How does the CBC review and inspect banks, and what must it keep secret?

The CBC supervises ACIs as Cyprus's competent authority, within the SSM; for significant banks the ECB carries out the review described below. The CBC takes part in the activities of the EBA (the European Banking Authority) and in colleges of supervisors, and makes every effort to comply with EBA guidelines and recommendations. Within two months of a guideline being issued, it must confirm whether it complies or intends to; if not, it tells the EBA why. This is known as comply or explain.

In all its duties the CBC must consider the possible impact of its decisions on financial stability in the other Member States concerned, especially in emergencies, using the information available at the time.

When called on, an ACI must make available to a CBC officer its books, records, accounts and other documents, including loan files, and its liquid and other assets. The officer may be helped by suitably qualified people the CBC names, under the same duty of confidentiality. ACIs may be charged the expenses of their supervision and inspection.

On site, the CBC may request, verify and collect information, enter ACIs' offices and business premises, examine files, books, accounts, records and other documents, including computer records, and take copies. It may not touch the personal correspondence or communications of employees or associates.

What the CBC learns in supervision is confidential. It may be used only for the CBC's functions under its own Law and the banking Law, but the CBC may publish it as aggregate statistics. Current and former CBC staff, and auditors or experts acting for it, are bound by professional secrecy: confidential information may be disclosed only in summary or aggregate form that identifies no institution. The exceptions include criminal cases, civil or commercial proceedings about a bank being wound up, and exchanges with other supervisors and the EBA.

In the supervisory review and evaluation process (SREP), the CBC examines each ACI's arrangements, strategies, processes and mechanisms, applying the criteria in Annex III to the Law. It weighs the risks the ACI faces or may face, and those revealed by stress testing and, since 21 February 2025, by digital operational resilience testing. Since 7 May 2021 the Law no longer lists the risks the ACI poses to the financial system among them. It then decides whether those arrangements, the ACI's own funds and its liquidity ensure sound management and coverage of the risks.

Frequency and intensity depend on the ACI's size and systemic importance, the nature, scale and complexity of its activities, and proportionality. The exam material says every review must take place at least annually. Since 30 January 2015, when Law 5(I)/2015 transposed CRD IV, the Law has required a yearly update only for ACIs in the supervisory examination programme. The CBC adopts that programme every year for banks whose stress tests or reviews show significant risks or breaches, and for any others it chooses. CySEC runs a comparable review for investment firms (What is the SREP, how intense is it, and what does it decide?).

The review covers each ACI's interest-rate risk from activities outside its trading book. Under section 26(10) of the Law, the CBC takes measures for an ACI incorporated in Cyprus whose economic value drops by over 20% of its own funds after a sudden, unexpected interest-rate move of a size the CBC sets for all ACIs. The exam material says the special measures then apply to all ACIs. The Law has never said so: the shock is common to all, but the measures target the ACI whose value fell.

Since 7 May 2021, when Law 94(I)/2021 transposed CRD V, Annex III has added the EU's supervisory outlier tests. The CBC must use its powers at least where an ACI's economic value of equity falls by more than 15% of its Tier 1 capital under any of six supervisory shock scenarios, or its net interest income suffers a large decline under either of two. Since 14 May 2024, Delegated Regulation (EU) 2024/856 has set a large decline at more than 5% of Tier 1 capital. No action is needed if the CBC finds the ACI's management of the risk adequate and its exposure not excessive. Both tests now stand side by side in the Law.