CySEC licensing for investment firms: CIF authorisation, MiFID and passporting explained

What a Cyprus Investment Firm is

A Cyprus Investment Firm, usually shortened to CIF, is a company authorised by the Cyprus Securities and Exchange Commission (CySEC) to provide investment services and activities on a professional basis. For the brokerage sector, the services that matter most are reception and transmission of orders, execution of orders on behalf of clients and dealing on own account. Many firms also hold permission for portfolio management or investment advice, though retail CFD brokers usually concentrate on the first three.

The CIF label is specific. A company incorporated in Cyprus is not a CIF simply because it sits in Limassol and employs dealers. It becomes one only once CySEC has granted authorisation, and only for the services and financial instruments named in that authorisation. A firm licensed to receive and transmit orders in transferable securities has no permission to deal on own account in contracts for difference unless the licence says so.

That distinction sounds technical, but it drives much of what happens later in banking and payments. The scope of the licence decides what the firm can lawfully do, and therefore what flows of money a partner should expect to see.

The MiFID framework behind the licence

CySEC authorises investment firms under the EU Markets in Financial Instruments framework, known as MiFID. The current version, MiFID II, together with the accompanying regulation MiFIR, sets common rules across the European Economic Area for how investment firms are authorised, organised and supervised, and how they treat clients.

Because the framework is shared, a CIF is subject to broadly the same core obligations as an investment firm authorised in Germany, France or Ireland. In practical terms this covers:

• Organisational requirements: sound governance, a board with the right mix of skills, clear reporting lines and documented policies.
• Independent control functions: compliance, risk management and internal audit, with the compliance and risk functions able to report directly to the board.
• Conduct of business rules: client categorisation, appropriateness testing, best execution, conflicts of interest management and clear disclosure of costs and charges.
• Safeguarding of client assets: client money held separately from the firm's own funds, with reconciliations and records that allow each client's entitlement to be identified.
• Transaction reporting and record keeping: detailed records of orders, communications and transactions, kept for the required periods.

Prudential requirements, meaning capital and liquidity, sit alongside MiFID under the EU's investment firm prudential regime. The amount of initial capital depends on the services a firm is authorised for. Firms that deal on own account face higher requirements than those that only receive and transmit orders. Anyone planning an application should take specific advice on the current figures rather than rely on numbers quoted second hand.

How CIF authorisation works in practice

The application process is document heavy. CySEC expects a full picture of the proposed firm before it grants a licence, and the quality of the file has a direct effect on how smoothly the review goes. A typical application includes:

• A programme of operations or business plan, describing the services, target markets, client types, products, distribution channels and financial projections.
• Details of shareholders and ultimate beneficial owners, including source of wealth and source of funds for the capital being injected.
• Fit and proper information for directors and key function holders, covering experience, qualifications and reputation.
• Draft policies and procedures: anti-money laundering, client onboarding, order execution, conflicts of interest, complaints handling, risk management and business continuity.
• Evidence of the organisational structure, including where staff will sit and what is outsourced.
• Details of the trading platform, liquidity arrangements and IT security.

CySEC reviews the file, raises questions and may ask for changes before reaching a decision. Firms should expect several rounds of comments. Real substance in Cyprus, meaning management and control functions physically present, is an expectation, and a firm that plans to run everything from elsewhere will struggle.

Once authorised, the firm appears on CySEC's public register, which lists its licence number and the services and instruments it may provide. That register entry is the reference point everyone else will use.

Ongoing obligations after the licence is granted

Authorisation is the start of supervision, and a CIF carries a steady reporting burden. It submits periodic financial and prudential returns, compliance and risk management reports, internal audit reports, and reports on client money and assets. Annual audited financial statements are required, and auditors also report on certain regulatory matters.

Material changes need notice to CySEC or its approval in advance. Typical examples include a change of qualifying shareholder, a new director, a new service or instrument, a new tied agent or branch, or a significant outsourcing arrangement. Firms that treat these as administrative afterthoughts tend to discover that a bank or partner has spotted the gap first.

CySEC also carries out on-site and desk-based inspections and publishes enforcement decisions, including settlements and fines. A history of enforcement does not automatically disqualify a firm with partners, but it will be read and discussed, and the firm should be ready to explain what changed afterwards.

Passporting across the EEA

One of the main reasons brokers choose an EU licence is the passport. Under MiFID, an investment firm authorised in one EEA member state may provide its authorised services in other member states without seeking a separate licence in each one.

