Broker Website Compliance Checklist (CySEC, FCA, ASIC) for 2026

A broker website is legally treated as a financial promotion, not marketing material. Under CySEC, FCA and ASIC rules that means risk warnings with firm-specific loss figures, balanced performance claims, accessible legal documentation, and correct display of the licensed entity and its registration details. Here's what that means in practice.

Websites play a central role in how brokers present themselves to the market. For many clients, it is the first point of contact and often the main source of information about products, pricing, and trading conditions. Clear explanations build trust. Transparent fee structures reduce misunderstandings. Accessible documentation supports informed decision-making.

However, visibility brings responsibility. The same content that attracts clients must also meet regulatory standards. Product descriptions, performance claims, leverage information, and even design elements can carry compliance implications. A well-designed website is important — but a legally sound one is essential. Balancing clarity, competitiveness, and regulatory accuracy is no longer optional for regulated brokers.

Your Website Is Now a Supervised Communication Channel

If you still think of your website as “marketing,” you’re already behind.

In 2026, regulators don’t separate branding from regulation. If a page promotes a leveraged product, it is part of your regulated activity. That includes the homepage hero banner, the “Why Trade With Us” section, Google Ads landing pages, and even that microsite an affiliate built six months ago.

Supervisors are no longer reacting only to complaints. They actively scan websites. They compare risk warnings. They check whether spread claims match fee disclosures. They look at whether professional client language is quietly being used to attract retail traders.

Under the FCA’s financial promotion rules (COBS 4), this kind of online communication clearly falls within scope.

The review process has become proactive. And digital.

What Regulators Actually Care About

Strip away the formal language and the principles are consistent across jurisdictions:

Is the client clearly told who they are dealing with (for example, via the FCA Register, the CySEC CIF Register, or the ASIC Professional Registers)?

Are the risks impossible to miss under the ESMA CFD intervention measures?

Does the marketing exaggerate, contrary to the FCA requirement that communications be “fair, clear and not misleading”?

Does the website match the legal documentation?

Is the product being promoted to the right audience under frameworks such as ASIC’s Design and Distribution Obligations (RG 274)?

If the answer to any of those is “not quite,” you’re exposed.

The Non-Negotiables (All Jurisdictions)

1. Clear Legal Identity

This is basic — yet often poorly executed.

Your legal entity name, registration details, and license number should be obvious. Not buried in a collapsible footer. Not hidden in a PDF. Not different across language versions.

Linking directly to the regulator’s public register — whether that’s the FCA Register, the CySEC public register, or the ASIC registers — isn’t mandatory everywhere, but it signals transparency and reduces doubt.

If a compliance officer can’t immediately see which entity operates the site, that’s a problem.

2. Risk Warnings That Are Actually Visible

Risk warnings are not branding elements.

For CFD brokers under UK or EU rules, the loss percentage must reflect your real client data and must be updated annually in line with the ESMA Q&A on CFD intervention measures. The format is prescribed. The prominence is prescribed.

The FCA also sets specific expectations for high-risk investment communications, detailed on its high-risk investments guidance page.

ASIC approaches this differently, but the principle is similar: risk disclosure must be meaningful and tied to product documentation, particularly the Product Disclosure Statement under ASIC Regulatory Guide 227.

3. Marketing That Matches Reality

This is where issues usually start.

If your website highlights “spreads from 0.0 pips,” regulators may check:

How often does that occur?

Under what conditions?

Does your fee schedule reflect it?

Is the risk explanation proportionate to the benefit claim?

In the UK, permanent restrictions on CFDs and marketing practices are outlined in the FCA’s CFD product intervention statement.

Aggressive language attracts attention. So does imbalance.

Retail protection frameworks don’t prohibit strong marketing — they prohibit misleading impressions.

4. Documentation That Is Actually Accessible

Client agreements, privacy policies, execution policies, complaints procedures — these should be public and current.

Key documentation requirements across regulators include:

ASIC requires publicly available PDS and TMD documents under its DDO framework (RG 274).

UK and EU frameworks require transparent disclosure of costs and execution policies under MiFID II.

The mistake brokers make is simple: updating products but forgetting to update documents everywhere.

Regulators notice inconsistencies.

CySEC: EU Expectations in Practice

CySEC follows MiFID II and ESMA intervention rules. That means retail investor protection is central.

In practical website terms, this means:

Your CFD loss percentage must be firm-specific under the ESMA intervention framework.

Investor Compensation Fund coverage (currently €20,000) must be clearly disclosed, as outlined on the official CySEC Investor Compensation Fund page.

PRIIPs KIDs must be accessible before a transaction under the PRIIPs Regulation.

Client categorisation (retail vs professional) must be explained properly.

CySEC also expects marketing to be “fair, clear, and not misleading.”

If your website reads like trading is easy and routine, expect questions.

FCA: Precision Matters

The FCA is detail-oriented.

Warning wording is prescribed under COBS 4.

Formatting is prescribed. Color contrast requirements exist.

Since Consumer Duty, the regulator looks beyond disclosure toward outcomes, as explained in the FCA’s Consumer Duty policy statement (PS22/9).

In simple terms: would a retail client reasonably understand the risk from reading this page?

If an influencer promotes your product to UK clients, that content falls under your regulatory responsibility — something the FCA has reinforced through its recent crackdown on illegal financial promotions.

Website compliance in the UK is not only about what you say — but how you say it.

