ESMA vs CySEC: Cross-Border Supervision and What It Means for EU Traders

Reviewed by

Regulation Desk

Regulation desk

The Two-Layer EU Regulatory System

The regulation of forex and CFD brokers in the European Union operates on two distinct layers. At the top sits ESMA — the European Securities and Markets Authority — an EU-level body headquartered in Paris. Below it sit the national competent authorities (NCAs) of each member state: CySEC in Cyprus, BaFin in Germany, the AMF in France, CNMV in Spain, CONSOB in Italy, and so on.

ESMA sets the overarching rules. It issues binding technical standards, publishes guidelines that NCAs must comply with or explain why they do not, and can impose temporary product intervention measures across the entire EU. The leverage caps introduced in August 2018, the ban on binary options for retail clients, and the mandatory risk-warning requirements all originated from ESMA.

National competent authorities enforce those rules on the ground. They grant and revoke licences, conduct on-site inspections, handle complaints from consumers, and impose fines on non-compliant firms. When you see a broker described as "EU-regulated," it holds a licence from one of these national authorities — never from ESMA directly.

This distinction matters. No broker is "ESMA-regulated." ESMA is a coordinator and rulemaker, not a licensor. If a broker claims ESMA regulation, that is either a misunderstanding or a deliberate misrepresentation. The licence always comes from a specific national authority.

What Is CySEC and Why Do Most Brokers Use It?

CySEC — the Cyprus Securities and Exchange Commission — is the national financial regulator of the Republic of Cyprus. Cyprus joined the EU in 2004, and CySEC became a fully MiFID-compliant regulatory authority, operating under the same legal framework as BaFin, the AMF, or any other EU national regulator.

A disproportionate share of Europe's retail forex brokers hold CySEC licences. Estimates vary, but upwards of 60% of EU-regulated retail FX and CFD brokers are headquartered in Cyprus and licensed by CySEC. Several factors drive this concentration:

Corporate tax rate: Cyprus levies a 12.5% corporate tax rate, among the lowest in the EU. An intellectual property box regime can reduce the effective rate further for firms with qualifying IP.
English-speaking environment: English is widely spoken in Cypriot business and regulatory circles, reducing friction for international firms.
Regulatory accessibility: CySEC has a well-defined application process, and licence applications have historically been processed more quickly than in some larger jurisdictions.
EU single market access: A CySEC licence provides passporting rights across all 30 EEA countries — the same access that a BaFin or AMF licence would provide.
Industry cluster effect: With so many brokers already based in Limassol and Nicosia, Cyprus has developed a deep talent pool of compliance officers, dealing-desk staff, and platform engineers familiar with the retail FX industry.

CySEC's reputation has evolved significantly. In the early 2010s, it was seen as a relatively permissive regulator. Since 2018, that perception has shifted. CySEC has imposed multi-million euro fines, revoked licences from firms that failed to comply with ESMA measures, and introduced its own national rules on marketing and bonus restrictions that in some cases go beyond ESMA's minimum requirements. It is no longer accurate to describe CySEC as a rubber stamp.

MiFID II Passporting — How a CySEC Broker Serves German Traders

The Markets in Financial Instruments Directive II (MiFID II) establishes a single-licence system across the European Economic Area. A broker licensed in one EEA country can provide investment services in any other EEA country through a mechanism called passporting. No second licence is required.

Here is how the process works in practice. A forex broker obtains its licence from CySEC in Cyprus. It then notifies CySEC that it intends to provide cross-border services into Germany. CySEC forwards this notification to BaFin. BaFin acknowledges the notification but does not re-licence the firm. The broker can then serve German clients under its CySEC licence.

This creates a specific division of supervisory responsibilities:

Home state (CySEC): Responsible for licence conditions, capital adequacy requirements, organisational requirements, conduct of business rules, and ongoing prudential supervision.
Host state (BaFin): Can impose additional marketing restrictions, language requirements for client-facing documents, and certain rules on how the broker interacts with local consumers. Cannot revoke the licence or impose capital requirements.
ESMA: Coordinates between NCAs, mediates disputes, publishes guidelines that both CySEC and BaFin must follow, and can issue temporary EU-wide product intervention measures when it identifies a significant investor protection concern.

The passporting system is the reason a single CySEC licence gives a broker access to traders in Germany, France, Spain, Italy, the Netherlands, and every other EEA country. It is also the reason why the relationship between ESMA, the home-state regulator, and the host-state regulator matters to you as a trader. The protections you receive, and the authority you complain to, depend on this structure.

What Protections Apply to You?

