Cyprus CIF & Forex License 2026 — CySEC MiFID II Authorization
The Cyprus Investment Firm (CIF) license — issued by the Cyprus Securities and Exchange Commission (CySEC) under EU Directive 2014/65/EU (MiFID II) — is the most commercially powerful investment and forex broker license in the European Economic Area. A CySEC CIF grants passporting rights to offer regulated investment services across all 30 EU/EEA member states without additional local licensing, making it the default choice for forex brokers, CFD platforms, proprietary trading firms, and asset managers seeking EU market access. Cyprus has licensed more CIFs than any other EU jurisdiction — several hundred retail brokers, proprietary trading firms, and asset managers operate under CIF authorization, with 47 new licenses approved by CySEC in 2025 alone. In 2026, three significant regulatory developments have increased the compliance burden for CIF applicants and holders: DORA digital resilience obligations (mandatory since January 2025), the MiCA Article 60 pathway for CIFs adding crypto-asset services, and a new EU sanctions compliance framework. Zitadelle AG is headquartered in Limassol, Cyprus, with direct working relationships with CySEC.
— Last updated: April 2026 · 8 min read
What is a Cyprus Investment Firm (CIF) License?
The Cyprus Investment Firm (CIF) license is an investment firm authorization issued by the Cyprus Securities and Exchange Commission (CySEC) under EU Directive 2014/65/EU (MiFID II). It permits firms to provide regulated investment services to retail and professional clients across Cyprus and — through MiFID II passporting — across all 30 European Economic Area (EEA) member states without requiring additional local authorizations.
CySEC is one of the most internationally respected financial regulators in the Forex, CFD, and securities industry. A CySEC CIF license is widely recognized by prime brokers, liquidity providers, payment processors, and institutional counterparties as a mark of serious regulatory standing — and is the license of choice for many of the world's leading online brokers and investment platforms.
Zitadelle AG is headquartered in Cyprus with direct working relationships with CySEC, making us uniquely positioned to guide clients through the CIF licensing process efficiently and accurately.
Permitted MiFID II Investment Services
- Reception and transmission of orders in relation to financial instruments
- Execution of orders on behalf of clients
- Dealing on own account (market maker / principal model)
- Portfolio management
- Investment advice
- Underwriting and/or placing of financial instruments on a firm commitment basis
- Placing of financial instruments without a firm commitment basis
- Operation of a Multilateral Trading Facility (MTF)
- Operation of an Organised Trading Facility (OTF)
Permitted Ancillary Services
- Safekeeping and administration of financial instruments
- Granting credits or loans to investors
- Foreign exchange services
- Investment research and financial analysis
- Services related to underwriting
Key Advantages of a CySEC CIF License
EU Regulatory Passporting
Under MiFID II, a CIF can offer services or establish branches in any of the 30 EU/EEA countries without additional licensing. One license unlocks the entire European market.
Internationally Recognised
CySEC is one of the most respected regulators globally in the forex and CFD space. A CySEC license is accepted by prime brokers, liquidity providers, banks, and institutional counterparties worldwide.
Cyprus Tax Efficiency
Corporate income tax of 12.5% (rising to 15% under Pillar Two OECD rules for large groups). One of the lowest corporate tax rates in the EU for qualifying firms.
Credible Banking Access
Cyprus offers access to established European banking institutions, with better banking prospects for regulated entities than most offshore jurisdictions.
Transparent Application Process
CySEC operates a well-defined, structured licensing process with clear requirements and predictable (if lengthy) timelines.
Strategic Location
Cyprus is physically at the crossroads of Europe, the Middle East, and Africa — an ideal operational base for firms serving international client books.
Zitadelle AG is based in Cyprus. Our European headquarters at Epipalou 11, IKONA HEIGHTS, Office 3D, Agios Tychonas, Limassol gives us direct, on-the-ground access to CySEC and the Cyprus regulatory ecosystem. This proximity materially improves communication quality and response times during your application.
