CySEC’s September 2025 Directive DI-87-09 amendment capped retail leverage at 10:1 on non-major commodity and index CFDs; ESMA’s Common Supervisory Action 2026 now extends that pressure into staff-incentive, platform-design, and conflicts-of-interest reviews — together a two-stage tightening that reshapes the operating model for Cyprus’s 261 CySEC-licensed CFD brokers serving 3.6 million cross-border EU retail clients.

The Cyprus Securities and Exchange Commission (CySEC) amended Directive DI-87-09 on September 5, 2025 (Regulatory Administrative Act (RAA) 270/2025), introducing a 10% initial margin requirement — equivalent to 10:1 leverage — on retail Contracts for Differences (CFDs) where the underlying is a non-listed commodity or stock index (Official Gazette of the Republic of Cyprus, September 5, 2025). On March 5, 2026, CySEC then issued a circular notifying Cyprus Investment Firms of on-site visits and desk-based reviews throughout 2026 as part of ESMA’s Common Supervisory Action (CSA) on Markets in Financial Instruments Directive II (MiFID II) conflicts-of-interest requirements. This longform walks through the rule mechanics, compares Cyprus against EU peers, the United Kingdom and Australia, sets out the operational implications for CFD brokers, and previews the open enforcement and consultation calendar.

Key Facts:

• CySEC Directive DI-87-09 amendment (RAA 270/2025) effective September 5, 2025 — 10% initial margin (10:1) on non-listed commodity and index CFDs
• Gold CFDs continue at 5% margin (20:1); ESMA defaults of 30:1 on major FX and 20:1 on minor FX unchanged
• ESMA’s Common Supervisory Action 2026 launched on conflicts-of-interest, staff remuneration, and digital-platform design under Article 23 MiFID II
• Cyprus-licensed firms serve approximately 3.6 million retail clients — roughly one-third of EU cross-border retail CFD trading (CySEC, March 2026)
• Complaints against Cyprus-based brokers rose 46% in 2024, per CySEC’s annual statistical bulletin
• Two unnamed Cyprus Investment Firms surrendered CIF authorisations within one month of the March 5, 2026 circular — Finance Magnates, March 2026
• CSA reporting deadline: CFD brokers and crypto firms had to submit 2025 statistical data via CySEC’s Transaction Reporting System by May 8, 2026

Methodology and sources

This analysis rests on three primary regulator documents: (1) the CySEC amending directive to DI-87-09 published as RAA 270/2025 in the Official Gazette of the Republic of Cyprus on September 5, 2025; (2) the ESMA press release of January 30, 2026 announcing the Common Supervisory Action on MiFID II conflicts-of-interest requirements; and (3) CySEC’s circular C-XXX of March 5, 2026 notifying Cyprus Investment Firms of CSA on-site and desk-based reviews. Cross-jurisdictional comparison data is drawn from the ESMA product intervention measures register (March 2026 update), the Financial Conduct Authority (FCA) Handbook (COBS 22.5, current to May 2026), and the Australian Securities and Investments Commission (ASIC) Corporations (Product Intervention Order — Contracts for Difference) Instrument 2020/986 (most recent extension order). Time window: September 1, 2025 to May 26, 2026. Limit: figures on broker-by-broker impact are not yet public; the analysis aggregates at the regime level.

What Directive DI-87-09 actually says

The amended Directive applies the 10% initial margin requirement — a 10:1 retail leverage cap — to CFDs where the underlying is a commodity or stock index that is not expressly listed in the annex to the Directive. The expressly listed assets, which remain at lower margin requirements (i.e., higher available leverage), are: gold (5% margin, 20:1), major fiat-pair commodity proxies, and the EUR STOXX 50, FTSE 100, DAX 40, CAC 40, S&P 500, Nasdaq 100, Dow Jones Industrial Average, and Nikkei 225 indices. Affected assets — those falling outside the listed annex and therefore subject to 10:1 — include wheat, corn, coffee and the broader soft-commodity complex; the industrial-metals complex covering copper, aluminium, and platinum; and regional/national indices including FTSE MIB (Italy), CAC Mid 60 (France-mid), IBEX 35 (Spain), and the major emerging-market indices.

How RAA 270/2025 connects to ESMA’s underlying framework. ESMA’s original retail product-intervention measures from 2018 set the 30:1 leverage cap on majors and 20:1 on minors at the EU level, with a margin close-out at 50% per account and mandatory negative-balance protection (ESMA product intervention measures, August 2018). RAA 270/2025 is a national tightening on top of those EU floors: where ESMA permits a national competent authority to set stricter measures, CySEC has now used Article 42 of MiFIR to push the cap down to 10:1 specifically for the non-listed commodity and index categories. The amendment is intended to align Cyprus more tightly with the post-2018 product-intervention philosophy, after Cyprus’s broker-supervision profile was flagged by ESMA in late 2024 for cross-border supervision shortcomings.

