Forex Regulation Explained: FCA, ASIC and CySEC in 2026

Forex regulation isn't one global standard — it's a patchwork of national regulators, each with its own leverage caps, compensation schemes, and enforcement power. The three names that come up most for retail traders are the UK's FCA, Australia's ASIC, and Cyprus's CySEC, and understanding what each one actually requires is the fastest way to tell a well-supervised broker from a lightly-regulated one wearing the same brand name.

The FCA (UK)

The Financial Conduct Authority regulates any firm offering forex or CFD trading to UK residents. FCA-authorized entities must hold client funds in segregated accounts separate from company money, provide negative balance protection to retail clients, cap retail forex leverage at 30:1 on major currency pairs (tighter still on more volatile instruments), and — for firms covered by it — offer Financial Services Compensation Scheme (FSCS) protection up to £85,000 if the firm fails. Pepperstone Limited (FCA 684312), IG Markets Limited (FCA 944492) and IG Index Limited (FCA 114059), Exness (UK) Ltd (FCA 730729), FxPro UK Limited (FCA 509956), Tickmill UK Ltd (FCA 717270), and XTB Limited (FCA 522157) are all examples of FCA-authorized entities within larger broker groups. The FCA's public register (register.fca.org.uk) lets anyone search a firm or individual by name or reference number and see its permissions, restrictions, and status in real time — the single most reliable way to confirm a UK claim is genuine.

ASIC (Australia)

The Australian Securities and Investments Commission regulates brokers serving Australian clients and, since a 2021 product intervention order, requires negative balance protection for retail OTC derivative issuers along with a 30:1 leverage cap on major forex pairs, matching the EU/UK standard. ASIC licenses (Australian Financial Services Licences, or AFSLs) are held by entities like International Capital Markets Pty Ltd (IC Markets, AFSL 335692), Pepperstone Group Limited (414530), OANDA Australia Pty Ltd (412981), IG Australia Pty Ltd (220440), Vantage Global Prime Pty Ltd (428901), FP Markets' First Prudential Markets Pty Ltd (286354), and Plus500AU Pty Ltd (417727). ASIC's register is searchable via its online services portal, and it's worth checking not just that a license exists but whether it carries any conditions, suspensions, or enforcement notices.

CySEC (Cyprus / EU)

The Cyprus Securities and Exchange Commission is the regulator most EU-facing retail brokers use to obtain a 'passportable' license valid across the European Economic Area under MiFID II. CySEC-regulated entities must follow ESMA-aligned retail protections: mandatory negative balance protection, a 30:1 leverage cap on major pairs, and participation in the Investor Compensation Fund, which covers eligible client claims up to €20,000 if a firm fails. Because CySEC licenses are comparatively achievable for firms with real compliance infrastructure but lower overhead than a full FCA authorization, it has become the default EU entity for most large multi-national brokers — IC Markets (EU) Ltd (362/18), Pepperstone EU Limited (388/20), XM's Trading Point of Financial Instruments Ltd (120/10), Exness (Cy) Ltd (178/12), XTB Limited's Cyprus entity (169/12), Tickmill Europe Ltd (278/15), FxPro Financial Services Limited (078/07), HF Markets (Europe) Ltd (183/12), Admiral Markets Cyprus Ltd (201/13), and FP Markets' First Prudential Markets Ltd (371/18) all hold CySEC licenses alongside their other regional entities.

Why one broker often holds licenses in all three

Large broker groups build a portfolio of regulatory entities so they can legally serve clients in different regions without every client falling under the same rulebook. Pepperstone alone holds FCA (684312), ASIC (414530), CySEC (388/20), DFSA in Dubai (F004356), and Bahamas SCB (SIA-F217) licenses across five separate legal entities. IC Markets splits between an ASIC entity, a CySEC entity, and a Seychelles FSA entity. This is normal industry structure, not a red flag by itself — but it means the protections you get depend entirely on which entity actually onboards you, which is usually determined automatically by your country of residence at signup.

