# CySEC CIF License Suspension Forensics & ICF Activation

> Forensic guide to Law 87(I)/2017 Sections 8–10 CIF license suspensions, historical AFX Capital Markets and ACFX cases, and DI87-07 ICF claim payouts.

Canonical: https://eurofirmledger.com/bulletins/cysec-cif-license-suspension-forensics-afx-acfx-icf-activation
Last updated: 2026-11-14T21:02:11.925Z

**Publication:** Euro Firm Ledger
**Category:** Cysec Cif Icf Safeguarding Directives
**Published:** 2026-11-13T12:20:25.915Z
**Author:** Lukas Lindqvist, CEFA (Certified European Financial Analyst (EFFAS/CEFA, Frankfurt & Zurich))
**Reviewer:** Not recorded

## Answer-first summary

When CySEC suspends a CIF license under Section 10(1) of Law 87(I)/2017—as seen in historical cases like AFX Capital Markets and ACFX—a strict statutory sequence governs position close-outs, withdrawals, and ICF activation.

## Key takeaways

- A Section 10(1) Law 87(I)/2017 CIF suspension freezes new client onboarding and new opening trades immediately, while legally obligating the suspended CIF to close existing positions on client instruction and return client funds.
- Voluntary license renunciations (Section 8(1)(a)) require 100% verified return of client funds before CySEC releases the charter—only compulsory insolvencies with missing funds (like AFX and ACFX) trigger ICF claims.
- Under Directive DI87-07, intact DI87-01 segregated trust bank balances are distributed first, and the ICF covers 90% of each retail client’s remaining uncovered net shortfall up to EUR 20,000.
- Investors must download full trade statements and SWIFT/card deposit receipts on Day 1 of any suspension notice and file directly through CySEC’s free official ICF portal—never through paid recovery scammers.

## Related financial entities

- **Cyprus Investment Services and Activities Law (CySEC)** (CYSEC-CIF) — license: Statutory framework administered by CySEC transposing MiFID II, governing the authorization and operational requirements of Cypriot Investment Firms.
- **European Securities and Markets Authority (ESMA)** (ESMA) — license: Independent European Union authority contributing to safeguarding the stability of the EU financial system by enhancing investor protection and promoting stable markets.
- **MiFID II Cross-Border Passporting Framework** (MIFID2-PASS) — license: Harmonized European framework allowing authorized investment firms to provide investment services across all EU member states and EEA countries.

## Analysis

Every European trader holding funds at a Cyprus broker needs a crystal-clear playbook for the worst-case supervisory headline: **"CySEC Decision to Suspend the CIF Authorisation in Whole Pursuant to Section 10(1) of Law 87(I)/2017."** Historical Cyprus enforcement actions—including the license suspension and subsequent revocation of **[AFX Capital Markets Ltd](/firms/afx-capital-markets)** and **[ACFX (Atlas Capital Financial Services Ltd)](/firms/acfx)**—demonstrate both why **[CySEC](/competent-authorities/cysec)** freezes troubled brokers immediately and why retail claimants must distinguish between a **temporary curative suspension**, a **voluntary solvent renunciation**, and a **compulsory withdrawal triggering [Directive DI87-07 ICF compensation](/bulletins/cysec-directive-di87-07-icf-90pct-eur-20000-compensation-cap)**!

Within our [CySEC CIF & ICF master guide](/bulletins/cysec-cif-authorisation-eur-20000-icf-safeguarding-guide-2026) and the [CySEC safeguarding hub](/topics/cysec-cif-icf-safeguarding-directives), contrast active, compliant CIFs ([CAPEX.com](/firms/capex), [Colmex Pro](/firms/colmex-pro), [1Market](/firms/1markets), [B2Prime](/firms/b2prime)) on our [live license verifier](/verify) against the exact statutory mechanics of Sections 8, 9, and 10 of Law 87(I)/2017.