As an EU retail trader, you benefit from a layered set of protections. Some are set by ESMA and apply uniformly regardless of which NCA issued the broker's licence. Others depend on the home state or vary by host state. The table below breaks down the key protections and where they originate.

Protection	Scope	Notes
Leverage caps (30:1 major FX)	ESMA rule — applies everywhere	Mandated by ESMA product intervention, adopted permanently by all NCAs
Negative balance protection	ESMA rule — applies everywhere	Retail clients cannot owe money to their broker from trading losses
Segregated client funds	ESMA rule — applies everywhere	Client money held in separate bank accounts from broker operating funds
Investor compensation	Home state scheme applies	CySEC broker = ICF (EUR 20,000). Not the host country scheme.
Standardised risk warnings	ESMA rule — applies everywhere	Broker must display the percentage of retail accounts that lose money
Best execution obligation	MiFID II — applies everywhere	Broker must take sufficient steps to obtain the best possible result for the client
Complaint handling	Home state regulator	Complaints are handled by CySEC regardless of the client's country of residence

The critical point: ESMA-level protections travel with you. No matter which EU country you live in or which NCA licensed your broker, you get the same leverage caps, negative balance protection, and risk warnings. The divergence is in investor compensation, complaint handling, and certain local marketing rules.

Investor Compensation — ICF vs FSCS vs National Schemes

Investor compensation is the area where the difference between home and host state supervision has the most tangible impact on traders. The scheme that covers you is determined by the jurisdiction of the entity holding your account — not by the country you live in.

If you are a German trader using a CySEC-regulated broker, the Cypriot Investor Compensation Fund (ICF) applies, covering you up to EUR 20,000. The German compensation schemes (EdW for investments, the Entschaedigungseinrichtung for deposits) do not apply because your account is held by a Cypriot entity. This is one of the most commonly misunderstood aspects of cross-border supervision.

The UK's Financial Services Compensation Scheme (FSCS) is frequently cited as a benchmark because it provides coverage up to GBP 85,000 — roughly four times the Cypriot ICF limit. Since Brexit, UK-based brokers no longer passport into the EU, so the FSCS comparison is relevant primarily for traders who maintain separate UK and EU accounts.

Country	Regulator	Scheme	Limit	Notes
Cyprus	CySEC	ICF	EUR 20,000	Covers investment services only, not deposits
United Kingdom	FCA	FSCS	GBP 85,000	Broadest coverage in Europe; covers deposits and investments
Germany	BaFin	EdW / Deposit Guarantee	EUR 20,000 (investments) + EUR 100,000 (deposits)	Two separate schemes for investment claims and deposit claims
France	AMF / ACPR	FGDR	EUR 70,000 (securities) + EUR 100,000 (deposits)	Securities and deposit protection are split across schemes
Spain	CNMV	FOGAIN	EUR 100,000	One of the highest compensation limits in the EU
Italy	CONSOB	Italian ICS	EUR 20,000	EU minimum for investment services
Netherlands	AFM	Dutch ICS	EUR 20,000	EU minimum for investment services
Ireland	CBI	Irish ICS	EUR 20,000	EU minimum for investment services
Poland	KNF	KDPW	EUR 20,100	Marginally above the EU minimum

For a detailed breakdown of all EU compensation schemes, see our EU Compensation Schemes research.

When Does Cross-Border Supervision Fail?

The passporting system works well in theory. In practice, there are friction points that EU traders should be aware of. Acknowledging these is not an argument against CySEC regulation — it is a realistic assessment of how a single-licence, multi-jurisdiction system operates.

Language barriers in dispute resolution

CySEC handles complaints and regulatory correspondence in English and Greek. If you are a French, German, or Spanish trader filing a complaint against a CySEC broker, the process will be conducted in English. Your national regulator (BaFin, AMF, CNMV) cannot adjudicate the complaint on your behalf — they can forward it to CySEC, but the investigation remains in CySEC's hands.

Complaint routing confusion

Many traders instinctively contact their local regulator when something goes wrong. A German trader with a CySEC broker will contact BaFin. BaFin can receive the complaint and forward it to CySEC through the regulatory cooperation framework, but BaFin has no authority to compel the CySEC broker to act. The complaint must be resolved through CySEC's own complaints process. This routing adds time and can create a sense that nobody is taking responsibility.

Slow compensation payouts

The ICF has a mixed track record on speed. Historical cases — including the collapse of several CySEC-regulated firms — saw eligible clients waiting 12 to 18 months for compensation payouts. The EUR 20,000 limit, while meeting the EU minimum, offers significantly less protection than the FSCS and some other national schemes.

