CySEC licensing: AIFM, CIF
and the operating model question.

Cyprus has established itself as one of the leading jurisdictions in the European Union for regulated investment management and financial services. The combination of EU passporting rights, an accessible regulatory process and a well-developed professional infrastructure has made CySEC authorisation an attractive route for fund managers, investment advisors, family offices and financial intermediaries operating across Europe and internationally.

This article sets out the principal licensing options available under CySEC: the Alternative Investment Fund Manager (AIFM) licence, the Cyprus Investment Firm (CIF) licence, and the combined AIFM with MiFID top-up structure. It also addresses the question that matters most before any licensing decision is made: what does the business actually do, and which structure genuinely serves it best?

Why Cyprus for regulated financial services?

Cyprus is a full EU member state, which means that a CySEC-authorised entity can passport its services across all 30 EEA member states without requiring separate authorisation in each jurisdiction. For a fund manager or investment firm with a European client base, this is a material operational advantage.

The regulatory framework is robust and aligned with EU standards, including AIFMD, MiFID II and DORA. CySEC has invested significantly in its supervisory infrastructure and is regarded as a credible EU regulator. At the same time, the practical process of obtaining authorisation in Cyprus, while rigorous, is manageable with proper preparation and does not carry the delays or structural complexity of some larger EU jurisdictions.

Cyprus also offers a corporate tax rate of 15% from 2026, an extensive network of double tax treaties, a well-developed legal system based on English common law, and a professional services market with deep experience in fund management, compliance and tax structuring. English is the working language of the financial services industry.

The AIFM licence

An Alternative Investment Fund Manager (AIFM) licence is required for any entity that manages one or more Alternative Investment Funds (AIFs) as an external manager. The legal framework in Cyprus is the Alternative Investment Fund Managers Law of 2013, implementing the EU AIFMD Directive, together with the Alternative Investment Funds Law 124(I)/2018 governing the funds themselves.

What an AIFM can do

An authorised AIFM can manage and administer alternative investment funds, including AIFs established as variable capital investment companies, limited liability partnerships, and AIFs with a limited number of persons (AIFLNPs). The AIFM can also provide portfolio management and risk management services to the funds it manages, and can be authorised to provide certain additional MiFID services as a top-up to its core AIFM authorisation. An EU-authorised AIFM benefits from the AIFMD marketing passport, allowing it to market AIF units to professional investors across the EEA without separate national approvals.

Capital requirements and governance

The minimum initial capital for an AIFM is €125,000. This must be held in a Cyprus bank account and evidenced as part of the application. The capital requirement increases as assets under management grow, with additional own funds required where AUM exceeds €250 million.

CySEC expects the AIFM to be managed by at least two executive directors who are full-time, exclusive to the entity, Cyprus-resident, and fit and proper as assessed by CySEC. The board is expected to include two independent non-executive directors. Key function holders, including the Portfolio Manager, Risk Manager and Compliance Officer, must hold the CySEC Advanced Certificate. The AML Compliance Officer must hold the CySEC AML Certificate.

The CIF licence

A Cyprus Investment Firm (CIF) is authorised under Law 87(I)/2017, the domestic implementation of MiFID II. A CIF can provide a defined list of investment services and ancillary services to clients across the EEA under the EU passport.

What a CIF can do

The investment services available to a CIF include the reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, investment advice, underwriting and placing of financial instruments, and operation of multilateral and organised trading facilities. For firms whose primary activity is providing investment advice without holding client funds, the CIF licence with a limited scope is a proportionate and cost-efficient structure.

Capital requirements and governance

As with the AIFM, CySEC expects a four-eyes governance structure with at least two executive directors, supported by independent non-executive directors. Management and control must be exercised in Cyprus. Key persons must be registered in CySEC's public register, which requires success in the relevant CySEC examinations.

The combined structure: AIFM with MiFID top-up

An AIFM may apply to CySEC for a MiFID top-up permission, enabling it to provide certain investment services — most commonly investment advice — in addition to its core fund management activities. This combined structure avoids the cost and complexity of maintaining two separate licensed entities where the operating model genuinely supports it.

CySEC's expectation is that the MiFID activity remains genuinely complementary to the core AIFM business. An entity whose primary revenue is generated from investment advice rather than fund management is not an appropriate candidate for this structure. CySEC will assess the income composition of the business and the proportionality of the MiFID activity relative to the AIFM function. Where MiFID income is the dominant revenue stream, a standalone CIF is the appropriate structure.

The operating model question

The licensing decision should always begin with the operating model, not the licence.

The most common mistake made in CySEC licensing is selecting a structure on the basis of capital cost or perceived simplicity, without a rigorous analysis of what the business actually does, where it intends to generate revenue, and how its activities are likely to evolve.

An entity that manages a family AIF and provides investment advice to the family members is a candidate for the combined structure, provided the advisory activity remains proportionate. An entity whose clients are predominantly advisory clients with no significant AIF management activity is a CIF. An entity that manages third-party funds with no advisory component is an AIFM.

Where the operating model is unclear or hybrid at inception, the default instinct is often to apply for the broader licence to preserve optionality. This can be appropriate, but it carries a cost: broader licences require more capital, more key persons, more governance infrastructure, and more ongoing regulatory overhead. The correct question is not which licence permits the most activities, but which licence is genuinely suited to the business being built.

Getting this right at the outset avoids the more expensive problem of operating under the wrong structure and having to restructure it later, or maintaining two separate licensed entities where one would have been sufficient.

AIFMD II: the deadline approaching

All EU member states are required to transpose AIFMD II into national law by 16 April 2026. The directive introduces targeted but material changes to the existing framework, with particular impact on:

Open-ended AIFs, which must now select and implement at least two liquidity management tools from a prescribed list and embed them into fund documentation and processes. The definition of open-ended is deliberately broad and captures structures not traditionally viewed as such.

Loan-originating AIFs, which are subject to new leverage limits, a 5% risk retention requirement and enhanced disclosure obligations. Loan-originating AIFs should in principle be closed-ended.

Delegation frameworks, where AIFMD II tightens the conditions under which AIFM functions can be delegated and introduces enhanced supervisory reporting on delegation arrangements.

Enhanced transparency obligations under Article 23, including new disclosures on liquidity risk management, fees and originated loans. These apply to EU and non-EU AIFMs alike.

For existing CySEC-authorised AIFMs, the practical implication is a review of fund documentation, liquidity management processes and delegation frameworks well ahead of April 2026. For entities considering AIFM authorisation, applications submitted now will be assessed against a regulatory framework that is in transition, and the licensing process should be designed with AIFMD II compliance in mind from the outset.

The enhanced Annex IV regulatory reporting requirements apply from 16 April 2027, providing a brief additional runway for reporting infrastructure. Operational readiness for the 2026 requirements, however, cannot be deferred.

The licensing process

CySEC operates a structured licensing process that typically takes between six and twelve months from submission of a complete application, depending on the licence type, the complexity of the proposed structure, and the speed at which CySEC's queries are addressed.

In practice, the main driver of delays is rarely the regulatory review itself. It is the time required to identify suitable, fit and proper key persons, collect supporting documentation for each of them, and prepare the detailed organisational and procedural documentation that CySEC requires. Applications that are well-prepared and respond promptly to CySEC queries proceed significantly faster than those that are not.

Following completion of the CySEC review, the regulator issues a conditional approval. The applicant must satisfy all conditions and then request an activation visit, during which CySEC expects the Cyprus-based team to be present and able to demonstrate operational readiness. Final approval by the CySEC Board follows a successful activation visit, at which point the entity is added to the public register and may commence operations.