Forex broker solutions for Europe: MiFID II

What does a forex broker need to operate in Europe in 2026?

A forex or CFD broker that serves retail clients in the European Union needs an authorisation from a national competent authority under MiFID II, and its platform has to apply the retail CFD restrictions that grew out of ESMA’s 2018 product intervention. In the UK the equivalent is FCA authorisation and the FCA’s own CFD rules, which are close to the ESMA set but not identical.

That gives you two separate projects that run in parallel. One is legal: the company, the licence application, the people CySEC, BaFin, the AMF or the FCA will want to interview, and the capital. Minimum capital is set by the regulator for each licence category, and the category depends on whether you deal on own account or only receive and transmit orders. The other is technical: an MT5 server or a place on someone else’s, liquidity, a broker CRM with KYC and appropriateness tests, a client portal, a branded WebTrader and mobile apps.

We work on the second project. Our job is to make sure that when your compliance officer signs off a rule, the platform actually behaves that way for every retail account, every day. A technology provider cannot make you MiFID II compliant, and you should be wary of anyone who says otherwise; compliance belongs to the licensed firm and its management body.

Which ESMA CFD rules must the trading platform enforce?

Five measures shape almost every retail CFD account in Europe: leverage limits by underlying, a margin close-out at 50% of required margin, negative balance protection per account, a ban on trading incentives and a standardised risk warning that shows the firm’s own percentage of losing retail accounts. ESMA agreed them on 23 March 2018 under Article 40 of MiFIR and announced them on 27 March 2018.

ESMA explained the reasoning at the time with a blunt statistic: national regulators’ analyses showed that 74–89% of retail accounts typically lose money on CFDs. The measures were designed so that, in the words of ESMA’s then Chair Steven Maijoor, investors “cannot lose more money than they put in”.

For a platform, the leverage list is the part that turns into configuration work. Each symbol has to sit in the right volatility class, and each retail group needs margin settings that produce the right ratio. A broker with 120 symbols, for example, can easily have a dozen that are misclassified on day one: an index CFD treated as major when it is not, or a gold contract left in the commodity class.

How do ESMA rules translate into MT5, CRM and app settings?

Each rule lives in a specific layer of the stack, and someone has to own it. The table below is how we split the work on a typical European project. It is a working map, not a compliance opinion: your compliance function decides what the rule means for your firm, and we make the systems match.

Did the CFD rules become permanent in the UK, Germany and Cyprus?

Yes. ESMA’s measures were temporary and had to be renewed periodically, so national regulators replaced them with permanent national rules during 2019. That is why a European broker reads two layers of text: the ESMA baseline and the national measure of its home regulator.

In Germany, BaFin’s General Administrative Act on CFDs became effective on 1 August 2019, when the last ESMA renewal expired. It sets minimum initial margin as a percentage of notional value, 3.33% for major currency pairs and 50% for cryptocurrencies, and defines negative balance protection as the upper limit of a retail client’s liability “for all CFDs connected to a CFD trading account with a CFD provider, and the funds in that CFD trading account.”

In the UK, the FCA confirmed its permanent restrictions on 1 July 2019; the rules apply from 1 August 2019 for CFDs and 1 September 2019 for CFD-like options. The FCA list matches the ESMA one in structure: leverage between 30:1 and 2:1, close-out at 50% of margin, protection so that a client cannot lose more than the funds in the CFD account, no inducements and a standardised risk warning.

In Cyprus, CySEC published PS-04-2019, its Policy Statement on the Imposition of National Measures in Relation to the Marketing, Distribution and Sale of CFDs, on 27 September 2019. It sits next to PS-01-2019 on the risk management arrangements of Cyprus Investment Firms providing services in CFDs, which is worth reading before you design your dealing desk.

Which MiFID II requirements change your broker technology?

Four MiFID II obligations have the most direct effect on systems: passporting scope, record keeping, appropriateness testing and best execution. MiFID II and MiFIR have applied since 3 January 2018, and the article texts are easiest to read in ESMA’s Interactive Single Rulebook.

What does a CySEC-licensed forex broker’s platform need?

A Cyprus Investment Firm needs the ESMA-derived settings above plus a few CySEC-specific touchpoints that land on the technology team. Cyprus is a frequent choice among the European projects we are asked about, so these points come up often.

