Payment Processing for CySEC-Licensed Forex and CFD Brokers
A CySEC licence is the most common route for forex and CFD brokers into the European market, and it is a licence acquirers understand. It also comes with detailed rules on how client money moves through payment providers, and card schemes now treat broker deposits as a category of their own. An acquirer will check both before it boards you.
Last reviewed October 2026
What a CySEC licence covers
Brokers in Cyprus are authorised by the Cyprus Securities and Exchange Commission as Cyprus Investment Firms under Law 87(I)/2017, which brings MiFID II into Cypriot law. The licence can be passported across the EU and EEA, either by serving clients cross-border or through a branch.
Initial capital depends on what the firm does: EUR 75,000 for firms that neither hold client money nor deal on their own account, EUR 150,000 for firms that hold client money, and EUR 750,000 for firms that deal on their own account, which is where most market-making CFD brokers sit. CySEC supervised more than 800 entities at the end of 2025.
Client money and payment providers
CySEC's safeguarding rules decide how your payment setup has to look. A Cyprus Investment Firm may hold merchant accounts with licensed payment or e-money institutions only to clear and settle client deposits and withdrawals, and the money must be moved to segregated client accounts at a bank or central bank immediately after settlement. Merchant accounts may not be used by connected persons or third parties, and firms must publish the list of payment providers they use on their website.
A trading account may not be credited before a card or e-payment has cleared unless the firm is licensed to provide credit and covers the amount from its own funds. In September 2026 CySEC also told firms they may not keep interest earned on client money.
Retail CFD rules that shape deposits
Since August 2019, CySEC has applied the European limits on retail CFDs permanently: leverage capped from 30:1 on major currency pairs down to 2:1 on crypto, margin close-out at 50%, negative balance protection, and a risk warning showing the share of the firm's retail accounts that lose money. Bonuses and other trading incentives for retail clients are banned, and binary options may not be sold to retail clients. In February 2026 ESMA said that derivatives sold as perpetual futures are likely to fall under the same CFD rules where they meet the CFD definition.
These rules matter to an acquirer because they limit how fast a retail client can lose a deposit, and fast losses are what drive disputes.
Try it with your own numbers
Chargeback ratio calculatorWork out the same figure for your own month before reading on.
Card scheme rules for brokers
Forex and CFD brokers are processed under merchant category code 6211, security brokers and dealers. Since 2018, Mastercard has treated these merchants as high-risk securities merchants and requires acquirers to collect the broker's licences before processing. Visa places them in Tier 3 of its Visa Integrity Risk Program.
From 18 October 2026, Visa requires deposits for CFDs, rolling spot forex, spread betting and similar products to be processed as account funding transactions instead of purchases, and the merchant to be registered in its Integrity Risk Program. Mastercard requires the same switch to account funding transactions for securities merchants in Europe by 31 March 2027. If your current provider has not raised this with you yet, ask.
What acquirers check before boarding a CySEC broker
- Your CySEC authorisation and the services and products it covers, held by the entity that will sign the merchant agreement.
- Which EU countries you passport into and which non-EU countries you accept clients from.
- How deposits flow: which payment providers you use and how quickly money moves to client accounts.
- Your retail and professional client split, and the risk warning percentage on your website.
- Your AML controls: identity checks before deposits, source of funds, sanctions screening.
- How you work with affiliates and introducers, and how you control their marketing.
- Processing history: volume, approval rates, refunds and chargebacks by month.
Mistakes that cost brokers their accounts
- Accepting deposits from cards or accounts that are not in the client's own name.
- Letting affiliates market in countries you do not serve, or with claims your licence does not allow.
- Leaving client money with a payment provider instead of moving it to client accounts.
- Processing deposits under the wrong merchant category code or transaction type after the scheme changes.
How Ecompayer helps CySEC-licensed brokers
Ecompayer is not a payment provider. You add your licence, client markets, volumes and payment methods once, and your profile is matched with a payment provider that boards CySEC-licensed brokers and supports the current Visa and Mastercard requirements. Your account is then prepared with that provider so you can take client deposits. Final approval and terms are always the provider's decision.
