The Cyprus Securities and Exchange Commission published another warning list this month — ten investment websites, none licensed, most cloned from names that sound almost right. If you trade forex, someone in your family is going to send it to you. A cousin. A brother-in-law. Your mother, forwarded from a WhatsApp group. And the message underneath will not be a question. It will be a verdict: *see, I told you.* This desk has watched that conversation happen at ten thousand kitchen tables since 2013. Here is how we got here, and what to say when the list lands in your inbox.
August 2013: The First CySEC Warning List Nobody at Home Understood
The first CySEC warning bulletins landed in a vacuum. Cyprus had become a Common Market gateway for retail forex in the years after 2004 accession, and by 2013 the register in Nicosia held more brokerage licences than any regulator in the eurozone outside the FCA. Warning lists were routine internal hygiene. What was new — and what nobody at a kitchen table anywhere in Europe was equipped to read — was the *volume*.
You have to imagine the reading experience. A file in Greek and English, PDF, no branding beyond the CySEC seal, listing entities by URL. No accompanying press explainer. No local-language interpretation. A wife in Athens searching the name of the site her husband had been depositing into would find the CySEC page, understand the word "unlicensed", and reach the only conclusion the document supported: the whole activity was illegitimate.
The distinction between an *unlicensed clone site pretending to be a real broker* and *the real licensed broker itself* did not exist in the family-conversation vocabulary of 2013. Both looked like forex. Both had leverage in the marketing. Both took wire transfers. If your father-in-law saw the CySEC page and your account statements in the same afternoon, the case was closed before you got home from work.
The lesson from that era, still true now: a regulator's warning list is not written for the trader's spouse. It is written for compliance officers and law enforcement. When it reaches the family, it needs a translator. That translator is you, and you had better have your vocabulary ready before the forward arrives.
January 2018: ESMA's Leverage Cap and the Kitchen-Table Question That Followed
On the second of January 2018, ESMA finalised its product intervention measures — a 30:1 leverage cap on major FX pairs for retail clients, tighter caps for minors and exotics, negative-balance protection, standardised risk warnings on every marketing page. The cap took full effect that August. Every CySEC-licensed broker serving EU retail had to comply. AvaTrade dropped its retail leverage. FXTM dropped its retail leverage. Exness dropped its EU retail leverage while keeping higher tiers under its non-EU entities. The regulatory ceiling was, for the first time in the retail-forex era, a hard number a non-trader could quote.
And that number is what changed the kitchen-table conversation.
Because now, when your wife asked *how much can you actually lose*, you had an answer she could parse. Before ESMA, "leverage" was an abstract multiplier that traders explained badly and families heard as "you can lose infinite money". After ESMA, on a CySEC-licensed retail account under EU jurisdiction, the honest answer was: *the most I can lose on any single trade is my margin plus a bit of slippage, and I cannot go negative on the account itself because the regulator forbids it.* That sentence, delivered flatly, does more to defuse a fight than any lecture on Fibonacci ever did.
But — and this is where the 2018 lesson hardens into 2026 relevance — the sentence only holds if the broker is CySEC-licensed and the account is a retail EU one. Take either of those away, and negative-balance protection is a marketing claim, not a legal one. The clone sites on this month's CySEC warning list offer none of it. Which is exactly why the regulator is warning about them.
August 2019: The Cyprus Bar Association Bulletin That Changed How Families Google
By 2019, the pattern was so entrenched that the Cyprus Bar Association began circulating guidance to member firms about how to handle inbound consumer inquiries on flagged websites. Families were retaining lawyers to recover deposits from sites that had never been licensed to hold them in the first place. The lawyers were writing to CySEC. CySEC was pointing back at the warning lists it had already published. And the wife or father who had first Googled the broker name was learning, months and thousands of euros later, that the "regulator" logo on the site's footer had been a JPEG lifted from someone else's landing page.
The shift that August was subtle but permanent. Family members stopped asking *is forex safe.* They started asking *is this specific website the real thing.* Which is a much better question. It is the question the regulator can actually answer.
This is the moment you want to bring to the surface when a warning list arrives at home. Not the abstract debate about whether trading is gambling. The specific, checkable question: *is the site in the URL bar of the person you are worried about the same entity as the CySEC-licensed broker they think it is?* Because Exness, for example, appears on the CySEC register through a licensed Cypriot entity, alongside FCA authorisation in the UK and FSCA in South Africa. FXTM appears on the register through its Cyprus arm, alongside FCA authorisation. AvaTrade holds a CBI licence in Ireland with additional ASIC and FSCA authorisations. FBS holds a CySEC licence for its Cyprus operations. HF Markets holds CySEC and FCA authorisations. Those names are on the register. The ten in the warning list are not.
