Cyprus Investment Firm (CIF) Licence in Cyprus
A Cyprus Investment Firm (CIF) licence, issued by the Cyprus Securities and Exchange Commission (CySEC)under Law 87(I)/2017 — Cyprus’s MiFID II transposition — is one of the most widely used EU investment firm authorisations for forex brokers, CFD providers, asset managers, and multi-asset investment platforms.
A CIF authorises a defined set of MiFID II investment services: reception and transmission of orders, execution, portfolio management, investment advice, and depending on capital class, dealing on own account. Once authorised, a CIF can passport services across all 30 EEA member states without separate national applications. Capital tiers follow IFR/IFD standards: €75,000 for advice and reception/transmission; €150,000 for firms holding client funds or conducting portfolio management; €750,000 for market-making or dealing on own account.
Important scope boundary: a CIF does not cover crypto-asset services under MiCA. Spot crypto exchange, custody, and trading platform activities require a separate CySEC CASP authorisation. Cyprus applies 12.5% corporate income tax, and Pillar Two global minimum tax (15%) applies only to very large groups.
New CySEC applications realistically take 12–18 months. A ready-made CIF entity provides immediate access to an existing authorisation — subject to CySEC’s mandatory change-of-control approval and fit-and-proper checks on incoming controllers and directors.
Legasset assists clients with both ready-made CIF acquisitions and new CySEC applications — capital structuring, governance setup, change-of-control filings, and post-approval compliance.
Ready to Buy CIF Licenses in Cyprus
Licensed Investment Firm (CIF) for Sale
An excellent opportunity to acquire a fully licensed Cyprus Investment Firm (CIF), ready to operate under MiFID II and serve clients across EU markets.
- Licensed for brokerage services, own-account trading, and portfolio management
- Clean regulatory history with no fines or client complaints
- Established banking network in Cyprus and internationally
- Trading platforms fully integrated and operational
- Strong capital position with adequacy ratio above 110%
- Modern office infrastructure included
- No outstanding tax liabilities
Related Cyprus and EU investment firm licences
Key Takeaways for Cyprus Investment Firm (CIF) in Cyprus
- CIF under CySEC gives EU-wide MiFID services with a head office in Cyprus and passporting via notifications—substance is mandatory.
- IFR/IFD capital €75k/€150k/€750k applies by permissions; client assets follow DI87-01 with ICF up to €20,000 per client.
- Taxes: corporate income tax is 12.5%; a possible 15% applies mainly to large groups under Pillar Two—plan group structures accordingly.
- Scope limits: spot-crypto needs MiCA CASP authorisation; a CIF alone does not cover exchange, custody, or platform services in crypto.
- Costs and “hidden” items: DI87-03 fees + annual audit, reporting tools, staff certification/CPD, and banking/PSP onboarding—expect sanctions screening to add work and time.
- Timelines: CySEC publishes no official timeline; realistic plans include Q&A rounds and banking lead times. Legasset supports both a ready-made CIF purchase and a new application, including filings, capital planning, and post-approval setup.
What You Need to Know About the Cyprus Investment Firm (CIF) Licence in Cyprus
Table of Contents
A CIF is an EU investment firm authorised by Cyprus Securities and Exchange Commission (CySEC) to provide MiFID II services from a head office in Cyprus. Typical permissions include reception and transmission of orders, execution, portfolio management, and placing/underwriting where authorised. Initial capital: €75,000–€750,000 depending on activities under IFR/IFD; client money/assets must be safeguarded, with ICF compensation up to €20,000 per client. This suits brokers, asset-managers, and fintechs needing regulated EU access and passporting via MiFID notifications. Note limits: strict AML/sanctions screening, detailed reporting (Class 2 quarterly; Class 3 annually), and scope bound to the granted services. Spot-crypto services fall under MiCAR CASP—CIF alone is not sufficient.
Why now: CySEC continues active supervision and updates (2025 circulars and fees directives), while MiCAR is live for CASPs, pushing firms to clarify whether their crypto activity is MiFID- or MiCAR-scope.
