How to keep a forex licence compliant after the first year

Obtaining a forex licence confirms that a company is ready to begin regulated activities but does not guarantee that it will retain the licence. After the first year, the regulator assesses actual operations, including capital adequacy, protection of client funds, reporting quality, AML controls and compliance with the licence scope. An overdue regulatory return, an unreported change of a key person or systemic client onboarding failures may result in a remediation order, fine or restriction of permitted services. The compliance framework must therefore be regularly tested and updated to reflect actual business risks. In this article, we explain the obligations a forex company must meet after its first year and how to prepare for a regulatory review.

This guide focuses primarily on the ongoing obligations of EU-regulated (MiFID II) investment firms. Requirements differ significantly for offshore-regulated brokers — for example, a Comoros (MISA) licence involves lighter-touch, non-MiFID supervision without K-factor capital calculations, EU passporting or DORA obligations. If your licence is issued outside the EU, contact Key2Law for guidance specific to your regulator. 

Confirm that the business still operates within its licence scope

A forex licence is not a general authorisation for all currency and derivative activities. Its scope covers specific investment services, financial instruments, client categories and regulatory conditions. The company must regularly compare its actual business model with the information submitted during authorisation.

The review should cover:

• Services provided, including reception and transmission of orders, execution, dealing on own account and investment advice;
• Permitted instruments, including spot forex, CFDs and other derivatives;
• Client categories and applicable investor protections;
• Countries where clients are targeted and served;
• Tied agents, introducing brokers and affiliates;
• Execution model, liquidity providers and conflicts management;
• Restrictions or special conditions in the licence decision.

A new product or customer journey may take the business beyond its permissions. Copy trading, for example, may involve portfolio management or investment advice. Moving from an agency model to dealing on own account also changes regulatory and capital requirements.

Before launching a service, the compliance function should conduct a regulatory perimeter analysis and determine whether a licence variation or prior notification is required.

EU investment firms may provide only the services covered by their authorisation. Cross-border services must also follow the MiFID II passporting procedure. Changes to notified activities must be reported through the home regulator.

The review should result in a licence scope matrix matching each product, client type, jurisdiction, marketing channel and responsible entity with the relevant permission. Any unsupported activity must stop or receive prior regulatory approval.

Maintain capital and meet regulatory reporting deadlines

After the first year, higher transaction volumes may make the initial capital buffer insufficient. The company must monitor its prudential position continuously, not only before filing a regulatory return.

Capital and liquidity

Minimum capital depends on the licence scope, company size and risk profile. EU investment firms may calculate own funds using permanent minimum capital, fixed overheads and K-factors. These cover risk-to-client, risk-to-market and risk-to-firm, including client money, orders handled and market exposure.

The company should:

• Calculate own funds using current accounting data;
• Monitor K-factors and other risk indicators;
• Maintain the required liquid assets;
• Account for losses, withdrawals and operating cost changes;
• Conduct stress testing and assess additional capital needs;
• Obtain compliance and financial approval before paying dividends.

EU investment firms must monitor changes that may materially affect their own funds requirement. The regulator may also impose additional capital based on the business model, scale and risks not covered by the standard calculation.

Management should receive early warnings before a breach occurs. Monthly capital reporting should include warning thresholds and an escalation procedure.

Regulatory reporting

A forex company may file prudential, transaction, financial, AML and client money reports. Forms and deadlines vary by regulator, so one annual filing is not enough.

After the first year, the company should confirm that:

• All periodic returns were filed;
• Regulatory figures match accounting records;
• Client money, own funds and transaction volumes were reported correctly;
• Annual accounts and external audit were completed;
• Supervisory fees were paid;
• Compliance, MLRO and internal audit reports were submitted;
• Qualifying shareholders and other required changes were disclosed.

A central calendar should record each form, reporting period, deadline, owner and approver. Source files and proof of submission should be retained.

Correcting an error after the deadline does not remove the original breach. Incorrect data or a capital shortfall may require immediate notification and a remediation plan. Delaying disclosure usually creates greater supervisory risk.

Protect client money and maintain fair execution

A forex company must protect client funds and ensure that pricing and execution do not unfairly benefit the broker. These duties increase as client balances and trading volumes grow.

Client money protection

If the licence permits holding client money, it must be segregated from company funds and accurately recorded for each client. MiFID II requires firms to distinguish client assets from their own and regularly reconcile internal records with third-party data.

The system should include:

• Properly designated client accounts;
• Regular internal and external reconciliations;
• Immediate investigation and correction of shortfalls;
• Due diligence of banks, custodians and other providers;
• Control of concentration risk;
• A ban on using client money for operating expenses;
• A responsible officer with sufficient authority;
• Retained reconciliation records and audit trails.

A bank account labelled as a client account is not enough. The company must review the banking agreement, rights of set-off and treatment of funds during insolvency.

Execution and client treatment

Forex and CFD providers may act as the client’s counterparty or execute trades outside a trading venue. This increases conflicts of interest and requires documented price controls.

The company should test:

• Compliance with the target market;
• Retail, professional and eligible counterparty classifications;
• Appropriateness assessments;
• Execution speed, slippage, rejected orders and requotes;
• Spreads, commissions, swaps and other charges;
• Withdrawal and complaint procedures;
• Best execution controls;
• Management of firm-client conflicts.

For OTC products, the firm must check price fairness using market data or comparable products and retain evidence of the calculation.

Retail CFDs are also subject to leverage limits, margin close-out, negative balance protection, standardised risk warnings and a ban on incentives. Renaming or restructuring a leveraged product does not avoid these rules if it remains a CFD.

Testing results should be reported to management. Repeated complaints, adverse slippage or withdrawal delays require root cause analysis and remediation.

