Quick answer
A CIF authorisation is a permission-specific investment-firm approval, not one generic forex licence. Initial capital depends on the investment services and client-asset permissions: €75,000, €150,000 or €750,000 under section 9 of the Cypriot prudential law. Ongoing own-funds requirements are a separate assessment.
What this licence actually authorizes
- Approved reception/transmission, execution on behalf of clients, dealing on own account, portfolio management, advice and other selected investment services.
- Any EEA cross-border framework requires the applicable notification and scope; it is not unrestricted global distribution.
What it does not authorize
- No universal €75,000 forex brokerage route; that bucket is conditional on eligible services and no permission to hold client money or securities.
- No automatic own-account permission from an execution/agency label.
- No unrestricted worldwide passport or blanket third-country client acceptance.
Who this jurisdiction suits
Suitable operating model
An operator seeking an EEA investment-firm framework and able to sustain local governance, conduct, client-protection and prudential requirements.
Who it does not suit
A minimal-substance offshore model, a business relying on one headline capital number, or an operator unwilling to evidence best execution and ongoing own-funds monitoring.
Legal / regulatory framework
Law 87(I)/2017; MiFID II; Law 165(I)/2021; IFR / IFD
The legal framework, current amendments, application guidance and individual conditions must be read together. A guideline is not a substitute for legislation; neither a company certificate nor software licensing establishes regulatory permission. Official source versions and unresolved verification notes are recorded below.
Capital by business model
Section 9(1) specifies €750,000 for dealing on own account and underwriting/placing on a firm-commitment basis. Section 9(2) specifies €75,000 for the listed services only where the CIF is not permitted to hold client money or securities. The €150,000 residual category needs analysis of the entire permission set. The OTF own-account special case is also €750,000. A-book and STP descriptions are not the statutory capital test.
Initial capital is not the ongoing funding requirement
IFR Article 11 introduces the relevant own-funds tests, including permanent minimum capital, fixed overheads and applicable K-factors. Build a prudential calculation and operating budget around the proposed services, client-assets model and risk profile. Keep a reconciliation between regulatory reporting, accounting data, exposure data and the board’s risk decisions. Do not quote the initial floor as the total amount needed to operate.
Before You Apply
| Prerequisite | Classification | Application evidence |
|---|---|---|
| Company / UBO | Activity dependent | Legal form, controller disclosures, beneficial ownership and source of funds must match the actual application. |
| Regulatory capital | Activity dependent | €75,000 for specified services without client-money/securities permission; €150,000 residual category; €750,000 for own-account/firm-commitment permissions and the specified OTF case. |
| Office / local substance | Activity dependent; verify applicable rule | Explain head-office, local governance and control arrangements in the programme of operations. Document how CySEC can supervise the firm, its records and outsourced functions. Distinguish a legally established office from meaningful management of the investment business. |
| Directors / approved persons | Activity dependent | Demonstrate management-body suitability, effective governance, qualifying-shareholder transparency and accountable compliance, risk and AML functions. The current authorisation pack and local role matrix need final confirmation; this page does not assert a universal executive/non-executive headcount. Outsourcing does not remove the CIF’s responsibility. |
| Compliance / risk / MLRO | Activity dependent | Confirm mandatory appointments, eligibility, residence, independence and permitted outsourcing. Software does not replace accountable governance. |
| Auditor / company secretary | Activity dependent | Identify audit and corporate-secretarial obligations under the chosen company and regulatory structure; do not treat every role as universally mandatory. |
| Professional indemnity | Activity dependent | Confirm any insurance obligation, coverage and eligibility under current rules; no universal amount is inferred. |
| Business plan / forecasts | Activity dependent | Reconcile the programme of operations, financial projections, capital, staffing costs and downside assumptions with approved permissions. |
| Technology / client-money architecture | Activity dependent | Map platforms, liquidity counterparties, customer contracts, settlement, safeguarding, records and access controls to the actual permission. |
| Managed support / staffing sourcing | InfyTradeTech add-on support | Coordination, suitable personnel sourcing, management consulting and scoped technology/compliance operations, subject to legal eligibility and approvals. |
Corporate structure
Confirm the legal form, ownership chain, funding, group contracts and appropriate local professional support. Keep incorporation and regulatory authorisation as separate workstreams, and explain which entity contracts with customers and counterparties.
Regulatory capital
€75,000 for specified services without client-money/securities permission; €150,000 residual category; €750,000 for own-account/firm-commitment permissions and the specified OTF case.
