What CySEC and ESMA Say: The Public Record

Why the regulatory record matters

Public regulator records are the only part of a broker's reputation that cannot be bought, staged or deleted. Reviews can be incentivised and forums can be brigaded; a licence number and a published decision sit on a state website either way.

Anyone can write that a broker is safe. Anyone can write that it is a scam. What almost nobody does is check the layer underneath both claims — the documents a financial regulator publishes because the law obliges it to. That layer is small, dull and unusually reliable, and it answers a narrower question than "is this broker good": it answers who the firm is, what it may lawfully do, where it may do it, and whether the supervisor has ever had to act.

What a regulator does and does not tell you

The distinction matters, because most disappointment with regulator records comes from expecting the wrong thing.

• It tells you the legal entity exists and is authorised — a name, a registration, an address, a supervisor with statutory powers over it.
• It tells you the rulebook that entity operates under: client-money segregation, capital requirements, conduct standards, complaint handling, marketing limits.
• It tells you the enforcement history, because supervisory action is published rather than settled quietly.
• It does not tell you the firm is a good broker. Spreads, execution quality, app design and customer service are outside the regulator's remit entirely.
• It does not guarantee you will make money. Trading CFDs and leveraged products carries a high risk of losing money, and no licence changes that.

The asymmetry nobody points out

A regulated firm generates a public record precisely because it is being watched. An unlicensed offshore operator generates nothing: no register entry, no filings, no decisions, no fines. Search for enforcement against a genuinely lawless platform and you will usually find a clean, silent void — which reads, to an inattentive eye, like a better record than a supervised firm with a settlement in its history.

That inversion is the single most common misreading in this niche. A published decision is evidence that a supervisor exists, examined the firm, found something and required a remedy. Silence is evidence of nothing at all. We work through the comparison in detail in why a CySEC licence outweighs an offshore registration, and it is worth holding in mind before reading a single line of the record below.

Three questions the record can settle today

1. Which entity would hold my account? The EU-licensed company and a non-EEA entity are not the same counterparty and do not carry the same protections.
2. Is that entity currently authorised? Licences can be suspended, surrendered or withdrawn; a status accurate last year is not a status.
3. Has the supervisor acted, and what for? Compliance failures, marketing breaches and outright misappropriation are wildly different findings that get flattened into the word "fine".

Everything that follows is an attempt to answer those three questions from documents rather than from sentiment, and then to say plainly what the answers add up to.

Regulator records answer a narrow question extremely well: who the firm is, what it may do, and whether it has been disciplined — treat everything else about a broker as a separate investigation.

CySEC's role and public register

Cyprus's securities supervisor authorises and polices investment firms under EU law. Its public register is the primary document for this brand, because that is where IQ Option Europe Ltd and licence 247/14 either appear with a current status, or do not.

The Cyprus Securities and Exchange Commission is the competent authority for Cyprus Investment Firms, operating inside the EU framework set by MiFID II. That framework is what makes a Cypriot licence meaningful outside Cyprus: the same conduct rules, capital rules and client-asset rules apply across the European Economic Area, and a licence granted in Nicosia can be passported to serve clients in other EEA states.

The entity and the number

The EU-facing company behind this brand is IQ Option Europe Ltd, a Cyprus Investment Firm registered in Limassol, holding CySEC licence 247/14, issued on 30 July 2014. Those are the only identifiers worth memorising, because they are the ones you can verify. A brand name proves nothing; a licence number attached to a named legal entity can be typed into the regulator's own register and either matches or does not.

What the licence actually obliges the firm to do

Those duties are the substance of the licence. They are also, notably, the categories that appear in enforcement decisions when something goes wrong — supervisors act on the rulebook they wrote, which is why reading the rulebook first makes the enforcement record legible instead of alarming.

The boundary of the licence

CySEC authorisation passports across the EEA and stops there. It does not authorise the firm in India, Brazil, Thailand, Colombia or the United States, and US residents are not accepted at all. Clients outside the EEA are typically onboarded by a non-EU entity, which does not carry the CySEC protections listed above. This is not a technicality — it decides whether segregation, the compensation fund and negative balance protection apply to your account, and it is covered fully in how client money protection actually works.

Why the register beats every other source

Affiliate pages copy licence numbers from each other and never update them. Screenshots age. Clone sites cheerfully display a real firm's licence number next to a fake domain, which is exactly why lookalike sites are so effective. The register is the one place where the number is checked against the entity by the body that issued it, and it takes about ninety seconds. Regulatory and company details on this page were checked against public regulator records on 3 September 2026; confirm current terms on the operator's own site before depositing.

