If you trade forex or CFDs from almost anywhere outside the United States, the broker courting you probably holds a licence from the Cyprus Securities and Exchange Commission. CySEC supervises more retail CFD brokers than any other regulator in the European Union, which makes it the licence a retail trader is most likely to encounter — and the one most worth understanding properly, because what it protects and what it merely appears to protect are not the same thing.
This guide explains what a CySEC licence actually obliges a broker to do, what the €20,000 compensation ceiling does and does not cover, how to verify a licence in about ten minutes using CySEC’s own registers, what the regulator’s enforcement record really looks like, and how the offshore sister-entity pattern quietly removes every protection described here. All figures and examples were verified in July 2026 against CySEC’s own publications.
What CySEC is, and why so many brokers are licensed in Cyprus
The Cyprus Securities and Exchange Commission is the public body that authorises and supervises investment services in the Republic of Cyprus. It was established in 2001, and it matters to retail traders for one structural reason: when Cyprus joined the EU in 2004, a CySEC authorisation became a European passport. A firm licensed in Cyprus as a Cyprus Investment Firm — a CIF — can offer investment services to clients across the entire European Economic Area under MiFID II without obtaining a separate licence in each country.
Passporting made every EU licence legally equivalent, so the industry gravitated to the member state where authorisation was cheapest and fastest to obtain. For most of the 2010s that was Cyprus, and it is worth saying plainly: the concentration of CFD brokers on the island is not an accident of geography. Low corporate tax, modest staffing costs, an English-language legal system, and a regulator that was historically lighter-touch than the FCA or BaFin all pulled in the same direction. Brokers domiciled in Cyprus for the same reason ships register under certain flags.
That history cuts both ways. Cyprus now hosts a deep pool of compliance and brokerage expertise, and CySEC’s rulebook is genuinely the EU rulebook. But Cyprus is also where the industry’s problem firms went first, and the regulator has spent the years since 2019 working off the reputation that era earned it. Both halves of that story are true, and a trader choosing a broker should hold both at once.
What a CIF licence obliges a broker to do
On paper, a CySEC-regulated broker operates under substantially the same conduct rulebook as an FCA-regulated one, because both implement the same EU-derived framework. The core obligations that matter to a retail client are:
- Client money segregation. Retail client funds must be held in segregated accounts at credit institutions, legally separate from the firm’s own money. On insolvency, that pool is returned to clients rather than absorbed into the estate for general creditors.
- Investor Compensation Fund membership. Every CIF serving retail clients must contribute to the ICF, which pays capped compensation if the firm fails and cannot return client money or instruments. The cap is examined in the next section.
- Negative balance protection, per account. A retail CFD account cannot lose more than the funds in it. A gap through your stop cannot leave you owing the broker money.
- The 50% margin close-out rule. Positions are closed when account equity falls to half the required margin, limiting how deep a losing account can dig before intervention.
- No bonuses or trading incentives for retail clients, and a standardised risk warning stating the percentage of the firm’s retail accounts that lose money.
- Appropriateness testing, best execution, capital requirements and annual audits — the machinery that operates in the background but shapes how the firm treats order flow and its own balance sheet.
The leverage caps deserve their own table. These originated as ESMA product intervention measures in 2018 and were made permanent in Cyprus national law in 2019, so they bind every CIF’s retail offering:
| Instrument class | Maximum retail leverage |
|---|---|
| Major currency pairs | 30:1 |
| Non-major currency pairs, gold, major indices | 20:1 |
| Commodities other than gold, non-major indices | 10:1 |
| Individual shares | 5:1 |
| Cryptocurrencies | 2:1 |
If a broker presenting itself as CySEC-regulated offers you 500:1 leverage, that offer is not coming from the CySEC entity. That single observation resolves more confusion about Cyprus brokers than any other, and it is the thread this guide pulls in the offshore-entity section below.
The Investor Compensation Fund: what €20,000 does and does not cover
The Investor Compensation Fund is the safety net behind every CIF. When CySEC determines that a member firm is unable to meet its obligations to clients — typically in insolvency — the ICF pays eligible retail clients the lower of 90% of their covered claim or €20,000, per client, per firm. That limit was re-verified in July 2026 against CySEC’s own ICF publications, and it is worth reading precisely: a client owed €15,000 receives €13,500, not €15,000, and a client owed €100,000 receives €20,000.
An honest comparison with the UK is unflattering. The FSCS covers investment claims against failed FCA-authorised firms up to £85,000 per person — more than four times the ICF ceiling at current exchange rates. The EU directive behind national compensation schemes sets only a €20,000 floor, and Cyprus sits exactly at the floor. This is the single largest concrete difference between holding an account with a CySEC entity and an FCA entity of the same broker, and it is not a difference broker marketing tends to dwell on.