Review marketing, affiliates and cross-border activity

Marketing creates compliance risk even when handled by an agency or introducing broker. A forex company remains responsible for communications issued on its behalf and cannot transfer this duty to an affiliate.

Before publication, the company should check:

• Claims about returns, spreads and execution speed;
• Visibility of risk warnings and conflicting statements;
• Balanced presentation of benefits and possible losses;
• Guarantees or unsupported profit promises;
• Information about the licence and regulator;
• Suitability for the relevant client category;
• Bonuses, trading credits and other incentives;
• Compliance with each target jurisdiction.

All financial promotions should receive formal approval. The company must retain the final version, publication date, approved jurisdictions and approver details. These rules cover websites, emails, social media, apps, webinars, influencers and affiliate content.

Affiliate agreements should define permitted marketing methods, required disclosures, review rights and immediate removal procedures. Remuneration based only on deposits, trading volume or client losses may create conflicts and encourage aggressive sales practices.

Before entering a new country, compliance must confirm that the activity is covered by a passport or other cross-border permission. A licence in one EU state does not automatically permit active marketing across the EU without the required notification.

Website language, paid advertising, local domains, phone numbers and sales staff may show that a firm targets a specific market. A disclaimer excluding local residents will not help if actual onboarding and marketing practices show otherwise.

Keep AML/CFT and sanctions controls operational

The AML framework must evolve with the customer base, products and geography. Initial risk scores and monitoring scenarios quickly become outdated when the company enters new markets or increases transaction volumes.

After the first year, review:

• The enterprise-wide ML/TF risk assessment;
• Customer risk methodology and KYC review periods;
• Beneficial ownership and source-of-funds evidence;
• PEP, sanctions and adverse media screening;
• Monitoring scenarios and thresholds;
• Alert backlog and STR/SAR escalation;
• AML training and compliance resources.

Ongoing monitoring should cover trades and fund movements. FATF guidance recommends checking whether transactions match the customer profile and purpose of the relationship. Forex red flags include third-party deposits, withdrawals without material trading, linked accounts, frequent changes in payment methods and transfers to unsupported jurisdictions.

KYC should be updated after a change in beneficial ownership, sharp turnover growth, new geography or activity inconsistent with the stated source of funds. Each alert should record the review, supporting documents and decision. Suspected activity must be escalated to the MLRO for an STR/SAR assessment without tipping off the client.

Management should receive regular information on high-risk clients, overdue reviews, backlogs and control gaps. Where required, the annual AML report should assign owners and remediation deadlines.

Maintain governance, substance and key personnel

A forex company must maintain the governance and resources on which its authorisation was based. Nominal directors and formal board meetings do not demonstrate effective oversight.

The management body should regularly review:

• Capital, client money and execution quality;
• AML alerts, complaints and regulatory breaches;
• Compliance and internal audit findings;
• Outsourcing and ICT incidents;
• Progress on remediation actions.

Decisions and follow-up must be recorded in board minutes. The company should also maintain sufficient local substance, including qualified management, compliance staff, access to records and genuine local decision-making. Growth without stronger control functions creates supervisory risk.

Changes to a director, compliance officer, MLRO, beneficial owner or qualifying shareholder may require approval or notification. The candidate’s experience, reputation, conflicts and time commitment should be assessed before appointment.

Compliance must remain independent, adequately resourced and able to access the board. Key persons also require succession plans. As MiFID II provides for ongoing supervision, material changes to management or the operating model should be assessed and disclosed before implementation.

Control outsourcing, technology and operational resilience

Forex companies often outsource cloud hosting, trading infrastructure, KYC, payments and customer support. Outsourcing does not transfer regulatory responsibility: the company must retain control, data access and operational continuity after termination.

For each critical function, review:

• Provider due diligence and financial stability;
• Service levels, security and incident notification;
• Company and regulator audit rights;
• Data location, protection and recovery;
• Subcontracting and concentration risk;
• Workable exit and transition plans;
• Regular business continuity testing.

After the first year, the ICT provider register should be matched against actual integrations and contracts. An unrecorded vendor, overdue security review or untested backup may cause disruption and regulatory breaches.

Management should receive information on incidents, system availability and unresolved vulnerabilities. Material changes to the trading platform, hosting or critical outsourcing must be assessed in advance for any regulatory notification or approval.

Conduct an annual compliance review

The annual review should test whether controls work in practice, not merely whether policies exist. Its scope should reflect the licence, business model, previous findings and regulatory changes.

Before the second year, the company should:

• Compare actual activities with the licence scope;
• Review capital and regulatory filings;
• Test client money reconciliations;
• Reassess AML risks and the alert backlog;
• Sample client and transaction files;
• Analyse execution, complaints and withdrawals;
• Review marketing and affiliates;
• Update outsourcing and ICT registers;
• Verify previous remediation actions.

Each gap should enter a remediation plan with a risk rating, owner and deadline. A material breach may require regulatory notification.

Management should approve the results. Testing samples, working papers, board minutes and evidence of remediation must be retained. This audit trail shows that the compliance framework is regularly tested and improved.

How Key2Law supports ongoing forex compliance

Key2Law advises regulated forex and CFD companies on ongoing compliance, governance and supervisory reviews. We compare actual operations with licence conditions and regulator requirements.

Key2Law can:

• Conduct an annual compliance gap analysis;
• Review the licence scope and cross-border activities;
• Assess capital, reporting and client money controls;
• Update AML/CFT and monitoring procedures;
• Review governance, outsourcing and DORA compliance;
• Prepare remediation plans and inspection materials.

If your first year under a forex licence has ended or your business model has changed, contact Key2Law. We will help identify gaps, update controls and maintain compliance without disrupting operations.