CySEC publishes which website each broker may operate, and six of the ten we checked are not approved for their own .com

The Cypriot regulator lists an approved domain for every licensed firm. XTB's licence covers xtb.com/cy, Tickmill's covers tickmill.com/eu. The global brand domain most people land on is a different door, and often a different company.

Last verified 8 September 2026 · how we check

Most regulators tell you whether a firm is licensed. The Cypriot one goes further and tells you which websites that licence covers, firm by firm, on a public page with no account required.

Almost nobody uses it. We swept the field for ten brokers we have reviewed, and the results change what “regulated in Cyprus” means when you are standing on a .com.

What each licence actually approves

Read the middle column first. The number of websites a Cypriot licence covers runs from one to forty-one, and the difference is not about company size.

Six of ten are not approved for their own .com

This is the finding, and it is exact rather than interpretive.

XTB’s Cypriot licence covers www.xtb.com/cy. Not xtb.com. A path.

Tickmill Europe’s covers www.tickmill.com/eu. Again a path, not the domain.

Eightcap EU’s covers www.eightcap.com/en-eu/. The same shape.

Exness (Cy)’s covers www.exness.eu, a separate top-level domain from the .com the brand is known by. IC Markets (EU) is the same: www.icmarkets.eu, plus www.ic.com/eu.

Four of the ten do have the plain global domain on the licence, and the count of approved addresses tells you nothing about which group a firm is in. Pepperstone EU holds exactly one approved domain and it is pepperstone.com/ itself. ThinkMarkets holds nine, led by www.thinkmarkets.com. FxPro’s twenty-four are led by www.fxpro.com, and Plus500CY’s forty-one by www.plus500.com.

So the useful split is not how many addresses a licence covers. It is whether the address a visitor actually types is one of them:

Why a path, and why it matters

None of this is misconduct, and the explanation is ordinary. These groups run several licensed companies. The Cypriot entity serves the European client, and the group routes European visitors to a specific path or country domain that belongs to it. The global .com belongs to a different company in the group, under a different regulator, with different protections.

We have set out that structure repeatedly: Eightcap holds FCA, ASIC and CySEC licences across three companies, and a fourth Seychelles entity sits outside all of them. Exness (UK) holds a licence with no retail permission at all.

The approved-domain field is the only place a regulator tells you which door leads to which company. Everything else about the entity structure sits in a client agreement you read after you sign up, if at all.

So the practical reading is not “this brand is unlicensed”. It is: the address decides which company you contract with, and six of these ten licences do not cover the address most people type.

What the widest lists tell you

Plus500CY’s forty-one approved domains are almost all country versions of one brand: plus500.nl, .pl, .at, .be, .ch, .ee, .ro, .lv, .lt, .dk, .it, .cz, .gr, .fr, .se, .hu, .no, .es, .pt, .si, .ie, .fi, .bg, .lu and more, including plus500.com.uy and plus500.com.mx.

FxPro’s twenty-four run the same way and reach further out: fxpro.ae, fxpro.cn, fxpro.vn, fxpro-thailand.com, fxpro.com.my.

That breadth is itself information. A licence covering forty-one addresses is one the group uses as its main European permission. A licence covering one path is a narrow door inside a larger structure, and the traffic that does not go through it goes to a different company.

The three-line check

This takes about a minute and needs nothing but a browser.

One. Open the CySEC register of Cypriot investment firms and find the company. The list is public and searchable; there were 248 firms on it when we pulled our copy.

Two. Read the Approved Domains field on the entity page. It sits under Other Information, above Investment Services.

Three. Compare it against the address in your browser bar. If the address you are about to deposit through is not on that list, the Cypriot licence is not the one covering your account, and the client agreement will name a different company.

That third step is the whole exercise, and it answers a question the four register failures we documented in checking a broker on the regulator’s register cannot: not whether the firm is licensed, but whether this website is.

If the address does not match

Finding your browser bar on a different address from the register is not by itself a problem, and it is worth knowing what it does mean.

Most often it means a different group company. The global site belongs to another entity under another regulator. Your protections then come from that regime, not from CySEC, and the client agreement names which one. That is the ordinary case at six of the ten firms above.

Occasionally it means something else. A site copying a licensed firm’s details will not appear on the approved list, because the list is maintained by the regulator rather than by the site. This is the one register field that catches a clone directly: the impersonator can copy the licence number, the company name and even the address, as happened at XTB, where a warned entity is listed at the authorised firm’s own postcode. It cannot add itself to the approved-domain list.

So the check has two possible answers, and both are useful. Either you learn which company you are actually contracting with, or you learn that the site is not the firm at all.

What this does not tell you

It is not a warning about any firm here. All ten hold live Cypriot licences. Operating a global site under a different group company is normal corporate structure, not evasion.

It does not cover other regulators. The FCA and ASIC registers we hold do not publish an equivalent field, so this check works for Cyprus and does not transfer.

It says nothing about price or conduct, which is the limit on every register check.

What it does settle is which legal entity is on the other side of the signup form, and that is the question that decides your compensation scheme, your leverage cap and your complaints route.

What we checked, and what we didn’t

We read the Approved Domains field on the CySEC register entry for each of the ten firms on 8 September 2026, and the counts above are the full published lists rather than samples. The licence numbers come from our local copy of the register of 248 Cypriot investment firms.

We have not opened an account through any of these addresses, and we have not tested where each domain redirects a visitor from a given country, which changes by geography and by the group’s own routing. The check described here is the one a reader can run in a browser; what happens after the signup form is a matter for the client agreement.

Sources

• CySEC: register of Cypriot investment firms
• CySEC: XTB Ltd, licence 169/12
• CySEC: Plus500CY Ltd, licence 250/14