Three scope limits matter as much as the number. First, the ICF covers the failure of the firm — it pays when a broker cannot return your money or instruments. It never covers trading losses; losing €20,000 on a position generates no claim. Second, it covers retail clients only; anyone reclassified as a professional client gives up ICF eligibility along with leverage caps. Third, payouts follow an administrative process that has historically taken years rather than months in past CIF failures, so the ICF is best understood as eventual partial recovery, not a prompt refund.
How to verify a CySEC licence, step by step
Verification takes about ten minutes and uses only CySEC’s own website. Screenshots of licence certificates and footer badges prove nothing; scam sites reproduce both routinely.
- Collect the broker’s claims. From the website footer and the client agreement, note the legal entity name and the licence number. CIF licence numbers follow a recognisable format: a serial number, a slash, and the two-digit year of authorisation — 120/10, for example, is the 120th licence, granted in 2010. A “licence number” that does not fit this pattern is a warning sign in itself.
- Search the CIF register. Look the entity up in CySEC’s register of Cypriot investment firms. Match the exact legal name and licence number, and read the entry itself — it shows the firm’s authorised services and whether the licence is active, suspended, or withdrawn. A firm that once held a licence and lost it will still surface in searches, so the current status matters more than mere presence.
- Check the approved domains list. This is a genuinely useful CySEC feature that few regulators offer: the commission publishes a list of approved domains recording exactly which websites each CIF is permitted to operate. Find the CIF and confirm that the domain you actually registered on appears under its name. If it does not, you are probably onboarding with a different entity — offshore or fraudulent — regardless of what the footer says.
- Match the entity to the brand. The brand name and the CIF’s legal name almost never match — a familiar trading brand may be operated in the EU by a company you have never heard of. The entity that counts is the one named in your account-opening agreement, because that is the company you can actually bring a claim against.
- Scan CySEC’s warnings. The commission regularly publishes warnings about websites falsely claiming authorisation or impersonating licensed firms. A quick search of the warnings section for the brand name closes the loop.
Licence verification against the primary register is also the first gate in how we rate brokers — no other signal about a firm is worth reading until this one passes.
Enforcement reality: settlements rather than fines
CySEC’s characteristic enforcement instrument is the settlement: the firm pays an agreed sum in respect of “possible violations” of the law, without any admission of wrongdoing, and the case closes. It is faster and cheaper for both sides than contested proceedings, and it dominates the commission’s enforcement output. Recent examples, current as of July 2026: a €200,000 settlement announced in June 2025 with Trek Labs Europe Ltd, the firm formerly known as FTX EU Ltd; a €70,000 settlement with Blacktower Financial Management (Cyprus) Ltd in November 2025; and a €50,000 settlement with EDR Financial Ltd announced in January 2026 over possible breaches of investment services legislation.
The honest reading of those numbers is that they are small. Settlements in the tens or low hundreds of thousands of euros, levied on firms whose annual revenues can run to nine figures, function more like a cost of doing business than a deterrent, and the absence of admissions means clients rarely learn exactly what went wrong. The FCA, by contrast, publishes detailed final notices and levies fines that regularly reach into the millions. A trader weighing the two regimes should treat enforcement intensity — not the rulebook, which is nearly identical — as a genuine point of difference.
Context matters, though, because CySEC’s trajectory has been upward. Through the mid-2010s Cyprus was the licensing home of the binary options industry, an era that ended with ESMA’s 2018 prohibition on selling binary options to retail clients, made permanent in Cyprus in 2019. Since then the commission has withdrawn or accepted the surrender of a long list of licences, tightened marketing and cross-border supervision, and pushed the worst operators off the register. The CySEC of the mid-2020s is a meaningfully stricter regulator than the CySEC of 2015 — while still, on enforcement severity, a meaningfully softer one than the FCA.
The offshore sister-entity pattern
Most large Cyprus-licensed brands operate a parallel entity in Seychelles, Belize, Mauritius, Vanuatu or a similar offshore centre — same brand, same platform, same login page design, different company. The commercial logic is simple: the EU rulebook caps leverage at 30:1 and bans bonuses, and the offshore entity can offer 500:1, deposit bonuses, and lighter onboarding. The regulatory logic is equally simple and far less advertised: none of the CySEC protections travel with the brand. Under the offshore entity there is no ICF, no ESMA-derived leverage cap, no statutory negative balance protection — at best a contractual promise, which is a policy the firm can change, not a right you can enforce — and client money oversight that is weaker or effectively absent.
