Cyprus Company for Forex and CFD Firms: The CIF Licence

Cyprus remains the default home for online forex and contract for difference (CFD) brokers serving European clients. This guide is written for founders and brokerage operators who already understand the business and now need the regulatory path. It maps the three capital classes to real brokerage models, sets out the substance CySEC now expects, and walks through the application, cost and timeline as they stand in 2026. For the wider regulatory picture, see the full legal framework governing Cyprus Investment Firms.

What is a Cyprus forex CIF licence?

A Cyprus forex CIF licence is the authorisation a company needs to legally provide forex and CFD trading services to clients as a regulated investment firm. It is issued and supervised by CySEC and gives the firm the right to operate throughout the European Union.

CIF, MiFID II and CySEC in plain terms

A Cyprus Investment Firm (CIF) is a company authorised to provide one or more investment services listed in the Markets in Financial Instruments Directive (MiFID II). In Cyprus, MiFID II is transposed by the Investment Services and Activities and Regulated Markets Law 87(I)/2017, under which CySEC authorises and supervises every CIF. Forex and CFDs are financial instruments under this framework, so any firm that receives, transmits, executes or deals in them for clients needs a CIF authorisation rather than a plain company registration.

Capital, governance and conduct rules for CIFs are set at EU level by the Investment Firms Regulation (IFR, EU 2019/2033) and the Investment Firms Directive (IFD, EU 2019/2034), which replaced the older bank-style capital regime with a framework tailored to investment firms.

Why forex and CFD brokers choose Cyprus

Brokers choose Cyprus for a combination of EU passporting, a mature CySEC supervisory ecosystem, a deep local pool of compliance and dealing talent, and competitive tax. A single CySEC licence lets a broker sell into every EU and EEA market without seeking 30 separate national authorisations. The island has hosted retail forex firms for well over a decade, so law firms, auditors, banks and technology vendors all understand the model, which shortens setup time compared with newer jurisdictions.

Do you actually need a CIF licence to run a forex broker?

Yes, if you deal with clients on financial instruments from or into Cyprus or the EU, you need a CIF licence or an equivalent EU authorisation. Operating a forex or CFD brokerage for the public without authorisation is a criminal offence and exposes principals to enforcement.

Which activities trigger authorisation

The regulated investment services that trigger CIF authorisation include reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management and investment advice. A forex or CFD broker almost always performs at least reception and transmission or execution, and market makers perform dealing on own account. Providing any of these on financial instruments to clients requires a licence. Ancillary services such as safekeeping, granting credit for trading, or foreign exchange linked to investment services are also covered.

Introducing broker and white-label alternatives

If you do not want to hold your own licence immediately, two lighter models exist. An introducing broker refers clients to an already-licensed CIF and is paid a commission, without holding client money or executing trades, though the referral activity itself may need a tied-agent registration. A white-label arrangement lets you operate under a licensed CIF's authorisation and technology while it retains regulatory responsibility. Both are legitimate entry routes, but neither gives you your own EU passport or brand independence, which is why serious operators ultimately apply for their own CIF.

How much initial capital does a CySEC forex licence require in 2026?

Minimum initial capital is EUR 75,000, EUR 150,000 or EUR 750,000, set by the class of licence under the IFR and MiFID II. The figure depends on which services you provide and whether you hold client money or take market risk.

Class 3, Class 2 and Class 1 thresholds

The three thresholds map directly to risk:

• EUR 75,000 (Class 3): firms that receive and transmit or execute orders, or give advice, but do not hold client money or client assets.
• EUR 150,000 (Class 2): firms that hold client funds or assets, including the typical straight-through processing (STP) or execution-only forex broker.
• EUR 750,000 (Class 1): firms that deal on own account or underwrite, meaning market makers that take the other side of client trades.

How the IFR and IFD changed capital rules

The IFR and IFD, applied since 2021, moved investment firms off the old bank-derived capital rules onto a bespoke prudential regime. Beyond the initial capital above, firms must hold ongoing own funds calculated as the highest of their permanent minimum capital requirement, one quarter of fixed overheads, or a set of activity-based K-factor requirements that measure risk to clients, to market and to the firm itself. In practice this means your regulatory capital scales with the size and risk of your book, not just the entry threshold.

Ongoing own funds after launch

After authorisation you must continuously meet your own funds requirement, not just the day-one initial capital. For a smaller broker the binding figure is often the one-quarter-of-fixed-overheads test, so a firm with high running costs must hold proportionately more capital. Because the exact K-factor and fixed-overheads calculation depends on your specific model, confirm the applicable ongoing requirement with your advisers before you finalise your capital plan.

Which CIF class fits your forex or CFD model?

The right class is the one that matches how you handle client orders and whether you take market risk. Choosing correctly at the outset avoids re-scoping the application later.

