Every founder we speak to about licensing eventually reaches the same fork: do we take a fast offshore license and start trading, or do we do this properly and go for an EU-regulated one? Cyprus sits at the centre of that second path. A CySEC license is one of the most recognised regulatory credentials a retail forex broker can hold, and it comes with something offshore licenses can’t offer: the ability to serve clients across the EU. But it’s also slower, costlier, and far less forgiving. Here’s the roadmap as it actually plays out, including the parts that surprise people.
What a “CySEC forex license” actually is
There’s no product literally called a forex license. What brokers mean is a Cyprus Investment Firm (CIF) authorization from the Cyprus Securities and Exchange Commission, issued under MiFID II. Forex and CFD trading fall under specific investment services within that authorization, so the permissions you request (execution of orders, dealing on own account, and so on) determine your capital and your obligations.
Once authorized, a CIF can passport its services across the EU/EEA by notifying CySEC, rather than seeking a separate license in each country. That passport is the main reason brokers accept the extra cost.
The roadmap at a glance
| Stage | What happens | Typical duration |
| 1. Business model and permissions | Decide which services you need, and whether you’ll hold client funds or deal on own account | 2–4 weeks |
| 2. Company setup and substance | Incorporate the Cyprus company, secure office, appoint directors and key staff | 2–3 months |
| 3. Documentation | Programme of operations, policies, business plan, financial projections, fit-and-proper files | 2–4 months |
| 4. Capital | Prove and place the initial capital | Runs in parallel |
| 5. CySEC review | Application assessment, questions, and follow-ups | Several months |
| 6. Authorization and launch prep | Final conditions, systems, and go-live | 1–2 months |
Overall, plan for roughly 12 to 16 months from start to authorization. Some applications move faster, but founders who budget for six months are usually disappointed.
Step 1: Choose your permissions carefully
This is the decision that drives everything else, so it deserves more time than it usually gets.
| Business model | Typical initial capital |
| Order execution/reception, no client funds held | €75,000 |
| Same services, holding client funds | €150,000 |
| Dealing on own account (market maker style), holding client funds | €750,000 |
Capital isn’t a one-time hurdle either. After authorization, requirements are reassessed against your fixed overheads and the risks of what you do, so your real ongoing requirement can exceed the initial figure.
The practical question we ask founders: will you hedge client flow with liquidity providers, or run a dealing desk? The answer moves you between capital tiers, and it changes your risk framework too.
Step 2: Build genuine substance in Cyprus
CySEC wants a company with a down-to-earth presence, not a “brass-plates” company. That translates to:
- A fully functional Cyprus office!
- A board of the appropriate size and local executive board members who are actively involved
- Key function holders in compliance, risk management & internal audit, both hired and appropriately outsourced
- A fit and proper money laundering compliance officer (MLCO).
The staffing may be flexible, such as outsourcing some of the functions, but regulators take a dim view of the actual decision-making process in Cyprus. The biggest reason for applications being delayed is treating it as paperwork.
Step 3: Prepare the application pack
The application is not a form, but rather a large mass of documents. Expect to produce:
- A plan for what you’ll do and how you will do it
- A business plan including multi-year financial projections.
- Policies and procedures for governance, risk management and conflict of interest.
- AML/KYC procedures and client onboarding processes.
- Order execution policy, client categorisation, and complaints handling
- Fit and proper information about shareholders, directors and key staff members, including source of funds and wealth of the qualifying shareholders.
Quality matters more than speed here. Thin or generic documents generate rounds of questions, and every round adds weeks.
Step 4: Prove the capital and the money
CySEC doesn’t only check that capital exists. It checks where it came from. Qualifying shareholders should expect detailed scrutiny of the source of funds and source of wealth, with documents that tell a consistent story. Founders with complex or cross-border finances should start assembling these early, because gaps here stall everything else.
Step 5: The review itself
During assessment, CySEC will ask questions, request clarifications, and sometimes interview the people who’ll run the firm. A few habits help:
- Answer completely rather than quickly; partial answers create another round
- Make sure directors and key staff can discuss the business model in their own words
- Keep your documents internally consistent, since contradictions between the business plan and the policies are a classic red flag.
What it costs
Costs depend heavily on your model, so treat any single number with caution.
| Cost area | What to expect |
| Initial capital | €75,000 to €750,000 depending on permissions |
| Application and license fees | Per CySEC’s fee schedule, per service authorised |
| Legal and advisory | A significant line item, often well into five figures |
| Substance (office, staff, directors) | Usually the largest recurring cost |
| Technology and compliance systems | Platform, CRM, reporting, and monitoring tools |
| Investor Compensation Fund contribution | Required once authorized |
One warning on fees: CySEC consulted in January 2026 on changes to investment firm fees, including higher per-service license fees and supervision charges. Those were proposals, and reported figures vary between sources, so confirm the current official fee schedule with CySEC or your adviser before building your budget around any number.
What changes after you’re licensed
Authorization is the start of the compliance burden, not the end of it.
- Leverage and risk warnings: EU retail rules cap leverage (for example, 30:1 on major currency pairs) and require standardized risk warnings and negative balance protection
- Marketing restrictions: CySEC applies strict rules on promotions, bonuses, and affiliate activity, which affects how you run IB programs and ads
- Reporting: Regular regulatory reporting, transaction reporting, and capital adequacy reporting
- Operational resilience: EU requirements such as DORA place real demands on your IT and third-party risk management
Brokers coming from offshore often underestimate this. Your marketing, your IB structure, and your product offering all need to be designed for these rules from the beginning.
Where applications go wrong
- Underestimating substance: Directors and staff who exist on paper but not in practice
- A vague business model: Applications that can’t clearly explain how money flows and how risk is managed
- Weak source-of-funds documentation for qualifying shareholders
- Choosing the wrong permissions and having to restructure mid-application
- No plan for after authorization, including liquidity, banking, and technology being sorted only at the last minute.
Is CySEC right for you?
It is fitting if you choose to serve clients from the EU, are interested in a solid reputation for banking and partners, and have the capital, manpower, and time to invest. If you have to go to market within weeks or wish to have minimal operations, it’s a poor fit. There are plenty of brokers that begin offshore, grow, and then get licensed by CySEC, or ones that don’t start offshore in the first place. Both are correct, but the error is in choosing without knowing the trade-off.
How Device Doctor India can help
A CySEC license is only one half of the work. The other half is the technology and operations around it: a CRM with compliant onboarding and KYC, back-office reporting, IB and affiliate controls that respect marketing rules, and payment and platform integration. At Device Doctor India, we build that layer for forex brokers and plan it alongside your licensing timeline, so it’s ready when authorization arrives instead of becoming a months-long delay afterward. Take a look at our Forex CRM to see how this fits together.
Figures and rules in this guide reflect sources available at the time of writing and can change. Always confirm current requirements with CySEC or a qualified Cyprus legal adviser before applying.
If you’re planning a CySEC application and want the technology and operations built in step with it, book a free consultation or call Device Doctor India directly at +91 81144 71036.
The total period is around 12 to 16 months; it will depend on the workload of CySEC and the quality of your application.
This varies from €75,000 to €750,000, based on whether or not you retain client funds and whether or not you trade on your own account.
Yes in general, but each EU/EEA country will have their own local marketing and conduct rules.
It is not a mailbox company; it is an office that has real substance that is involved in the community and has directors in the community.
It provides greater credibility and EU access, but at a higher cost, at a slower pace and at a more demanding set of rules. It will depend on your clients and budget.