Which entity you end up with is usually decided by your country of residence during sign-up, sometimes by which regional website you happened to land on, and occasionally by a choice the broker frames as an upgrade — higher leverage is the standard lure. Establishing which side of the line you are on takes minutes:
- Read the legal entity named in your account-opening agreement and welcome email — this is decisive, whatever the website says.
- Check the footer of the exact domain you registered on, not the brand’s main site — regional domains frequently onboard to different entities.
- Compare that domain against the CIF’s entry on CySEC’s approved domains list — if it is absent, the CIF is not your counterparty.
- Look at your leverage — anything above 30:1 on major FX pairs means you are not a retail client of the Cyprus entity.
An offshore entity is not automatically a scam — plenty of legitimate firms run one — but the price of the higher leverage should be understood before it is paid. If a dispute arises, it will be a dispute with a Seychelles or Belize company under that jurisdiction’s law, and the CySEC licence the brand advertises will be legally irrelevant to your claim.
CySEC vs FCA vs ASIC vs offshore: the comparison that matters
The table below compares the four regulatory situations a retail CFD trader most commonly faces, as verified in July 2026.
| Protection | CySEC (Cyprus) | FCA (UK) | ASIC (Australia) | Typical offshore (Seychelles, Belize) |
|---|---|---|---|---|
| Compensation scheme | ICF — lower of 90% of the claim or €20,000 | FSCS — up to £85,000 per person | No comparable investor scheme; CSLR is a narrow backstop for unpaid AFCA determinations | None |
| Retail leverage cap, major FX | 30:1 | 30:1 | 30:1 | Commonly 500:1 or higher |
| Negative balance protection | Statutory, per account | Statutory, per account | Statutory, per account | Contractual at best |
| Client money segregation | Required under EU-derived rules | Required under CASS rules with strict audit | Required, trust accounts under the Corporations Act | Varies; oversight weak or absent |
| Enforcement style | Settlements, typically five to six figures, no admission | Contested fines, frequently millions, detailed public notices | Court actions, licence cancellations, fines | Rare and largely nominal |
| Dispute route | Financial Ombudsman of Cyprus | UK Financial Ombudsman Service | AFCA | The broker’s own goodwill |
The pattern is consistent: on the conduct rulebook, CySEC stands alongside the FCA and ASIC. On the size of the safety net and the weight of enforcement, it sits visibly below both — and every regulated option sits far above the offshore column.
Frequently asked questions
Is CySEC a good regulator?
It is a legitimate, mid-tier regulator — a genuine EU supervisor enforcing MiFID II, materially stricter since its post-2019 cleanup, but with a smaller compensation fund and lighter enforcement than the FCA. A CySEC licence is a real protection and a reasonable baseline; it is not the strongest licence a broker can hold, and treating it as equivalent to FCA authorisation overstates it.
Is my money safe with a CySEC-regulated broker?
Safer than with an unregulated or offshore broker, with two qualifications. Your funds must be held in segregated client accounts, and the ICF stands behind the first €20,000 if the firm fails — but segregation only protects money that was actually segregated, and the ICF pays nothing for trading losses. The protection also applies only if your account is genuinely with the Cyprus entity, which is worth verifying rather than assuming.
What does the ICF actually pay if my broker fails?
The lower of 90% of your covered claim or €20,000, per client, per firm, as verified in July 2026. Retail clients only, and only for the firm’s failure to return money or instruments. Historical payouts have taken years to complete, so plan around eventual partial recovery rather than a quick refund.
How do I check if a broker is really CySEC-regulated?
Search the legal entity name and licence number in CySEC’s register of Cypriot investment firms at cysec.gov.cy, confirm the licence is active, then check that the domain you signed up on appears in the firm’s entry on CySEC’s approved domains list. If either check fails, the CySEC licence being advertised does not cover your account.
Why does my CySEC broker also have a Seychelles entity?
To offer what EU rules prohibit — leverage far above 30:1, bonuses, lighter onboarding. The offshore entity is a separate company: no ICF coverage, no statutory negative balance protection, no EU client money oversight. Your account agreement, not the brand, determines which entity you are with.
Is CySEC as strict as the FCA?
The rulebooks are close to identical, because both derive from the same EU framework. The differences are the safety net — €20,000 under the ICF against £85,000 under the FSCS — and enforcement, where CySEC relies on modest no-admission settlements while the FCA levies larger contested fines with public findings. On paper, near parity; in consequences for a failed or misbehaving firm, the FCA regime is heavier.
Reader reviews
Traded with this broker? Tell others what actually happened.