Offshore regulators: lighter oversight, same brand name

Beyond FCA, ASIC, and CySEC sit a tier of regulators with lower capital requirements, less frequent audits, and no leverage caps or mandatory negative balance protection — common examples include the Seychelles FSA, Belize FSC, Vanuatu VFSC, Mauritius FSC, Mwali International Services Authority (MISA, Comoros), Saint Vincent and the Grenadines FSA, and the Cayman Islands CIMA. Brokers use these entities to offer higher leverage (often 500:1 or more) to clients outside the EU, UK, and Australia's stricter frameworks. RoboForex, Alpari, LiteFinance's offshore entity, and AMarkets are examples of brokers whose primary or sole regulation sits with these lighter-touch authorities rather than a tier-one regulator — which doesn't necessarily mean fraud, but does mean materially less regulatory backstop if something goes wrong.

Publicly listed brokers add another layer of scrutiny

A handful of retail brokers are publicly traded, which layers financial-market disclosure requirements on top of their regulatory licenses. Plus500 Ltd trades on the London Stock Exchange main market (LSE: PLUS) as a FTSE 250 constituent and publishes audited annual results. XTB S.A. is listed on the Warsaw Stock Exchange and, as a public company, also publishes audited financials. IG Group Holdings plc is an LSE-listed FTSE 100 constituent. Being publicly listed doesn't replace regulatory oversight, but it does mean independent auditors, exchange listing rules, and public shareholders are all watching the same balance sheet you'd be trusting with your deposit.

How to actually verify a broker's regulation

Don't take a badge or logo at face value. Instead:

• Find the exact legal entity name and license number in the broker's terms of business, not just its marketing pages
• Search that license number directly on the regulator's own public register — FCA (register.fca.org.uk), ASIC (via its online licensee search), or CySEC (its public register of Cyprus investment firms)
• Confirm the entity name matches exactly and the license is active, not expired, surrendered, or suspended
• Check which entity you'll actually be contracted with based on your country of residence — it's often a different one than the regulator most prominently advertised on the homepage

This single check — matching entity name to license number on the regulator's own site — takes under five minutes and is the most reliable filter available before depositing any money.

What regulation doesn't protect you from

Regulation covers the broker's conduct and financial soundness — segregating your funds, capping leverage, guaranteeing negative balance protection, and providing a compensation scheme if the firm itself collapses. It does not protect you from ordinary trading losses, poor strategy, or excessive leverage used within the legal limit. A fully FCA-regulated account can still be traded to zero through normal market risk; regulation reduces counterparty and firm-failure risk, not market risk. Keeping this distinction clear helps set realistic expectations before funding any account, however well-regulated the broker is.

Frequently asked questions

What's the difference between FCA, ASIC, and CySEC regulation?

All three require segregated client funds, negative balance protection for retail clients, and a 30:1 leverage cap on major forex pairs. The FCA (UK) and CySEC (Cyprus, EU-passportable) also offer compensation schemes — FSCS up to £85,000 and the Investor Compensation Fund up to €20,000 respectively — while ASIC (Australia) doesn't operate an equivalent retail compensation fund.

Is CySEC regulation as strong as FCA regulation?

CySEC applies the same EU/MiFID II retail protections as other EU regulators, including negative balance protection and leverage caps, and is a legitimate tier-one license. It's generally seen as somewhat less rigorous in enforcement than the FCA, which is why many large brokers hold both, routing clients to whichever entity matches their country.

Why does the same broker have different rules for different countries?

Broker groups operate multiple separately licensed legal entities to serve different regions, and each entity is bound only by its own regulator. Which entity actually contracts with you is usually decided automatically by your country of residence at signup, and the protections differ between entities even under the same brand.

Are offshore-regulated brokers unsafe?

Not automatically, but offshore regulators like the Seychelles FSA, Belize FSC, or Vanuatu VFSC have lower capital requirements, less frequent audits, and typically no mandatory negative balance protection or leverage caps. They offer meaningfully less recourse than the FCA, ASIC, or CySEC if a dispute or insolvency occurs.

How do I check if a broker's regulatory license is genuine?

Get the exact legal entity name and license number from the broker's terms of business, then search that number directly on the regulator's own public register — the FCA register, ASIC's licensee search, or CySEC's investment firm list — and confirm the entity name matches exactly and the license is active.

Does a publicly listed broker mean it's better regulated?

Being listed on a stock exchange, like Plus500 (LSE), XTB (Warsaw Stock Exchange), or IG Group (LSE), adds audited financial disclosure and exchange listing requirements on top of regulatory licensing, which is a useful additional trust signal — but it doesn't replace or exceed the protections of the underlying regulatory license itself.