Cyprus Law 87(I)/2017 CIF Authorisation: Application Dossier, Fees & Activation Gates

Incorporating a Cyprus Investment Firm (CIF) in Limassol or Nicosia under Part II (Sections 5 through 25) of Law 87(I)/2017 and CySEC Application Directive DI87-03 remains one of the primary pathways for global multi-asset brokers, prime-of-prime liquidity houses, and algorithmic asset managers entering the 30-state European Economic Area. Yet the days of 4-month "rubber-stamp" CIF approvals are long gone: today's CySEC Authorisations Department runs forensic source-of-wealth checks on Ultimate Beneficial Owners (UBOs), demands full 3-year IFR/IFD K-factor stress projections, and withholds live operational activation until examiners physically inspect the firm's Cyprus premises, IT servers, and certified key-function holders!

Within our CySEC CIF & ICF master guide and the CySEC safeguarding hub, benchmark your greenfield CIF licensing timeline and fee budget against established authorization holders such as CAPEX.com (292/16), Colmex Pro (123/10), and B2Prime.

Permission-to-Capital & Application-Fee Matrix (Law 87(I)/2017 & DI87-03)#

Under Directive DI87-03, CySEC calculates upfront non-refundable application scrutiny fees additively per requested MiFID II Annex I Section A investment service and Section B ancillary service:

Inside Form 87-00-01: Five Dossier Pillars That Delay Incomplete Filings#

Why does Section 7(3) Law 87(I)/2017's statutory "6-month decision deadline" stretch to 10–14 months in practice? Because the 6-month clock starts ticking ONLY once CySEC formally certifies the dossier as "complete"—and examiners pause the clock whenever any of five core annexes lack institutional rigor:

1. Forensic UBO Source-of-Wealth (SOW) & Tax Clearance Trail: Every ultimate natural person holding >= 10% (or cumulative controlling influence) submits personal questionnaires, clean apostilled criminal records, 5-year personal tax returns, and audited bank trails tracing every euro of initial CET1 back to taxed legitimate business income.
2. Internal Operations Manual (IOM) & Conflict-of-Interest Policy: Must reflect your exact order-routing topology (MT5/cTrader/proprietary OMS bridges, named EU Liquidity Providers, B-book vs A-book split)—CySEC rejects generic copy-pasted consultant Word templates on sight!
3. Three-Year Prudential IFR/IFD & ICARA Model: Month-by-month CET1, FOR, K-CMH, K-ASA, K-NPR, K-TCD, and Article 43 HQLA stress tests proving CET1 never dips below 100% of PMR/FOR even under zero Year-1 revenue.
4. DORA ICT Risk Architecture & Business Continuity Plan: Mapping primary/backup EEA data centers, cybersecurity CISO reporting, and vendor exit clauses.
5. Four-Eyes Board & Certified Key-Function Nominations: Naming 2 Cyprus-resident Executive Directors + >= 2 Non-Executive Directors alongside CySEC Advanced & AML-certified Compliance/MLRO and Risk heads.

Two-Stage Conditional Authorization vs Live Activation Gate#

Unlike jurisdictions where receiving the license certificate lets you onboard clients the next morning, CySEC splits authorization into two distinct legal milestones:

• Milestone A — Conditional Authorization Letter: Confirms CySEC's Board approved the application subject to completing operational build-out within 6 to 12 months (leasing physical dedicated offices in Cyprus, moving initial capital from blocked bank escrow to operational accounts, paying the initial Directive DI87-07 non-refundable ICF joining fee, obtaining a GLEIF LEI, and onboarding staff onto Cyprus Social Insurance!).
• Milestone B — Final Operational Activation & Public Register Listing: Only after CySEC verifies every fulfillment document (often including an on-site/video walk-through of the Limassol/Nicosia trading, compliance, and server rooms) does CySEC assign the public XXX/YY license number and unlock Article 34 EEA passport filings!

Modeling Total Greenfield CIF Pre-Revenue Launch Capital & Setup Outlay#

Budget the true all-in cash commitment required from incorporation through Month-12 live activation for a EUR 750,000 Full-Scope Principal Market-Maker CIF:

Domain Pre-Approval & Section 8(1) "Use It or Lose It" 12-Month Rule#

Two post-licensing traps require strict calendar tracking: first, no CIF may launch a new brand website or regional landing domain without prior notification and listing in CySEC's Approved Domains registry. Second, under Section 8(1)(a) of Law 87(I)/2017, CySEC may withdraw authorization if a CIF does not make use of its authorization within 12 months or expressly renounces/ceases providing investment services for more than 6 consecutive months—blocking "warehoused dormant shell licenses"!