Client-money arrangements
Permission-specific; do not assume custody. Record banking, safeguarding, reconciliation and withdrawal-authority controls against the actual permissions before accepting funds.
Regulatory Operating Model
Required roles, activity-dependent responsibilities and InfyTradeTech add-on support are different things. This structure identifies operating responsibilities without calling every role a universal legal requirement.
Cyprus Securities and Exchange Commission (CySEC)
Authorised entity / approved scope
Governance and legal responsibility remain with the entity.
Board / key persons
Activity dependent
Governance, competence and fit-and-proper evidence
Compliance / AML / risk
Activity dependent
Responsibility, local eligibility and approval requirements
Dealers / representatives
Activity dependent
Only where the actual permission and business require them
Illustrative operating structure, not a regulator-endorsed chart. Infy support is not a substitute for approved persons.
Directors / key personnel
Demonstrate management-body suitability, effective governance, qualifying-shareholder transparency and accountable compliance, risk and AML functions. The current authorisation pack and local role matrix need final confirmation; this page does not assert a universal executive/non-executive headcount. Outsourcing does not remove the CIF’s responsibility.
Local substance / office
Explain head-office, local governance and control arrangements in the programme of operations. Document how CySEC can supervise the firm, its records and outsourced functions. Distinguish a legally established office from meaningful management of the investment business.
Need Qualified Regulatory Personnel?
We can assist with sourcing and structuring required personnel through our professional network, subject to qualification, fit-and-proper and regulator approval requirements.
Compliance, technology & operating evidence
Compliance / AML
Build the AML/CFT framework around the customers, instruments, payment methods and countries the firm will actually serve. The onboarding policy needs customer identification, beneficial-owner identification, purpose of the relationship, source-of-funds assessment, sanctions and PEP screening, escalation and ongoing monitoring. A downloaded manual is not evidence that these controls operate. Allocate accountable people, document exception handling and retain an auditable decision trail. Suspicious-activity reporting, record retention and training must be aligned with the applicable local rules; do not substitute a vendor screening result for the firm’s own risk assessment.
Technology & operating model
The regulatory dossier and the trading configuration should describe the same business. Record which legal entity contracts with the customer, which entity is the counterparty, where an order is executed and who holds the money. Describe account groups, instrument availability, markups, margin settings, order handling, access rights and change controls. An agency label is not enough if the client agreement or platform makes the applicant the contractual principal. Likewise, hedging every trade does not necessarily change the legal identity of the counterparty. Confirm the permission analysis before configuring production accounts.
Trading platform / liquidity
Prepare a platform architecture showing client terminal → trading server → execution interface → authorised counterparty. For an intermediary, demonstrate the actual external execution relationship rather than a simulated A-book diagram. For a principal model, document exposure measurement, hedging authority and limits. Identify the platform vendor, hosting location, bridge provider, LP agreements, order-reject handling, price-feed ownership and disaster-recovery arrangements. Vendor agreements must match the applying entity. Software licensing, an LP account and regulator authorisation are separate approvals; none proves the other.
Documents required
Ownership & corporate evidence
Constitutional documents, ownership chart to natural-person beneficial owners, shareholder and controller records, source-of-funds/source-of-wealth evidence and any required certified identity records. Disclose changes and linked entities consistently across forms, bank submissions and the business plan.
Business plan & financial projections
A permission-led business plan: target clients and countries, products, execution model, commercial assumptions, staffing and outsourcing. Prepare three-year projections as an application working file, identifying capital, operating expenses, revenue assumptions and downside scenarios; use the regulator’s actual prescribed horizon where different. Do not present a forecast as an achieved result.
Operations & Compliance Manual
Organisational responsibilities, account opening, approvals, complaints, recordkeeping, outsourcing oversight, incident management and regulatory reporting. Each policy needs an owner and practical evidence of implementation; avoid mutually inconsistent definitions across manuals.
AML/CFT systems and procedures
KYC/CDD and enhanced-due-diligence procedures, customer risk assessment, beneficial ownership, screening, transaction monitoring, reporting, training and review. Map the client cabinet and payment workflow to these decisions and preserve evidence of exceptions.
Client agreements & material contracts
Customer terms, risk disclosures, conflicts policy, execution disclosures and client-money arrangements where relevant. Provide platform, hosting, bridge, liquidity, outsourcing and key service-provider contracts aligned with the legal entity and proposed permissions.
Risk, business continuity & disaster recovery
Exposure and liquidity controls, dealing authority, escalation, continuity ownership, system backups, restoration tests and communications. Distinguish RiskMan’s automated software controls from the decisions taken by a human dealing desk. Document the limitations of each.
