CySEC marketing rules for CFD firms: risk warnings, bonuses and affiliates

Where the rules come from

In Cyprus, ESMA's temporary CFD restrictions were replaced by CySEC Directive DI87-09, in force since 2 October 2019.

1. 2018ESMA restricts CFDs across the EUTemporary product intervention measures, including a standard risk warning.
2. 31 Jul 2019ESMA's measure lapsesESMA did not renew it after this date; national regulators replaced it with their own permanent measures.
3. 27 Sep 2019CySEC Directive DI87-09 publishedIn the Official Gazette, with Policy Statement PS-04-2019 in English.
4. 2 Oct 2019DI87-09 in forceCySEC's permanent CFD measures.
5. 5 Sep 2025Margin tier amendedOne margin tier changed; the risk warnings did not. The leverage table below shows the current margins.

The binding Directive is in Greek. CySEC set out the same measures in English in its Policy Statement PS-04-2019, which the quotes below come from.

The Directive applies to retail clients resident in Cyprus, in EU states without their own national CFD measures and outside the EU. Where a client lives in an EU state with its own measures, those apply instead, and marketing to that client is allowed if it complies with them (PS-04-2019, territorial scope, paragraph 5.3).

When the warning is required

A CFD provider must not send, directly or indirectly, a communication to a retail client, or publish information a retail client can access, about the marketing, distribution or sale of CFDs, unless it includes the appropriate risk warning and meets its conditions (DI87-09, paragraph 4; PS-04-2019, paragraph 3.5.12).

The conditions (Annex II, Section A):

• “The risk warning shall be in a layout ensuring its prominence, in a font size at least equal to the predominant font size and in the same language as that used in the communication or published information.”
• The full version is used in durable media and on webpages; the abbreviated version in other media.
• If the abbreviated warning exceeds the character limit in a third-party marketing provider's standard terms, the reduced version may be used, but then the communication “shall also include a direct link to the webpage of the CFD provider containing the risk warning” in full.

The wordings

There are six wordings: full, abbreviated and reduced, each in a version with the provider's own percentage and a standard version for firms with no open retail CFD in the last 12 months.

With the provider's percentage

CFDs are complex instruments and come with a high risk of losing money rapidly due to leverage. [insert percentage per provider]% of retail investor accounts lose money when trading CFDs with this provider. You should consider whether you understand how CFDs work and whether you can afford to take the high risk of losing your money.

[insert percentage per provider]% of retail investor accounts lose money when trading CFDs with this provider. You should consider whether you can afford to take the high risk of losing your money.

[insert percentage per provider]% of retail CFD accounts lose money.

No open retail CFD in the last 12 months

CFDs are complex instruments and come with a high risk of losing money rapidly due to leverage. The vast majority of retail investor accounts lose money when trading CFDs. You should consider whether you understand how CFDs work and whether you can afford to take the high risk of losing your money.

The vast majority of retail investor accounts lose money when trading CFDs. You should consider whether you can afford to take the high risk of losing your money.

CFD-retail client accounts generally lose money

CySEC chose “vast majority” and “generally” instead of the former ESMA wording of a percentage range, and says they correspond to “a percentage well above 51%” (PS-04-2019, paragraph 5.4). CySEC's own English is not consistent: the annex says “retail investor accounts”, paragraph 3.5.11 says “retail client accounts … trading in CFDs”, and the binding Greek refers to retail clients.

Calculating the percentage

The calculation “shall be performed every three months and cover the 12-month period preceding the date on which it is performed” (Section A(6)). An account has lost money if “the sum of all realised and unrealised net profits on CFDs connected to the CFD trading account during the 12-month calculation period is negative”. The calculation includes “all charges, fees and commissions”, and excludes accounts with no open CFD in the period, profits or losses on other products, and deposits and withdrawals.

No bonuses or benefits

The Directive bans CFD providers from giving a retail client, directly or indirectly, “a payment, monetary or excluded non-monetary benefit in relation to the marketing, distribution or sale of a CFD, other than the realised profits on any CFD provided” (DI87-09, paragraph 4(1)(δ); PS-04-2019, paragraph 3.4.3). An excluded non-monetary benefit is any non-monetary benefit other than information and research tools relating to CFDs.

ESMA's Q&A, which CySEC says clarifies terms in its measures, describes the scope: “bonuses in relation to the opening a new account or the offering of rebates on fees, including volume-based rebates”, while “lower fees, not linked to volumes, for all retail clients (i.e. competition on price), are allowed”.

Tiered fees and spreads, where lower costs apply to new trades once a client reaches a set volume, are different. CySEC does not consider them to fall within the ban, because they are built into the cost structure and nothing is paid back for past trades (PS-04-2019, paragraph 3.4.10).

The Directive also prohibits knowingly and intentionally taking part in activities that have as their object or effect the circumvention of these restrictions, including by those acting as a substitute for the CFD provider (paragraph 5; our translation of the Greek text).

Leverage limits

Marketing that mentions leverage has to stay within these retail limits (DI87-09, Annex I):

Underlying	Initial margin	Leverage
Major currency pairs	3.33%	30:1
Non-major currency pairs, gold, major indices	5%	20:1
Commodities other than gold, non-major indices	10%	10:1
Individual equities and other underlyings	20%	5:1
Cryptoassets	50%	2:1

The general EU marketing rules

CFD marketing must also meet the MiFID II rules that apply to every investment firm:

All information, including marketing communications, addressed by the investment firm to clients or potential clients shall be fair, clear and not misleading. Marketing communications shall be clearly identifiable as such.

Article 44 of Delegated Regulation 2017/565 adds that information must give “a fair and prominent indication of any relevant risks when referencing any potential benefits”, use a risk font “at least equal to the predominant font size” and not “disguise, diminish or obscure important items, statements or warnings”. It must not use a regulator's name in a way that suggests endorsement. Past performance needs “a prominent warning that the figures refer to the past and that past performance is not a reliable indicator of future results”.

On prominence, ESMA's Q&A describes good practice as warnings “contained within their own distinct border”, fixed on screen as the customer scrolls and repeated on linked pages. Poor practice includes warnings in a pop-up shown only on the first visit, under “FAQs” or “Disclaimers”, or on coloured or patterned backgrounds. In Cyprus the Q&A is guidance; in the UK the border and fixed placement are binding (COBS 22.5.8R).

Affiliates and influencers

CySEC's Circular C217 sets out what it expects of Cyprus investment firms (CIFs) that use affiliates. It treats as an affiliate anyone carrying out the marketing activities the circular describes, such as promoting the firm's brand online, hosting promotional content and directing traffic to it, “irrespective of how the CIF chooses to define such person/entity”. The circular dates from 2017 and refers to the investment services law since replaced by Law 87(I)/2017.

1. Prepare or pre-approveAffiliates' marketing material “either is prepared by the CIF itself and disseminated to Affiliates, or is subject to pre-approval and ongoing monitoring by the CIF”.
2. MonitorCySEC encourages firms to use “a marketing intelligence tool that enables them to gather all the Affiliates' digital media data that relates to the CIF”.
3. Act on breachesWhere an affiliate breaches the agreement, end the relationship, tell the firm's clients and disclose the incident to CySEC.

In September 2024, CySEC warned that any social media post or video giving advice or ideas about buying or selling a financial instrument “may constitute an investment recommendation”, with sanctions of “up to EUR 500.000 for natural persons and up to EUR 1.000.000 for legal persons” for breaching the investment recommendation rules. ESMA's finfluencer factsheet, which has a Greek edition for Cyprus, tells influencers to label paid content with words such as “Ad”, “Paid partnership” or “Sponsored”. It says that, where they give personalised advice or investment recommendations, disclaimers such as “This is not investment advice” will not protect them.

A checklist for CySEC CFD marketing

Connor checks promotions against CySEC's rules as one of nine markets, alongside the UK, the EU, Ireland, the US, Australia, the UAE, DIFC and ADGM.