# CySEC Circulars C268 & C518 Offshore Group Routing Bans

> Audit CySEC Circulars C268, C417, and C518 plus ESMA Q&A prohibiting Cyprus Investment Firms from routing EEA retail traders to offshore group entities.

Canonical: https://eurofirmledger.com/bulletins/cysec-circular-c268-c518-third-country-offshore-group-routing
Last updated: 2026-11-14T21:27:12.774Z

**Publication:** Euro Firm Ledger
**Category:** Cysec Cif Icf Safeguarding Directives
**Published:** 2026-11-13T14:50:25.915Z
**Author:** Lukas Lindqvist, CEFA (Certified European Financial Analyst (EFFAS/CEFA, Frankfurt & Zurich))
**Reviewer:** Not recorded

## Answer-first summary

When ESMA capped retail CFD leverage at 30:1, several brokerage groups tried nudging European clients onto Seychelles or Bahamas sister entities—triggering CySEC Circulars C268 and C518 enforcement.

## Key takeaways

- CySEC Circulars C268, C417, and C518 strictly prohibit Cyprus Investment Firms from marketing, cross-selling, or redirecting EEA retail clients toward offshore third-country group entities.
- Pre-ticked onboarding disclaimers claiming an EU retail client approached a Seychelles or Bahamas sister brand at their "own exclusive initiative" are void under MiFID II Article 42.
- Hedging a Limassol CIF’s B-book with an unrated offshore sister company triggers an 8.0% K-TCD risk factor and severe IFR K-CON concentration penalties above 25% of Own Funds.
- Every website URL and landing funnel operated by a CIF must match CySEC’s public Approved Domains Register before accepting a single euro of EEA traffic.

## Related financial entities

- **Cyprus Investment Services and Activities Law (CySEC)** (CYSEC-CIF) — license: Statutory framework administered by CySEC transposing MiFID II, governing the authorization and operational requirements of Cypriot Investment Firms.
- **European Securities and Markets Authority (ESMA)** (ESMA) — license: Independent European Union authority contributing to safeguarding the stability of the EU financial system by enhancing investor protection and promoting stable markets.
- **MiFID II Cross-Border Passporting Framework** (MIFID2-PASS) — license: Harmonized European framework allowing authorized investment firms to provide investment services across all EU member states and EEA countries.

## Analysis

Immediately after [ESMA](/passports/european-securities-and-markets-authority) introduced pan-European 30:1 retail CFD leverage caps in August 2018, supervisory sweeps uncovered an aggressive regulatory-arbitrage funnel across Limassol: global multi-brand brokerage groups used their authorized **[Cyprus Securities and Exchange Commission (CySEC)](/competent-authorities/cysec)** CIF website to attract European Union traffic, then displayed "Trade at 500:1 Globally" pop-ups or call-center scripts steering EEA residents into sister entities incorporated in Seychelles, Mauritius, Belize, St. Vincent, or Vanuatu! Through **CySEC Circulars C268, C417, and C518**—reinforced by ESMA's 2022–2024 Supervisory Briefings on third-country firm circumvention—CySEC made cross-selling or redirecting EEA retail clients to offshore group entities an immediate license-suspension offense.

Within our [CySEC CIF & ICF master guide](/bulletins/cysec-cif-authorisation-eur-20000-icf-safeguarding-guide-2026) and the [CySEC safeguarding hub](/topics/cysec-cif-icf-safeguarding-directives), multi-jurisdictional groups operating compliant Cyprus hubs alongside global desks—such as [CAPEX.com](/firms/capex) ([License 292/16](/verify/license/292%2F16)), [1Market](/firms/1markets), [B2Prime](/firms/b2prime), and [Colmex Pro](/firms/colmex-pro)—must maintain hard technical, legal, and staffing walls between their EEA MiFID domain and any non-EEA sister brand.