The first is domains. CySEC publishes a List of Approved Domains that maps each regulated firm to the websites it may use. If you plan a new marketing domain, a localised site or a separate client portal URL, plan the approval in advance; your WebTrader and portal should sit on domains the regulator knows about.

The second is onboarding. CySEC’s PS-01-2024 of 6 August 2024 deals with the enhancement of the non-face-to-face customer onboarding process with electronic methods. In practice this shapes which identity verification vendor you plug into the CRM and what evidence the CRM stores per client.

The third is investor compensation. CySEC publishes how cover from the Investor Compensation Fund is calculated: a share of the client’s cumulative covered claims, up to a fixed maximum per client. The current limit belongs on your client documents, not in your platform, but it is a common client question that your support team should answer consistently, using CySEC’s own wording. For UK firms the comparable scheme is the FSCS, which publishes its investment limit per eligible person, per firm, with different limits depending on when the firm failed.

The fourth is DORA, which CySEC now also charges supervisory fees for under PS-03-2025 of 4 September 2025. We cover what DORA means for your vendors further down.

How is the UK FCA route different from the EU route?

The UK route is a separate authorisation with its own rulebook, and an EU licence does not passport into the UK after Brexit. Many groups therefore run two entities, one EU and one UK, on the same technology with different configuration.

The headline CFD rules look alike, but the scope and details differ. The FCA, for example, extended its rules to CFD-like options, which it notes “were not included in ESMA’s temporary restrictions”, and describes its rules as maintaining and strengthening the protections. Your symbol classes and product list cannot simply be copied from the EU groups to the UK groups; someone has to check them line by line against the current FCA Handbook.

Technically, the clean way to run both is one MT5 environment with separate groups per entity, a CRM that holds the entity on every client record, and front ends that show the right legal name, risk warning and loss percentage for that entity. A client who registers from Lyon should never see the UK entity’s terms, and vice versa.

What does DORA mean for your platform vendor?

DORA means your contracts with technology vendors, us included, have to meet EU requirements for ICT third-party risk. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, entered into force on 16 January 2023 and has applied since 17 January 2025.

ESMA groups the regulation into six topics: ICT risk management, ICT third-party risk management, digital operational resilience testing, ICT-related incidents, information sharing and oversight of critical third-party providers. Under third-party risk, ESMA points to key contractual provisions and to technical standards on contracts for ICT services that support critical or important functions.

For a broker that means a register of ICT providers, contracts with audit, exit and incident-notification clauses, and a tested plan for what happens if a provider fails. Ask every vendor, including your MT5 grey label host, liquidity bridge and CRM provider, for its incident process and exit terms in writing. If a vendor cannot tell you where your data sits and how you get it back, that is your answer.

We are happy to go through a DORA vendor questionnaire with your compliance team. Send it to us on Telegram and we will answer it item by item, including the parts that depend on third parties such as MetaQuotes or your liquidity provider.

White label, grey label or own MT5 licence for a European broker?

For a regulated European broker, the choice depends mainly on what your regulator expects you to control and how quickly you need to launch. An MT5 grey label is a brokerage set up inside another company’s licensed MetaTrader 5 server: you get your own client groups and your brand on the WebTrader, mobile apps, CRM and client portal, while the MT5 server licence stays with the provider. That is fast, but a regulator may ask hard questions about outsourcing and control.

Whether a new MT5 white label is available depends on MetaQuotes’ current approach: trade press and providers reported in 2022 that MetaQuotes had tightened or suspended new white labels in many cases, so we check the position case by case before promising anything; our MetaQuotes white label policy guide has the dated sources. Larger regulated firms often end up with their own MT5 licence, which keeps the server, data and configuration inside the licensed entity.

MetaQuotes’ order page lists three MT5 licence tiers by business capacity: Entry for 1,000 real accounts, Standard for 25,000 and Enterprise for 200,000. MetaQuotes does not publish prices. In the applications we handle, the licence carries a monthly fee that depends on the tier, and if you choose Entry, MetaQuotes asks for three months to be paid upfront. FXUP works as a consulting firm here: we prepare the MetaQuotes requirements and run the application for you, for a fee we quote per project. Ask us on WhatsApp and we will send current figures for the tier that fits your client numbers.

Which payment methods and languages do European clients expect?