For the latest CySEC enforcement data, new license approvals, and compliance obligations for existing CIF holders, see our 2026 guide: CySEC CIF License 2026 — Enforcement, New Requirements & Application Reality →
MiFID II Passporting — What It Means in Practice
A CySEC CIF license grants automatic passporting rights under MiFID II across all 30 EU and EEA member states. This means your Cyprus-licensed entity can:
- Provide investment services to clients in Germany, France, Spain, Italy, the Netherlands, Poland, and all other EU/EEA countries
- Establish branches in any EEA member state by notifying CySEC — no separate local authorization required
- Market financial products cross-border via digital channels to retail and professional clients throughout the EEA
- Access EU institutional counterparties, clearing houses, and regulated markets
This single-license access to 30 countries makes the CySEC CIF one of the highest-value investment licenses available globally — and explains why it is the dominant license among major online brokers operating in Europe.
Capital Requirements
| License Category | Minimum Paid-Up Capital | Source of Funds Proof Required |
|---|---|---|
| STP / Agency Model (no own account dealing) | €125,000 | €500,000 in legitimate funds |
| Market Maker / Dealing on Own Account | €730,000 | €1,000,000+ in legitimate funds |
Capital must be deposited in a Cyprus bank account before the license is granted. CySEC requires full documentation of the legitimate source of all shareholder funds — this is a rigorous examination process. Zitadelle AG assists clients in preparing comprehensive source of funds documentation.
Company Structure Requirements
| Component | Requirement |
|---|---|
| Shareholders | Minimum 1 (natural or legal person; no nationality or residency restrictions) |
| Executive Directors | Minimum 2 (must reside in Cyprus; subject to CySEC fit and proper assessment) |
| Non-Executive Directors | Minimum 2 |
| Total Directors | Minimum 4 (majority must reside in Cyprus) |
| Local Employees | Minimum 3 (recommended: accountant, compliance officer, back office) |
| Compliance Officer | Required — CySEC-approved, Cyprus-based |
| Anti-Money Laundering Officer (AMLCO) | Required |
| Risk Manager | Required |
| Internal Auditor | Required (may be outsourced) |
| Resident Secretary | Required |
| Registered Office | Required — Cyprus address |
| Professional Indemnity Insurance | Required |
Staffing Note: The requirement for at least 4 directors and 3 local employees, combined with mandatory compliance, AML, and risk management functions, means that a CySEC CIF requires meaningful substance in Cyprus — not just a registered address. Annual staffing and operational costs typically range from €150,000 to €400,000+. Zitadelle AG advises on cost-efficient staffing structures and can source qualified Cyprus-based personnel through our HRFinEase network.
Investor Compensation Fund (ICF): All CIFs serving retail clients must be members of the Cyprus Investor Compensation Fund. The ICF protects retail client claims up to €20,000 per client in the event of CIF default. Annual contribution is up to 0.5% of assets. ICF membership is a pre-condition for license activation for retail-facing CIFs.
Required Documentation
- 1Completed CySEC application form
- 2CVs, CySEC questionnaires, and personal declarations for all shareholders, directors, and key personnel
- 3Certificate of incorporation and company constitutional documents
- 4Proof of registered office in Cyprus
- 5Confirmation certificates for directors and company secretary
- 6Group and organizational structure charts
- 7Clean criminal records and Certificates of Good Standing for all key persons
- 8Company procedures manual (compliance, risk management, internal controls)
- 9Three-year business plan and detailed financial forecasts
- 10AML/KYC policy documentation
- 11Tax declarations or audited financial statements proving legitimate shareholder funds
- 12IT infrastructure documentation and cybersecurity policies
- 13Client agreement templates and disclosure documents (KID, Key Information Documents)
Application Timeline
| Stage | Duration |
|---|---|
| Cyprus company incorporation | ~3 weeks |
| CySEC license preparation — documentation, business plan, manuals | 3–6 months |
| CySEC application submission and initial review | 1–2 months |
| CySEC examination, queries, and supplementary information | 3–6 months |
| CySEC final assessment and license grant | 1–2 months |
| Bank account opening (parallel) | 3–5 weeks additional |
| Total typical timeline | 9–14 months (average 12 months) |
CySEC is thorough and will scrutinize every element of the application. A well-prepared, complete application submitted through an experienced advisor significantly reduces query rounds and overall timeline. Zitadelle AG has extensive experience managing CySEC licensing projects from our Cyprus headquarters.