## Five Prohibited Offshore Group Routing Practices Under Circulars C268 & C518

| Abusive Multi-Entity Practice | Statutory Provision Violated | CySEC & Host-NCA Forensic Detection Method | Regulatory Sanction Exposure |
| :--- | :--- | :--- | :--- |
| **1. Geo-Selector / Dropdown Offshore Opt-Out** | **MiFID II Art. 24(1) & 42; Circular C518** | Mystery-shopping IPs from Madrid, Paris, Rome, and Berlin testing whether EU users can pick "Global 1:500" | Administrative fines up to EUR 5M + [Art. 86 host-state block](/bulletins/mifid-ii-article-86-precautionary-powers-host-nca-blocking-2026) |
| **2. "Reverse Solicitation" Pre-Checked Disclaimers** | **MiFID II Art. 42 & ESMA Q&A** | Auditing onboarding checkboxes claiming the EU client "requested the offshore firm at own exclusive initiative" | Checkbox ruled legally void; unauthorized third-country investment service! |
| **3. Shared Limassol Retention Call Centers** | **Law 87(I)/2017 Sec. 17 & Circular C268** | Unannounced CySEC floor raids checking CRM tabs and VoIP logs of Limassol account managers | Suspension of CIF authorization under [Section 10(1) Law 87(I)/2017](/bulletins/cysec-cif-license-suspension-forensics-afx-acfx-icf-activation) |
| **4. Back-to-Back 100% Offshore B-Book Transfer** | **IFR K-TCD / K-CON & Circular C417** | Reviewing COREP IF 06/08 counterparty exposure where CIF hedges 100% of trades with an unrated Belize sister shell | Disallowance of risk mitigation + punitive [K-CON capital surcharge](/bulletins/ifr-part-four-k-con-concentration-risk-25pct-own-funds-excess)! |
| **5. Brand-Mirroring Domain Confusion (**.com** vs **.eu**)** | **Law 87(I)/2017 Sec. 25(3) Fair/Clear/Not Misleading** | Inspecting CySEC Approved Domains Registry against Google Paid Search landing URLs in EU states | Immediate cease-and-desist + mandatory domain takedown |

![Technical and operational firewall architecture required by CySEC Circulars C268 and C518 between a Cyprus CIF and non-EEA group entities](/api/figure?type=flow&title=CySEC%20C268%20%2F%20C518%20EEA%20Geo-Fencing%20%26%20Entity%20Segregation%20Firewall&subtitle=Mandatory%20hard-blocking%20of%20EEA%20residents%20from%20non-EU%20sister%20brands%20and%20shared%20CRM%20desks&steps=1.%20EEA%20IP%20%26%20KYC%20Gate%3A%3AHard-lock%20EU%2FEEA%20IP%2C%20tax%20residency%2C%20and%20passport%20holders%20to%20.eu%20CIF!%7C2.%20Zero%20Offshore%20Links%3A%3AStrip%20all%20hyperlinks%2C%20pop-ups%2C%20and%20leverage%20comparisons%20to%203rd-country%20entities%7C3.%20Separate%20CRM%20%26%20Staff%3A%3ACySEC-certified%20retention%20officers%20access%20ONLY%20EEA%20CIF%20client%20records%7C4.%20Arm%E2%80%99s-Length%20LP%20Hedge%3A%3AVerify%20group%20liquidity%20routing%20meets%20EMIR%2C%20K-TCD%2C%20and%20K-CON%20caps&metrics=EEA%20OFFSHORE%20OPT-OUT%3A%3A0%25%20Permitted%3A%3ACheckbox%20waivers%20void%20under%20Art.%2042%7CDOMAIN%20APPROVAL%3A%3AMandatory%20Pre-Use%3A%3ACySEC%20Approved%20Domains%20Register%7CGROUP%20LP%20EXPOSURE%3A%3A%3C%3D%2025%25%20Own%20Funds%3A%3AIFR%20K-CON%20non-bank%20group%20cap!%7CHOST%20NCA%20WATCH%3A%3ACNMV%2FAMF%2FBaFin%3A%3AJoint%20ESMA%20mystery-shopping%20sweeps)

