fee, 2026 | €7,000; €25,000 for an MTF or OTF | €4,250 / €5,000 / €7,250 / €15,000 for classes (a)–(d) | €4,090.34 / €6,135.50 / €10,225.84 | €947 |
| Annual regulator's fee, 2026 | From €6,500 up to the €150,000 cap; DORA fee €2,000–20,000 | From €4,000 (class a) to €30,800 (class d) | Sum per service plus 0.03% of revenue | No verified figure |
| Investor cover | 90%, up to €20,000 | 90%, up to €20,000 | 90%, up to €20,000 | Up to €22,000 |
| Statutory decision period | 6 months | 6 months; "in principle" approval for 3 months | 3 months, or 1 month after a reply; 6 at most | 6 months |
| Labour cost per hour, finance (2025) | €42.6 | €27.4 | €16.1 | €28.7 |
| Corporate income tax | 15% | 35% headline | 10% | 17% |

Fees are already under revision in two of the four. In Cyprus, on 12 January 2026 CySEC opened consultation [CP(2026-01)](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=dc9d1739-a19a-44a3-84cb-91c46b293cc4) on replacing the DI87-03 fee grid. The draft proposes an application fee of €2,000 plus €8,000 for each of services 1, 2, 4, 5, 6 or 7, €15,000 for dealing on own account and €30,000 for an MTF or OTF, and an annual fee of €8,000 for each such service, €30,000 for dealing on own account, €20,000 for safekeeping or client funds and 2%, 1%, 0.5% and 0.3% on turnover bands above €500,000; the €3,000 CFD add-on would go and the cap would rise from €150,000 to €600,000. For a retail CFD broker dealing on own account and holding client money, the fixed element would move from €10,000 + €3,000 to €8,000 × 2 + €30,000 + €20,000 = €66,000 before turnover increments. As of 29 September 2026 no amending directive had been issued, and DI87-03 as amended by KDP 298/2025 still applies. In Malta the increase is already legislated in S.L. 370.52: from 2027 the application fee is €5,000, €6,000, €8,000 and €19,000 for classes (a)–(d), and the annual fee runs from €4,700 to €18,000 for (a), €5,500 to €18,800 for (b), €8,800 to €22,100 for (c) and €20,000 to €33,300 for (d); no amending legal notice had been published by 29 September 2026.

## The EU sanctions perimeter

An investment firm in any of the four can add crypto-asset services equivalent to its authorisation by notifying its regulator at least 40 working days in advance ([MiCA Art. 60(3)](https://eur-lex.europa.eu/eli/reg/2023/1114/oj)); Lithuania's Law (Art. 4(2¹)) and Bulgaria's ZPFI provide for the route expressly, and the full crypto-asset service provider regime is set out in [“The MiCA CASP Licence: Procedure, Cost and Choosing a Jurisdiction”](https://wiki.private.law/en/casp-license-guide). EU sanctions against Russia never decide between the four, because they sit in a regulation that applies identically in each. [Regulation 833/2014](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0833-20260724) does not bar Russian nationals or residents from owning an EU investment firm that provides only MiFID services. Art. 5b(2a) bars them from owning, controlling or sitting on the governing bodies of a firm that provides crypto-asset services — wallet, account or custody services since 18 January 2024 and any MiCA service since 25 August 2026. EU, EEA and Swiss nationals and residence-permit holders there are exempt. Owner and manager vetting is covered in [“Qualifying Holdings and Fit & Proper: How Regulators Vet Owners and Managers”](https://wiki.private.law/en/qualifying-holding-fit-proper), and the wider perimeter in [“Sanctions: a Route Map for the Individual, the Bank and the Structure”](https://wiki.private.law/en/sanctions-map).

## Where the choice goes wrong

> ⚠️ **A licence without people in the country.** In all four the licence requires a head office and at least two persons effectively directing the business on site; Malta adds an MFSA-approved compliance officer and MLRO, Lithuania a collegial board. In June 2026 CySEC [suspended the licence of Mind Money Limited in full](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=c7944de0-c392-45b8-a7a8-5a49da79c58e), citing among other grounds the absence of two persons effectively directing the business.

**Forgetting Bulgaria's 25% at filing.** For a firm dealing on own account that is at least €187,500 in the account before the regulator decides.

**Treating CySEC's fees as fixed.** Consultation CP(2026-01) has not yet been adopted; as proposed it would multiply the fixed annual fee of a broker dealing on own account and holding client money several times over, and the cap fourfold.

**Choosing the country before the bank.** Capital, client money and settlement all run through banks, and their onboarding policies may take Bulgaria's presence on the FATF list into account.