Regulator, laws, taxes, and current shifts (what operators must track)
Competent authority: CySEC (independent public supervisor). Core laws: Law 87(I)/2017 (MiFID II transposition), MiFIR, and Commission Delegated Regulation (EU) 2017/1943 on authorisation information. Prudential regime: IFR/IFD with K-factors and own-funds tests. Cyprus maintains a public CIF register and a former-CIFs list signalling ongoing enforcement. Corporate income tax is 12.5% (Pillar Two 15% applies only to very large groups). Expect enhanced screenings tied to EU restrictive measures to influence banking/PSP onboarding.
Legasset supports both pathways: purchasing a ready-made CIF (subject to change-of-control approval and fitness checks) or applying for a new authorisation with full filings, governance setup, and operational readiness. Next, we detail eligibility, capital class selection, staffing, and documentation so you can map costs and timelines precisely.
Eligibility Requirements for Obtaining a Cyprus Investment Firm (CIF) Licence
Who qualifies and legal form
Applicants must be EU investment firms constituted as Cyprus companies and authorised by CySEC under Law 87(I)/2017. The head office must be in Cyprus, aligned with MiFID II Article 5. Shareholders and directors must be fit and proper and able to direct the business effectively. Key staff who provide investment services must be CySEC-certified and entered in the public register.
Capital and ongoing prudential obligations
Initial capital depends on permissions under IFR/IFD: €75,000, €150,000, or €750,000. Own funds and reporting follow the IFR/IFD framework after authorisation. Client money and assets must be safeguarded per CySEC’s DI87-01, with ICF participation providing up to €20,000 compensation per client.
Local presence and compliance oversight
A registered office and real presence in Cyprus are required. Firms must appoint a Compliance Officer and an AML Compliance Officer with appropriate competence; CySEC maintains Basic, Advanced, and AML certification schemes and expects alignment with EBA AML officer guidelines. Enhanced sanctions screening is a current supervisory focus.
Documents and submission
Core dossier items follow Reg. (EU) 2017/1943: programme of operations, governance map, shareholder suitability, policies (including AML), and financial projections. Corporate records, UBO disclosures, and policies may require notarisation or apostille depending on origin. Passporting uses MiFID notification forms after authorisation.
Fees, timing, and hidden costs
Official application and annual fees are set in DI87-03. CySEC does not publish a fixed approval timeline; duration varies with scope and file quality. Budget for audits, prudential reporting setup, staff certifications, and banking onboarding, which can extend timelines due to sanctions and AML checks.
Common challenges and how to handle them
Typical hurdles include proving substance in Cyprus, meeting staff certification and AML expectations, and securing PSP or bank accounts. We mitigate these by mapping permissions to the correct capital class, scheduling exams early, aligning AML governance with EBA guidance, and preparing sanctions evidence packs for counterparties.
Pros & Cons of Acquiring a Cyprus Investment Firm (CIF) Licence
+ EU-wide passporting under MiFID II. A CIF authorised by CySEC can provide its permitted services across the EU via freedom to provide services or branches, once notified. This delivers immediate market reach.
+ Clear prudential rulebook (IFR/IFD). Capital is activity-based—€75k/€150k/€750k—with ongoing own-funds and K-factor tests, giving predictable supervision for brokers and managers.
+ Client asset protection via DI87-01 and ICF. Segregation is mandated and eligible clients have up to €20,000 compensation, strengthening retail trust.
+ Established regulator and live registers. Public lists of active and former CIFs signal ongoing enforcement and transparency for counterparties.
+ Attractive baseline tax context. Corporate income tax is 12.5% for most firms; Pillar Two 15% targets only very large groups, preserving SME appeal.
+ Local substance framework is explicit. Head-office in Cyprus is required, reducing “letterbox” risks and aligning with MiFID expectations—banks view this positively.
– No official approval SLA. CySEC publishes no fixed timeline; duration depends on scope and file quality, complicating launch planning—plan contingencies.
– Sanctions/AML burden is rising. 2025 guidance and circulars heighten controls under EU restrictive measures; expect tougher questions from banks and PSPs. Solution: pre-build sanctions evidence packs and screening workflows.
– Capital and reporting scale with permissions. Higher-risk services (dealing/underwriting) require €750k initial capital and more intensive IFR reporting—model costs before expanding scope.
– Ongoing fees and audits add up. Charges and annual fees apply under DI87-03, alongside statutory audits and prudential filings; budget beyond application costs.
– Spot-crypto is outside CIF. MiFID permissions do not cover spot-crypto; firms need separate MiCAR CASP authorisation for those services, affecting product roadmaps.
