Cyprus CIF / CySEC Licence 2026: Capital Tiers, MiFID Scope, the Application Steps and Ongoing Compliance

Cyprus is one of the EU's busiest hubs for regulated investment firms — brokers, wealth managers, CFD platforms and asset managers — and the reason is structural: a CySEC authorisation is a MiFID II passport into the entire single market, granted from a low-cost, English-speaking, 15%-corporate-tax jurisdiction.Law 87(I)/2017 (Investment Services and Activities and Regulated Markets Law, transposing MiFID II)

This guide sets out, at practitioner altitude, what it actually takes to become a Cyprus Investment Firm in 2026: the capital you must lock up, the MiFID services each tier unlocks, the CySEC application steps and realistic timeline, the governance and substance CySEC now insists on, and the prudential, AML and DORA obligations that never stop once you are live. Every figure below is tied to its statute or regulation; where a number depends on your exact service mix, we say so rather than pretend a single answer fits all.

What is a CIF and why licence in Cyprus?

A Cyprus Investment Firm (CIF) is a company authorised and supervised by the Cyprus Securities and Exchange Commission (CySEC) to provide investment services under Law 87(I)/2017, the national transposition of MiFID II. Once authorised, it can passport those services across all EU and EEA member states.

A CIF must first exist as a Cyprus limited company — see the company registration guide— before it can apply for authorisation. The commercial draw is the MiFID II single passport: rather than licensing in each country, a CIF notifies CySEC and then offers services cross-border or through a branch throughout the EU/EEA. Layered on top is a competitive tax position — the 15% corporate rate from 1 January 2026 explained in our Cyprus corporate tax guide— and a deep local pool of compliance, legal and audit talent.MiFID II, Directive 2014/65/EU, Articles 34–35 (freedom of services and branch passporting)

How much capital does a CIF need?

Initial capital follows three tiers set by the Investment Firms Regulation (IFR) and Directive (IFD): €75,000 where the firm holds no client money and does not deal on own account; €150,000 where it holds client funds or financial instruments; and €750,000 where it deals on own account, underwrites on a firm-commitment basis, or operates a trading venue.

The capital must be genuinely paid up in cash and available before authorisation, not merely subscribed. Under the IFR/IFD prudential regime that replaced the old CRD framework for investment firms, initial capital is only the floor: a firm must at all times hold own funds equal to the highest of its permanent minimum capital, a fixed-overheads requirement (broadly a quarter of annual fixed costs), and — for larger firms — a K-factor requirement measuring risk to clients, market and the firm itself. Small, non-interconnected firms (SNIs) are exempt from K-factors, which materially lightens the burden for a boutique CIF.Regulation (EU) 2019/2033 (IFR) and Directive (EU) 2019/2034 (IFD), transposed by Law 165(I)/2021

Which MiFID services can a CIF offer?

A CIF is licensed for a specific menu of investment services and activities under Part I of Annex I to MiFID II, and optionally a set of ancillary services. You apply for exactly the services you intend to provide, on the exact financial instruments you will handle — the licence is scoped, not open-ended.

• Reception and transmission of orders in financial instruments.
• Execution of orders on behalf of clients.
• Dealing on own account (market-making, principal trading) — the €750,000 tier.
• Portfolio management on a discretionary, client-by-client basis.
• Investment advice (personal recommendations).
• Underwriting / placement of instruments, with or without firm commitment.
• Operation of an MTF or OTF (multilateral / organised trading facility).

Ancillary services — safekeeping and administration of instruments, granting credit to clients to carry out transactions, FX services linked to investment services, and investment research — can be added but do not on their own require a CIF licence. The chosen menu drives everything downstream: the capital tier, the K-factors, the ICF obligation and the CySEC application fee. CFD, forex and prop-trading models, covered in our Cyprus forex traders and prop firms guide, are a common CIF use case and carry additional product-governance and leverage constraints.MiFID II, Directive 2014/65/EU, Annex I, Sections A and B

What are the CySEC application steps?

You incorporate the company, assemble a comprehensive application dossier — business plan, three-year financials, internal-operations manual, AML manual, and fit-and-proper files for every director and shareholder — deposit the initial capital, pay the CySEC application fee, and submit. CySEC then reviews, queries, and decides.