## Why Offshore Sister Hedging Triggers an IFR K-CON Capital Explosion!

Even when a Cyprus CIF keeps 100% of EEA retail clients onboarded inside Cyprus—never sending a single European client offshore—many international groups still make a fatal prudential mistake: routing 95%–100% of the Cyprus CIF's back-to-back B-book/STP hedging trades to an **unregulated or offshore group market-making entity** in Mauritius, Dubai, or Seychelles!
- Under **IFR Articles 36–39**, while exposures to *prudentially supervised EEA credit institutions and Class 2 investment firms* enjoy specific institutional exemptions or EUR 150M floors, an **unregulated or non-equivalent offshore sister company is treated as an ordinary non-financial / unrated corporate counterparty**—capped at **25% of the CIF's Own Funds**!
- The moment net positive replacement cost and unsegregated margin posted by the Limassol CIF to its offshore group entity exceed 25% of Own Funds, **IFR Table 6 progressive K-CON surcharges (200% to 900% of K-TCD)** detonate the CIF's Pillar 1 capital ratio!

## Approved Domains Registry & Google Ads Geo-Targeting Audits

CySEC maintains a public **Approved Domains List** directly inside each CIF's entry on the [CySEC institutional registry](/competent-authorities/cysec) (cross-checked on our [license verification engine](/verify)). Under **Circular C417**, operating *any* unnotified landing domain, mirror funnel, or mobile app store listing under a CIF's brand—or allowing affiliates to bid on European search keywords pointing to a **.com** offshore domain instead of the **.eu** CIF domain—is prosecuted directly against the Cyprus Board of Directors! Compare how [Article 42 Reverse Solicitation rules](/bulletins/mifid-ii-article-42-reverse-solicitation-exclusive-initiative) reinforce this ban across all 27 EU Member States.

## Quantitative Exposure Model: Group Offshore Hedging K-CON Penalty vs EEA Prime Routing

Model the exact **Own-Funds Deterioration** suffered by a Limassol CIF (EUR 4,000,000 CET1 Own Funds) that posts EUR 3,200,000 of unsegregated hedging margin to an offshore group entity versus routing to an EEA regulated Prime-of-Prime or bank:

```formula
Group_Offshore_Hedge_Counterparty_Concentration_Penalty (IFR_Art_37_39):
 CIF_Eligible_Own_Funds (OF_EUR) = EUR 4,000,000
 Hard_Non_Institutional_Group_Limit (25% * OF) = EUR 1,000,000

 Case_A (Offshore_Unrated_Group_Dealer_Exposure EV = EUR 3,200,000):
 Excess_Exposure (EVE) = 3,200,000 - 1,000,000 = EUR 2,200,000 (220% of Limit -> Spans Bands up to >250% OF_25%!)
 Base_K_TCD_Unrated_Corporate (RF = 8.0%, alpha = 1.2) = 1.2 * 3,200,000 * 0.08 = EUR 307,200
 Progressive_K_CON_Surcharge (>10 days un-remediated) ~= EUR 960,000+ punitive CET1 charge!
 Plus: EUR 3,200,000 cash = EUR 0 IFR Art. 43 Liquid Assets!

 Case_B (Authorized_EEA_Institution / Bankruptcy_Remote_Custodian EV = EUR 3,200,000):
 Institutional_Limit = max(25% * OF, min(EUR 150M, 100% * OF)) = EUR 4,000,000 -> EVE = EUR 0 (K-CON = EUR 0!)
 Base_K_TCD_Institution (RF = 1.6%, alpha = 1.2) = 1.2 * 3,200,000 * 0.016 = EUR 61,440 (-95.2% total capital!)
```