Advisory and reception of orders (Class 3)

Class 3, at EUR 75,000, suits firms that advise clients or route their orders to another executing broker without ever holding client money. This is the lightest model and rarely fits a full retail forex brand, but it can work for advisory boutiques or firms building toward a larger licence.

STP and execution-only broker (Class 2)

Class 2, at EUR 150,000, is the workhorse licence for retail forex and CFD brokers. An STP broker passes client orders straight through to external liquidity providers and does not take the opposite side of trades, so it earns from spread and commission rather than client losses. Because it holds client funds, it needs the EUR 150,000 threshold and must join the Investor Compensation Fund.

Market maker and own-account dealing (Class 1)

Class 1, at EUR 750,000, is required where the firm deals on its own account, quoting prices and taking the other side of client positions as a market maker. This model carries market risk on the firm's own book, which is why the capital requirement is far higher and CySEC scrutiny of risk management is more intense.

What are the substance and governance requirements?

CySEC requires genuine substance in Cyprus: a properly staffed board, dedicated control functions and a real office. Shell structures are not acceptable, and enforcement has tightened.

Board of four directors and the four-eyes principle

A CIF must have a board of at least four directors, typically two executive and two independent non-executive directors. This delivers the four-eyes principle, meaning no single person controls the firm, and gives the board independent challenge. The duties of directors in a Cypriot company apply on top of the CIF-specific fitness and probity assessment that CySEC conducts on every proposed director and shareholder.

Compliance, risk, internal audit and AMLCO

The firm must appoint key function holders: a compliance officer, a risk manager, an internal auditor and an Anti-Money-Laundering Compliance Officer (AMLCO), the last often dual-hatted with compliance in smaller firms. It also needs a head of dealing where relevant. These functions must be competent, approved by CySEC and genuinely independent of the revenue side of the business.

Physical office and local staff in Cyprus

CySEC expects the firm to be managed from Cyprus with a real office and local staff, not merely a registered address. Mind and management must sit on the island, which means the executive directors and key function holders are expected to be Cyprus-based. Building this out is part of establishing genuine economic substance in Cyprus. Because CySEC updates its expectations through circulars, confirm the exact current requirements (number of resident executive directors and minimum local headcount for your model) with your lawyer before committing.

How does the CySEC application process work step by step?

The process runs from company incorporation through a detailed application pack to CySEC review and requests for information. Preparation quality determines how quickly it moves.

Incorporating the Cyprus company

First you form the vehicle. Incorporating your Cyprus company creates the legal entity that will hold the licence, with the memorandum and articles drafted to permit investment services. In parallel you begin opening corporate and segregated client bank accounts, because a broker holding client money must keep those funds strictly separate from the firm's own accounts.

Preparing the business plan and manuals

The heart of the file is a comprehensive business plan plus a full suite of internal manuals: compliance, risk management, internal audit, anti-money-laundering, conflicts of interest, best execution, client onboarding and outsourcing policies. You must also submit financial projections, the organisational chart, questionnaires for directors and shareholders, and evidence of the initial capital. This documentation typically takes several months to assemble properly.

Filing, completeness review and the RFI rounds

The application is filed through CySEC's online portal with the relevant fee. CySEC first checks the file for completeness, then begins its substantive assessment, issuing requests for information (RFIs) that the applicant must answer within set deadlines. Applications commonly go through several RFI rounds. Strong, complete answers keep the file moving; weak or late responses stall it.

How long does CIF authorisation take?

Realistically, budget 9 to 14 months for a Class 2 retail forex CIF, covering incorporation, documentation, filing and RFI rounds. The statutory clock is shorter, but real timelines are longer.

Statutory six-month clock versus real timelines

Under MiFID II, CySEC has a six-month assessment period once it holds a complete application. That clock only starts when the file is complete, and it pauses each time CySEC asks for further information. Adding the preparation phase before filing and the RFI exchanges after, the end-to-end journey for a Class 2 broker usually lands in the 9 to 14 month range. Class 3 advisory firms can be quicker, while Class 1 market makers, with heavier risk documentation, tend to be slower.

What delays applications

The most common delays are an incomplete initial file, weak internal manuals, directors or shareholders who fail fitness and probity checks, unclear ownership structures, and slow responses to RFIs. Under-resourcing the compliance function or presenting an unrealistic business plan also draws additional scrutiny. Getting the documentation right the first time is the single biggest lever on speed.

What does a Cyprus forex licence cost?

Total first-year investment for a Class 2 broker typically runs well into six figures once capital, fees and setup are combined. The licence application fee itself is a small part of the picture.

CySEC fees, capital and professional fees

CySEC application fees are commonly cited in the EUR 5,000 to EUR 10,000 range depending on the class of licence. On top of that sit the class capital (from EUR 75,000), professional fees for legal drafting, manuals and the business plan, plus office fit-out, technology and initial staffing. Because CySEC updates its fee directive periodically, confirm the exact application and annual figures for your class before you rely on them.

