Cyprus Forex License: CySEC Requirements, Approved Domains and Website

A Cyprus forex license is formally a Cyprus Investment Firm (CIF) authorisation, granted by CySEC under Law 87(I)/2017, which transposes MiFID II. Initial capital is EUR 75,000, EUR 150,000 or EUR 750,000 depending on the services you apply for, and authorisation carries passporting rights across the EEA.

For CySEC-regulated brokers, the website is not the last step before launch. It is part of the licensing infrastructure — reviewed by the regulator, checked by liquidity providers, and verified by every banking partner in the chain.

What the Cyprus Forex License Is and What It Costs

A CIF licence is the EU-passportable authorisation a broker needs to operate from Cyprus. Three capital tiers apply, set by the services in your application rather than by your size, and the whole process typically runs six to twelve months from incorporation to activation.

The three tiers

Capital must be paid up in cash into a Cypriot credit institution and stays ring-fenced until authorisation is granted. Treat the tier figure as a floor rather than a target. CySEC assesses the capital your business plan actually requires, and retail brokers are routinely asked to hold materially more. Ongoing own funds then follow the IFR K-factor methodology, not the initial figure.

What else has changed recently

Two frameworks now sit on top of MiFID II for every CIF. DORA has applied since January 2025, which means a documented ICT risk management framework, incident reporting and regular resilience testing. MiCA covers crypto-asset services. Neither is optional, and both affect what your compliance manuals and your website have to say.

Cyprus is a forex license cyprus applicants choose for the passport rather than the price. Offshore jurisdictions are cheaper and faster. What they do not give you is access to thirty EEA markets on one authorisation.

Why Your Website Is Part of the CySEC Licensing Process

Most founders building a forex brokerage treat the website as the final step — something to worry about after the licence is approved. This is a misunderstanding of how the process actually works.

When a company applies for a Cyprus Investment Firm (CIF) licence, CySEC evaluates the overall operational readiness of the applicant. This includes the business plan, organisational structure, compliance framework, capital adequacy — and the client-facing infrastructure. The website sits at the centre of that client-facing infrastructure.

Once authorised, every CIF's official domain is published on CySEC's public register. The regulator maintains a List of Approved Domains — a publicly accessible database linking each regulated firm to its authorised website addresses. CySEC also publishes a separate List of Non-Approved Domains, flagging websites that are not operated by authorised entities.

This system exists for investor protection. It means that the domain you choose, the pages you publish, and the disclosures you display become part of your regulated identity — not just a branding exercise. CySEC rules overlap heavily with other regimes, compared side by side in our guide to broker website compliance requirements by regulator.

Beyond CySEC itself, every counterparty in the brokerage supply chain also reviews the website:

If any of these parties find a website that looks incomplete, misleading, or lacking mandatory disclosures, the onboarding process stalls. A poor website does not just affect conversion — it can delay your entire launch by weeks or months.

CySEC Approved Domains: What They Are and Why They Matter

The List of Approved Domains is one of CySEC's investor protection tools. It is a public register, available on the CySEC website, that maps every authorised CIF to its official website domain(s).

For founders, this has several practical implications:

Domain registration timing

Your domain should be registered and structurally ready before you complete the licensing process. CySEC will need to know which domain(s) will be associated with your CIF. Waiting until after authorisation to think about your domain strategy creates unnecessary delays.

Multiple domains

Some CIFs operate multiple brands or regional sites. Each domain used for client-facing activity needs to be approved and listed. Unapproved domains operating under the CIF's umbrella are a compliance risk.

Non-approved domain warnings

CySEC regularly publishes warnings about unauthorised websites. In recent announcements, the regulator has flagged dozens of domains that falsely claim CySEC regulation or impersonate regulated firms. If your website is not on the approved list, potential clients and partners may treat it with suspicion — or avoid it entirely.

Practical takeaway: Register your domain early. Plan your domain architecture (primary site, regional variants, trading platform subdomains) as part of your licensing preparation, not after. Your compliance officer and legal counsel should be aware of every domain the business intends to use.

What Pages a CySEC Broker Website Must Include

The specific pages required on a CIF broker website are driven by MiFID II, ESMA intervention measures, and CySEC's own supervisory expectations. In April 2025, CySEC Circular C703 explicitly reminded regulated firms that websites must be maintained, transparent, accurate, and regularly updated.

Here is the page structure a CySEC-regulated broker should plan for:

For a detailed breakdown of how these pages differ across CySEC, FCA, and ASIC jurisdictions, see our Broker Website Compliance Checklist for 2026.

