CIFs and Banks

53 free CySEC Basic Chapter 3 flashcards. Tap a card to flip, or use the arrow keys to move through the deck.

Card 1 of 53Organisational requirements

1 / 53

Tap the card to flip · use ← → arrow keys to navigate

Know the numbers? Now learn the why.Read the Investor Protection and Conduct of Business study notes: short answers, key numbers and the law behind each rule.

What organisation, risk management and internal audit must an investment firm have?
What must an investment firm's compliance function do, and how independent must it be?
What must an investment firm record of telephone calls and electronic communications?

Ready to test yourself? 10 free CySEC Basic questions

All 53 cards in this deck

Organisational requirements

How must a CIF specify its reporting lines and the allocation of functions?: Clearly and in a documented manner at all times — not merely verbally or on request from CySEC. The organisational structure must always exist in writing.
What must a firm take into account when meeting its organisational requirements?: The nature, scale and complexity of its business and the nature and range of investment services and activities it provides — the proportionality principle. A small boutique and a large bank carry different obligations.
What are the three systems-and-procedures requirements under the organisational rules?: Safeguarding the security, integrity and confidentiality of information; business continuity (preserving essential data and functions, with timely recovery after interruption); and delivering timely financial reports that give a true and fair view.
What training must a newly hired employee of a CIF receive?: Induction training on the firm's own procedures and obligations, regardless of prior experience at another firm. Each firm has its own procedures, so awareness of them is a core requirement.

Compliance function

What are the responsibilities of a CIF's compliance function?: Monitor compliance on a permanent basis; advise and assist relevant persons in meeting their MiFID obligations; report to the management body (annually and ad-hoc); and monitor the handling of complaints. It advises — it does not issue binding front-office instructions.
Who is responsible for appointing and replacing the Compliance Officer of a CIF?: The management body (Board of Directors), not the CEO acting alone. This gives the Compliance Officer sufficient authority and independence, with the board directly accountable.
When must the compliance function report to the management body on an ad-hoc basis?: When it detects a significant risk that the firm will fail to comply with its obligations. This is separate from the annual report and alerts the board immediately to serious regulatory risks.
What condition secures the independence of the compliance function?: Relevant persons in compliance must not be involved in the activities they monitor, and their remuneration must not compromise (or be likely to compromise) their objectivity.
What must a Compliance Officer of a CIF possess?: Knowledge of the applicable law and relevant experience in applying it; academic qualifications alone are not enough. In Cyprus the regulatory compliance officer of a CIF must also have passed CySEC's Advanced examination and be on CySEC's public register.
What must happen when senior management significantly reduces the compliance budget?: The reduction must be documented in writing with detailed explanations, creating an audit trail. The Compliance Officer's prior approval is not required, but the decision must be formally justified.

Recording & durable medium

In what form must a CIF's policy for recording telephone and electronic communications be set out?: In writing, appropriate to the size, organisation and complexity of the firm, and reviewed on a periodic basis. A verbal policy provides no audit trail and does not satisfy the requirement.
For how long must recordings be retained and made available to clients on request?: Five years as the default, which CySEC may extend to a maximum of seven years. The five-year period must be communicated to clients.
When must a firm inform a client that conversations are being recorded?: Prior to providing investment services relating to the receipt, transmission and execution of orders. The notification is proactive, not a response to a client request.
When is email an acceptable durable medium for client communications?: Original rule (Delegated Regulation 2017/565, Article 3(3)): where there is evidence that the client has regular access to the internet, and an email address the client gives for the business counts as such evidence; the exam material does not cover this point. Since 28 February 2022: information is provided electronically by default, and retail clients may ask for paper free of charge.