Ongoing annual and supervisory costs

After launch the firm pays annual supervisory fees to CySEC, ongoing salaries for its compliance, risk and dealing teams, audit fees, Investor Compensation Fund contributions, technology and liquidity costs, and office rent. These recurring costs, not the one-off application, are what make a CIF a substantial operating business rather than a paper licence.

How does EU passporting work for a Cyprus broker?

A CySEC-authorised CIF can provide its investment services across the entire EU and EEA under the MiFID II passport, without a separate licence in each country. This single-market access is the main commercial reason to license in Cyprus.

Freedom of services versus branches

There are two passporting routes. Under freedom of services (cross-border), the firm serves clients in other member states remotely from Cyprus. Under the branch route, it establishes a physical presence in the host state. Freedom of services is lighter and faster; a branch makes sense where local presence matters commercially or is required by the host market.

The notification and 15-day rule

Passporting works through regulator-to-regulator notification, not a fresh application. The firm notifies CySEC of its intended host states, and CySEC transmits the notification to each host regulator. For freedom of services, the firm may begin providing services 15 calendar days after CySEC sends the notification, which makes EU-wide rollout genuinely quick once the licence is in hand.

What forex-specific rules apply (ESMA leverage caps and marketing)?

CFD brokers face product-intervention rules that ordinary investment firms do not, covering leverage, close-out, negative balance protection and marketing to retail clients. These are the rules most likely to shape your product and conduct.

Retail leverage limits and negative balance protection

Under the European Securities and Markets Authority (ESMA) product-intervention measures adopted in Cyprus, retail CFD leverage is capped by asset class. As an indicative example, major currency pairs are limited to 30:1 and crypto CFDs to 2:1, with tighter caps for more volatile instruments. Firms must apply a mandatory margin close-out and provide negative balance protection, so a retail client cannot lose more than the funds in the account. Higher leverage is only available to clients who qualify and opt in as elective professional clients. Because national measures can be amended, confirm the current caps and close-out percentage before you configure the platform.

Restrictions on bonuses and advertising

The same regime restricts how CFDs are marketed to retail clients. Monetary and non-monetary trading bonuses and similar incentives are prohibited, and firms must display standardised risk warnings showing the percentage of retail accounts that lose money. Marketing must be fair, clear and not misleading, and aggressive or misleading advertising is a frequent enforcement target. Compliance sign-off on marketing is not optional.

How are Cyprus investment firms taxed in 2026?

From 1 January 2026, Cyprus corporate income tax is 15%, applied to the CIF's profits like any other Cyprus company. The regime remains competitive within the EU and pairs with attractive treatment for individual shareholders.

15% corporate income tax and the reform

Following the House of Representatives' approval of the 2025 tax reform on 22 December 2025 and publication of the amending laws in the Official Gazette on 31 December 2025, the headline corporate income tax rate rose from 12.5% to 15% with effect from 1 January 2026. For individuals who are both Cyprus tax resident and domiciled, the general SDC rate on dividends from profits earned from 1 January 2026 fell from 17% to 5%, subject to the transitional profit-period rules. Separately, the ordinary corporate tax-loss carry-forward period increased from five to seven years. Defensive withholding rules for certain associated-company payments to low-tax jurisdictions are a different regime and must not be confused with the individual SDC rate. See more on the corporate tax benefits of a Cyprus company.

Non-dom shareholders and dividends

Individual shareholders who become Cyprus tax resident but non-domiciled can receive dividends from the CIF without Special Defence Contribution for the duration of their non-dom status, which materially improves the after-tax return for founders relocating to the island. The interaction of company-level and shareholder-level tax should be planned together with your advisers.

Comparison table: Class 1 vs Class 2 vs Class 3 CIF

Note that a firm holding client money must be a member of the Investor Compensation Fund, which protects eligible retail clients up to EUR 20,000 if the firm fails, and must always keep client funds in segregated accounts separate from its own money.

How Philippou Law Firm can help

Setting up a CySEC-regulated forex or CFD brokerage is a multi-strand project spanning company law, financial regulation, tax and substance, and small errors early can add months to the timeline. Philippou Law Firm advises founders through the whole path: choosing the right licence class for your model, incorporating and capitalising the vehicle, drafting the business plan and the full manual suite, assembling the board and control functions, and managing the CySEC application and RFI rounds through to authorisation. We also structure the surrounding pieces, from opening corporate and segregated client bank accounts to shareholder tax planning, and can advise if you wish to combine the CIF with becoming a MiCA-authorised crypto-asset service provider in Cyprus or an adjacent permission such as obtaining an Electronic Money Institution licence in Cyprus. Contact us to scope your CIF project and receive a realistic timeline and cost estimate for 2026.