## Three Distinct License Exit States on CySEC's Registry (Do Not Confuse Them!)

| CySEC Registry Status | Statutory Basis (Law 87(I)/2017) | Can CIF Accept New Trades or Deposits? | Client Withdrawal & ICF Compensation Status |
| :--- | :--- | :--- | :--- |
| **1. Partial / Full Suspension (15–90 Days)** | **Section 10(1)** & **Law 165(I)/2021** | **NO!** Zero new clients, zero new marketing, zero new opening orders (30-day cure window typical) | CIF **MUST still close open trades on client instruction AND return segregated funds (Sec. 10(1)(b))**—ICF *not yet* triggered! |
| **2. Voluntary Renunciation (Lapsed)** | **Section 8(1)(a)** | **NO** (orderly wind-down plan pre-approved by CySEC) | **100% of client funds & assets returned BEFORE CySEC releases license**—zero client haircut, no ICF needed! |
| **3. Compulsory Withdrawal + ICF Activation** | **Section 8(1)(c)–(f)** + **DI87-07 Para. 19** | **PERMANENTLY TERMINATED**; website must display withdrawal notice within days | If segregated bank IBANs have a **missing shortfall** (like [AFX Capital Markets](/firms/afx-capital-markets) / [ACFX](/firms/acfx)), CySEC **activates ICF claims (min(90%, EUR 20k))**! |

![Statutory timeline from CySEC Section 10(1) CIF license suspension through Section 8 withdrawal and Directive DI87-07 Investor Compensation Fund payout](/api/figure?type=flow&title=From%20Section%2010%281%29%20CIF%20Suspension%20to%20DI87-07%20ICF%20Claim%20Payout&subtitle=Exact%20legal%20milestones%20when%20a%20Cyprus%20Investment%20Firm%20fails%20to%20cure%20a%20safeguarding%20or%20CET1%20breach&steps=Day%200%20%20Sec.%2010%281%29%20Freeze%3A%3ACySEC%20suspends%20CIF%20%2815%E2%80%9330d%29%3B%20bans%20new%20trades%2Fads%3B%20orders%20client%20payouts%7CDay%2030%E2%80%9390%20%20Forensic%20Audit%3A%3AIf%20shortfall%20uncured%20%28e.g.%20AFX%2FACFX%29%2C%20CySEC%20revokes%20license%20%28Sec.%208%29%7CICF%20Invitation%20Notice%3A%3APublished%20in%20Official%20Gazette%20%2B%20%3E%3D2%20newspapers%3B%20%3E%3D3-month%20claim%20window%7CAudit%20%26%203-Month%20Payout%3A%3AICF%20verifies%20covered%20retail%20balances%20-%3E%20pays%20min%2890%25%2C%20EUR%2020%2C000%29!&metrics=SUSPENSION%20CURE%20SLA%3A%3A15%20to%2030%20Days%3A%3ATypical%20Section%2010%281%29%20window%7CCLAIM%20FILING%20WINDOW%3A%3A%3E%3D%203%20Months%3A%3AExtendable%20up%20to%20%2B3%E2%80%936%20months%7CICF%20PAYOUT%20CAP%3A%3Amin%2890%25%2C%2020k%29%3A%3APost-2019%20DI87-07%20co-insurance%7CUNPAID%20EXCESS%20CLAIM%3A%3ALiquidator%20Rank%3A%3AFiled%20in%20Cyprus%20District%20Court)

## Forensic Lessons From AFX Capital Markets (253/14) & ACFX (085/07)

What actually went wrong inside Cyprus's two most cited historical CIF insolvencies—and how did CySEC close those exact loopholes for post-2020 CIFs?
1. **[AFX Capital Markets Ltd](/firms/afx-capital-markets) (Suspended July 2019 -> Revoked -> ICF Activated)**: Alongside its FCA sister entity AFX Markets Ltd (which entered Special Administration in London with millions in missing client funds), CySEC uncovered suspected serious breaches of **client-fund safeguarding (Sec. 17(9)) and Own Funds**. CySEC immediately suspended AFX's CIF license under Section 10(1), later withdrew authorization completely, and initiated the **Investor Compensation Fund claim procedure** via online portal submissions backed by client bank-transfer and MT4 account proofs.
2. **[ACFX / Atlas Capital Financial Services Ltd](/firms/acfx) (Suspended 2016 -> Revoked 2017 -> ICF Activated)**: Following sudden withdrawal freezes linked to severe liquidity/reconciliation failures after market shocks, CySEC suspended ACFX, imposed administrative sanctions, revoked its CIF authorization, and activated the ICF claim invitation process for covered retail clients.
3. **Why Post-2019 CIFs Face Harder Real-Time Gates**: Directly because of AFX and ACFX, CySEC enacted the **2019 Directive DI87-07 overhaul** ([ICF risk-based ex-ante levies](/bulletins/cysec-icf-risk-based-ex-ante-contributions-extraordinary-buffer)), **mandatory annual external auditor ISAE 3000 safeguarding opinions**, **3‰–5‰ self-held liquid client-protection buffers**, and **Circular C458 daily zero-floored reconciliations** ([DI87-01 daily reconciliations](/bulletins/cysec-directive-di87-01-client-money-segregation-reconciliation))—catching shortfalls *months earlier* before holes widen!