Marketing supervision gaps

Host states can impose marketing rules on passported firms, but enforcement is inconsistent. A CySEC broker targeting German traders via German-language advertising is technically subject to both CySEC conduct rules and BaFin marketing rules. In practice, enforcement of host-state marketing rules on cross-border firms has lagged behind what is applied to domestically licensed firms. ESMA's 2024 guidelines on marketing of investment products aim to close this gap, but implementation varies.

Practical implication:None of these issues make CySEC brokers unsafe. They are structural features of the cross-border system. Being aware of them means you can take practical steps — such as documenting all communications, filing complaints directly with CySEC from the start, and understanding that your compensation ceiling is EUR 20,000, not the limit of your home country's scheme.

How to Check Your Broker's Cross-Border Status

Before opening an account, verify exactly how the broker operates in your country. The regulatory structure affects your protections, your compensation scheme, and which authority handles your complaints.

Check the CySEC public register. CySEC maintains a searchable register of all licensed Cyprus Investment Firms (CIFs) at cysec.gov.cy. Verify the broker's licence number, the services it is authorised to provide, and whether any sanctions or restrictions are active.
Check the ESMA passporting register. ESMA publishes a register of firms that have notified their intention to provide cross-border services. This confirms whether the broker has followed the proper passporting procedure for your country.
Determine whether the broker has a tied agent or branch in your country. A tied agent or branch triggers a different supervisory model than pure cross-border services. Branches are subject to more host-state oversight, including potential local capital requirements and conduct-of-business rules. Your broker's legal documentation should specify which entity you are contracting with.
Read the client agreement carefully.The agreement will specify the legal entity, its registered jurisdiction, the applicable regulator, and the investor compensation scheme. If it names a Cypriot entity, CySEC is your regulator and the ICF is your compensation scheme — regardless of where the broker's website domain or marketing suggests it is based.

Frequently Asked Questions

Is ESMA a regulator?

ESMA is an EU-level authority, not a national regulator. It coordinates rules across the EU, issues binding technical standards, and can impose temporary product intervention measures (such as the leverage caps introduced in 2018). However, it does not grant licences to individual brokers. Licensing is done by national competent authorities such as CySEC, BaFin, or the AMF.

Why are so many brokers regulated by CySEC?

Cyprus offers a combination of EU membership, competitive corporate tax rates (12.5%), an English-speaking regulatory environment, and straightforward licence application procedures. A CySEC licence grants passporting rights across all 30 EEA countries, making it the most efficient entry point for brokers aiming to serve the entire EU market.

Am I protected by ESMA rules if I use a CySEC broker?

Yes. ESMA's product intervention measures — leverage caps, negative balance protection, standardised risk warnings, and the ban on binary options — apply uniformly to all EU-regulated brokers, regardless of which national authority issued the licence. A CySEC-regulated broker serving a German client must comply with exactly the same ESMA rules as a BaFin-regulated broker.

What is MiFID II passporting?

MiFID II passporting allows an investment firm licensed in one EEA country to provide services in any other EEA country without needing a separate licence. The home-state regulator (the one that granted the licence) retains primary supervisory responsibility. The host-state regulator is notified and can impose certain local requirements, particularly around marketing and language, but cannot block the firm from operating.

Where do I complain if a CySEC broker wrongs me?

Your first step is the broker's internal complaints procedure, which EU law requires every firm to maintain. If the internal process does not resolve the issue, the complaint escalates to CySEC, not to your local regulator. CySEC handles complaints in English and Greek. If you are in Germany, BaFin can forward your complaint to CySEC but cannot adjudicate it directly.

Is CySEC regulation safe?

CySEC is a fully MiFID II-compliant regulator within the EU framework. Since 2018, CySEC has significantly tightened its supervisory approach, issuing substantial fines and revoking licences from non-compliant firms. It is no longer the permissive regulator it was perceived to be in the early 2010s. That said, the investor compensation limit (EUR 20,000 via the ICF) is lower than in some other jurisdictions, notably the UK (GBP 85,000 via the FSCS).

Does BaFin supervise CySEC brokers operating in Germany?

BaFin has limited supervisory powers over CySEC-passported brokers. It can impose local marketing restrictions and language requirements, and it receives the passporting notification. However, prudential supervision — capital adequacy, conduct of business rules, and licence conditions — remains with CySEC as the home-state regulator. BaFin cannot revoke a CySEC licence.

What is the ICF and how much does it cover?

The ICF (Investor Compensation Fund) is Cyprus's investor protection scheme. It covers up to EUR 20,000 per eligible client if a CySEC-regulated investment firm fails and cannot return client assets. The ICF covers investment services only — not bank deposits. Claims can take 12-18 months to process based on historical cases.