Sources
- Law 87(I)/2017 on investment services; Regulation (EU) 2019/2033 and Directive (EU) 2019/2034 on investment firm capital.
- CySEC Policy Statement PS-04-2019 on CFD product intervention; CySEC Circular C418 on safeguarding of client funds; CySEC Circular C801, September 2026.
- ESMA public statement on derivatives within the scope of CFD measures, February 2026.
- Visa Integrity Risk Program; Visa rules for high-risk investment products effective 18 October 2026, as published by Checkout.com.
- Mastercard Developers, high-risk securities indicator for MCC 6211.
Check your own situation
Whether a provider boards you depends on your licence, markets, volume and history. Answer four questions to see which payment routes may fit your business.
Four questions about your business
Industry, company country, customer markets and estimated monthly volume, that is all we need to begin.
Related licences
Seychelles FSA licence
A Seychelles Securities Dealer licence is one of the most used licences for forex and CFD brokers serving clients outside Europe. Acquirers know it, but they treat it as an offshore licence: they look past it to where your clients are, who runs the business and how client money is handled. The 2025 changes to Seychelles law help, because they put more substance behind the licence.
Mauritius FSC licence
Mauritius is an established base for forex and CFD brokers serving Africa, Asia and the Middle East, and its regulator, the Financial Services Commission, is well known to acquirers. Since Mauritius left the FATF grey list in 2021 and the EU high-risk list in 2022, the jurisdiction itself is no longer the obstacle. What decides your application is your client markets, your substance and how client money moves.
Malta Gaming Authority (MGA)
An MGA licence is one of the most widely recognised gaming licences, and it opens the door to acquirers that run gambling programmes. What decides the outcome is not the licence alone but which markets you take players from, how you protect player money and how you verify players. Acquirers check all three before they board you.
Related merchant problems
Chargeback rate too high
Visa flags a merchant once fraud and disputes reach 1.5% of settled transactions in most regions, and Mastercard at 1.5% of transactions with at least 100 chargebacks in a month. Above those lines come fines, reserves and in the end a closed account. The good news: most chargebacks have a small number of causes, and the fastest fixes work within weeks.
Provider asked for more documents
A request for more documents is not a rejection. It means the provider cannot verify something in your file yet, and it has to before it can open your account. Providers are legally required to know who they do business with, so the fastest way through is to send exactly what is asked, complete and consistent, in one go.
A rolling reserve was requested
A reserve is not a rejection. The provider is holding part of your settled money to cover refunds and chargebacks that can arrive months after you have been paid. It delays income rather than taking it, but it can tie up a large share of your working capital, so get the exact terms and run them against your own numbers before you accept.
Related guides
High-risk payment processing
High-risk payment processing is card acceptance for businesses that acquirers and card schemes consider more likely to cause chargebacks, fraud, legal or reputational problems. It is a classification, not a verdict on your business: it means fewer providers will take you on, underwriting asks for more, and terms include safeguards such as reserves. With the right provider, high-risk businesses process cards every day.
Chargeback ratio
Your chargeback ratio is the number of disputes in a month divided by a month of transactions, shown as a percentage. Mastercard flags merchants from 1.5% of chargebacks and Visa from 1.5% of fraud plus disputes in most regions, both with minimum counts, and most acquirers act before that. It is the number that decides whether you keep your account, so know exactly how your provider calculates it.
MCC codes
A merchant category code (MCC) is a four-digit code that tells the card schemes and card issuers what kind of business you are. Your acquirer assigns it when you are onboarded. It affects what interchange you pay, whether issuers approve your payments, whether you need scheme registration and which rules apply to you.
Check which payment routes may fit your business
Answer a short set of questions about your business and we will check your profile against the requirements providers have given us. No approval is decided here.
Check my payment optionsNothing is shared with a provider until you submit your onboarding pack. Approval is always the provider's decision.