## Exact Four-Step Investor Action Protocol Upon Seeing a Section 10(1) Suspension Notice

If CySEC publishes a **Section 10(1) Suspension Decision** on a CIF where you hold an open account, execute these four steps **on Day 1—do NOT wait passively**:
1. **Export Complete Immutable Evidence Immediately**: Before any server goes offline, download full PDF/CSV trade histories, daily confirmation emails, MT4/MT5/cTrader HTML statements, deposit bank wire receipts (SWIFT MT103 / SEPA / card statements), and account-opening KYC contracts!
2. **Exercise Your Statutory Right Under Section 10(1)(b)(i)–(ii)**: In almost every Section 10(1) suspension notice, CySEC explicitly orders that while suspended, the CIF **IS PERMITTED (and obligated) to (i) complete/close existing open transactions strictly in accordance with client instructions, and (ii) return all funds and financial instruments attributable to its clients**! Submit a formal timestamped position-close and 100% IBAN withdrawal instruction immediately!
3. **Beware "Recovery Agency" Chargeback Scammers**: Never pay upfront fees to cold-calling "Cyprus legal recovery specialists"—both **CySEC's ICF Claim Portal** and the **[Cyprus Financial Ombudsman](/competent-authorities/cyfo)** charge **EUR 0** (or nominal EUR 20 Ombudsman fee) directly to retail claimants!
4. **Track Official ICF Invitation Windows**: Subscribe to CySEC's official ICF Announcements page; once ICF claims open, submit before the published deadline (>= 3 months).

## Recovery Math: Segregated Bank Distribution + DI87-07 ICF Cap + Liquidator Dividend

Understand how **recovered segregated client bank funds** interact with **DI87-07 ICF compensation** and **general liquidator claims** for an investor holding EUR 35,000 when a CIF collapses with a 40% segregated bank shortfall:

```formula
CIF_Insolvency_Two_Stage_Client_Recovery_Waterfall:
 Verified_Client_Account_Equity (E_client) = EUR 35,000
 Suppose Forensic Liquidator Recovers 60% of Segregated Client Trust Pool Intact (40% Unlawfully Missing):
 Stage_1_Segregated_Trust_Return = 0.60 * 35,000 = EUR 21,000 (Returned as ring-fenced trust property!)
 Remaining_Uncovered_Net_Claim_Submitted_To_ICF = 35,000 - 21,000 = EUR 14,000

 Stage_2_DI87_07_ICF_Compensation_Payout (Para_23_2_Post_2019_Formula):
 ICF_Payout = min(EUR 20,000, 0.90 * Remaining_Uncovered_Net_Claim)
 = min(20,000, 0.90 * 14,000) = EUR 12,600!
 Total_Cash_Recovered_Before_General_Liquidation = 21,000 + 12,600 = EUR 33,600 (96.0% Total Recovery!)
 Residual_Unsecured_Claim_In_Court_Liquidation = 35,000 - 33,600 = EUR 1,400

 Contrast_Total_100Pct_Missing_Pool_Worst_Case (0% Segregated Recovery on EUR 35,000 Account):
 ICF_Payout = min(EUR 20,000, 0.90 * 35,000) = EUR 20,000 (57.1% Immediate ICF Recovery; EUR 15,000 in Liquidation!)
```