Outsourcing

When a CIF outsources a critical or important function, who remains responsible for it?: The firm's senior management — responsibility cannot be delegated. A firm can outsource the activity but not the accountability or its licence.
Name functions explicitly excluded from the definition of 'critical or important' for outsourcing.: Legal advice, training of personnel, billing services, physical security, and standardised services such as market-information services and price feeds.
What conditions apply when outsourcing portfolio management to a third-country provider?: The provider must be authorised and supervised in its home country, and a cooperation agreement must exist between CySEC and that country's supervisory authority to allow regulatory access.
Under what condition may a service provider sub-outsource an outsourced function?: Only with the investment firm's explicit written consent. This preserves the firm's control over its supply chain.
What oversight rights must the written outsourcing agreement preserve for the firm?: Rights of instruction and termination, information rights, and rights of inspection and access to the service provider's books and premises. Without access rights, effective supervision is impossible.
When may a firm terminate an outsourcing arrangement with immediate effect?: When immediate termination is in the interests of its clients — for example where the provider's conduct harms clients. Client protection is the trigger, not commercial considerations.

Safeguarding client assets

When must a CIF inform a client that safekeeping of client assets is outsourced?: Whenever the service is outsourced, regardless of location. Location affects the additional warnings required, but the basic duty to inform is universal.
What must a client be told when their funds may be held in an omnibus account by a third party?: Where the client's financial instruments may be held by a third party in an omnibus account, the client must be told so and given a prominent warning of the risks, such as difficulty in identifying individual holdings if the third party fails.
Before using client instruments in a securities financing transaction, what must the firm do?: Inform the client in advance of the terms for restitution and the risks involved. This is a pre-transaction disclosure, not a post-transaction notification.
What control must a CIF perform when safekeeping client assets?: Regular reconciliations between its internal records and the external records of third-party custodians, to detect discrepancies from errors or misuse early.

Risk management & internal audit

What must a firm do if it does not establish a formal risk management function?: Be able to demonstrate on request that its adopted policies and procedures meet the substance of a risk management function. The function can be embedded, but the substance cannot be absent.
How must the internal audit function be positioned within a CIF?: Separate and independent from all other functions and activities of the firm — including compliance and risk management. Its independence gives its findings credibility.
Which task is NOT a responsibility of the internal audit function?: Setting the firm's risk tolerance levels — that belongs to the management body and risk management function. Internal audit plans, executes, recommends and verifies compliance with its recommendations.

Conflicts of interest

Give one of the defined conflict-of-interest scenarios under MiFID II.: Where the firm is likely to make a financial gain, or avoid a financial loss, at the expense of the client. This zero-sum dynamic is the core conflict.
What is the common name for procedures that control the exchange of information between staff where it could harm clients?: A Chinese wall (information barrier). It stops, for example, a corporate finance team sharing inside information with the trading desk.
How should disclosure of a conflict of interest to a client be used?: As a measure of last resort, only when organisational and administrative measures cannot prevent damage to client interests with reasonable confidence. It is not the first line of defence.
How often must the conflicts-of-interest policy be reviewed?: At least annually. Over-reliance on disclosure instead of prevention is treated as a policy deficiency to be caught in the review.

Investment research

What distinguishes investment research from a marketing communication?: Investment research recommends or suggests an investment strategy for distribution channels or the public, is labelled or presented as investment research or as objective or independent, and would not be investment advice if given to a client. A recommendation that fails the labelling or objectivity test is a marketing communication and must say that it was not prepared under the research-independence rules.
What independence requirement applies to the issuer when a CIF disseminates investment research?: A firm producing research must not let the issuer review a draft that contains a recommendation or target price, except to check the firm's own legal compliance. A firm that only passes on another firm's research can be exempt if it does not alter it or present it as its own.

Client communications

What standards must all information addressed to clients meet regarding risk?: It must be accurate and give a fair and prominent indication of any relevant risks. The font size describing risks must be at least equal to that used for the rest of the material — risks cannot be buried in small print.
What minimum period must past-performance information cover, and in what units?: At least the preceding five years, in complete 12-month periods (or the full life of the product if shorter). This prevents cherry-picking short periods of strong performance.
On what basis must future-performance indications be presented?: On reasonable assumptions supported by objective data, showing both positive and negative scenarios in different market conditions. They may not be based on simulated past performance.

