CySEC licensing: AIFM, CIF
and the operating model question.

Cyprus operates a fully MiFID II and AIFMD-aligned regulatory regime, accessible at a cost and timeline that compare favourably with other EU jurisdictions for regulated investment management and financial services. The combination of EU passporting rights, an accessible regulatory process and a well-developed professional infrastructure has made CySEC authorisation a workable route for fund managers, investment advisors, family offices and financial intermediaries operating across Europe and internationally.

This article sets out the principal licensing options available under CySEC: the Alternative Investment Fund Manager (AIFM) licence, the Cyprus Investment Firm (CIF) licence, and the combined AIFM with MiFID top-up structure. It also addresses the question that matters most before any licensing decision is made: what does the business actually do, and which structure genuinely serves it best?

Why Cyprus for regulated financial services?

Cyprus is a full EU member state, which means that a CySEC-authorised entity can passport its services across all 30 EEA member states without requiring separate authorisation in each jurisdiction. For a fund manager or investment firm with a European client base, this is a material operational advantage. The mechanics of the MiFID II passport for a Cyprus Investment Firm are addressed separately.

The regulatory framework is robust and aligned with EU standards, including AIFMD, MiFID II and DORA. CySEC has invested significantly in its supervisory infrastructure and is regarded as a credible EU regulator. At the same time, the practical process of obtaining authorisation in Cyprus, while rigorous, is manageable with proper preparation and does not carry the delays or structural complexity of some larger EU jurisdictions.

Cyprus also offers a corporate tax rate of 15% from 2026, an extensive network of double tax treaties, a well-developed legal system based on English common law, and a professional services market with deep experience in fund management, compliance and tax structuring. English is the working language of the financial services industry.

The AIFM licence

An Alternative Investment Fund Manager (AIFM) licence is required for any entity that manages one or more Alternative Investment Funds (AIFs) as an external manager. The legal framework in Cyprus is the Alternative Investment Fund Managers Law of 2013, implementing the EU AIFMD Directive, together with the Alternative Investment Funds Law 124(I)/2018 governing the funds themselves. The AIFM authorisation file that CySEC assesses, the phases the file runs through, the AIF strategies the licence covers, the Internal Operations Manual that describes how the AIFM will operate, the personal file for each individual examined, and the activation clock that starts on the day of the licence letter are walked separately.

What an AIFM can do

An authorised AIFM can manage and administer alternative investment funds, including AIFs established as variable capital investment companies, limited liability partnerships, and AIFs with a limited number of persons (AIFLNPs). The AIFM can also provide portfolio management and risk management services to the funds it manages, and can be authorised to provide certain additional MiFID services as a top-up to its core AIFM authorisation. An EU-authorised AIFM benefits from the AIFMD marketing passport, allowing it to market AIF units to investors across the EEA through a notification procedure to its home NCA, without the need for separate national authorisation in each host member state.

Capital requirements and governance

The minimum initial capital for an AIFM is €125,000. This must be held with a credit institution authorised in the EU/EEA and evidenced as part of the application. The capital requirement increases as assets under management grow, with additional own funds required where AUM exceeds €250 million.

CySEC expects the AIFM to be managed by at least two executive directors who are full-time and exclusive to the entity, with at least one Cyprus-resident, and both fit and proper as assessed by CySEC. Subject to the division of responsibilities, the second executive director may be based outside Cyprus where their function does not require day-to-day Cyprus presence. The board is expected to include two independent non-executive directors. Key function holders, including the Portfolio Manager, Risk Manager and Compliance Officer, must hold the CySEC Advanced Certificate. The AML Compliance Officer must hold the CySEC AML Certificate. The fit and proper standard CySEC applies at licensing is the same across AIFM and CIF applications, and it is a standard the regulator applies to the individuals, not just to the entity.

The CIF licence

A Cyprus Investment Firm (CIF) is authorised under Law 87(I)/2017, the domestic implementation of MiFID II. A CIF can provide a defined list of investment services and ancillary services to clients across the EEA under the EU passport.

What a CIF can do

The investment services available to a CIF include the reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, investment advice, underwriting and placing of financial instruments, and operation of multilateral and organised trading facilities. For firms whose primary activity is providing investment advice, portfolio management and the reception and transmission of orders, without holding client funds or assets, the CIF licence with a limited scope offers a proportionate and cost-efficient structure. This is the typical model for external asset managers operating under CySEC authorisation.

As with the AIFM, CySEC expects a four-eyes governance structure with at least two executive directors, supported by independent non-executive directors. Management and control must be exercised in Cyprus. Key persons must be registered in CySEC's public register, which requires success in the relevant CySEC examinations. The Cyprus Companies Law director duties that sit underneath the CySEC governance overlay apply equally to executive and independent non-executive seats; the regulatory overlay structures the board, the Companies Law sets the duty. The CIF minimum capital requirement sits alongside the governance in the application bundle, and both are tested against the operating model rather than assumed from the licence.

The combined structure: AIFM with MiFID top-up

An AIFM may apply to CySEC for a MiFID top-up permission under Article 6(4) AIFMD, enabling it to provide additional investment services, including portfolio management, reception and transmission of orders, and investment advice, as well as the ancillary service of safekeeping and administration of financial instruments. This combined structure avoids the cost and complexity of maintaining two separate licensed entities where the operating model genuinely supports it.

CySEC's expectation is that the MiFID activity remains genuinely complementary to the core AIFM business. An entity whose primary revenue is generated from MiFID services rather than fund management is not an appropriate candidate for this structure. CySEC will assess the income composition of the business and the proportionality of the MiFID activity relative to the AIFM function. Where MiFID income is the dominant revenue stream, a standalone CIF is the appropriate structure.