IQ Option Europe Ltd holds CySEC licence 247/14 from 30 July 2014 — verify that pairing in the register yourself, and confirm which entity your own account agreement names.

ESMA and the 2018 turning point

Europe's markets authority rewrote this entire product category in 2018. Binary options were banned for EU retail clients and CFD rules were tightened, which explains a change traders still misread as a broker quietly withdrawing a product it could not honour.

The European Securities and Markets Authority coordinates securities supervision across the EU and, unusually, holds direct product-intervention powers. In 2018 it used them against the retail binary-options and CFD market — not against one firm, but against the instruments themselves. Every EU-regulated broker was affected identically, and national regulators including CySEC carried the measures forward.

What changed

• Binary options were prohibited for EU retail clients. From 2018, CySEC-regulated firms could no longer offer them to retail clients in the EEA. The instrument did not become fraudulent overnight; the regulator concluded it was unsuitable for retail distribution.
• CFD leverage was capped, with tighter caps on volatile assets than on major currency pairs.
• Negative balance protection became mandatory for retail accounts.
• Standardised risk warnings were required on marketing and platforms.
• Monetary inducements were banned — the reason deposit bonuses do not exist for EU retail clients of regulated firms.

We deliberately state those as rules rather than numbers. Leverage caps and risk-warning percentages are per-firm and per-period; anyone quoting you a precise current ratio from a review page is quoting something they have not verified today.

Why this matters for the scam question

A recurring accusation runs roughly: "they removed binary options because they were caught." The sequence was the opposite. A supervisor banned an instrument market-wide, and firms that wanted to keep their EU licences complied. The brokers that carried on offering binaries to Europeans were the ones outside the EU perimeter — which is to say, the unlicensed ones. Compliance with an unwelcome rule is weak evidence of fraud and reasonable evidence of the opposite.

Digital options, where offered, are a distinct and regulated instrument. Treating "digital" as a rebranded workaround for the ban misreads both the product and the rule.

The inducement ban and the bonus problem

Because monetary inducements are prohibited for EU retail clients, no cash deposit bonus exists for an EU retail account at a regulated firm. That single rule is the sharpest clone-detector available. Any page advertising an "IQ Option deposit bonus code" for a European account is describing something the regulation forbids, and is either an unlicensed operator, an affiliate fabrication or an outright impersonation. The mechanics are set out in how bonus and promo-code scams work.

Checking what applies to your own account

Product availability is not a single global fact, and no review page can answer it for you. What a retail client in the EEA may trade, what leverage is available and whether digital options appear at all depend on the entity holding the account and on the country of residence recorded during verification. Two people opening accounts on the same day, from different countries, can end up with different instrument menus and different protections without either of them doing anything wrong.

The practical consequence is that comparisons written for one jurisdiction travel badly. A trader in Brazil reading a European product description, or a trader in Thailand reading an EEA leverage rule, will form expectations the platform never promised them, and the gap between expectation and screen is the raw material of a great many scam accusations. Confirm the instrument list, the applicable rules and the named entity inside your own account before drawing conclusions from anything written elsewhere, including here.

The trade-off ESMA made

The 2018 measures cost European traders access and leverage, and they cost brokers revenue. What they bought was a market where the headline product could not be sold to retail clients at all, where accounts cannot go into debt, and where marketing cannot dangle cash. Whether that trade was correct is a policy argument. What it is not is a scandal about one broker, and reading it as one produces a badly distorted picture of the record.

The 2018 product intervention was market-wide: the binary-options ban, leverage caps and the inducement ban hit every EU-regulated firm, so complying with them tells you a broker stayed inside the perimeter.

Reading enforcement and warnings

Two categories get confused constantly. A supervisor disciplining a firm it licenses is one thing; a foreign regulator noting that a firm was never licensed there is something else entirely, and only one of them is enforcement.

The published record for this brand contains both types, and they carry very different weight. Taking them in order.

The 2019 CySEC settlement

CySEC reached a settlement with IQ Option Europe Ltd by a Board decision dated 15 April 2019, published on 21 May 2019. The reported settlement amount is EUR 450,000, covering possible breaches of the Investment Services and Activities and Regulated Markets Law L.144(I)/2007 and the AML Law L.188(I)/2007 — specifically matters of conflict-of-interest safeguards, client due diligence, and transaction security. The decision is recorded on the regulator's own site, and readers who want the primary document can open the CySEC decision page for that settlement directly.

