Yes, CySEC does require negative balance protection. They are more lenient than some other bodies but they still state clients accounts cannot go into the red.