CySEC Marketing Rules: What Brokers Can and Cannot Say

Which rules apply to a CIF's marketing?

Several layers apply at once, and no single document holds them all. Start from CySEC's own list. Circular C574 of May 2023 named the framework it would use when reviewing marketing: Articles 17(3), 17(5) and 25(3) of Law 87(I)/2017, and Articles 21, 44, 46(5) and 46(6) of the MiFID II Delegated Regulation.

Three of these circulars pre-date Law 87(I)/2017. We found nothing saying they were withdrawn, and the principles match the current rules, but ask your compliance officer how CySEC treats each one today.

What can you say, and what can you not?

This table turns the rules into sentences a marketer can use.

Every communication must include the firm's name, and its content must suit the average person likely to receive it.

The prescribed CFD warning

Retail CFD marketing must carry a specific warning, and CySEC leaves little room for adaptation. PS-04-2019 sets out the conditions, and they are worth building into your templates.

• It must be prominent, in a font size at least equal to the predominant font size.
• It must be in the same language as the communication.
• It must include your own loss percentage, calculated every 3 months over the prior 12 months.

There are three formats. Copy the full wording from the directive or policy statement exactly, in the language you are using.

CySEC differs from ESMA on one point. A new firm without 12 months of retail client data does not use a percentage range. PS-04-2019 replaces it with a statement that the vast majority of retail client accounts lose money. In the reduced format it reads: "CFD-retail client accounts generally lose money".

Margin limits by product

These limits come from Annex I of the consolidated Directive DI87-09. We read the Greek text on 1 November 2026. Your marketing must not imply retail clients can get anything better.

Margin close-out and negative balance protection also apply, and both can be described accurately in marketing. Keep them factual, since safety language around CFDs can easily turn into a misleading impression.

How should risk information look?

CySEC's 2012 circular gives concrete design advice that still works well. It recommends these for marketing communications.

• Put important information, statements or warnings in bold.
• Balance benefits and drawbacks with equally prominent features.
• Put risk warnings inside their own distinct border.
• Place them in the main body, ahead of the small print.
• Show risk information on the home page a customer reaches from a promotional link.

Give these to your designer as a brief. A pale grey line of text under a bright button would be hard to square with any of them.

Who answers for affiliates?

You do, in practice. Circular C217 uses a wide definition: third parties that promote your brand online, display your marketing, direct web traffic to you or raise your profile through search engine optimization, however you choose to name them.

It says firms should exercise due skill, care and diligence, check an affiliate's own authorisation where needed, make sure material is prepared by the firm or pre-approved and monitored, and bring oversight into the internal control framework. If an affiliate steps outside its agreement, the firm should end the cooperation, inform clients through its website and disclose the incident to CySEC.

Our guide on how to build a forex affiliate program turns that into a working process.

What is CySEC looking at now?

Marketing is a stated supervisory focus. CySEC's 2025 priorities mention strengthened monitoring of marketing communications and client onboarding for cross-border activity, and thematic work on AI and financial influencers. We read the 2025 document and CySEC's press release of 21 January 2026, which says its 2025 supervision also covered finfluencer promotion and that strong supervision remains a key objective for 2026. Its 2023 circular also said CySEC planned on-site visits and desk reviews on a sample of firms serving retail clients.

The cross-border point is the one to plan around. Where a firm under CySEC's remit markets to residents of a member state with its own measures, PS-04-2019 says those measures shape the content. C785 of June 2026 is a current example: CySEC urged firms selling to retail investors in Spain to follow the CNMV's position on spot quoted futures and similar products. If you are still setting up, our guide on setting up a forex company in Cyprus covers the company side.

A ten-point test for any landing page

Run this on one live page today.

1. Does the page name the legal entity and licence?
2. Is it obvious this is marketing?
3. Is the correct warning format used for this medium?
4. Is the loss percentage current, and does it match your other pages?
5. Is the warning at least the predominant font size?
6. Is the page all in one language, including the warning?
7. Are risks as prominent as benefits?
8. Is any bonus, gift or reward language present?
9. Do any margin or ratio claims exceed this client's limit?
10. Is there a record of who approved this page, and when?

Any "no" on the first seven, or a "yes" on eight or nine, goes to compliance today. Once your pages pass, our fintech and forex SEO service can help you build on them, and we will work to your approval route.