Cyprus Investment Firm
For MiFID investment services and activities such as reception and transmission of orders, execution, portfolio management, investment advice, dealing on own account or underwriting, depending on permission scope.
European Union financial licensing
Cyprus Financial Licensing
Practical, end-to-end support for Cyprus Investment Firm (CIF), Electronic Money Institution (EMI), Payment Institution (PI), AIFM and MiCA crypto-asset service provider authorisation.
- CySEC and CBC pathways
- EU regulatory framework
- Application-to-launch support
Why Cyprus
An established EU base for regulated financial services
Cyprus combines EU financial-services legislation with an established ecosystem of investment firms, payment businesses, fund managers, professional advisers and technology providers.
- Access to EU or EEA passporting mechanisms where the relevant framework and permission scope allow.
- English is widely used in business, professional services and application preparation.
- Established brokerage, payments, funds and compliance talent pool.
- EU-wide prudential, conduct, AML/CFT and operational-resilience standards.
- Multiple regulatory routes for investment, payment, fund-management and crypto-asset models.
Passporting is not automatic. Cross-border activity remains subject to the licence permissions, the applicable notification procedure, local conduct rules and any restrictions in the intended host market.
Licence routes
Choose the route that matches the regulated activity
A licence should be selected by reference to the actual services, client types, asset flows, custody arrangements and geographic plan—not simply by the preferred label.
EMI or PI
For issuing electronic money and/or providing regulated payment services, with safeguarding, governance, prudential, operational and reporting obligations.
AIFM and AIF structures
For managing alternative investment funds or establishing an eligible Cyprus fund structure. The manager authorisation and the fund’s establishment, registration or notification must be assessed separately.
Crypto-asset services
For custody, trading-platform operation, exchange, execution, placing, transfer and other crypto-asset services within the scope of the EU Markets in Crypto-Assets Regulation.
Regulatory responsibility
Two principal authorities, different application frameworks
CySEC
The Cyprus Securities and Exchange Commission is the competent authority for Cyprus Investment Firms, AIFMs and relevant fund structures, and MiCA crypto-asset service provider authorisation in Cyprus.
CBC
The Central Bank of Cyprus is the competent authority for Payment Institutions and Electronic Money Institutions. From 3 August 2026, prospective EMI and PI applicants must first complete the CBC’s pre-application exploratory stage.
Prudential planning
Indicative minimum initial capital
Capital depends on the exact services and legal category. Minimum initial capital does not replace ongoing own-funds, liquidity, safeguarding or other prudential requirements.
| Route | Indicative minimum | Key qualification |
|---|---|---|
| CIF | €75,000 / €150,000 / €750,000 | The applicable level depends on the services, whether the firm holds client money or securities, and whether it undertakes own-account dealing, underwriting or firm-commitment placing. Ongoing IFR/IFD requirements also apply. |
| Electronic Money Institution | €350,000 | Additional ongoing own-funds and safeguarding requirements apply to the proposed e-money and payment model. |
| Payment Institution | €20,000 / €50,000 / €125,000 | The level depends on the payment services requested. An AISP-only model follows a registration and professional-indemnity framework rather than the same PI capital schedule. |
| External AIFM | €125,000 | Additional own funds may be required by reference to assets under management, subject to the applicable AIFMD rules and any permitted insurance arrangement. |
| Internally managed AIF | €300,000 | The correct structure depends on the fund form, investor category, investment strategy and management arrangement. |
| MiCA CASP | €50,000 / €125,000 / €150,000 | Class 1, 2 or 3 depends on the crypto-asset services. Prudential safeguards are generally the higher of the class minimum and one quarter of the preceding year’s fixed overheads. |
Figures are regulatory starting points, not a quotation or a complete capital assessment. The final requirement must be confirmed against the applicant’s permissions, structure and current law.
Application journey
From feasibility to operational readiness
Scope and feasibility
Map regulated services, clients, markets, asset flows, permissions, capital and key risks.
Ownership and substance
Assess shareholders, UBOs, group structure, board, key functions, office and staffing plan.
Application build
Prepare the programme of operations, forecasts, policies, controls, agreements and evidence.
Submission and review
Coordinate filing, regulator questions, interviews, amendments and supporting documentation.
Conditions and launch
Complete capital, staffing, technology, outsourcing, banking, reporting and readiness actions.
Special EMI/PI step from 3 August 2026: the CBC pre-application exploratory stage requires a Pre-Application Document and a non-refundable €5,000 fee. The preliminary assessment is normally completed within 30 working days, or up to 50 working days where enhanced due diligence is requested. The subsequent formal application fee is €10,000. Completion of the exploratory stage does not constitute approval.