Risk Warnings, Fee Disclosures and MiFID II Website Obligations

CySEC operates under the MiFID II framework and enforces ESMA's intervention measures on CFDs. For broker websites, this translates into specific, non-negotiable obligations.

Risk warnings

Every CySEC-regulated broker offering CFDs must display a firm-specific loss percentage — the proportion of retail investor accounts that lose money when trading CFDs with that firm. This figure must be calculated from real client data and updated at least annually, in line with ESMA's Q&A on CFD intervention measures.

The warning must appear prominently on relevant pages — not only in the footer or in a separate legal document. CySEC expects it to be visible at the point where a client makes a decision, not buried where it requires deliberate effort to find.

Fee transparency

Under MiFID II cost disclosure requirements, brokers must present all costs and charges clearly, including spreads, commissions, overnight financing, and any other fees. The information must be provided in a format that allows comparison — not hidden in ranges without context.

If your website states "spreads from 0.0 pips," CySEC may check whether this reflects typical trading conditions or whether it is an edge case presented as a standard. The principle is simple: marketing claims must match the reality documented in your fee schedule.

Content standards

CySEC expects all website content to be "fair, clear and not misleading" — language drawn directly from MiFID II. This applies to every page, including the homepage, product descriptions, promotional banners, and landing pages used in paid advertising campaigns.

CySEC Circular C703, released in April 2025, explicitly reminded regulated entities that websites must be regularly reviewed and updated. The circular emphasised that firms remain responsible for third-party websites operating under their brand — including affiliate sites and white-label partner pages.

Pre-Licence Website vs Post-Licence Website: What You Can Publish Before Approval

One of the most common questions from founders in the licensing process: should we build a full website before we have the licence, or wait?

The answer is nuanced and depends on your jurisdiction, your legal counsel's guidance, and how close you are to authorisation. Here are the general principles:

What you can typically publish pre-licence

A corporate-style website that introduces the company, its vision, the team, and the types of services it intends to offer — without making specific product claims or inviting clients to open accounts. Think of it as a credibility layer that regulators, banking partners, and potential employees can review.

This pre-licence site should include the domain you plan to register with CySEC, basic legal pages (privacy policy, cookie notice), company information, and contact details. It should clearly state that the company is in the process of obtaining regulatory authorisation and is not yet offering investment services.

What you should avoid pre-licence

Do not publish trading conditions, account type comparisons, deposit/withdrawal pages, or anything that could be interpreted as soliciting clients before authorisation. Do not display a licence number you do not yet have. Do not use language suggesting the firm is regulated when it is not.

A pre-licence website that reads like a live brokerage creates risk — both regulatory and reputational. CySEC, or the banking partners reviewing your application, may view it as an attempt to operate before authorisation.

WSA approach: We work with pre-licence brokers to build a compliant website in stages. The first stage is a corporate presence suitable for the application process. The second stage — product pages, compliance pages, onboarding flows, trading platform integration — is prepared in parallel and deployed immediately upon authorisation, so there is no launch delay.

For a deeper comparison of landing page vs full website strategies, see our article on fintech landing page vs full brokerage website.

What Liquidity Providers and Banks Check Before Onboarding

Your website is not only reviewed by CySEC. Every counterparty in the brokerage ecosystem conducts their own due diligence — and the website is often the first thing they check.

Liquidity providers evaluate whether your website accurately represents your regulatory status, product scope, and operational credibility. A website with missing risk disclosures, inconsistent entity information or no visible licence number will raise flags — and may result in a slower onboarding process or outright rejection.

Banking partners — particularly those providing segregated client fund accounts — apply their own compliance standards. They check for AML/KYC policy visibility, complaints procedures, and whether the overall website presents a legitimate, well-governed financial institution.

Payment processors look for clear refund and withdrawal policies, visible legal identity, SSL certification, and risk warnings. A payment provider that services regulated brokers will not onboard a firm whose website does not meet basic trust and compliance thresholds.

The practical consequence: a website that looks unfinished, inconsistent, or non-compliant creates friction with every partner in the chain. This is why the website should be built in coordination with the licensing process, not as a last-minute addition.

Common Website Mistakes That Delay CIF Applications

Based on our experience building websites for regulated brokers, these are the issues we see most often:

1. Missing or inconsistent entity information

The company name on the homepage does not match the entity registered with CySEC. Or the licence number appears in the footer of one page but is absent from others. Regulators and banking partners cross-reference these details — inconsistencies trigger additional questions.