Personnel evidence
Personnel CVs, qualifications, experience certificates and background disclosures. Police/criminal-record certificates and regulatory exams apply where the current regime requires them. Confirm certification, translations, expiry and regulator eligibility before filing.
Application process
Perimeter
Map products, contractual principal, customers and target markets to required permissions. Record host-country marketing restrictions before selecting an entity.
Structure
Establish ownership, local professional support, key persons and the substance plan. Confirm funding and the capital basis rather than converting an historic minimum into a launch budget.
Evidence
Build and reconcile the application dossier, projections, client terms and operational controls. Test that the platform configuration matches the legal model.
Submission
Submit through the applicable official channel using the current forms and appropriate local representation. Maintain a versioned response register for further information requests.
Conditions
Resolve regulator queries and any pre-commencement conditions. Verify the authorisation, approved activities and register entry before enabling the corresponding business.
Operate
Maintain reporting, audit, financial-resource monitoring, complaints and AML controls. Assess changes to ownership, personnel, vendors, products and client countries before implementation.
Timeline
Plan by dependencies rather than a promised approval date: ownership and funding evidence → personnel/premises readiness → reconciled application → regulator queries → conditions → commencement. There is no guaranteed regulator timetable. Any indicative preparation schedule must be agreed for the actual scope and is not a commitment by the regulator.
What InfyTradeTech Handles
Application architecture
Translate the actual business model into a permission matrix, corporate structure and controlled application evidence register. Coordinate local professional input; the regulator retains the authorisation decision.
Corporate setup coordination
Coordinate incorporation, ownership documentation and the appropriate local management/company-secretarial workstream. Registered-office services alone are not represented as regulatory substance.
KYC / CDD file preparation
Organise shareholder, UBO and key-person evidence with source-of-funds and source-of-wealth support. The client remains responsible for complete and truthful disclosures.
Policies, projections & agreements
Coordinate client agreements, Operations & Compliance Manual, AML/CFT procedures, risk and conflicts policies, financial projections and material contracts against the agreed operating model.
Business continuity / disaster recovery
Connect the policy architecture to hosting, backups, permissions, restoration procedures and the people responsible for incident decisions.
Application pack & regulator queries
Coordinate the application forms and supporting pack, reconcile responses and track follow-up. Filing and representation arrangements depend on local eligibility rules and the agreed engagement.
Operational readiness
Connect licensing work to banking/PSP support, trading platform, Forex CRM, bridge/gateway, liquidity integration, RiskMan software and separately scoped 24/7 human operations. These services are not implied to be mandatory regulatory vendors.
What the client provides
Ownership, identity and funding
Provide accurate legal ownership, beneficial owners, certified personal records where needed, background disclosures and evidence explaining the origin and availability of capital.
Commercial decisions
Confirm products, agency/principal model, customer countries, distribution channels, client-money handling and launch priorities. The application cannot resolve conflicting instructions about who will be the counterparty.
People and premises
Nominate suitably qualified key persons, agree local substance arrangements and provide office/service contracts. Attendance, experience and accountability cannot be replaced by a name on a form.
Approvals and evidence
Review and approve the business plan, projections, policies and agreements; disclose changes promptly and provide vendor contracts and practical control-test evidence. Do not begin regulated activity before the required permissions and conditions are met.
From Application to Operating Company
We do not disappear once the licence is issued. Application coordination, suitable personnel and scoped ongoing management support should connect to the way the business actually operates.
Licensing
Regulatory strategy & application
Category selection, corporate structure, feasibility study, business plan, forecasts, forms and authority submission coordination; queries are tracked through a controlled evidence register.
Control architecture
AML/CFT, compliance, risk, internal controls, internal-audit planning, conflicts, code of conduct, BCP/DR, complaints, whistleblowing and sanctions/terrorist-financing screening aligned with the real operating model.
Banking & technology readiness
Banking assistance, client documentation, platform/CRM architecture, liquidity relationships and operational evidence. No bank acceptance or authorisation is guaranteed.
Staff & substance
Need the required team? We can help.
Assist with sourcing / arranging suitably qualified personnel subject to regulatory approval: Head of Category, compliance officer, MLRO/DMLRO, risk officer, financial analyst, promotion manager, dealer representatives, resident directors, company secretary and operations/administration staff, where legally permitted.
Qualifications & approvals
Build role-specific CV, qualifications, experience and background evidence, including exams where applicable. Verify fit-and-proper, residence, independence and role-combination requirements rather than promising guaranteed approved staff.
