Cyprus CIF Licence 2026 — CySEC Capital, Cost & Timeline

A Cyprus Investment Firm (CIF) is a MiFID II investment firm authorised by the Cyprus Securities and Exchange Commission (CySEC) under the Investment Services and Activities and Regulated Markets Law of 2017, Law 87(I)/2017. Cyprus has licensed more CIFs than any other EU jurisdiction — over 250 as of 2026.

A CIF authorisation permits the provision of investment services across the entire European Economic Area under the MiFID II passport. The 30 EEA states include all 27 EU member states plus Iceland, Liechtenstein and Norway. A CIF licensed in Cyprus can passport its services to any of these jurisdictions without obtaining a separate local licence, subject to notification procedures under Articles 34 and 35 of MiFID II.

The services a CIF can provide depend on its licence class. Class 3 permits investment advice, portfolio management, and reception and transmission of orders without holding client funds. Class 2 adds the ability to hold client funds or financial instruments, enabling STP and execution-only brokerage. Class 1 permits dealing on own account, underwriting, and operating a Multilateral Trading Facility (MTF) or Organised Trading Facility (OTF).

The CIF licence is the only Cyprus authorisation that provides MiFID II passporting for investment services. A CASP authorisation under MiCA covers crypto-asset services but does not extend to traditional investment services. An Electronic Money Institution licence covers payment services and e-money issuance. A Payment Institution licence covers payment services. Each licence is distinct — but a CIF can add crypto-asset services under MiCA Article 60 without a separate CASP authorisation.

CySEC is the sole competent authority for CIF authorisation and supervision. It operates the SPIDER portal for applications, publishes a fee calculator, and enforces compliance through on-site inspections, periodic reporting, and enforcement actions including fines and licence withdrawals under Article 72 of Law 87(I)/2017.

Law 165(I)/2021 (art. 9) sets three minimum initial capital tiers by the services a firm is authorised for. Advisers usually call them Class 3, Class 2 and Class 1, which is how this page refers to them; the law itself names no classes. The tier determines the minimum initial capital and the permitted services, and EU Investment Firms Regulation 2019/2033 sets the ongoing prudential regime.

Class 3 — €75,000. This class covers firms providing investment advice, portfolio management, and reception and transmission of orders without holding client funds or financial instruments. A robo-advisory platform that generates portfolio recommendations and transmits orders to a custodian is a Class 3 CIF. A pure advisory firm that recommends securities to clients but never touches client money is also Class 3. The capital must be paid up in cash and held in a Cypriot credit institution, ring-fenced until authorisation.

Class 2 — €150,000. This class covers everything in Class 3 plus the authorisation to hold client funds or financial instruments. An STP forex broker that receives client orders and passes them to liquidity providers is a Class 2 CIF. An execution-only stockbroker that holds client accounts and executes trades on regulated venues is also Class 2. The distinction from Class 3 is the holding of client assets — if your business model involves touching client money, you need Class 2.

Class 1 — €750,000. This class covers firms dealing on own account, underwriting, or operating an MTF or OTF. A market maker that provides liquidity on trading venues is a Class 1 CIF. A firm that operates a multilateral trading system matching buyer and seller orders is also Class 1. The capital jump from €150,000 to €750,000 reflects the higher risk profile of proprietary trading and venue operation.

The class is determined by the services listed in the application, not by the firm's business plan. A firm that applies for Class 3 services cannot hold client funds, even if it intends to do so in the future. Adding services requires a variation of authorisation under Article 15 of Law 87(I)/2017, which involves a new assessment by CySEC. Firms should apply for the class that matches their immediate business plan and expand later.

The capital requirements are statutory minimums. CySEC assesses whether the firm's actual capital is sufficient to cover its running costs during the period before it reaches profitability. If the business plan shows €500,000 in first-year costs and €150,000 in projected revenue, CySEC will require at least €350,000 in initial capital regardless of the class minimum. The €75,000, €150,000 or €750,000 figure is the floor, not the answer.

The €75,000 Class 3 minimum capital is the statutory floor set by Law 165(I)/2021. It is not what CySEC will actually require you to hold.

CySEC's assessment is driven by the business plan. The regulator examines your projected running costs, the time to profitability, and the infrastructure needed from day one. If your business plan shows €300,000 in first-year operating costs — compliance staff, office, technology, professional fees — and €100,000 in projected revenue, CySEC will require at least €200,000 in capital. The statutory minimum ensures the firm has skin in the game; the business plan ensures it can actually survive until it earns.

