The Cyprus forex license, without the shortcuts

A “Cyprus forex license” is not a product you buy — it is authorisation as a Cyprus Investment Firm (CIF), granted and supervised by the Cyprus Securities and Exchange Commission (CySEC) under Law 87(I)/2017, the national version of MiFID II. Retail forex and CFD trading falls inside that framework as an investment service, so the broker is licensed the same way any EU investment firm is: with a fixed minimum capital, a real compliance and risk apparatus, fit-and-proper owners and managers, and ongoing supervision. This is heavily regulated ground. If a provider offers to sell you a ready “forex licence” cheaply and fast, they are either selling a shelf CIF at full price under a marketing label, or selling something that is not a CySEC authorisation at all.

What the authorisation actually covers

A CIF licence is defined by the investment services and financial instruments written into it. A forex/CFD broker typically needs reception and transmission of orders, execution of orders on behalf of clients, and — if it acts as a market maker — dealing on own account, over instruments that include CFDs and other derivatives on currencies. There is no line on the licence that says “forex”. The services you request drive both the capital tier and the depth of CySEC’s review, which is why scoping the permission correctly is the first real decision, not a formality.

Initial capital: three tiers

Since June 2021, minimum initial capital follows the IFR/IFD prudential regime, not the older CRD figures:

Most retail forex/CFD brokers land at €150,000 or €750,000, because they hold client money and often make markets on their own book. The older €50,000/€125,000/€730,000 numbers still circulating online were replaced when IFR/IFD took effect. And initial capital is only the entry ticket: once live, the firm must hold own funds at the higher of its fixed-overheads requirement or the K-factor requirements under the IFR — a moving figure that grows with the business.

The CySEC process, step by step

1. Incorporate the vehicle. A Cyprus company is formed first — the licence attaches to a legal entity. See company formation for the base layer.
2. Build the substance and the team. Resident directors, a compliance officer, risk and internal audit functions, and premises proportionate to the plan.
3. Assemble the application. Business plan and financial projections, internal policies and procedures manual, organisational structure, and fit-and-proper files for shareholders, directors and key persons.
4. Deposit the initial capital in the correct tier and evidence it.
5. File with CySEC and answer its review. Expect substantive questions; the quality of the file determines how many rounds this takes.

Timeline, honestly

CySEC has a six-month statutory window to decide once an application is complete. That word — complete — carries the weight. The months before submission, spent building the compliance framework and getting the documentation right, are what actually determine the total timeline. We would rather tell you the honest range up front than quote the statutory maximum as if it were a promise.

Passporting: the reason to be regulated in the EU

An authorised CIF can passport across the EU and EEA under MiFID II — providing services cross-border or through a branch, after a notification to CySEC. One licence, one home supervisor, access to the whole single market. That is the substantive difference between a CySEC-regulated broker and a nominal offshore permit: the passport, the client trust that comes with EU supervision, and access to banking and payment rails that increasingly refuse unregulated crypto- and forex-adjacent flows.

Who this is not for

If your plan is to raise client money quickly with minimal capital and no local team, Cyprus is the wrong jurisdiction — and we will say so early rather than take you through six months to a refusal. The CIF route rewards operators who are building a real, capitalised, supervised business and want EU reach. It is demanding by design. A separate but adjacent question — licensing crypto-asset services under MiCA — is covered on the Cyprus crypto license page; the two regimes are distinct, and a CIF licence does not by itself authorise crypto-asset services.

A licensed CIF is still an ordinary Cyprus tax resident company, so the 15% corporate tax and standard accounting and audit duties apply on top of the CySEC regime.

How we run it

1. Scope the permission first. We map the services and instruments you actually need to the correct capital tier — before anything is filed.
2. Stand up the company and substance. Incorporation, directors, offices and the compliance/risk functions CySEC expects to see operating, not promised.
3. Build the application to survive review. Business plan, manuals and fit-and-proper files assembled to answer CySEC’s questions before it asks them.
4. Run the CySEC dialogue. We manage the review rounds and keep the six-month clock working for you, not against you.
5. Maintain the licence. Own-funds monitoring, reporting and ongoing obligations kept current, because authorisation is the start of supervision, not the end of the work.