The bar association's 2019 guidance was, in effect: teach the client to check the register before the retainer arrives, not after. That teaching now belongs to you, at home.
March 2020: Lockdown, the Retail Surge, and the In-Law Conversation Nobody Prepared For
Then came the pandemic. The BIS Triennial Survey published in December 2019 had already captured a retail-adjacent surge in daily FX turnover, but nothing in the archive prepared regulators for what the March 2020 lockdowns produced. Millions of people, at home, with brokerage apps on their phones and time on their hands. CySEC's inbound complaints volume, according to its own annual reports, climbed steeply through 2020 and 2021. Warning list publication frequency roughly doubled.
And the in-law conversation, which had been an occasional storm before, became weather.
Here is what nobody warned traders about: the March 2020 surge did not just bring in new retail participants. It brought their entire households into the room. A husband trading EUR/USD in the kitchen at 3 in the afternoon while his wife took a Zoom call in the bedroom was a visible activity in a way that trading before commutes-were-cancelled had never been. Every drawdown was witnessed. Every all-nighter around an NFP release was audible. The information asymmetry — the trader knowing what he was doing, the family knowing only that money was moving — collapsed. Not because the family suddenly understood. Because the activity was now impossible to compartmentalise.
Listen — I know this part is uncomfortable. But the way you talk about trading at home in 2026 is downstream of what your household saw between March 2020 and the end of 2021. If your spouse saw you red-eyed at 4 AM after the March 2020 oil-crash cascades, or if your mother watched you refresh a P&L page during Thanksgiving because you had left a position open, those images are the priors she is bringing to every future warning-list conversation. You do not get to argue past them. You have to work with them.
The rule from that period, still operating: transparency about the *structure* of what you do (regulated broker, sized position, capped loss) buys credibility that no amount of showing green screenshots ever will. Show them the CySEC register page. Show them your account's regulatory footer. Show them the negative-balance protection clause in the client agreement. Do not show them today's P&L.
August 2026: The Fresh CySEC List of Ten and What to Actually Print Out
Which brings us to this month. Ten sites, published by CySEC, none of them authorised in Cyprus, most of them cloned from URLs that look one character off from a legitimate broker. This is the pattern the regulator has been warning about for thirteen years, iterated and refined by scammers who have learned exactly which typos slip past a distracted family member on a Sunday afternoon.
Here is the printout you want at home when the forward arrives.
Print page one: the CySEC public register entry for your actual broker. Not the marketing page. The register entry, hosted on cysec.gov.cy, showing the licensed entity name, the licence number, the date of authorisation, the services permitted. If you trade with Exness, you print the Cyprus register entry for the licensed Exness entity — and you circle the licence number. If you trade with FXTM, the same. If you trade with AvaTrade through its EU offering, you print the CBI Ireland entry. If FBS, its CySEC entry. If HF Markets, its CySEC entry alongside the FCA one for the UK arm.
Print page two: the CySEC warning list itself. Highlight the URLs. Then, next to each URL on the warning list, write out — by hand, on the printout — the correct URL of the licensed broker it appears to be imitating. The visual gap between "the site your relative saw on WhatsApp" and "the site with the same-ish name on the register" is the entire argument, made in one glance.
Print page three: the ESMA leverage and negative-balance-protection rules. One page from the ESMA site. Highlight the retail leverage cap and the negative-balance protection clause. This is the document that answers *how much can I actually lose* without requiring the questioner to understand what a pip is.
That is the whole conversation. Three pages, no defence, no PowerPoint. You are not arguing that trading is a good idea. You are arguing that the specific website your family is worried about is not the same website you use, and that the regulator publishes the difference between them, and that everything you do is inside a rule set with a hard loss ceiling. If they still object after seeing those three pages, the objection was never really about the warning list. That is a different conversation, and you should have it — but not with the CySEC PDF as your evidence.
Do not show them the leverage on your non-EU tier if you use one. Do not open your MT5 to demonstrate. Do not explain what a swap rate is. Every one of those moves invites the "gambling" verdict back to the table.