1. Incorporate a Cyprus limited company and secure a physical office and key personnel on the island.
2. Build the dossier: detailed business plan and financial projections, organisational chart, internal operations manual, risk-management and compliance frameworks, and an AML/CFT manual.
3. Prepare fit-and-proper files for directors, senior managers, the compliance/risk/internal-audit heads and qualifying shareholders — CVs, clean criminal records, references and questionnaires.
4. Deposit the initial capital in cash with a Cypriot credit institution, ring-fenced pending authorisation.
5. Pay the application fee and submit the complete file through CySEC's portal.
6. Respond to CySEC review rounds — expect multiple written queries; the statutory six-month clock only runs on a complete file and pauses while you answer.
7. Authorisation and entry on the CIF register, followed by ICF membership and go-live conditions.

How long does it take and what does it cost?

CySEC must decide within six months of a complete application, but the realistic end-to-end timeline is 9–14 months. The CySEC application fee is €7,000, with an additional €3,000 where the CIF will offer CFDs; the far larger cost is the capital lock-up plus setup and first-year running costs.

Treat the fee as the smallest line. The binding numbers are the paid-up capital, professional fees for building the dossier, and the recurring cost of qualified compliance, risk and audit staff CySEC expects to see in place. Annual supervisory fees are then payable to CySEC on an ongoing basis, pro-rated in the first year to the period for which the authorisation is held.Law 87(I)/2017, Art. 7 (six-month decision period)

What governance and substance is required?

CySEC authorises firms, not shells. It expects a real four-eyes management body — at least two executive and two non-executive directors, a majority resident in Cyprus — plus independent compliance, risk-management and internal-audit functions, and a genuine office and staff on the island.

Every director, key-function holder and qualifying shareholder is vetted for fitness and propriety before authorisation, and material changes afterwards require CySEC approval. Substance is not a box-tick: mind and management must sit in Cyprus, which also underpins the company's Cyprus tax residency and its access to the treaty network. Under-resourcing the compliance and risk functions is the most common reason applications stall, because CySEC reads it as a signal the firm cannot meet its ongoing obligations.

What are the ongoing compliance obligations?

A live CIF must maintain own funds under the IFR/IFD regime, run an annual ICARA, contribute to the Investor Compensation Fund, operate full MiFID II conduct rules, meet AML/CFT obligations, file regular prudential and transaction reports, and have its accounts audited annually by an ICPAC-licensed auditor.

• Prudential: continuous own-funds compliance and an annual Internal Capital Adequacy and Risk Assessment (ICARA) process; regular COREP-style reporting to CySEC.
• Investor protection: ICF membership covering retail clients up to the lower of €20,000 or 90% of the covered claim per client.
• Conduct: best execution, client categorisation, suitability/appropriateness, product governance and MiFID II transaction reporting.
• AML/CFT: a compliant framework, an approved AML compliance officer, and ongoing monitoring under Cyprus AML law.
• Audit: a full statutory audit every year — regulated firms cannot use the small-company review option in our Cyprus audit requirements guide.

Investor Compensation Fund coverage — CySEC (up to €20,000 or 90% of the covered claim, retail clients)

How does DORA affect a CIF in 2026?

The EU Digital Operational Resilience Act (DORA) has applied directly to CIFs since 17 January 2025. Every CIF must run an ICT risk-management framework, classify and report major ICT incidents, test its digital resilience, and manage third-party ICT provider risk — and it now pays a dedicated DORA supervisory fee to CySEC.

DORA is not optional guidance; it is a regulation with direct effect. CySEC set out its implementation approach in Circular C700 (8 April 2025) and introduced a DORA fees directive on 29 August 2025, so the cost and reporting burden are now baked into a CIF's annual compliance calendar. Practically, expect to maintain a register of ICT third-party arrangements, an incident-classification and reporting procedure, and a resilience-testing programme — all of which CySEC can inspect. Firms that also touch crypto-assets should read our Cyprus CASP / MiCA licence guide, since DORA applies across both regimes.Regulation (EU) 2022/2554 (DORA), applicable from 17 January 2025; CySEC Circular C700 (8 April 2025)