2. Risk warnings treated as decoration

A small, grey-on-white disclaimer at the very bottom of the page does not meet CySEC's expectations. Risk warnings need to be prominent, accurate, and visible where investment decisions are made — not only on the legal page.

3. Aggressive marketing claims

"Start trading and earn money today." "Zero risk with our platform." "Guaranteed returns." These statements violate the "fair, clear and not misleading" standard and can trigger supervisory action. CySEC has been increasingly proactive about scanning broker websites for exactly this type of language.

4. No complaints procedure

CySEC requires regulated firms to have a visible and accessible complaints handling process. Many pre-launch websites omit this entirely, creating a gap that needs to be addressed before the site can be considered compliant.

5. Legal pages published as afterthoughts

Terms and conditions copied from a template, privacy policies that reference the wrong jurisdiction, AML policies that describe generic procedures rather than the firm's actual processes. Regulators read these pages. Banking partners read these pages. If they look generic, they undermine the credibility of the entire application.

6. Multi-language inconsistencies

Offering the website in multiple languages but only translating product pages — not legal pages or risk disclosures — creates compliance gaps. If you serve clients in a language, your disclosures must be available in that language.

Frequently Asked Questions

How much capital do you need for a Cyprus forex license?

Initial capital depends entirely on which investment services you apply for. Firms that receive and transmit orders, advise, or manage portfolios without holding client funds or financial instruments fall in the EUR 75,000 tier. Firms authorised to hold client money or instruments, which covers most STP brokers, need EUR 150,000. Firms dealing on own account, market making, or underwriting on a firm-commitment basis need EUR 750,000. The figure has to be paid up in cash and held in a Cypriot credit institution, ring-fenced until authorisation is granted. Treat the statutory minimum as a floor rather than a target: CySEC assesses the capital your business plan actually requires, and retail brokers are commonly asked to hold materially more than the tier minimum. Ongoing own funds then follow the IFR K-factor methodology rather than the initial capital figure.

What are CySEC approved domains?

The List of Approved Domains is a public register on the CySEC website that maps every authorised Cyprus Investment Firm to its official website domain or domains. CySEC also maintains a separate list of non-approved domains, published so clients can identify firms falsely claiming Cypriot authorisation. For a licensed broker this means the domain is part of the regulatory record rather than a marketing choice. Every domain you operate under, including regional variants and platform subdomains, has to be declared and approved, and adding one later is a notification process rather than a free decision. Clients increasingly check the register before depositing, so a domain that does not appear on it costs you conversions even when the licence is genuine.

Can a broker apply for a CySEC licence with only a landing page?

Yes, but the page needs careful scoping. A minimal corporate page is workable during the application phase: it can introduce the company, give contact information and include basic legal notices. What it must not do is solicit clients, advertise account types, leverage or spreads, or imply the firm is already authorised. Anything that reads as a financial promotion for a regulated product is a problem before the licence exists. The practical limit comes from your commercial partners rather than the regulator. Banking providers, liquidity providers and payment processors usually want to see a substantive site before onboarding, and those reviews often run in parallel with the CySEC application, so a placeholder becomes a bottleneck sooner than applicants expect.

What pages should a CySEC-regulated broker website include?

At minimum: a risk disclosure with the firm-specific CFD loss percentage, terms and conditions, an AML and KYC policy, a privacy policy, a complaints procedure, client categorisation information, and correct display of the legal entity, licence number and registered address. Cookie and consent handling belongs on the same list as a page-level GDPR obligation. Two things about this list cause more problems than the list itself. The loss percentage must be calculated from your own client outcomes and refreshed at least annually, so it needs to sit in an editable CMS field rather than inside a design. And prominence is a rule, not a preference: reducing the size of a risk warning to protect the layout creates a compliance issue.

What website pages do liquidity providers and payment processors check?

Liquidity providers typically check regulatory status, product scope, entity structure and jurisdictional disclosures, because they need to know what you are authorised to offer and to whom. Payment processors focus on legal identity, risk warnings, refund and chargeback terms, and whether the described business matches the merchant application. Banks review much the same ground with more attention to the corporate entity. What all three share is that they read the public site as evidence rather than as marketing, and their standards are usually stricter than the regulator's because they carry commercial risk directly. The practical implication is that a site sufficient for CySEC may still fail a payment provider's review, so build for the stricter audience.

What should a pre-licence broker avoid saying on its website?

Avoid any language suggesting the firm is already regulated, any invitation to open accounts or deposit funds, specific trading conditions (spreads, leverage), performance claims, and any display of a licence number you do not yet hold. The website should clearly state that the company is in the process of obtaining authorisation.