![Total retail investor cash recovery on a EUR 35,000 CIF account across 100% solvent voluntary exit, 60% segregated recovery + ICF, and 0% segregated worst case](/api/figure?type=bars&title=Investor%20Recovery%20Scenarios%20on%20a%20EUR%2035%2C000%20CySEC%20CIF%20Account&subtitle=How%20DI87-01%20bank%20ring-fencing%20and%20the%20DI87-07%20min%2890%25%2C%20EUR%2020%2C000%29%20ICF%20backstop%20combine&steps=Voluntary%20Exit%20%28Sec.%208a%29%3A%3AEUR%2035%2C000%20%28100.0%25%20returned%20prior%20to%20CySEC%20license%20release%29%7C60%25%20Trust%20%2B%20ICF%20Top-Up%3A%3AEUR%2033%2C600%20%2896.0%25%20%3D%20EUR%2021k%20trust%20%2B%20EUR%2012.6k%20ICF%20payout!%29%7C0%25%20Trust%20%28Worst%20Fraud%29%3A%3AEUR%2020%2C000%20ICF%20max%20%2857.1%25%20immediate%20%2B%20EUR%2015k%20court%20claim%29%7COffshore%20Sister%20Entity%3A%3AEUR%200.00%20statutory%20compensation%20%280%25%20ICF%20%2F%200%25%20EU%20trust%20law!%29&metrics=TRUST%20POOL%20PRIORITY%3A%3A1st%20Ring-Fence%3A%3AOutside%20general%20creditors%20%28DI87-01%29%7CICF%20CO-INSURANCE%3A%3A90%25%20up%20to%2020k%3A%3ACovers%20residual%20shortfall%7CICF%20FILING%20COST%3A%3AEUR%200%20Official%3A%3ANever%20pay%20%22recovery%22%20cold-callers!%7CPAYMENT%20TIMELINE%3A%3A3m%20Post-Verify%3A%3AExtendable%20%2B3m%20complex%20cases)

## Why Keeping Retail Single-Broker Exposure Near EUR 22,222 Optimizes Worst-Case Protection

Notice the clean portfolio-sizing takeaway from the waterfall above: even in an extreme fraud where 100% of segregated accounts vanished, a retail trader holding **EUR 22,222 per independent CySEC CIF** recovers **0.90 * 22,222 = EUR 20,000 (90.0%)** directly from the ICF—whereas parking EUR 200,000 at a single small retail CFD broker leaves EUR 180,000 reliant entirely on intact [DI87-01 segregated bank waivers](/bulletins/cysec-directive-di87-01-client-money-segregation-reconciliation)!

## Frequently asked questions

### Does a temporary 30-day Section 10(1) CIF suspension automatically activate the EUR 20,000 Investor Compensation Fund?

No! During an initial 15-to-30-day Section 10(1) suspension, the CIF is ordered to remediate governance/capital findings and return client withdrawals directly from its segregated bank accounts. The ICF is activated ONLY later if the CIF proves permanently unable to return client funds and CySEC withdraws its license.

### Can a suspended CySEC CIF forcibly liquidate all open profitable client positions at arbitrary prices without asking clients?

No: standard CySEC Section 10(1) suspension decisions instruct the CIF to complete all its own transactions and those of its clients currently before it "in accordance with client instructions"—arbitrary off-market close-outs breach client rights!

### How long did historical ICF compensation processes take in complex cross-border cases like AFX Capital Markets?

While Directive DI87-07 sets a 3-month payment window AFTER claim verification completes (extendable by 3 months), forensic reconciliation of tens of thousands of cross-border MT4 claims and parallel UK/Cyprus insolvency estates historically took 18 to 36+ months from initial suspension to final bank wire.

### Are institutional or Elective Professional clients of a revoked CIF eligible to file claims with the Cyprus ICF?

No! Annex II Per Se Professional Clients (banks, investment firms, funds, large corporates) AND clients who validly opted up to Elective Professional status are statutorily excluded from Investor Compensation Fund payouts under Directive DI87-07.


## Source URLs

- https://www.cysec.gov.cy/en-GB/investor-protection/icf/
- https://www.cysec.gov.cy/en-GB/supervision/investment-firms/suspension-withdrawal/
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:31997L0009

## Citation

- APA: Lukas Lindqvist, CEFA. (2026). CySEC CIF License Suspension & Withdrawal Forensics: AFX, ACFX & ICF Claim Activation. Euro Firm Ledger. https://eurofirmledger.com/bulletins/cysec-cif-license-suspension-forensics-afx-acfx-icf-activation
- Canonical article: [CySEC CIF License Suspension & Withdrawal Forensics: AFX, ACFX & ICF Claim Activation](https://eurofirmledger.com/bulletins/cysec-cif-license-suspension-forensics-afx-acfx-icf-activation)
- Site research index: [Euro Firm Ledger](https://eurofirmledger.com/llms-full.txt)