– Substance and certification expectations. Real presence and CySEC staff certifications (Basic/Advanced/AML) are required; scheduling exams and CPD adds lead-time. Mitigation: plan hiring and exam windows early.
How to Get a Cyprus Investment Firm (CIF) Licence in Cyprus
Two routes, one playbook: you can buy a ready-made CIF (subject to CySEC change-of-control approval and fitness checks) or apply for a new authorisation from scratch. We handle both—entity registration, substance build-out in Cyprus, capital planning under IFR/IFD, policies, filing, and post-approval obligations. Note that CySEC sets official fees in DI87-03 and governs client-asset rules in DI87-01; there is no published approval SLA.
- Step 1: Route, scope, and permissions mapping 1-3 weeks
Define whether you acquire a ready-made CIF or seek a new licence, then map MiFID services (RTO, execution, PM, placing, underwriting) and target client categories. This scoping drives initial capital class (€75k/€150k/€750k) and reporting under IFR/IFD. Key Documents: permissions matrix, business plan, revenue model, target markets.
Estimated Cost: advisory for scoping, internal workshops; no regulator fees yet.
Timeline: 1–3 weeks to align stakeholders and capital class. - Step 2: Cyprus company and substance setup 2-4 weeks
Incorporate a Cyprus company and establish head office in Cyprus—a legal requirement under Law 87(I)/2017/MiFID II. Set registered office, governance calendar, and operational footprint. Key Documents: incorporation docs, register of directors/UBOs, lease or office agreement.
Estimated Cost: formation, office lease, local services (company secretary, registered office).
Timeline: 2–4 weeks for entity; office lead-times vary by location. - Step 3: Capitalisation and prudential setup 1-3 weeks
Deposit initial capital based on permissions and draft the prudential framework (K-factors, FOR, own-funds composition). Align ICAAP-lite and wind-down assessment with the business model. Key Documents: bank confirmation of paid-in capital, capital policy, wind-down plan.
Estimated Cost: capital is locked for prudential purposes; advisory and banking fees apply.
Timeline: 1–3 weeks once the bank account is open. - Step 4: People and competency 3-8 weeks
Appoint Board, four-eyes management, Compliance Officer and AMLCO. Staff providing investment services must be CySEC-certified (Basic/Advanced) and appear on the public register; AMLCO should hold the AML certification. Schedule exams and CPD. Key Documents: CVs, clean-record declarations, fit-and-proper forms, certification proofs.
Estimated Cost: exam fees, CPD, background checks; recruitment costs if external hires.
Timeline: 3–8 weeks depending on hiring and exam slots. - Step 5: Policies, systems, and client-asset safeguarding 3-6 weeks
Draft operational policies: conduct, conflicts, best execution, outsourcing, complaints, safeguarding of client money/assets per DI87-01, product governance, and sanctions/AML procedures aligned with EU restrictive-measures guidance. Key Documents: full policy suite, organisational chart, outsourcing due diligence, IT/security overview.
Estimated Cost: policy drafting, RegTech/monitoring tools, ICF onboarding preparation.
Timeline: 3–6 weeks in parallel with Steps 2–4. - Step 6: Prepare the authorisation pack 3-6 weeks
Compile the Reg. (EU) 2017/1943 dossier: programme of operations, financial projections, governance map, shareholder suitability, and risk/compliance frameworks. Translate/notarise/apostille where required by origin. Key Documents: full authorisation file per 2017/1943, UBO disclosures, audited financials (if group sponsors).
Estimated Cost: legalisation/translation, audit confirmations, group attestations.
Timeline: 3–6 weeks once inputs are complete. - Step 7: File with CySEC and respond to queries multiple roundss
Submit the application and pay DI87-03 fees. Expect technical questions and potential conditions. CySEC does not publish a fixed timeline—reviews are iterative and depend on scope and file quality. Key Documents: application forms, fee receipts, Q&A tracker, revised policies as requested.
Estimated Cost: official fees under DI87-03; advisory time for Q&A rounds.
Timeline: plan for multiple rounds; build contingency into your go-live plan. - Step 8: Passporting, ICF, and banking/PSP onboarding several weeks
Post-approval, notify cross-border services/branches via MiFID passporting, join the Investor Compensation Fund, and complete bank/PSP onboarding—often the longest practical step due to sanctions/AML scrutiny. ICF covers eligible clients up to €20,000. Key Documents: passporting notifications, ICF membership docs, sanctions/AML evidence pack, onboarding KYC.