The operating model question

The licensing decision should always begin with the operating model, not the licence.

The most common mistake made in CySEC licensing is selecting a structure on the basis of capital cost or perceived simplicity, without a rigorous analysis of what the business actually does, where it intends to generate revenue, and how its activities are likely to evolve.

The combined structure is well suited to a business that manages a family AIF while also advising the same family members on their broader investment affairs, provided the advisory activity remains proportionate to the AIFM function. Where the business provides investment advice and other MiFID services without managing any AIFs, a standalone CIF is the appropriate licence. Conversely, where the sole activity is managing AIFs with no advisory or other MiFID services, a standalone AIFM licence is sufficient.

Where the operating model is unclear or hybrid at inception, the default instinct is often to apply for the broader licence to preserve optionality. This can be appropriate, but it carries a cost: broader licences require more capital, more key persons, more governance infrastructure, and more ongoing regulatory overhead. The correct question is not which licence permits the most activities, but which licence is genuinely suited to the business being built.

Getting this right at the outset avoids the more expensive problem of operating under the wrong structure and having to restructure it later, or maintaining two separate licensed entities where one would have been sufficient.

AIFMD II: the deadline that just landed

EU member states were required to transpose AIFMD II into national law by 16 April 2026. The transposition deadline has now passed and the directive's provisions are entering effect across the EU as each member state's transposition statute comes into force. The directive introduces targeted but material changes to the existing framework, with particular impact on:

Open-ended AIFs, which must now select and implement at least two liquidity management tools from a prescribed list and embed them into fund documentation and processes. The definition of open-ended is deliberately broad and captures structures not traditionally viewed as such.

Loan-originating AIFs, which are subject to new leverage limits, a 5% risk retention requirement and enhanced disclosure obligations. Loan-originating AIFs should in principle be closed-ended.

Delegation frameworks, where AIFMD II tightens the conditions under which AIFM functions can be delegated and introduces enhanced supervisory reporting on delegation arrangements.

Enhanced transparency obligations under Article 23, including new disclosures on liquidity risk management, fees and originated loans. These apply to EU and non-EU AIFMs alike.

For existing CySEC-authorised AIFMs, the practical implication is a review of fund documentation, liquidity management processes and delegation frameworks against the transposed regime as it now applies. For entities considering AIFM authorisation, applications are now assessed against a framework that incorporates AIFMD II, and the licensing process should be designed with AIFMD II compliance in mind from the outset.

The enhanced Annex IV regulatory reporting requirements apply from 16 April 2027, providing a brief additional runway for reporting infrastructure. Operational readiness for the 2026 requirements, however, cannot be deferred.

The licensing process

CySEC operates a structured licensing process that typically takes between six and twelve months from submission of a complete application, depending on the licence type, the complexity of the proposed structure, and the speed at which CySEC's queries are addressed.

In practice, the main driver of delays is rarely the regulatory review itself. It is the time required to identify suitable, fit and proper key persons, collect supporting documentation for each of them, and prepare the detailed organisational and procedural documentation that CySEC requires. The application bundle is not a one-time exercise: it becomes the constitutional document of the regulated entity, and the gap between what those documents say the firm does and what it actually does is the primary measure of regulatory risk after activation. The internal audit function CySEC expects the firm to run annually is the mechanism that finds and closes that gap in the ordinary course; applications that are well-prepared and respond promptly to CySEC queries proceed significantly faster than those that are not.

Following completion of the CySEC review, the regulator issues a conditional approval. The applicant must satisfy all conditions and then request an activation visit, during which CySEC expects the Cyprus-based team to be present and able to demonstrate operational readiness. Final approval by the CySEC Board follows a successful activation visit, at which point the entity is added to the public register and may commence operations. The firm's regulated entity licensing practice runs CIF, AIFM and PI/EMI licensing engagements on this framework, from operating model assessment through activation and post-authorisation support.

Frequently asked questions

What is a CySEC licence?

A CySEC licence is an authorisation issued by the Cyprus Securities and Exchange Commission to operate as a regulated financial entity in Cyprus. CySEC regulates investment firms (CIF), alternative investment fund managers (AIFM), alternative investment funds (AIF), and other financial intermediaries. CySEC-licensed entities benefit from EU passporting rights under MiFID II and AIFMD.

What is the difference between an AIFM and a CIF licence in Cyprus?

An AIFM licence is required to manage alternative investment funds. A CIF licence under MiFID II is required to provide investment services to clients. The correct choice depends on the operating model: whether the entity is managing a fund or providing advisory, discretionary management, or other investment services directly to investors. Some structures require both, and the combined AIFM with MiFID top-up avoids the cost of two separate licensed entities where the operating model genuinely supports it.

What is AIFMD II and how does it affect Cyprus-licensed AIFMs?

AIFMD II is the revised Alternative Investment Fund Managers Directive that introduces enhanced substance requirements for EU-based AIFMs, targeted liquidity management tools for open-ended AIFs, leverage limits and a five per cent risk retention requirement for loan-originating AIFs, tighter conditions on delegation, and enhanced transparency obligations under Article 23. The transposition deadline was 16 April 2026 and the directive's provisions are now in effect as each member state's transposition statute comes into force. The enhanced Annex IV reporting requirements apply from 16 April 2027.

How long does it take to obtain a CySEC licence in Cyprus?

A well-prepared CIF application typically takes six to nine months from submission to approval. An AIFM application may take nine to twelve months. The most significant variable is application quality: incomplete documentation, unclear ownership structures, and inadequate business plans are the primary causes of delay. Citius Trust manages the full process from feasibility through to post-licensing compliance infrastructure.