Sources: ESMA product-intervention measures (esma.europa.eu); CySEC RAA 270/2025 (Harneys analysis); FCA Handbook COBS 22.5 and COBS 22.6; ASIC Corporations (Product Intervention Order — Contracts for Difference) Instrument 2020/986. Last updated: May 26, 2026.

How four jurisdictions compare in practice

The four regimes are converging on a 30:1 / 20:1 floor for retail CFDs but diverging at the edges. The EU/ESMA baseline of 30:1 majors and 20:1 minors is now the lowest common denominator across all four; Cyprus’s 10:1 cap on non-listed underlyings is the strictest national tightening within the EU, but each member state is permitted to layer additional measures under Article 42 MiFIR. The UK kept the ESMA framework after Brexit but added a full retail ban on cryptoasset CFDs (COBS 22.6), which neither Cyprus nor ESMA has matched. Australia aligned its leverage caps to the ESMA baseline in 2021 and last extended the order in 2024 for a further five years.

The practical effect for a broker offering, say, a copper CFD: a Cyprus-licensed firm now charges a 10% margin on a copper position; an FCA-licensed firm continues to charge approximately 5-7% margin under the ESMA-equivalent UK framework (COBS 22.5.2R); an ASIC-licensed firm sits in the 5-10% range depending on its internal calibration. The same EU supervisory-architecture push that drove the May 2026 DORA 19-provider designation is reshaping CFD product-intervention rules in parallel: more national-level prescription, less broker-level optionality.

Why Cyprus moved first, in 60 seconds. Cyprus-licensed CFD brokers serve roughly one in three EU cross-border retail CFD clients (CySEC market data, March 2026), which means CySEC’s product-intervention choices effectively set the leverage ceiling for a large slice of the EU retail market regardless of where individual brokers are headquartered. The September 2025 amendment was issued in the context of an ESMA peer-review finding that flagged shortcomings in Cyprus’s supervision of cross-border investment activities in 2024 — pressure that CySEC responded to by accelerating the non-listed-asset leverage tightening, then layering the March 2026 CSA inspection regime on top.

“CySEC’s new restrictions don’t really change the market in any fundamental way. In practice, what the regulator has done is tighten the rules around non-major commodities.”

— Alex Tsepaev, Chief Strategy Officer, B2PRIME Group
(Finance Magnates broker reaction compilation)

Enforcement context: what the CSA 2026 means in practice

CySEC’s March 5, 2026 circular committed Cyprus Investment Firms to on-site visits and desk-based reviews throughout 2026, focused on three enumerated areas: (1) staff compensation structures and how bonus schemes shape product recommendations to retail clients; (2) digital platform design that may steer users toward higher-margin products; and (3) the management of tension between firm revenue targets and retail-client best-interest obligations under Article 24(1) MiFID II. The circular explicitly states that “adherence to the circular will form part of CySEC’s supervisory review for the purposes of the CSA 2026” — language that establishes the inspection findings as supervisory file rather than informal commentary.

Two Cyprus Investment Firms surrendered their CIF authorisations within one month of the March 5 circular, per Finance Magnates reporting (March 2026). CySEC has not yet named the firms or published a specific enforcement order under the CSA, but the precedent matters: surrendering a CIF authorisation under regulator pressure has historically been the prelude to either a Final Decision or a settlement, both of which feed into the firm’s record under the European Banking Authority (EBA) database of administrative sanctions. The closest comparable enforcement track is the FCA’s HTX action of February 10, 2026, which placed HTX on the UK Warning List for breach of the Financial Promotions Regime; CySEC’s emerging pattern under the CSA could mirror that public-shaming-plus-administrative-penalty model.

For brokers operating in or marketing into Cyprus, the immediate exposure is layered: an inspection score under the CSA 2026, a separate compliance check against the RAA 270/2025 leverage cap, and the May 8, 2026 statistical-reporting deadline that closed three weeks before this analysis was published. Missed deadlines on the statistical filing carry administrative penalties; CySEC has stated it will not issue reminders.

What this means for brokers, exchanges, fund managers, and compliance teams

The operational implications differ by firm type. For retail CFD brokers the immediate document load is the September 2025 leverage cap, which requires product-pricing-engine reconfiguration on every non-listed commodity and index pair; the platform-design review under the CSA requires documented evidence that nudges, default settings, and onboarding flows do not steer retail clients toward higher-margin products; and the staff compensation review requires that bonus and revenue-share schemes be documented and made available on inspection. For prime brokers and liquidity providers Andreas Kapsos, CEO of Match-Prime Liquidity, has flagged that “stricter regulations and compliance requirements may make it challenging for some liquidity providers — particularly smaller ones with limited resources.” For fund managers using Cyprus-licensed brokers as execution counterparties, due diligence requirements now include verification of the CSA inspection cycle status and the broker’s RAA 270/2025 compliance attestation.