ASIC: Distribution Is the Focus

ASIC’s framework increasingly centers around the Design and Distribution Obligations (RG 274).

It’s not enough to disclose risk. You must also demonstrate that the product is being promoted to its defined target market.

For Australian-facing websites, this means:

AFSL details must be clearly visible and verifiable via the ASIC registers.

The PDS must be current and downloadable.

The Target Market Determination must be public.

Leverage caps must reflect ASIC limits (e.g., 30:1 for major FX pairs), as introduced under ASIC’s CFD product intervention order.

If marketing language attracts a broader audience than your TMD allows, that creates regulatory tension.

Compliance by jurisdiction

Requirements differ by authority. These guides cover what each regulator expects to see published, and when in the application it matters.

Seychelles (FSA)

• Securities dealer licence checklist — the full application document set

• Whether you need a website before applying — sequencing the site against the application

• Compliance documents to publish post-approval — structuring a /legal/ hub that passes LP due diligence

Mauritius (FSC)

• Investment dealer licence checklist — what the FSC asks for

• Broker compliance documents — required website disclosures

Bahamas (SCB)

• DARE application checklist for crypto exchanges — digital asset registration

• SCB licence documents — broker checklist and website guide

South Africa (FSCA)

• ODP licence application — over-the-counter derivative provider route

• Broker compliance documents — what belongs on the live site

Dubai (DFSA)

• Authorisation checklist — DIFC application stages

• Website compliance documents — DIFC pages and placement

Cyprus (CySEC)

• Website requirements for forex brokers — CySEC-specific disclosure rules

• Whether you need a website for a CySEC licence — timing against the application

Final Thoughts

Website compliance in 2026 is not cosmetic.

It’s operational.
It’s supervisory.
And increasingly, it’s data-driven.

Regulators are no longer waiting for complaints before reviewing digital communications. They monitor websites, landing pages, and online promotions as part of ongoing supervision. That means inconsistencies — even minor ones — can trigger questions.

Brokers that integrate compliance into marketing workflows and conduct structured, jurisdiction-specific reviews significantly reduce risk. Those who treat their website as “just marketing” are relying on luck.

In a regulated environment, transparency is not optional — and neither is oversight.

FAQ

1. Is a broker’s website legally considered a financial promotion?

Yes, in most major jurisdictions. Under UK rules the FCA treats a website promoting a regulated product as a financial promotion, and the same principle applies across the EU under MiFID II and in Australia under ASIC's conduct rules. The practical consequence is that ordinary marketing decisions become compliance decisions. A landing page for a CFD account has to carry risk warnings with firm-specific loss percentages, balanced performance claims and correct entity details, and it must not disguise or obscure those warnings for the sake of visual hierarchy. Offshore regimes word the requirement differently, but banks, payment providers and liquidity providers apply comparable standards during their own onboarding, so the practical bar is similar wherever the licence is held.

2. Where can clients verify a broker’s license?

Through the regulator's own public register, which every major authority maintains and keeps searchable by firm name or licence number. The FCA publishes the Financial Services Register, CySEC publishes its register of Cypriot Investment Firms, and ASIC publishes its professional registers. Offshore authorities including the FSA in Seychelles, the FSC in Mauritius and the SCB in the Bahamas maintain equivalents. What matters for a broker's website is that the details a client finds on the register match the details on the site exactly: legal entity name, licence number and registered address. A mismatch, even an outdated address, reads as a red flag to a client who is specifically checking whether the firm is genuine.

• FCA Financial Services Register: https://register.fca.org.uk/

• CySEC CIF Register: https://www.cysec.gov.cy/en-GB/entities/investment-firms/cypriot/

• ASIC Professional Registers: https://asic.gov.au/online-services/search-asic-s-registers/professional-registers/

3. Do affiliate or IB websites fall under the broker’s responsibility?

In most cases, yes. Where third parties promote a licensed firm's regulated products, regulators generally expect the licensed entity to exercise oversight and ensure those communications meet financial promotion standards. Responsibility does not transfer to the affiliate simply because the affiliate wrote the copy. In practice this means maintaining an approved-materials process, reviewing what partners publish, and being able to demonstrate that review if a supervisor asks. The exposure is real: an affiliate promising returns or omitting a risk warning creates a problem for the broker's licence, not for the affiliate's. Firms running introducing-broker or affiliate programmes should treat partner pages as part of their own compliance surface.

4. How often should CFD loss percentages be updated?

At least annually, using firm-specific data rather than an industry average. Under UK and EU frameworks the percentage of retail accounts losing money has to be calculated from the firm's own client outcomes and refreshed at minimum once a year. Significant changes in client performance may require an earlier update, and a figure that no longer reflects reality is a disclosure problem rather than a stale statistic. The operational consequence is that the number cannot be hardcoded into a design. It needs to sit in a CMS field or an editable component so compliance can change it without a developer, because a website that takes two weeks to update becomes a liability the day the calculation changes.

5. How often should a broker conduct a website compliance review?

At minimum once a year, plus a review triggered by specific events rather than by the calendar. The events that should prompt an unscheduled review are a regulatory update in any jurisdiction the firm serves, a change in leverage or pricing, expansion into a new market, a new product line, and any major marketing campaign. An annual review alone tends to catch problems months after they appear. The practical approach is a short recurring check on the items most likely to drift, which are loss percentages, entity details, product descriptions and jurisdictional restrictions, combined with a rule that compliance sees any new landing page before it goes live rather than after.