CySEC Licence Requirements: Authorising a Cyprus Investment Firm in 2026
Updated for 2026 — last updated: 19 July 2026
Cyprus remains the EU's most popular gateway for investment firms seeking a passportable licence, and CySEC one of the most experienced authorisation regulators in the Union. But much of what circulates online about "Class 2 licences" and "€125,000 capital" describes a regime that no longer exists: since the EU Investment Firms Regulation and Directive were transposed by Law 165(I)/2021, capital requirements follow a three-tier structure keyed to the services performed. This guide sets out the current requirements, the realistic timeline, and what CySEC actually examines.
Table of Contents
- What a CIF Licence Covers — and What "Class 2" Really Means
- Initial Capital: The IFR/IFD Three-Tier Structure
- Substance, Governance and Local Presence
- The Application Process and Realistic Timeline
- Ongoing Obligations: ICARA, DORA and the Compensation Fund
- Applying vs Acquiring an Existing CIF
- Frequently Asked Questions
What a CIF Licence Covers — and What "Class 2" Really Means
A Cyprus Investment Firm (CIF) licence authorises the investment services and activities of MiFID II — reception and transmission of orders, execution, portfolio management, investment advice, dealing on own account, underwriting and placing — passportable across the EU. The old "Class 2" shorthand for a firm holding client money without dealing on own account survives in marketing copy, but the regulatory classification now runs through the IFR/IFD prudential framework: what matters is which services you perform and the prudential class your size and activities place you in, not a licence "class" label. Crypto-asset services sit outside the CIF licence entirely — they are authorised separately under MiCA, covered in our Cyprus CASP licence guide.
Initial Capital: The IFR/IFD Three-Tier Structure
Since Law 165(I)/2021 transposed the IFD, initial capital depends on the services authorised — the historic €125,000 middle tier is gone:
| Initial capital | Services |
|---|---|
| €750,000 | Dealing on own account; underwriting or placing on a firm commitment basis |
| €150,000 | Holding client money or client financial instruments (typical brokerage / portfolio management models) |
| €75,000 | Reception & transmission, execution, portfolio management or advice without holding client money or instruments |
Initial capital is the floor, not the budget: ongoing own-funds requirements are the highest of the permanent minimum, the fixed-overheads requirement and (for larger firms) the K-factor calculation, so realistic capitalisation exceeds the table figures from day one.
Substance, Governance and Local Presence
CySEC authorises firms, not letterboxes. Expect requirements for a genuine Cyprus office; a board with executive and independent non-executive members of demonstrable fitness and probity; a four-eyes management structure resident in Cyprus; compliance, risk management, internal audit and AML functions (the compliance officer and AMLCO drawing particular scrutiny); and policies covering conflicts, best execution, safeguarding of client assets, remuneration and outsourcing. The shareholder side is examined up the chain to every ultimate beneficial owner, with source-of-wealth evidence — weak ownership files are the single most common cause of delay.
The Application Process and Realistic Timeline
The application bundle comprises the CySEC forms, a three-year business plan with financial projections, the full suite of internal policies and manuals, personal questionnaires for every director, shareholder and key-function holder, and the capital evidence. Statutorily, CySEC must determine a complete application within six months — but "complete" is the operative word: rounds of comments and resubmissions mean the real-world span from engagement to licence typically runs nine to fourteen months, driven mostly by how prepared the applicant is at filing. CySEC's published fee schedule applies to the application and each authorised service, with the regulator consulting on revised fees in early 2026 — check the current schedule before budgeting.
Ongoing Obligations: ICARA, DORA and the Compensation Fund
Authorisation is the start of the compliance programme, not the end. A CIF runs a continuous ICARA process (the internal capital and risk assessment under the IFD regime) with prudential reporting to CySEC; complies with DORA's digital operational resilience requirements — ICT risk management, incident reporting and third-party register — which apply to investment firms since January 2025; contributes to the Investor Compensation Fund protecting eligible clients; and maintains the MiFID II conduct framework across marketing, appropriateness, best execution and reporting. Budgeting for the compliance function's real annual cost is part of an honest business plan.
Applying vs Acquiring an Existing CIF
The alternative to a fresh application is acquiring an authorised CIF — faster in principle, but the change-of-control approval is itself a CySEC process examining the buyer to the same fitness and source-of-wealth standard, and the target's history (complaints, regulatory findings, dormant infrastructure) transfers with it. Acquisitions suit buyers who need specific existing permissions quickly and have clean, well-documented ownership; fresh applications suit those building a tailored permission set without legacy risk. Both routes end in the same supervisory relationship, so the choice is commercial, not regulatory arbitrage.
Frequently Asked Questions
How much capital do I need for a CySEC licence?
Under the IFR/IFD framework (Law 165(I)/2021): €75,000 for advisory/RTO/execution/portfolio-management models that do not hold client money, €150,000 where client money or instruments are held, and €750,000 for dealing on own account or firm-commitment underwriting. Figures of €125,000 describe the pre-2021 regime.
How long does CySEC authorisation take?
Six months is the statutory determination period for a complete application; nine to fourteen months from engagement to licence is the realistic planning span once preparation and comment rounds are included.
Does a CIF licence cover crypto services?
No. Crypto-asset services are authorised separately under MiCA as a CASP licence, with its own capital and substance requirements — though CySEC is the regulator for both, and combined groups are increasingly common.
Speak to Connor Legal
Connor Legal advises founders and financial groups on CySEC authorisation — scoping the permission set, preparing the application bundle, and managing the regulator relationship through to licence, or the change-of-control route where acquisition fits better. To scope your project, contact the firm.