DORA — Digital Operational Resilience Requirements (Mandatory Since January 2025)
The Digital Operational Resilience Act (DORA — Regulation EU/2022/2554) has applied to all CySEC-licensed CIFs since 17 January 2025. This is not optional guidance — it is directly applicable EU law. DORA obligations for CIFs include:
- ICT risk management framework: A documented, board-approved ICT risk management framework covering identification, protection, detection, response, and recovery must be in place
- ICT incident reporting: Major ICT-related incidents must be reported to CySEC under Circular C700 — initial report within 4 hours, intermediate report within 72 hours, final report within 1 month
- Digital resilience testing: Regular testing of ICT systems including vulnerability assessments and, for significant firms, threat-led penetration testing (TLPT)
- Third-party risk management: All critical ICT third-party providers (cloud, trading platform vendors, data providers) must be assessed, contractually bound, and monitored under DORA's third-party risk framework
- ICT register: A register of all contractual arrangements with ICT third-party service providers must be maintained and made available to CySEC on request
New CIF applications in 2026 must demonstrate DORA readiness as part of the IT infrastructure documentation submitted to CySEC. Applicants without a credible DORA framework will face queries and delays. Zitadelle AG prepares DORA-compliant ICT risk frameworks as part of the application package.
MiCA Article 60 — Adding Crypto Services to a CIF License
Under the Markets in Crypto-Assets Regulation (MiCA — Regulation EU/2023/1114), CySEC-licensed CIFs can extend their authorization to cover crypto-asset services through a streamlined notification procedure — without filing a full standalone MiCA CASP application.
How Article 60 works:
- The CIF submits a notification to CySEC at least 40 working days before commencing crypto-asset services
- CySEC has 20 working days to review and may request additional information once
- Required submissions include: description of intended crypto services, updated governance and compliance arrangements, a business continuity plan covering crypto activities, and confirmation of DORA compliance for the expanded scope
- Once approved, the CIF may provide crypto-asset services across the EU under full MiCA passporting — the same geographic reach as the existing MiFID II passport
Important: crypto derivatives (BTC/USD CFDs, ETH/USD CFDs) are already MiFID II instruments and sit under the existing CIF license without any MiCA notification required. Article 60 is relevant where the firm wants to add spot crypto trading, crypto custody, or crypto exchange services beyond derivatives.
Most CIFs offering crypto-exposure products in 2025–2026 chose the Article 60 route to compress the timeline. Zitadelle AG manages Article 60 notifications for existing CIF holders and advises on the correct product classification for new applicants combining MiFID and MiCA activities.
Government Fees
The CySEC application fee is approximately €5,000 plus 19% VAT, based on the specific investment services selected. CySEC provides an official fee calculator to determine the exact amount based on your authorized service scope. Annual license renewal fees also apply. Zitadelle AG provides a full fee breakdown during the initial scoping phase.
CySEC CIF vs Other EU Investment Licenses
| Factor | Cyprus (CySEC) | Malta (MFSA) | Lithuania | Netherlands | Germany |
|---|---|---|---|---|---|
| EU Passporting | Yes (MiFID II) | Yes (MiFID II) | Yes (MiFID II) | Yes (MiFID II) | Yes (MiFID II) |
| Timeline | 9–14 months | 12–18 months | 6–12 months | 12–24 months | 12–24 months |
| Capital (STP) | €125,000 | €125,000 | €125,000 | €125,000 | €125,000 |
| Capital (Market Maker) | €730,000 | €730,000 | €730,000 | €730,000 | €730,000 |
| Corporate Tax | 12.5%–15% | 35% (effective ~5%) | 15% | 25.8% | 30%+ |
| Local Substance Required | Yes | Yes | Moderate | Yes | Yes |
| Regulator Recognition | Very High (Forex/CFD) | High | Moderate–High | High | Very High |
| Zitadelle AG Presence | Headquarters | Advisory | Advisory | Advisory | Advisory |
Who Needs a CySEC CIF License?
The CySEC CIF is the optimal license for:
- Forex and CFD brokers seeking regulated EU market access and MiFID II passporting
- Securities dealers offering equities, bonds, ETFs, or structured products to European clients
- Portfolio managers and discretionary asset managers serving EU retail or professional clients
- Investment advisors providing regulated advice to EU clients
- Online investment platforms targeting the European retail market
- Fund managers requiring MiFID II authorization alongside a CIS license
- Non-EU firms (from US, Asia, Australia, MENA) establishing their EU regulatory hub
- Existing offshore-licensed brokers seeking to add EU credibility to their regulatory portfolio
CySEC CIF Companies for Sale
Acquiring an existing CySEC-licensed investment firm can be significantly faster than applying for a new license. Zitadelle AG maintains current listings of CySEC CIF entities available for acquisition through our Financial License Market platform — including STP brokers, market makers, and multi-service investment firms with clean compliance records.