Estimated Cost: ICF contributions, EMI/PSP fees, legal opinions if requested by counterparties.
Timeline: banks may take several weeks; EMIs can be faster but have limits. - Step 9: Go-live and ongoing compliance ongoing
Implement reporting under IFR/IFD (Class 2 quarterly; Class 3 annually), statutory audit, complaints handling, product governance, and sanctions screening updates. Plan board cycle and compliance monitoring calendar. Key Documents: regulatory returns, audit files, CPD logs, monitoring reports, incident registers.
Estimated Cost: annual CySEC fees (DI87-03), audit, RegTech subscriptions, CPD, board governance costs.
Timeline: ongoing; first full cycle within year 1.
- Hidden costs to plan for: translations/legalisations, repeated background checks, RegTech integrations, banking delays driving interim reliance on EMIs, and potential tax changes now debated in Parliament (proposal to move CIT from 12.5% to 15%—monitor for effect dates).
- Quick overall view: there is no official SLA; well-prepared projects sequence incorporation, staffing, policies, and filing in parallel to reduce idle time, then plan for iterative CySEC queries and banking onboarding before full launch. We manage both the ready-made transfer path and the new authorisation track end-to-end so you enter the market with the right permissions, capital class, and compliance baseline from day one.
Post-Licensing Compliance Obligations for a Cyprus Investment Firm (CIF) in Cyprus
- Compliance continues after authorisation. CIFs must meet ongoing prudential, conduct, AML, and reporting duties. Breaches can trigger fines, suspension, or licence withdrawal. MiFID II and IFR/IFD set core obligations; MiCA may apply if you also run spot-crypto as a CASP.
- AML and KYC monitoring. Maintain risk-based onboarding, ongoing due diligence, sanctions screening, and file STR/SAR reports to the Cyprus FIU (MOKAS) via the goAML portal. Keep audit trails for alerts, escalations, and decisions.
- Regulatory filings and audits. Submit IFR/IFD reports: Class 2 quarterly, Class 3 annually; adjust if your year-end differs, per EU implementing rules. Arrange annual statutory audit and respond to CySEC queries.
- Client asset protection. Apply DI87-01 segregation, reconciliations, and disclosures. Maintain ICF membership for eligible client coverage up to €20,000 per client.
- Fees, tax, and accounting. Pay annual CySEC fees under DI87-03. File corporate tax returns; the 12.5% CIT rate may change if Parliament finalises the 15% proposal—plan scenarios.
- Governance and changes. Keep a real head office in Cyprus and qualified Compliance Officer and AMLCO. Notify CySEC and seek approval for qualifying holding changes before completion; unapproved transfers risk enforcement.
- Penalties and enforcement climate. CySEC actively fines and restricts firms for reporting failures, safeguarding gaps, or sanctions lapses—treat remediation timelines seriously.
Legasset’s support
We run an annual compliance calendar, set up IFR/IFD reporting, refresh DI87-01 controls, prepare goAML procedures, manage DI87-03 fee planning, and draft change-of-control files. Our team supports audits, ICF obligations, and banking reviews so your CIF stays live and inspection-ready.
Common Pitfalls and Challenges of Operating Under a Cyprus Investment Firm (CIF) in Cyprus
A CIF offers real EU market access, but day-to-day compliance is demanding. The hurdles below are manageable with planning, accurate scoping, and disciplined execution.
- Banking and payments. Local banks and many PSPs apply strict sanctions and AML tests. Onboarding can take longer than expected. We prepare sanctions evidence packs and, where needed, sequence EMI solutions before full banking.
- Regulatory change and queries. CySEC has no fixed approval or variation timeline and may issue multiple information requests. We run a response tracker, align policies with current circulars, and stage permissions changes to avoid bottlenecks.
- Market access limits. Passporting is powerful, but marketing and conduct rules still apply in each host state. We map cross-border notifications and local disclosures before launch.
- Costly audits and ongoing filings. Annual audit, prudential reports under IFR/IFD, and fees under DI87-03 add recurring costs. We build a year-one compliance calendar with budget lines for returns, ICF, and CPD.