Core requirements
What regulators expect to see
Ownership and governance
- Transparent source of wealth and source of funds
- Suitable shareholders and qualifying holders
- Fit-and-proper board and senior management
- Clear segregation of duties and decision-making
Cyprus substance
- Registered and head-office requirements where applicable
- Effective management and decision-making in Cyprus
- Physical premises appropriate to the business
- Credible local staffing and time-commitment plan
Control functions
- Compliance and AML/CFT oversight
- Risk management and internal audit
- Financial control and regulatory reporting
- Independence and outsourcing assessed proportionately
Client and asset protection
- Client classification and conduct controls
- Safeguarding or segregation where applicable
- Reconciliations and complaints handling
- Clear disclosures, agreements and terms
AML and financial crime
- Business-wide risk assessment
- CDD, EDD, sanctions and PEP screening
- Transaction monitoring and suspicious reporting
- Training, recordkeeping and testing
Technology and DORA
- ICT governance and risk-management framework
- Incident classification and reporting
- Resilience testing, BCP and disaster recovery
- ICT third-party risk, contracts and registers
Application evidence
Documents we develop and coordinate with you
Regulatory business planBusiness model, services, target markets, operational structure and implementation plan.
Financial modelBase and stress projections, capital, liquidity, own-funds and break-even assumptions.
Ownership packageGroup chart, UBO evidence, source of wealth/funds and qualifying-holding documentation.
Governance frameworkBoard structure, committee terms, role profiles, time commitments and decision rights.
AML/CFT frameworkRisk assessment, customer due diligence, monitoring, sanctions and reporting procedures.
Compliance and riskMonitoring plan, conflicts, complaints, product governance and risk-control arrangements.
Safeguarding modelFund flows, safeguarding accounts, segregation, reconciliations and insolvency protection.
ICT and DORASystems architecture, security, incidents, resilience testing, continuity and third-party risk.
Outsourcing inventoryDue diligence, agreements, service levels, audit/access rights, registers and exit planning.
Customer documentsTerms, disclosures, privacy, complaints and client-facing risk information.
Personnel evidenceCVs, references, questionnaires, responsibilities and fit-and-proper support.
Launch readinessConditions tracker, reporting calendar, testing evidence, training and operational runbooks.
Indicative timing
Plan for preparation, completeness review and regulatory assessment
CIF
Common planning range: 6–12+ months.
CySEC’s statutory decision period is linked to submission of a complete application. Preparation, completeness work and responses can extend the end-to-end timeline.
EMI / PI
Common planning range: 9–15+ months.
Allow additional time for the CBC pre-application exploratory stage, formal assessment, ownership review, management suitability and operational evidence.
AIFM / MiCA CASP
Scope-dependent.
Timing depends materially on permissions, ownership, management readiness, fund structure or crypto services, outsourcing and application completeness.
All timelines are non-binding estimates. Regulatory workload, interviews, requests for information and changes to the proposed model may materially affect timing.
FinPro support
One coordinated workstream from planning to go-live
Strategy and feasibility
Permissions mapping, regulator-route assessment, capital planning, substance blueprint, gap analysis and implementation roadmap.
Application coordination
Entity and team workstreams, policy suite, application forms, evidence index, filing support and regulator-question coordination.
Operational readiness
Conditions tracking, control implementation, outsourced-provider coordination, reporting calendar, training and launch-readiness support.
Frequently asked questions
Cyprus licensing FAQs
Which Cyprus licence is suitable for a forex or CFD broker?
A broker carrying on MiFID investment services will generally require a CIF authorisation with permissions matched to its execution model, handling of client assets and any own-account activity. The correct scope must be determined from the full operating and order-flow model.
Can a Cyprus licence be passported across Europe?
Many CIF, EMI, PI, AIFM and MiCA permissions benefit from EU cross-border mechanisms, but passporting is neither automatic nor unlimited. The firm must complete the relevant notification process and comply with its permission scope and applicable host-state rules.
Can a new applicant still obtain the former Cyprus CASP registration?
No. The national CASP transition has ended. A new crypto-asset service provider should assess authorisation directly under MiCA. Legacy transitional arrangements do not constitute a new application route.
Is the CBC EMI/PI pre-application stage optional?
No. For prospective EMI and PI applications under the process effective from 3 August 2026, the pre-application exploratory stage precedes the formal licensing application. It includes a preliminary assessment and an initial meeting, but does not guarantee approval.
Must the business have real operations in Cyprus?
Applicants should expect meaningful Cyprus substance appropriate to their model, including effective management, suitable premises, local staffing and sufficient time commitment from key personnel. A registered address alone is not an adequate operating model.
Does meeting minimum capital guarantee authorisation?
No. Capital is only one requirement. Regulators also assess ownership, reputation, governance, competence, business viability, safeguarding, AML/CFT, technology, outsourcing, DORA readiness and the applicant’s ability to operate on an ongoing basis.
Discuss your Cyprus licensing plan
Tell us what services you intend to provide, where your clients will be located and how money, orders or crypto-assets will flow. We will help define the appropriate route and the work required before submission.