Client categorisation

What are the three client categories under MiFID II?: Retail (highest protection), professional, and eligible counterparty (lowest protection). 'Intermediate' and 'private' are not MiFID II categories.
What are the three size thresholds for a large undertaking to be a professional client?: Balance sheet total ≥ €20m, net turnover ≥ €40m, and own funds ≥ €2m. Meeting any two of the three qualifies the undertaking as professional.
What must a retail client satisfy to be treated as an elective professional client?: At least two of three: on average 10 significant transactions per quarter over the previous four quarters; a portfolio exceeding €500,000; at least one year in a professional role in the financial sector. The firm must also assess the client's expertise, and the client makes a written request, receives a written warning and confirms in a separate document.
Who is responsible for requesting reclassification from professional to non-professional treatment?: The client: a per se professional client must ask for more protection, and the firm must tell the client that this option exists. The firm may also decide on its own initiative to treat a professional client as retail.
Is an individual investment adviser employed by an investment firm automatically a professional client?: No. The employer may be professional, but the individual's personal investment capacity is assessed separately. Authorised entities, national/regional governments and central banks are automatically professional.

Information on instruments

What must the description of an instrument's risks cover, where relevant?: The risks associated with leverage and the risk of losing the entire investment, including scenarios such as issuer insolvency and bail-in.
What must a firm provide when an instrument is composed of two or more instruments or services?: An adequate description of the components and of how their interaction affects the overall investment risks, since combined risk may differ from the sum of the individual risks.

Costs & charges

How must the aggregated total of costs and charges be expressed to a client?: Both as a cash amount and as a percentage of the investment. The dual presentation gives the clearest picture of the cost impact on returns.
When must the illustration of the cumulative effect of costs on return be provided?: Both on an ex-ante basis (before the investment) and on an ex-post basis (in the annual costs report). Both timeframes are required.

Investment advice & suitability

What must a firm do if it cannot meet the criteria for independence in its selection process?: It may not present itself as providing independent investment advice. Misrepresenting non-independent advice as independent is a regulatory breach.
What must a firm do if it cannot obtain sufficient information for a suitability assessment?: It must not recommend investment services or financial instruments to the client. No information, no recommendation — assumptions do not meet the suitability standard.
When must a firm update a client's suitability information?: At a regular frequency set by the client's risk profile, and also whenever an event changes the client's circumstances (income, objectives, risk tolerance). Separately, a periodic suitability assessment, where offered, is done at least annually.
Is asking a client for written consent confirming an investment is 'suitable' compliant with CySEC's Suitability Guidelines?: No. Suitability is the firm's responsibility, not the client's to confirm; obtaining such consent improperly shifts responsibility and is specifically identified as non-compliant.

Best execution & order handling

Which venues count as execution venues where a CIF may execute client orders?: Regulated markets, MTFs, OTFs, systematic internalisers, and market makers or other liquidity providers (including equivalent third-country entities).
When must a firm review its order execution policy?: At least annually, and additionally whenever a material change occurs that affects its ability to obtain best execution — such as the closure of a major execution venue.
In what order must a firm carry out otherwise comparable client orders?: Sequentially and promptly (a time-priority rule), unless the characteristics of the order or prevailing market conditions make this impracticable, or the client's interests require otherwise.
What is required before aggregating client orders, and who has priority in a partial fill?: No client consent is needed. Aggregation must be unlikely to disadvantage any client overall, each client must be told that it may work to their disadvantage, and a fair allocation policy must be applied. Where client orders are combined with the firm's own and only partly filled, clients have priority unless the firm shows it could not otherwise have executed on such good terms.

← Chapter 3: exam weight and topics More CySEC Basic decks →