- Substance and staffing. A real head office in Cyprus is required. Key roles need CySEC certifications (Basic, Advanced, AML). We plan hiring, exam dates, and CPD early.
- Crypto scope clarity. Spot-crypto requires MiCA CASP authorisation, not a CIF alone. We separate MiFID and MiCA services and schedule any additional application.
How we help. Legasset designs the operating model, prepares banking files, calibrates permissions to the right capital class, drafts DI87-01 controls, and manages responses to regulator queries—so you stay launch-ready and inspection-ready.
FAQ About Purchasing a Cyprus Investment Firm (CIF) Licence in Cyprus
What does a Cyprus Investment Firm (CIF) licence allow, and what doesn’t it cover?
A CIF authorised by CySEC can provide MiFID II services such as reception–transmission, execution, portfolio management, and (where approved) placing/underwriting, from a head office in Cyprus with EU passporting. CIFs must safeguard client money/assets under DI87-01 and participate in the ICF (coverage up to €20,000 per client). CIFs do not cover spot-crypto services—those fall under MiCA CASP authorisation.
How do I legally purchase a ready-made CIF in Cyprus and change ownership?
Acquisition requires CySEC approval of any qualifying holding before completion. Buyers submit the regulator’s notification package, evidence of fitness and financial soundness, and post-deal governance. Transactions should be conditioned on CySEC clearance to avoid closing risk. After transfer, update passports, ICF membership, and internal policies.
What are the real costs and ongoing fees for a CIF in Cyprus?
Official charges and annual fees are set in DI87-03 (application and yearly fees). Add audit, prudential reporting tooling, ICF contributions, staff certification/CPD, and policy upkeep. Tax-wise, Cyprus corporate income tax is 12.5% for most firms; a move to 15% affects mainly large MNEs under Pillar Two.
What is the timeline to operate after acquiring a ready-made CIF or applying new?
CySEC does not publish a fixed SLA. In practice, plan for iterative Q&A on ownership changes or authorisations. Prudential reporting starts post-approval: Class 2 quarterly and Class 3 annually under IFR/IFD. Banking/PSP onboarding can add weeks due to sanctions/AML checks—have EMI options ready.
How do MiCA rules affect a CIF that wants crypto services?
MiCA’s CASP regime applies to spot-crypto (exchange, custody, platform operation). CySEC began a preliminary phase in November 2024 and now processes MiCA authorisations; firms registered under old national rules have transition paths. If you need spot-crypto, expect a separate CASP authorisation alongside your CIF.
How can Legasset help with a ready-made CIF or a new application (and MiCA)?
We manage both routes: sourcing and due-diligencing ready-made CIFs, preparing qualifying-holding files, and coordinating CySEC approvals. For new builds, we handle entity setup, substance in Cyprus, capital class selection, policy drafting (DI87-01), and filings (DI87-03 fees). For crypto roadmaps, we design MiCA-aligned controls and run CASP applications or transitions—so your permissions map cleanly to your business model.
Additional Links and Resources for Cyprus Investment Firm (CIF) Licence
The official CySEC portal listing all authorised and former Cyprus Investment Firms. This register confirms a firm’s regulatory status, license scope, and authorised services under MiFID II.
II. Law 87(I)/2017 on Investment Services – CySEC
This is the official English version of Law 87(I)/2017 (the “Investment Services and Activities and Regulated Markets Law”) which sets out CIF authorisation, scope, capital and operating conditions in Cyprus.
III. EU Investment Firm Directive (IFD) 2019/878
The IFD sets prudential requirements and governance standards for investment firms across the EU, directly shaping CySEC’s capital and reporting framework for CIFs.
IV. EU Investment Firm Regulation (IFR) 2019/2033
Companion to the IFD, this regulation defines detailed own-funds, liquidity, and reporting obligations applicable to Class 2 and Class 3 CIFs in Cyprus and other EU states.
V. Cyprus Tax Department – Official Portal (EN)
Official Ministry of Finance portal for the Cyprus Tax Department. Use it to access corporate income tax information, forms, circulars, and contact details. Includes links to online services and current guidance.
VI. Tax For All (TFA) – Cyprus government tax portal
The government’s Tax For All portal for registrations and electronic filings (replacing parts of TAXISnet). Useful for company tax registration, returns, and payments.