For legal and compliance teams the immediate work-streams are: (1) updating product disclosure documents to reflect the 10% margin on non-listed underlyings; (2) drafting board-level minutes documenting review of staff-compensation conflicts of interest; (3) preparing the response file for the inspection of digital-platform design choices (default leverage selection, prominence of risk warnings, onboarding suitability assessments). The parallel MiCA July 1 implementation cliff overlaps for firms that hold both a Cyprus Investment Firm authorisation and a Crypto-Asset Service Provider (CASP) registration — both go through MiFID II conflicts review under the CSA.

“Honestly, no matter what we do, scammers will find new ways to deceive investors.”

— Dr. George Theocharides, Chairman, Cyprus Securities and Exchange Commission
(CySEC public statement, Finance Magnates, March 2026)

What’s next — the forward view

Three calendar items shape the second half of 2026. (1) CySEC’s CSA on-site inspection cycle is expected to peak between June and October 2026, with findings to be reflected in CySEC’s 2026 Annual Report (published Q1 2027). (2) ESMA is expected to issue updated technical standards on conflicts-of-interest documentation in Q3 2026, which will tighten the disclosure requirements firms must meet to demonstrate compliance with Article 23 MiFID II. (3) The UK FCA is expected to consult in late 2026 on whether to mirror Cyprus’s non-listed-asset leverage cap in COBS 22.5; the consultation will close 12 weeks after publication, with implementation likely in mid-2027 if approved. The ASIC product-intervention order extension does not currently include a leverage-cap re-write, but its 2024-2029 effective window allows ASIC to amend the order via instrument before March 2029 if EU divergence widens. The CFTC’s review of US retail FX leverage caps (50:1 majors, currently the most permissive of the four major regimes) remains pending; the CFTC’s bandwidth is currently consumed by the prediction-market circuit split, making a 2026 retail-FX leverage review unlikely.

FAQ

Does the 10:1 cap apply to gold, oil, or the major indices?

No. Gold CFDs remain at 5% initial margin (20:1 leverage); oil and the major indices (EUR STOXX 50, FTSE 100, DAX, CAC 40, S&P 500, Nasdaq 100, Dow Jones, Nikkei 225) are expressly listed in the annex to the amended Directive and continue at lower margin requirements. The 10:1 cap applies only to CFDs on underlyings that fall outside that listed annex — wheat, coffee, copper, regional indices, and emerging-market indices being the main affected categories.

Will the UK or Australia adopt a similar non-listed asset cap?

The UK FCA is expected to consult in late 2026 on whether to mirror Cyprus’s non-listed-asset cap in COBS 22.5; no decision has been published as of May 26, 2026. The ASIC product-intervention order in force to March 2029 does not currently include a non-listed-asset cap, but ASIC can amend via instrument before that date.

What penalties apply if a Cyprus broker breaches RAA 270/2025?

The Cyprus Investment Services Law permits administrative penalties of up to €1 million per breach, with higher amounts available for repeated or systemic non-compliance. Brokers should expect inspection findings under the CSA 2026 to be cross-referenced with leverage-cap compliance in the same supervisory cycle.

How are the CSA inspections actually conducted?

CySEC has stated the inspections will combine on-site visits and desk-based reviews. On-site visits include unannounced office attendance, interviews with senior managers and compliance officers, and inspection of platform configuration, staff-incentive schemes, and conflict-of-interest registers. Desk-based reviews proceed via document requests with mandatory response deadlines.

Are firms outside Cyprus affected if they market into Cyprus?

Yes. Under Article 39 of MiFID II, firms providing investment services into Cyprus on a cross-border basis are subject to host-state conduct rules, including the RAA 270/2025 leverage cap on relevant in-scope CFDs. CySEC’s host-state powers under MiFIR Article 42 permit enforcement against non-Cyprus-licensed firms that breach Cypriot product-intervention rules for Cypriot clients.

How does this interact with the EU’s overall regulatory roadmap?

The CSA 2026 is one of a series of supervisory coordination exercises ESMA conducts under MiFID II, sitting alongside the parallel implementation of MiCA (June 30, 2026) for crypto-assets and the operational-resilience focus of DORA. The FATF Travel Rule’s 2026 implementation phase sits in a related compliance cycle for firms with combined CFD and digital-asset offerings.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.

Rick Steves

Rick Steves has seen business and economics through many lenses. He joined the financial services industry in 2009, and has been a financial journalist since 2011. He holds a degree in Business Administration and has experience producing real-time news, from both buy-side and sell-side, as well as for retail traders, brokers and service providers. Steves' work has appeared in a variety of online publications including FX Street, NewsBTC, FinanceFeeds, and The Industry Spread. Rick has great interest in the dynamics of the trading industry. The never-ending clash between technology, economics, regulation, and more importantly, the people.