The capital must be paid up in cash and held in a Cypriot credit institution before authorisation. It is ring-fenced — CySEC verifies that the funds are available and not pledged as collateral for other obligations. The capital can be deployed into the business after authorisation, but the firm must maintain its ongoing capital adequacy requirements under the IFR/IFD regime throughout.

The IFR (Investment Firms Regulation) and IFD (Investment Firms Directive) apply to all CIFs from 2026. They replaced the CRD IV/CRR framework for non-systemic investment firms. Class 2 and Class 3 firms are subject to a fixed overheads requirement — 25% of the previous year's eligible fixed overheads — as their ongoing capital floor. Class 1 firms are subject to the full CRR requirements, including risk-weighted capital ratios.

In practice, a Class 2 applicant should expect CySEC to require between €200,000 and €500,000 in initial capital, depending on the business plan. A Class 3 applicant should expect €100,000 to €300,000. The statutory minimum is the starting point of the conversation, not the end of it.

Substance is the requirement that applications fail on. CySEC requires a CIF to have genuine operational presence in Cyprus — not a registered address and a part-time compliance officer.

The minimum is four directors, at least three local employees, and mandatory compliance, AML and risk management functions. Directors must be Cyprus residents — CySEC verifies residential addresses, tax residency status, and time spent in Cyprus. A board that meets twice a year in Cyprus and operates from London will not pass the assessment. At least two directors must be non-executive, and at least one must be independent.

The three local employees must be genuinely employed — on Cyprus payroll, paying social insurance, and physically working from the Cyprus office. CySEC conducts on-site visits before and after authorisation to verify that the office is operational. A shared office with a serviced reception is acceptable for the application stage, but the firm must demonstrate that it has secured permanent premises before authorisation.

The compliance function is non-negotiable. The compliance officer must hold the CySEC Advanced Certificate in Compliance or an equivalent qualification, and must be sufficiently senior to report directly to the board. The AML function requires a designated MLCO (Money Laundering Compliance Officer) with CySEC-approved certification. The risk management function requires a dedicated officer responsible for identifying, measuring, and reporting risks across the firm's activities.

Annual staffing and operational cost typically runs €150,000 to €400,000 or more. This is a line item that determines whether the CIF model is viable — if the firm cannot generate enough revenue to cover its substance costs, it will not be authorised. CySEC assesses the business plan's revenue projections with professional scepticism, not optimism.

A registered address alone is not substance. CySEC has rejected applications where the firm proposed a registered office, a part-time compliance consultant, and no full-time staff in Cyprus. The regulator's guidance is explicit: a CIF must be a genuine operating entity in Cyprus, with decision-making, risk management, and compliance functions physically present and functioning.

The substance requirement is what separates a real CIF from a letterbox entity. It is also what makes a Cyprus CIF credible in the eyes of other regulators, counterparties, and clients. The cost is real — but the credibility it provides is the reason the passport is worth having.

The Digital Operational Resilience Act (DORA) applies to all CIFs from 17 January 2025. It imposes a dedicated ICT risk management framework, incident reporting obligations, and regular digital resilience testing.

The ICT risk framework must be documented, approved by the board, and integrated into the firm's overall risk management. It covers ICT asset management, ICT risk identification and assessment, protection and prevention, detection, response and recovery, and communication. CySEC Circular C700 sets out the specific reporting templates and timelines for major ICT-related incidents — a major incident must be reported within four hours of classification, with a follow-up report within 72 hours and a final report within one month.

Digital resilience testing is mandatory. CIFs must conduct annual testing of their ICT systems, including vulnerability assessments, penetration testing, and scenario-based testing. Class 1 firms and firms designated as critical or important under DORA must undergo advanced testing, including threat-led penetration testing (TLPT) supervised by the relevant authority.

Third-party ICT risk management is a specific DORA requirement. CIFs must maintain a register of all ICT third-party providers, assess the risk posed by each, and ensure that contractual terms include audit rights, incident notification obligations, and exit strategies. The European Supervisory Authorities have published a template for ICT services contracts, and CySEC checks compliance during on-site inspections.

DORA also introduces oversight of critical ICT third-party providers. The designation of a provider as critical is made at EU level, and overseen by a lead supervisory authority. CIFs using designated critical providers face additional reporting and contractual requirements.