What It All Means
Warning lists are a regulatory hygiene function, and they have been publishing continuously for over a decade. What has changed is not the lists themselves. What has changed is that they now reach the trader's family before they reach the trader — via WhatsApp, via a cousin who saw a news aggregator headline, via a mother-in-law's Facebook feed. The regulator writes the list once. It gets forwarded ten thousand times, and every forward strips more of the context away. By the time it reaches your kitchen table, "unlicensed website" has become "forex is a scam."
Your job — and this is the piece the CySEC bulletin will never do for you — is to restore the missing context. The distinction between a clone site and the real broker on the register. The distinction between an EU retail account with negative-balance protection and an offshore tier without. The distinction between a warning list, which is a public-safety notice about ten specific URLs, and a moral judgment on the entire activity of trading. The regulator draws these distinctions in its published documents. Your family will not read them. You have to.
The question this desk keeps returning to, and cannot yet answer from the archive: whether the warning-list mechanism itself — refined over thirteen years, published dozens of times a year, translated into more languages, delivered through more channels — has actually reduced retail losses to clone sites, or whether it has just documented them more efficiently for the lawyers who arrive after the money has moved. The CySEC annual reports contain complaint volumes and enforcement counts, but not the counterfactual. If someone on this desk's readership has run that analysis, or seen it run, write in. It is the piece we have been waiting fifteen years for someone to publish.
FAQ
What is a CySEC warning list, in one plain sentence a non-trader can understand?
It is a public notice from the Cyprus regulator naming websites that solicit investment activity from Cypriot or EU residents without holding a CySEC licence — nothing more, nothing less. It is not a ruling that forex trading is illegal, and it is not a judgment on any licensed broker. It is a list of URLs the regulator has flagged as unauthorised, published so that consumers and lawyers can check them.
How do I check whether the broker I actually use is on the CySEC register?
Go directly to the CySEC website and search the public register by the licensed entity name — not by the marketing brand alone. Match the licence number shown on your broker's account statements or website footer against the number on the register. If the entity name and number line up, you are looking at a genuinely authorised firm. If your broker's website lists no licence number, that is itself the answer.
If my broker is on the CySEC register, does that mean my account cannot go negative?
For EU retail accounts under ESMA's 2018 product intervention rules, yes — negative-balance protection on a per-account basis is mandatory for CySEC-licensed brokers serving EU retail clients. That protection does not automatically apply to accounts held under a broker's non-EU regulatory arm, even if the same brand operates both. Read your specific client agreement; the paragraph is short and unambiguous.
Why do so many clone sites use names that sound almost like real brokers?
Because the cost of registering a look-alike domain is trivial and the payoff from a single deposit from a confused user often exceeds the entire setup cost. Clones typically imitate names with strong retail recognition, using single-character swaps, added hyphens, or unusual top-level domains. The CySEC warning lists have documented this pattern for over a decade, which is why the register — not the URL — is the only reliable identity check.
What should I do if a family member has already deposited money into one of the listed sites?
Stop further deposits immediately and preserve every piece of documentation — emails, wire receipts, screenshots, chat logs with any "account manager". Report the site to CySEC through its complaint channel and to the family member's own bank; some banks can raise a chargeback if the deposit was via card and is within the window. Consult a lawyer familiar with cross-border retail-investment recovery before paying anyone who promises to recover funds for a fee.
Is it worth showing my family my trading account to prove it is legitimate?
Show them the regulatory footer, the licence number, and the client agreement's negative-balance-protection clause. Do not show them your live P&L, open positions, or leverage screen. The regulator-facing documents answer the question your family is actually asking; the trading screen answers a different question they did not ask, and it invites a debate you were not trying to start.
How often does CySEC publish warning lists like this one?
Frequently — bulletins appear multiple times a month during active periods, sometimes weekly. The publication cadence roughly doubled in the wake of the March 2020 retail surge and has stayed elevated since. Treat any single list as one entry in an ongoing stream, not as a one-off event. Subscribing to the CySEC news feed is more useful than reacting to whichever list your family happened to forward.
Does a warning list from CySEC apply to residents outside Cyprus and the EU?
The regulatory jurisdiction is Cyprus, but the practical warning value is universal — a clone site targeting Cypriot residents is almost always targeting other jurisdictions with the same infrastructure. Regulators in the UK (FCA), Australia (ASIC), South Africa (FSCA) and elsewhere publish their own equivalent lists. For a full check on any suspicious site, cross-reference at least two regulators' warning databases, not just one.