![Pillar 1 K-TCD plus K-CON own-funds charge comparing offshore sister-company hedging against regulated EEA institutional prime brokerage on EUR 3.2M margin](/api/figure?type=bars&title=Capital%20Penalty%20of%20Offshore%20Group%20Hedging%20vs%20EEA%20Prime%20Routing&subtitle=Total%20Pillar%201%20K-TCD%20%2B%20K-CON%20own-funds%20requirement%20on%20EUR%203.2M%20hedging%20exposure%20%28EUR%204M%20CET1%20CIF%29&steps=Offshore%20Sister%20Shell%3A%3AEUR%201%2C267k%2B%20CET1%20charge%20%288%25%20RF%20%2B%20punitive%20Table%206%20K-CON!%29%7CUnsegregated%20EU%20Prime%3A%3AEUR%2061.4k%20CET1%20charge%20%281.6%25%20RF%3B%20100%25%20OF%20institutional%20cap%29%7CTri-Party%20Segregated%20LP%3A%3ANear-zero%20RC%20margin%20exposure%20%2B%20preserves%20HQLA%20liquidity!%7CClient%20Offshore%20Referral%3A%3AForbidden!%20Risks%20EUR%205M%20fine%20%2B%20Sec.%2010%281%29%20CIF%20suspension&metrics=CAPITAL%20SAVINGS%3A%3A-95.2%25%20CET1%3A%3AEEA%20institution%20vs%20offshore%20shell%7COFFSHORE%20RF%3A%3A8.0%25%20vs%201.6%25%3A%3A5x%20higher%20K-TCD%20risk%20factor!%7CICF%20DISCLOSURE%3A%3AZero%20Coverage!%3A%3AOffshore%20sister%20has%20EUR%200%20EU%20ICF%7CCIRCULAR%20C518%3A%3AStrict%20Geo-Lock%3A%3AMandatory%20EEA%20onboarding%20wall)

## Board Attestation & Annual Compliance Officer Review Duties

Under **CySEC Circular C518** and **Law 87(I)/2017 Section 17**, the CIF's Compliance Officer must include a dedicated **Group Cross-Border & Third-Country Circumvention Audit Section** inside the Annual Compliance Report approved by the Board of Directors—testing live onboarding flows via EU residential VPNs across Spain ([CNMV](/competent-authorities/cnmv)), France ([AMF](/competent-authorities/amf)), Italy ([CONSOB](/competent-authorities/consob)), and Germany ([BaFin](/competent-authorities/bafin)) to verify zero leakage to offshore group brands.

## Frequently asked questions

### Can a global brokerage group legally own both a CySEC CIF for EU residents and an FSC/FSA entity for non-EU clients?

Yes, owning separate regional licenses for Latin America, Asia, or MENA is completely lawful—provided strict technical geo-blocking prevents EEA residents from onboarding offshore, brands/domains never mislead EU users, and Limassol CIF staff never solicit EU clients for offshore entities.

### What if an existing CySEC retail client emails asking to transfer their account to the group’s offshore 1:500 entity?

Under ESMA’s MiFID II Article 42 Q&A and CySEC Circular C518, if the group maintains any presence, brand awareness, or relationship with the client in the EU, steering or facilitating a "transfer" to bypass ESMA 30:1 CFD limits does NOT qualify as valid reverse solicitation!

### Can a Limassol CIF outsource IT development or back-office reconciliations to a group service company outside the EEA?

Technical back-office support may be outsourced subject to strict MiFID II Delegated Regulation 2017/565 Article 31–32 outsourcing notifications, DORA ICT rules, and GDPR safeguards—provided critical management, Four-Eyes control, and client-facing regulated activities stay in Cyprus/EEA.

### How can traders check whether a ".com" website belongs to a regulated CySEC CIF or an uninsured offshore sister company?

Look up the CIF’s 3-digit license number on CySEC’s Regulated Entities directory (or our /verify portal) and check the exact "Approved Domains" field—if only brand.eu is listed while you are logging into brand-global.com, your account is NOT CySEC-protected!


## Source URLs

- https://www.cysec.gov.cy/en-GB/legislation/services-markets/cifs/
- https://www.esma.europa.eu/sites/default/files/library/esma35-43-349_mifid_ii_qas_on_investor_protection_topics.pdf
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0065

## Citation

- APA: Lukas Lindqvist, CEFA. (2026). CySEC Circulars C268 & C518: Third-Country Offshore Group Cross-Selling Bans in the EEA. Euro Firm Ledger. https://eurofirmledger.com/bulletins/cysec-circular-c268-c518-third-country-offshore-group-routing
- Canonical article: [CySEC Circulars C268 & C518: Third-Country Offshore Group Cross-Selling Bans in the EEA](https://eurofirmledger.com/bulletins/cysec-circular-c268-c518-third-country-offshore-group-routing)
- Site research index: [Euro Firm Ledger](https://eurofirmledger.com/llms-full.txt)