Non-compliance with DORA is a breach of CySEC's prudential requirements and can trigger enforcement actions including fines, restrictions on activities, and licence withdrawal. The regulation has been in force since January 2025 — it is not a future obligation.

A CIF can provide crypto-asset services without a separate CASP authorisation in two scenarios: through the simplified notification under MiCA Article 60, or because the crypto-asset service is already in-scope under MiFID II.

The simplified notification applies to CIFs that wish to add crypto-asset services listed in MiCA Article 3. The CIF notifies CySEC of its intention to provide the additional services, CySEC has 25 working days to assess the notification, and the CIF can begin providing the services upon a non-objection. No new capital is required — MiCA imposes no additional capital on a CIF already meeting MiFID II requirements. The CIF must update its programme of operations, compliance procedures, and AML framework to cover the crypto-asset services, but the prudential regime remains the IFR/IFD.

Crypto derivatives — including CFDs on crypto-assets, crypto futures, and crypto options — are already MiFID-in-scope financial instruments. A CIF authorised to deal in derivatives can provide crypto-derivative services under its existing licence without any MiCA notification. The instruments are treated as financial instruments under MiFID II Annex I, Section C, and the CIF's existing permissions cover them.

A separate CASP authorisation is required if the firm wishes to provide crypto-asset services that fall outside MiFID II scope — for example, operating a crypto-asset trading platform for spot crypto-assets, providing crypto custody and administration, or placing crypto-assets. The CASP authorisation is a separate licence under MiCA, with its own capital requirements (€50,000 to €150,000 depending on the service), application process, and ongoing obligations. A firm can hold both a CIF and a CASP authorisation.

The interaction between MiFID II and MiCA is a common source of confusion. If the service involves a financial instrument (derivative, structured product) on a crypto-asset, it is MiFID-in-scope and sits under the CIF licence. If the service involves the crypto-asset itself (spot trading, custody, placement), it is MiCA-in-scope and requires either the Article 60 notification or a CASP authorisation.

For a forex broker adding crypto CFDs, the CIF licence is sufficient — the CFDs are financial instruments. For a firm offering spot crypto trading and custody, the MiCA Article 60 notification is the route if it already holds a CIF licence, or a standalone CASP authorisation if it does not.

A CIF authorised by CySEC can provide investment services across the entire EEA under the MiFID II passport. The 30 EEA states comprise all 27 EU member states plus Iceland, Liechtenstein and Norway.

Passporting operates under two mechanisms. The cross-border provision of services (without a branch) uses the Article 34 notification — CySEC transmits the notification to the host regulator, and the firm can begin providing services in the host state once the notification is acknowledged. The establishment of a branch uses the Article 35 notification — CySEC transmits the notification with the branch's details, and the host regulator has two months to confirm receipt and set any local requirements.

The passport covers the investment services and activities listed in the CIF's authorisation. A Class 2 CIF authorised for reception and transmission of orders, portfolio management, and execution of orders on behalf of clients can provide all of these services in any EEA state. The host state cannot impose additional capital requirements, but it can impose conduct-of-business rules, product intervention measures, and marketing restrictions.

The MiFID II passport is the primary reason most CIFs choose Cyprus. The combination of a credible EU regulator, a 15% corporate tax rate, a non-dom regime that exempts dividend distributions, and passporting to 30 EEA states creates a competitive package that few jurisdictions can match. Malta offers the same passport but with a smaller ecosystem and higher substance costs. Ireland and Luxembourg offer the passport with higher costs and more established ecosystems for fund services.

Passporting does not eliminate local obligations. A CIF passporting into Germany must comply with BaFin's marketing rules, register with BaFin, and pay any local levies. A CIF passporting into France must comply with AMF's product governance requirements. The passport gives the right to provide services; it does not exempt the firm from local conduct rules.

A CIF is a Cyprus tax resident company, subject to 15% corporate tax on its worldwide profits from 2026. The rate increased from 12.5% under the 2026 tax reform, but Cyprus remains among the lowest corporate tax rates in the EU.

The effective rate can be lower. Platform software, trading algorithms, and other qualifying intellectual property can be licensed to the CIF under the IP box regime, reducing the effective tax rate on that income to 3% (15% × 20%). For a fintech-driven CIF whose technology is a significant asset, the IP box can substantially reduce the overall effective rate.