Browse CySEC Licensed EntitiesHow Zitadelle AG Supports Your CySEC CIF Application
Zitadelle AG is headquartered in Limassol, Cyprus — giving us direct, on-the-ground access to CySEC and the Cyprus regulatory ecosystem. We have guided numerous clients through the full CIF licensing process, from initial scoping through to license grant and post-authorization compliance.
- Initial scoping and license category assessment (STP vs. Market Maker; authorized service scope)
- Cyprus company incorporation and registered office setup
- Full documentation preparation — business plan, procedures manual, AML/KYC policies, organizational charts, financial projections
- Director, compliance officer, AMLCO, and key personnel sourcing via HRFinEase
- Source of funds documentation support
- CySEC application submission and full liaison — managing all CySEC correspondence and queries
- Bank account opening assistance with Cyprus and European banking partners
- Post-license compliance support — regulatory reporting, MiFID II annual reviews, CySEC notifications, and staff training
How the Process Works
Initial Consultation
1–2 daysFree scoping call — jurisdiction selection, structure, capital requirements, and timeline assessment.
Document Collection
2–4 weeksGather all required KYC, corporate, and background documentation for all directors, shareholders, and UBOs.
Application Preparation
4–12 weeksPreparation of the full application package — business plan, compliance programme, financial projections, and regulatory documentation.
Submission & Review
9–14 monthsSubmission to the regulator. Our team manages all follow-up queries and information requests during the assessment period.
License Issued
9–14 monthsAuthorization granted. Post-licensing support covers compliance setup, banking introductions, and ongoing regulatory obligations.
Frequently Asked Questions
The typical timeline is 9 to 14 months, with an average of approximately 12 months from submission to license grant. Company incorporation takes approximately 3 additional weeks before the license application can be submitted. A well-prepared, complete application managed by an experienced advisor like Zitadelle AG can reduce query rounds and keep the process on the shorter end of this range.
Ready to Obtain Your CySEC CIF License?
Whether you are launching a new EU-regulated investment firm, expanding an existing offshore-licensed brokerage into Europe, or acquiring an existing CySEC entity, Zitadelle AG's Cyprus-based team provides the regulatory expertise, CySEC relationships, and hands-on support to make your CIF application successful. Free initial consultation — response within 24 hours.
Related Licenses
Related Articles & Guides
How to Start a Forex Broker in 2026 — The Complete Guide to Licensing, Technology & Operations
June 10, 2026The complete 2026 guide to starting a forex broker — business model, jurisdiction comparison across every tier, company structure, technology stack, AML/CFT, realistic cost breakdown, and timelines from SVG to CySEC.
Read more →Regulatory UpdatesCySEC CIF License in 2026 — What's Changed, Who's Getting Fined, and What Applicants Need to Know
April 26, 202647 new CIF licenses approved in 2025, €2.3M in fines, Triangleview suspended, new sanctions regime from August 2025. ESMA CSA 2026 inspections running now. Full guide including offshore counterpart structures in Mauritius and Seychelles.
Read more →Regulatory UpdatesMauritius FSC Clarification — Investment Dealers Are Not Permitted to Act as Liquidity Providers
April 24, 2026The FSC Mauritius has clarified that investment dealer companies may not act as liquidity providers to other brokers. No current authorisation framework permits this activity except under an investment banking licence. Affected firms should seek immediate advice.
Read more →Quick Facts
- Regulator
- CySEC
- Framework
- MiFID II
- Passporting
- 30 EU/EEA countries
- Timeline
- 9–14 months
- Capital (STP)
- €125,000
- Capital (MM)
- €730,000
- Min. Directors
- 4 (majority Cyprus-resident)
- Min. Staff
- 3 local employees
- Corporate Tax
- 12.5%–15%
- Zitadelle Office
- Limassol, Cyprus
- Updated
- April 2026
- Service
- End-to-end
Looking for a faster route?
Browse existing CySEC-licensed firms available for acquisition.
View listingsDisclaimer: This page is for informational purposes only and does not constitute legal, tax, or regulatory advice. Regulatory requirements and timelines are subject to change. Zitadelle AG recommends engaging professional advisors before making licensing decisions. This content was last reviewed in April 2026.