There are two routes:

• Cross-border services: the firm provides services into another member state from Cyprus, without a physical presence there. It notifies CySEC, which passes the notification to the host regulator.
• Branch or tied agent: the firm establishes a branch or appoints a tied agent in the host state. This route involves more information and gives the host regulator a larger role, particularly over conduct of business at the branch.

The passport covers only the services and instruments in the home licence. It does not extend beyond the EEA. A CIF cannot rely on its CySEC licence to serve clients in the United Kingdom, Canada, Australia or other non-EEA markets, each of which applies its own rules. Some host EEA regulators also apply national marketing rules and product restrictions to firms passporting in, so the passport removes the need for a new licence but leaves local conduct expectations in place.

A practical point: a passport notification shows up on the home register and often on the host regulator's register too. Payments partners can check both, and a firm marketing heavily in a member state with no notification on file will attract questions.

Retail CFD rules that shape the business

Since the European Securities and Markets Authority introduced product intervention measures for CFDs offered to retail clients, national regulators including CySEC have applied equivalent rules. In general terms these include minimum initial margin requirements that vary by underlying asset class, margin close-out rules, negative balance protection, restrictions on incentives to trade and a standard risk warning showing the share of retail accounts that lose money.

These rules affect the commercial model of a CIF. Some groups respond by focusing on professional clients, who fall outside some of the retail protections once properly categorised. Others route certain client segments to group entities outside the EU. Both approaches are lawful when done correctly, but they create questions a payments partner will want answered: which entity onboards which clients, on what basis, and where the money for each segment is held.

What a CySEC licence signals to payments partners

When a bank, electronic money institution or payments provider assesses a broker, the licence is the starting point of the risk review. A CIF authorisation tells the partner several useful things:

• A regulator has reviewed the owners, directors and business model and found them acceptable.
• The firm must keep independent compliance, risk and audit functions, so there are named people responsible for controls.
• Client money must be segregated, which helps the partner understand which accounts hold whose funds.
• The firm is under ongoing supervision, files periodic reports and can be sanctioned if it fails to meet its obligations.
• AML obligations under EU law apply, so the firm should already run customer due diligence, transaction monitoring and suspicious activity reporting.

For a partner handling corporate flows such as liquidity provider transfers or technology vendor payments, this matters because it gives a baseline. The partner can build its own due diligence on top of a framework it understands, instead of starting from nothing.

What a licence does not tell a partner

A licence is necessary but it does not answer every question. Experienced partners look past the certificate to the details:

• Which entity is applying: a group might hold a CySEC licence in one company and ask a partner to bank a different, unlicensed company in the same group. The licence does not transfer.
• Scope: the services and instruments on the register entry should match what the firm actually does. A firm dealing on own account without that permission has a serious problem.
• Where clients come from: marketing into countries outside the EEA, or into member states without a passport notification, is a recurring issue.
• Clone and lookalike firms: regulators publish warnings about websites impersonating authorised firms. Partners match domain names, addresses and contact details against the register entry.
• The quality of controls: a licence says controls must exist. Only conversations with the compliance officer, sample policies and evidence of monitoring show whether they work.

For these reasons, good partners verify the licence directly on the CySEC register, never relying on a PDF supplied by the applicant, and then read the register entry against the business description they have been given.

Preparing a CIF for a payments partner review

Brokers that move through onboarding quickly tend to prepare a clean pack in advance. A useful set includes the certificate of incorporation and constitutional documents, the CySEC register link and licence scope, a group structure chart showing every entity and its regulatory status, details of directors and beneficial owners, the latest audited accounts, the AML policy, a description of each payment flow the firm wants to run, and the names of liquidity providers and main technology vendors.

Be specific about what the account is for. A CIF asking a corporate payments provider to handle liquidity provider margin transfers and platform licence fees is a clear request that can be assessed. A request that mixes corporate flows with client deposits and withdrawals is a different proposition, and many corporate providers will decline client money as a matter of policy. Separating the two from the outset saves time on both sides.

Finally, keep the pack current. A new director, a change in licence scope or a new passport notification should be shared with partners promptly. It is far easier to update a file than to explain a discrepancy found during a periodic review.

General information only

This article is general information about how investment firm authorisation works in Cyprus and how payments partners tend to read it. It is not legal or regulatory advice, and licensing requirements change over time. Firms considering a CIF application, or changes to an existing licence, should take advice from qualified Cyprus counsel and consult CySEC's own published guidance.

CCYFX provides Foreign exchange, International payments, and Collections and payouts to businesses. It does not handle broker client deposits or withdrawals. For further background, see our CFD brokers page or our overview of Cyprus.