One group of companies. Two leverage regimes. One server estate.
Most Cyprus brokers run a second entity offshore, because the caps there are a different order of magnitude. The two books usually share symbol names, group naming conventions and the habits of the same operations team. That is where the breach comes from.
What CySEC allows a retail client to hold.
Cyprus applies the European caps. These are the ratios your Cyprus-licensed retail book has to sit inside, whatever the entity next door is permitted to offer.
- Major currency pairs: 30:1
- Minor currencies, gold, major indices: 20:1
- Commodities other than gold, minor indices: 10:1
- Government bonds: 5:1
- Shares and other assets: 5:1
- Crypto-assets: 2:1
The gap between the two books is the size of the mistake.
A Cyprus retail book caps gold at 20:1. A common offshore regime permits a flat 200:1 across every asset class. Same broker, same brand, often the same people configuring both.
Nothing about a group template announces which entity it belongs to. A template that is entirely correct on one server is a ten-fold breach on the other, and it looks completely ordinary in both.
- Each server checked against its own licence, not a group-wide default
- Cross-entity template reuse surfaced as a finding
- Client counts attached, so exposure is countable not theoretical
- A finding names the symbol, the group and the server
Cyprus applies them. Europe writes them.
CySEC implements the European product intervention measures, so the caps track ESMA rather than diverging from it. A change at European level lands on your Cyprus book, and a group configured before that change stays wrong until somebody looks. Nothing in the platform tells you a rule moved underneath it.
CySEC, answered plainly.
30:1 on major currency pairs and 20:1 on minor pairs. Gold and major indices are 20:1. Other commodities and minor indices are 10:1. Government bonds and shares are both 5:1, and crypto-assets are 2:1.
That is a licensing question rather than a configuration one, and plenty of groups do it lawfully. The risk is not the offshore book itself. It is a group template crossing from one entity to the other, which is a configuration question, and that is what we watch.
The currency and index rows match. Government bonds do not: 5:1 under CySEC against 30:1 under the FCA. Crypto is capped at 2:1 in Cyprus and banned outright for UK retail.
Yes, and that is precisely why classification has to be checked per group rather than assumed. A professional book holding leverage a retail book may not is correct. A retail group inheriting a professional template is not.
No. We read. Nothing we run can change a symbol, a group or an account, so the worst case for your environment is that we see something you would rather we had not.
One group of companies. Two leverage regimes. One server estate.
Most Cyprus brokers run a second entity offshore, because the caps there are a different order of magnitude. The two books usually share symbol names, group naming conventions and the habits of the same operations team. That is where the breach comes from.
What CySEC allows a retail client to hold.
Cyprus applies the European caps. These are the ratios your Cyprus-licensed retail book has to sit inside, whatever the entity next door is permitted to offer.
The gap between the two books is the size of the mistake.
A Cyprus retail book caps gold at 20:1. A common offshore regime permits a flat 200:1 across every asset class. Same broker, same brand, often the same people configuring both.
Nothing about a group template announces which entity it belongs to. The symbols carry the same names. The naming conventions were copied from each other. A template that is entirely correct on one server is a ten-fold breach on the other, and it will look completely ordinary in both.
This is why we check each server against the regulator that actually governs it rather than against a single house standard. A house standard is exactly what produces the error.
- Each server checked against its own licence, not a group-wide default
- Cross-entity template reuse surfaced as a finding
- Client counts attached, so exposure is countable not theoretical
- A finding names the symbol, the group and the server
Cyprus applies them. Europe writes them.
CySEC implements the European product intervention measures, so the caps track ESMA rather than diverging from it. What that means in practice is that a change at European level lands on your Cyprus book, and a group configured before that change stays wrong until somebody looks. Nothing in the platform tells you a rule moved underneath it.
Each server to its own regulator
A book licensed offshore is checked against offshore rules, and the Cyprus book against Cyprus rules. Neither inherits the other's ceiling by accident.
Templates compared across entities
Group templates get reused between entities because the symbol sets look alike. We compare what each group actually applies rather than what it was meant to inherit.
Retail and professional apart
An elective professional client may hold leverage a retail client may not. Each group is checked against the classification that governs it.
CySEC, answered plainly.
30:1 on major currency pairs and 20:1 on minor pairs. Gold and major indices are 20:1. Other commodities and minor indices are 10:1. Government bonds and shares are both 5:1, and crypto-assets are 2:1.
That is a licensing question rather than a configuration one, and plenty of groups do it lawfully. The risk is not the offshore book itself. It is a group template crossing from one entity to the other, which is a configuration question, and that is what we watch.
The currency and index rows match. Government bonds do not: 5:1 under CySEC against 30:1 under the FCA. Crypto is capped at 2:1 in Cyprus and banned outright for UK retail.
Yes, and that is precisely why classification has to be checked per group rather than assumed. A professional book holding leverage a retail book may not is correct. A retail group inheriting a professional template is not.
No. We read. Nothing we run can change a symbol, a group or an account, so the worst case for your environment is that we see something you would rather we had not.