Profit extraction is efficient for non-dom shareholders. A non-dom shareholder receiving dividends from the CIF pays 0% SDC (Special Defence Contribution) for 17 years from the date non-dom status is granted. GHS (General Healthcare System) contributions of 2.65% apply on dividend income up to a cap, but the combined rate is far below what most EU jurisdictions impose on dividend income.

The Notional Interest Deduction (NID) under Article 9B of the Income Tax Law provides a further deduction on new equity injected into the CIF. The NID is calculated as a reference rate (the 10-year Cyprus government bond yield plus a 3% premium) applied to the new equity. For a CIF that has injected €500,000 in new equity, the NID could reduce the taxable profit by €25,000 or more per year, depending on the reference rate.

The tax position for owners is the differentiator. A CIF generating €1 million in profit pays €150,000 in corporate tax (15%), and the remaining €850,000 can be distributed as dividends to a non-dom shareholder at 0% SDC plus 2.65% GHS. The combined effective rate — corporate tax plus shareholder tax — is roughly 17.2%. In Ireland, the same structure would pay 12.5% corporate tax plus up to 51% income tax on dividends, for a combined rate of roughly 57%.

Cyprus does not impose withholding tax on dividend payments to non-resident shareholders, and most double tax treaties and the EU Parent-Subsidiary Directive eliminate withholding on payments to corporate shareholders. This makes the CIF structure efficient for both individual and corporate owners.

The CIF application is filed through CySEC's SPIDER portal. It requires a completed application form, a business plan, a programme of operations, corporate documents, and the details of all directors, shareholders, and senior managers.

The application fee, set by CySEC Directive DI87-03, is €7,000 for any of investment services 1 to 7, €25,000 to operate a multilateral or organised trading facility, plus €500 for each ancillary service and €2,000 if the firm will trade algorithmically. The fee is non-refundable, even if the application is withdrawn or rejected.

The completeness review takes 10 to 15 working days from submission. CySEC checks that all required documents are present and correctly formatted. If the application is incomplete, CySEC issues a request for additional information and the clock stops until the firm responds. A well-prepared application passes completeness on the first submission; a poorly prepared one can take months of back-and-forth.

The substantive assessment takes up to six months from a complete file under MiFID II. CySEC reviews the business plan, the fitness and propriety of directors and shareholders, the adequacy of the compliance and risk management framework, the ICT systems, and the capital adequacy. CySEC may request meetings with the board and senior management, conduct on-site visits, and require additional documentation.

The only official deadline is CySEC's: a decision within six months of a complete application (Law 87(I)/2017, art. 7(3)). By industry estimates, the real-world timeline is 9 to 14 months for a Class 2 CIF. Class 3 can be shorter — 6 to 9 months — because the prudential regime is lighter. Class 1 takes longer — 12 to 18 months — because the CRR requirements are more complex and CySEC scrutinises proprietary trading models more closely.

Firms should not plan to launch within six months of deciding to apply. The preparation phase alone — entity formation, hiring directors and staff, securing premises, building the compliance framework, and preparing the business plan — typically takes 3 to 4 months before the application is even filed.

Is a CIF licence right for your business?

Fifteen minutes. We will assess your business model, recommend the right class, and tell you if a different licence route fits better.

The Cyprus CIF licence is one of four financial services licensing routes available in Cyprus. The others — forex broker licence, EMI licence, and payment institution licence — serve different business models.

A forex broker is typically a CIF with a dual Payment Institution structure. If your business model involves forex or CFD brokerage, see the Cyprus forex broker licence guide for leverage limits, negative balance protection, and the CIF-plus-PI structure.

An Electronic Money Institution licence covers e-money issuance and payment services with a minimum capital of €350,000. If your product involves digital wallets, prepaid cards, or stored value, see the Cyprus EMI licence guide.

A Payment Institution licence covers payment services under PSD2 with capital starting at €20,000 for money remittance. If your product involves payment processing or money transfer, see the Cyprus PI licence guide.

For a side-by-side comparison of all four routes — CIF, EMI, PI and CASP — with a single decision flow table, see the financial services licensing hub.

The choice between these licences depends on the business model, not on capital cost alone. A firm providing investment services needs a CIF. A firm issuing e-money needs an EMI. A firm providing payment services without e-money needs a PI. A firm providing crypto-asset services needs either a CIF (for derivatives) or a CASP (for spot). See the hub for the decision flow.