> 🍓 Capital, the statutory decision period and the passport are identical in Cyprus, Malta, Bulgaria and Lithuania because the IFD and MiFID II set them. The choice turns on national values: application and supervision fees and their scheduled increases (the CySEC draft and Malta's scale to 2029), Bulgaria's internal clock together with 25% of capital at filing, Malta's "in principle" approval, Lithuania's €22,000 compensation cap and Malta's inclusion of every retail firm in its scheme, the reach of the Cypriot CFD rules and Malta's data requirements, Lithuania's collegial board, register depth, the hourly cost of labour, the corporate tax rate and Bulgaria's presence on the FATF list.

## Q/A

### The comparison itself

### **Which of the four is the cheapest?**

It depends on the line item, since capital is the same. The lowest entry charge is Lithuania's €947 state levy; the FSC charges €4,090.34–10,225.84, CySEC €7,000 and the MFSA €4,250–15,000 in 2026. The FSC's fixed annual fee is a few hundred euros per service, against minimums of €6,500 at CySEC and €4,000 at the MFSA; on the hourly cost of labour (€16.1 in 2025) and corporate tax (10%) Bulgaria is cheaper than all three. There is no verified figure for the Bank of Lithuania's annual fee.

### **Where is a licence granted fastest?**

Bulgaria's clock is the shortest on paper: three months after completeness is confirmed, or one month after the reply to an FSC request, within the same six-month maximum as the other three. Neither the FSC nor the MFSA publishes actual processing times.

### **What does a Maltese "Category 3" licence mean today?**

Legally, nothing: regulation 6(1) of S.L. 370.03, which defined the categories, was deleted by L.N. 20 of 2022, and the regulations themselves were repealed by L.N. 370 of 2024. The old Category 3 corresponds to fee class (d) under S.L. 370.52 — services including dealing on own account or underwriting, with client money — with €750,000 of capital and an application fee of €15,000 in 2026 and €19,000 from 2027.

### Capital, fees and timing

### **Does any of the four require more capital than the IFD?**

No, all four repeat the IFD Art. 9 figures of €75,000, €150,000 and €750,000. In Malta a power of attorney over a client's account counts as control of client money and moves a manager into the €150,000 row.

### **How much must be paid in when applying in Bulgaria?**

At least 25% of the initial capital is paid in when the application is filed. The balance and proof of the Investor Compensation Fund entry contribution follow within 14 days of the FSC's notice that it intends to grant the licence, and the licence issues within 14 days of that.

### **Will CySEC's fees change?**

Possibly. Consultation CP(2026-01) of 12 January 2026 proposes per-service fees, removes the €3,000 CFD add-on and raises the cap from €150,000 to €600,000. As of 29 September 2026 the proposal had not been adopted, and the DI87-03 fees as amended by KDP 298/2025 still apply.

### Clients, CFDs and protection

### **Do the retail CFD rules differ between the four?**

Leverage limits follow the ESMA model everywhere, from 30:1 to 2:1. Cyprus extends the limits expressly to retail clients in third countries and requires the C534 procedure; Malta requires transaction data to be held at the head office and a compliance officer with CFD experience; Bulgaria also bans binary options for retail clients.

### **What compensation does a client receive if the firm fails?**

In Cyprus, Malta and Bulgaria, 90% of the claim up to €20,000. In Lithuania investor-liability insurance pays the value of the instruments and money that cannot be returned, up to €22,000, with no 10% haircut.

### **Must a Maltese firm that holds no client money join the compensation scheme?**

If it has retail clients, yes: L.N. 224 of 2026 brought holders of every IFR class into the scheme, and such a firm pays at least €5,000 a year from its second year. A firm serving only non-retail investors may opt in and then pays only the fixed contribution.

### **Can crypto-asset services be added to an investment firm licence?**

Yes, by notifying the regulator at least 40 working days in advance under MiCA Art. 60(3). From then on Art. 5b(2a) of Regulation 833/2014 applies: Russian nationals and residents, other than EU, EEA or Swiss nationals and residence-permit holders there, may not own or control the firm or sit on its governing bodies.

### **Can one advise in Lithuania without an investment firm licence?**

Within narrow limits: a financial advisor company provides advice and reception and transmission of orders there without holding client money or instruments, with liability insurance in place of IFR capital and no passport to other EEA states.

---

## Factual claims

- The differences sit wherever EU law leaves the decision to the member state, and on those axes each country has a distinct profile.
- The CySEC list, accessed on 28 September 2026 (page header "as of 04 May 2026"), has 247 Cyprus investment firms, 19 of them under examination for voluntary renunciation of the licence — by far the deepest register of the four.
- Since 2017 CySEC has limited leverage for non-professional clients, banned bonuses and revoked nine CFD licences.
- A retail CFD and FX broker works under the same leverage limits in any of the four; ESMA's statement of 24 February 2026 adds that leveraged "perpetual futures", including on crypto-assets, are likely within scope whatever they are called.
- An MTF or OTF operator chooses between the FSC's fixed fees and CySEC's 11% of venue revenue.
- Forgetting Bulgaria's 25% at filing.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot