What MiFID II requires of forex brokers, how CySEC and BaFin enforce it, and exactly what protections you have as a retail trader in the EU.
Updated July 2026 · Reading time: ~8 minutes
MiFID II (Markets in Financial Instruments Directive II) is the EU legal framework that governs investment services — including forex and CFD brokers — across all 27 EU member states. It came into force in January 2018 and replaced the original MiFID directive with significantly stronger client protections.
The directive sets minimum standards that every broker must meet to hold an EU authorisation. These are not optional features — they are legal requirements. Here is what MiFID II mandates for retail forex accounts:
Every EU-regulated forex broker must be authorised by a national competent authority (NCA). Thanks to MiFID II passporting, a broker authorised in any EU member state can legally offer services across the entire EU. The four most common regulators for forex brokers are:
The most widely used regulator for EU forex brokers. A CySEC licence (CIF — Cyprus Investment Firm) grants full MiFID II passporting rights across the EU. CySEC operates the Investor Compensation Fund (ICF), covering up to €20,000 per retail client.
Germany's financial regulator — one of the most rigorous in the EU. BaFin-regulated brokers must meet strict capital requirements and disclosure standards. Germany's Investor Compensation Scheme (EdW) covers up to €20,000 per client.
France's securities regulator. AMF-regulated brokers can passport to all EU states. France maintains the FGDR (Fonds de Garantie des Dépôts et de Résolution) for investor protection, also capped at €70,000 for securities accounts.
Highly respected regulator but no longer an EU member post-Brexit. FCA-only brokers cannot passport to EU states. Many brokers hold both FCA and CySEC licences to serve both markets. EU clients should look for an EU licence, not solely FCA.
ESMA introduced permanent leverage caps in 2018 following the 2015 Swiss franc flash crash and other market events that caused widespread retail account deficits. These caps apply to all EU-regulated brokers serving retail clients and cannot be exceeded without the client upgrading to professional status.
| Instrument type | Maximum retail leverage | Example |
|---|---|---|
| Major currency pairs | 30:1 | EUR/USD, GBP/USD, USD/JPY |
| Minor/exotic pairs & gold | 20:1 | USD/MXN, EUR/TRY, XAU/USD |
| Other commodities | 10:1 | Brent crude, natural gas |
| Individual equities (CFDs) | 5:1 | Apple CFD, LVMH CFD |
| Cryptocurrency CFDs | 2:1 | BTC/USD, ETH/USD |
EU regulation translates into six concrete protections that apply automatically when you open a retail account with an EU-regulated broker. No action required on your part — they are legally mandated:
Your account balance cannot go below zero. If an extreme market event (gap, flash crash) causes your margin to be exceeded, the broker resets your balance to €0. You owe the broker nothing beyond your deposit. Mandatory for all EU retail accounts under ESMA rules.
Your deposited funds must be held in a separate bank account, distinct from the broker's own capital. In the event of broker insolvency, your funds should not form part of the broker's estate and should be returned to you via the insolvency process.
For CySEC-regulated brokers, if segregated funds cannot be returned (e.g. due to fraud or a complex insolvency), the Investor Compensation Fund (ICF) covers up to €20,000 per retail client. This is a last-resort backstop, not a substitute for segregation.
Before trading, you must receive a KID disclosing: all fees (spread, commission, swaps, inactivity fees), performance scenarios, and the exact proportion of retail accounts that lost money. This figure — typically "74% of retail CFD accounts lose money" — must be accurate and current.
ESMA's maximum leverage limits (30:1 for major pairs) reduce the speed at which losses accumulate during adverse moves. A 1% adverse move on a 30:1 leveraged position costs 30% of your margin — painful but survivable. At 500:1 the same move wipes the account five times over.
Disputes must be handled through a formal complaints procedure. If unresolved within eight weeks, you can escalate to the national Financial Ombudsman (Cyprus: Financial Ombudsman, Germany: Bundesbank Ombudsman, etc.) at no cost. Offshore brokers have no such obligation.
Never rely on a "Regulated by CySEC" badge on a broker's own website — badges can be faked or out of date. Always verify directly on the regulator's public register:
Scroll to the very bottom of the broker's website. A genuine EU broker will list their regulator name and licence number, e.g. "Regulated by CySEC, Licence No. 285/15". Note these details.
CySEC: cysec.gov.cy → Regulated Entities → Investment Firms. BaFin: bafin.de → Company Database. AMF: regafi.fr. Enter the broker name or licence number and confirm it is listed as "authorised" or "active".
ESMA maintains a cross-EU register of investment firms at esma.europa.eu (MiFID database). A broker passporting to your country should appear here too. This confirms they are not operating under an expired or revoked licence.
Search "[broker name] warning" on the ESMA register and on your national regulator's warning list. ESMA and national regulators publish lists of unauthorised firms and revoked licences. If a broker appears on a warning list, do not deposit.
Offshore brokers — registered in Vanuatu, St Vincent and the Grenadines, Seychelles, Belize, and similar jurisdictions — may offer higher leverage and larger bonuses. But you lose every protection listed above. Here is what that means in practice:
| Protection | EU-regulated broker | Offshore broker |
|---|---|---|
| Negative balance protection | ✓ Mandatory | ✗ Not required |
| Fund segregation | ✓ Mandatory | ✗ Not required |
| Investor compensation scheme | ✓ Up to €20,000 | ✗ None |
| Key Information Document | ✓ Mandatory | ✗ Not required |
| Leverage cap (major pairs) | ✓ Max 30:1 | ✗ Often 500:1+ |
| Regulated complaint process | ✓ Financial Ombudsman | ✗ No equivalent |
| Capital adequacy requirements | ✓ Mandatory minimums | ✗ Minimal or none |
| Legal recourse in EU courts | ✓ Available | ✗ Extremely limited |
Both brokers below are fully regulated for EU retail clients, comply with all MiFID II requirements, and have been reviewed by CompareFX. This is not a ranked recommendation — choose based on your own needs and do your own research.
74% of retail CFD accounts lose money. Capital at risk.
71% of retail CFD accounts lose money. Capital at risk.
See our full comparison of EU-regulated forex brokers — rated on regulation, fees, platforms, and withdrawal speed.
View EU broker comparison →MiFID II requires EU forex brokers to segregate client funds, provide negative balance protection, cap retail leverage (30:1 for major pairs), supply a Key Information Document before trading, disclose the percentage of retail clients who lose money, offer best execution, manage conflicts of interest, and operate a regulated complaint procedure. Brokers must be authorised by a national competent authority to operate in the EU.
CySEC is Cyprus's financial regulator — an EU member state. A CySEC licence grants MiFID II passporting rights across the entire EU, so the broker can legally serve retail clients in Germany, France, Spain, and all other EU states without a separate national licence. CySEC is popular because it offers a cost-effective licensing environment while meeting the same EU-standard investor protections as any other member state regulator.
ESMA caps retail leverage at 30:1 for major currency pairs, 20:1 for non-major pairs and gold, 10:1 for other commodities, 5:1 for individual equity CFDs, and 2:1 for cryptocurrency CFDs. Professional clients can access higher leverage but lose key protections including negative balance protection.
The ICF (Investor Compensation Fund) covers CySEC-regulated broker clients up to €20,000 per retail client if a broker becomes insolvent and cannot return client money. This is a last-resort backstop in addition to mandatory fund segregation. ICF does not cover trading losses — only the broker's failure to return funds.
Check directly on the regulator's public register, not the broker's website. CySEC: cysec.gov.cy → Regulated Entities. BaFin: bafin.de → Company Database. AMF: regafi.fr. ESMA EU-wide: esma.europa.eu (MiFID database). Enter the broker name or licence number and confirm it appears as authorised. Also check for any regulator warnings against the broker.
Negative balance protection (NBP) means you cannot lose more than you deposit. If a market gap or flash crash causes your account to go below zero, the broker must reset it to €0. You owe nothing beyond your deposit. NBP is mandatory for all EU-regulated retail forex and CFD accounts under ESMA rules and does not apply to professional accounts.
A KID is a standardised pre-trade disclosure document covering: instrument type, all costs and charges (spread, commission, swaps, fees), performance scenarios, and the exact percentage of retail investors who lose money on this instrument. EU law requires all regulated brokers to provide it before account opening. If a broker cannot produce a KID, they are likely unregulated.