European retail clients mostly fund by bank transfer and card, with e-wallets and open-banking payments in some markets. What matters for the broker is that each payment provider is contracted by the licensed entity and allowed for the client’s country, and that card data stays with the provider rather than in your systems.

We run our own CRM and also work with partner CRMs, and we propose whichever fits your licence and back office. Either way, the CRM connects to the payment providers you contract and posts approved deposits to the client’s MT5 account; withdrawals go through an approval queue your finance team controls. We do not pretend to have every European provider pre-built. If you already have a provider in mind, tell us and we will confirm the integration effort before you sign.

On language, our WebTrader and mobile app currently ship in English, Turkish and Arabic. Additional languages, such as German, French, Italian, Spanish or Polish, can be added as part of a project. Remember that the risk warning, appropriateness questions and key documents must be in the language you market in, and that translations go through compliance, not just the marketing team.

What does FXUP set up for a broker licensed in Europe?

We set up and run the technology between the MT5 server and your clients, configured to your rule set. FXUP is an independent technology provider and is not affiliated with MetaQuotes; we work with the MT5 server you choose, whether it is your own, a white label or a grey label we arrange.

• MT5 groups and symbol classes for retail and professional clients, with ESMA or FCA leverage, stop-out and negative balance settings documented for your compliance file.
• A broker CRM, either our own or a partner CRM we propose because it suits your operation, with registration, KYC vendor integration, appropriateness questionnaire, client categorisation, deposits and withdrawals, IB commissions and MT5 account sync.
• A branded WebTrader and iOS and Android apps that show your entity’s risk warning and run on approved domains; the apps are publishable under your own developer accounts.
• Liquidity provider and bridge integration, with execution data kept for best-execution evidence, and support for A-book, B-book or hybrid models as your licence allows.
• Copy trading and PAMM where your permissions cover them; our copy trading regulation guide explains why that is a licensing question first.
• Licensing support through partners for company formation and licence applications. For an own MT5 licence we act as consultants: we handle MetaQuotes’ requirements and the application on your behalf, for a fee we quote per project.

How do you launch a European brokerage stack, step by step?

The order below keeps the technology from running ahead of the licence. Technical setup takes weeks; licensing takes months, so most clients start the build while the application is still with the regulator and keep everything in a test environment until approval.

1. Fix the legal perimeterDecide which entity serves which countries, which services you will provide and whether you deal on own account. Your lawyer and the regulator settle this, and it drives everything else.
2. Write the rule setCompliance turns ESMA or FCA measures, the national rules and your own risk appetite into a one-page configuration brief: symbol classes, leverage, stop-out, client categories, restricted countries.
3. Choose the MT5 routeGrey label, white label or own licence, weighed against outsourcing and DORA expectations. We help you document the choice.
4. Configure and integrateGroups and symbols on MT5; CRM with KYC, appropriateness and payments; WebTrader and apps on approved domains; liquidity and bridge.
5. Test against the briefYour team opens retail and professional test accounts, hits the leverage limits, triggers a 50% close-out, forces a negative balance and checks the records. Every result goes into the compliance file.
6. Go live and reviewOnboard the first clients, then review the configuration whenever a rule, a symbol or a target country changes.

What should be on your pre-launch checklist?

Before the first real client deposits, the points below should be ticked and evidenced. This is the list we walk through with clients in the final week of a European project.

If you want a second pair of eyes on your configuration brief, message us on WhatsApp and we will tell you where it is likely to break.

• Every symbol mapped to an ESMA or FCA class, with the leverage it produces in each retail group checked in the WebTrader and apps.
• Stop-out at 50% of required margin for retail groups, tested on a live demo position.
• Negative balance procedure written, tested and assigned to a named person.
• Bonus and promotion modules off for retail clients unless compliance has approved them.
• Risk warning with the current loss percentage on the website, portal, apps and ads, with a date for the next update.
• Appropriateness questionnaire and warning stored per client in the CRM.
• Restricted-country list applied at registration, and only passported countries open.
• Record retention for calls, chats and emails set to at least five years.
• ICT vendor register and contracts reviewed against DORA, including exit plans.
• Domains for site, portal and WebTrader approved where your regulator requires it.

Questions buyers ask

Not covered here? Ask us on WhatsApp, message @FXUPCK on Telegram or write to [email protected].