Physical operating presence
Coordinate premises, local professional support, systems and responsible personnel. A nameplate or registered-office contract is not proof that every local-substance requirement is met.
Post-licence management
Regulatory compliance
Scoped support for AML/CFT monitoring, KYC/CDD oversight, screening, risk assessments, reporting, compliance calendar, policies, inspection preparation and compliance-file maintenance. Renewal support applies only where the regime requires renewal.
Management consulting
Board/management support, operational governance, vendor management, brokerage workflows, technology governance, risk framework, internal controls, business continuity and management reporting.
Operations & technology
Platform administration, CRM/account operations, payment workflows, liquidity coordination and risk monitoring. RiskMan software and human-managed dealing operations remain separately scoped. The licensed entity retains legal responsibility.
After the licence — ongoing obligations
Maintain authorisation conditions, investor-protection controls, client information, suitability/appropriateness where applicable, best execution, conflicts management and applicable investor-compensation arrangements. Prudential reporting and own-funds calculation follow IFR/IFD and the permissions/classification. Marketing and client-asset protections require continuing control, not an initial formality.
Managed Regulatory Operations
For firms that do not want to assemble every operational and compliance function independently, InfyTradeTech can coordinate an ongoing managed-support model covering regulatory administration, compliance workflows, approved-person support, technology operations and management consulting.
Add-on support, subject to legal eligibility, regulator approval where required and agreed scope. The licensed entity retains responsibility.
Discuss Managed Regulatory OperationsBanking / PSP considerations
Banking / PSP considerations
Banks and payment providers conduct their own underwriting. Prepare the ownership chain, source-of-wealth evidence, expected customer geography, transaction flow, refund process and reconciliation model. Separate operating funds from customer funds where required and explain settlement accounts and payment-provider balances. Establish who can approve withdrawals, how duplicate callbacks are handled and how discrepancies are investigated. A licence does not guarantee bank acceptance, card acquiring or uninterrupted payment processing. Do not commence client-money handling merely because an account has been opened; check the permissions and operational controls first.
Common reasons applications fail
Material inconsistencies are more serious than cosmetic omissions. Typical readiness problems include an unexplained ownership chain, unsupported source of funds, a business plan inconsistent with proposed permissions, unrealistic revenue assumptions, unsuitable key persons, an office that does not demonstrate operational substance and contracts signed by the wrong entity. Generic compliance policies often fail to explain who investigates an alert or approves a withdrawal. A principal-dealing contract presented as agency execution creates a permission problem. Keep an evidence register, resolve contradictory versions and respond to regulator questions with reconciled documents rather than isolated edits.
Alternative jurisdictions
Frequently asked questions
What does this route actually authorise?
A CIF authorisation is a permission-specific investment-firm approval, not one generic forex licence. Initial capital depends on the investment services and client-asset permissions: €75,000, €150,000 or €750,000 under section 9 of the Cypriot prudential law. Ongoing own-funds requirements are a separate assessment.
Does it permit operating worldwide?
No blanket global permission is asserted. Local authorisation or incorporation does not remove the need to assess solicitation and service provision in each target market.
How much capital should the business plan include?
€75,000 for specified services without client-money/securities permission; €150,000 residual category; €750,000 for own-account/firm-commitment permissions and the specified OTF case. Separate this requirement from operating expenses, bank underwriting and any ongoing financial-resource calculation.
Can the launch date be guaranteed?
No. Application readiness, queries, personnel approvals, banking and regulator decisions affect the sequence. Preparation milestones can be planned; regulator timing and approval cannot be guaranteed.
Can an existing company be acquired instead?
An acquisition route requires genuine availability, legal and financial due diligence, and any applicable regulatory notifications/approvals or fit-and-proper assessment. Changes to ownership or key persons may affect the permission. Availability is confirmed privately, not assumed.
Official sources
Reviewed against official regulator sources for drafting. Source review does not constitute completed regulatory sign-off; incomplete checks are identified explicitly.
CySEC investment-services lawLaw 87(I)/2017; Greek legally binding text and latest amendments require final checkCySEC prudential lawLaw 165(I)/2021 section 9EU Investment Firms RegulationRegulation (EU) 2019/2033CIF authorisation application Form 87-00-01Official application landing page; downloadable revision to confirmCySEC current CIF registerOfficial register; verify individual permissionsRegulatory requirements are subject to amendment and should be confirmed against the regulator’s current rules before an application is submitted.