Read it precisely. A settlement is a compliance matter resolved with the supervisor. It is not a criminal conviction, not a finding of theft, and not a determination that client money was misappropriated. It is also not nothing: a six-figure settlement covering due-diligence and conflict-of-interest obligations describes real control weaknesses that a regulator considered serious enough to act on.

The earlier reported fine

The public record also carries an earlier CySEC administrative fine, reported at EUR 180,000 in 2016, relating to marketing communications and compliance failures. We flag this as reported rather than verified — we have not opened the primary decision — and we treat the pattern rather than the figure as the meaningful part: this is a firm that has been disciplined more than once, in categories concerning marketing and compliance rather than client funds.

Alert lists are not enforcement

Several regulators outside the EEA have listed the brand, and this is where careless reviews go badly wrong in both directions.

The common thread is jurisdiction, not honesty. Each entry says a firm authorised in Cyprus was not authorised there — which is what a CySEC licence, passporting only across the EEA, would predict. None of them is a finding that the platform stole money. Equally, none of them is harmless: being outside a domestic perimeter means that if something goes wrong, the local regulator has no complaint channel for you. The Indian position specifically is unpacked in the legality question for Indian residents.

How to weigh a decision you find yourself

1. Who issued it? The firm's own supervisor, or a foreign authority noting non-authorisation?
2. What is the finding? Marketing and disclosure, control weaknesses, client-money misuse, or fraud? These are not interchangeable.
3. What date? A 2016 marketing matter and a live 2026 restriction sit very differently.
4. What happened next? Remediation, continued authorisation, or withdrawal of the licence?
5. Does the licence still stand? The register answers this, and it is the answer that matters most.

Where a country's file shows no verified action, we say so rather than filling the gap. For Thailand and Colombia, for instance, the honest statement is that the brand is not a locally licensed intermediary — not that a local regulator has ruled against it, because we found no such ruling.

One real settlement with its own supervisor, one earlier reported fine, and several alert-list entries about jurisdiction rather than fraud — that is the whole record, and each category deserves a different weight.

Turning the record into a judgement

Documents do not deliver verdicts; people do. The useful move is to convert the record into a small set of conditions — which entity, which protections, which recourse — and then decide whether those conditions fit what you intend to do.

Put the pieces on one page and the shape is clear enough. There is an EU entity with a licence issued in 2014 and a rulebook covering segregation, compensation and negative balance protection. There is a market-wide 2018 intervention that reshaped the product line. There is a 2019 settlement and an earlier reported fine, both in compliance and marketing territory rather than client-asset misappropriation. There are alert-list entries in countries where the firm never held a licence. And there is no published finding, anywhere in that record, that the platform refused to return client money it held.

What the record supports

• The firm is a real, identifiable, supervised legal entity in the EU — the opposite of an anonymous offshore platform.
• Its supervisor has intervened, published the outcome, and continued to authorise it.
• Its protections are real but conditional: they attach to the licensed entity and to EEA retail clients, and not to accounts held elsewhere.
• Outside the EEA, recourse thins dramatically — often to nothing more than the firm's own complaints process.

What the record does not support

• It does not support the claim that this is a fraud operation. Nothing published says that.
• It does not support a clean bill of health either. Two disciplinary matters is a history, not an accident.
• It says nothing about whether you will trade profitably. Most of the complaints that fuel the scam label come from losses, verification friction and clone sites rather than from anything in a regulator's file — the pattern is set out in why the accusation persists.

A five-minute personal check

1. Search the CySEC register for IQ Option Europe Ltd and confirm licence 247/14 shows a current status.
2. Read your account agreement and identify the entity named in it. If it is not the CySEC firm, the protections above do not apply to you.
3. Check whether your own country's regulator lists the brand, and treat an alert-list entry as "no local recourse" rather than "criminal".
4. Reach the platform only by typing the official domain yourself; the clone problem is larger than the enforcement record.
5. Size positions on the assumption that you may lose them, because leveraged trading carries a high risk of losing money regardless of who is regulated.

Where this leaves the question

"What do the regulators say" turns out to be answerable, which is more than can be said for most questions in this category. They say: authorised in the EU since 2014, disciplined twice in compliance matters, restricted by a market-wide product ban, and not authorised in a list of countries where it was never licensed. That is a supervised broker with a used record. Whether it suits you depends on which entity would hold your account and what you intend to trade — and the full weighing sits in our verdict on whether IQ Option is a scam or legitimate, alongside the detailed licence check.

The public record describes a supervised EU broker with a real compliance history and conditional protections — convert it into your own entity check rather than accepting anyone else's verdict.