Cyprus MiFID II Investment Firm (CIF) Licence 2026 — Application, Capital, EU Passporting

1. Legal framework

Cyprus's MiFID II framework is in the Cyprus Investment Services and Activities and Regulated Markets Law 87(I)/2017 (CISARMA), transposing EU MiFID II Directive 2014/65/EU + EU Markets in Financial Instruments Regulation (MiFIR) 600/2014. CySEC is the competent authority. Once authorised, the Cyprus CIF can passport into all 30 EEA states.

2. Regulated services

• Reception + transmission of orders
• Execution of orders on behalf of clients
• Dealing on own account
• Portfolio management
• Investment advice
• Underwriting / placing of financial instruments
• Operation of an MTF (Multilateral Trading Facility) or OTF (Organised Trading Facility)
• Ancillary services (custody, FX-related services, credit, M&A, research)

3. The three capital tiers

4. The application file

• Programme of operations — services offered, target client segments, geographic markets.
• Business plan with 3-year financial projections.
• Governance framework — organisational chart, three-lines-of-defence model, board composition.
• Fit-and-proper assessments for directors + senior managers + qualifying shareholders (≥10%).
• AML / CFT manual — aligned with Cyprus AML Law 188(I)/2007 + EU AMLD6 / AMLR 2024/1624.
• Operational risk management framework.
• ICT + outsourcing policies (NIS2 + DORA-aligned).
• Client onboarding + KYC procedures.
• Conflicts-of-interest policy.
• Best-execution policy (Article 27 MiFID II).
• Complaints-handling + ADR policy.
• Capital adequacy calculations + own-funds policy under IFR (Investment Firms Regulation EU 2019/2033).
• Insurance / professional-indemnity arrangements.

5. Timeline + process

1. 1Pre-application engagement with CySEC (1-2 months) — summary file, informal feedback.
2. 2Full application submission to CySEC (Day 0).
3. 3Completeness check (Day 0 to Day 25) — CySEC confirms file is complete.
4. 4Substantive assessment (Day 25 to Day 65) — 1-3 rounds of questions typical.
5. 5Decision (Day 65 to Day 90, statutory; extendable by 60 days for complex files).
6. 6Authorisation issued + entered in CySEC register.
7. 7Total: 6-9 months clean files; 9-12+ months for complex / tier-3 (€750k) applications.

6. EU passport + ongoing

• Once authorised, CIF can passport services to all 30 EEA states (notification regime under MiFID II Article 34 + 35).
• Annual CySEC supervisory fee (scaled to firm size).
• Quarterly + annual prudential reporting under IFR / IFD frameworks.
• Annual ICAAP (Internal Capital Adequacy Assessment Process) + ILAAP (liquidity).
• Annual external audit + audited financial statements.
• Specific best-execution + transaction reporting under MiFIR.

Official verification starting points

Cyprus Securities and Exchange Commission and Central Bank of Cyprus publish the controlling material for this topic. Check the current law, form, circular or portal instructions before acting; this article is general information and the live official material prevails.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.