Who supervises Cypriot banks, and how does the CBC work with other supervisors?

The Business of Credit Institutions Law (Law 66(I)/1997) is Cyprus's main banking statute; an amending law of 9 September 2013 gave it this name in place of 'the Banking Laws'. The exam material uses the title 'Laws of 1997–2016'. Since Law 84(I)/2026 was published on 21 April 2026, the collective title has run from 1997 to 2026.

The Law covers licensing, deposit-taking, the use of the word 'bank', branches, sales and mergers, qualifying holdings, managers' fitness, recovery plans, accounts and returns, supervision, cooperation and the CBC's powers. Capital ratios, liquidity and most disclosure rules sit in the directly applicable Capital Requirements Regulation (CRR). Consumer-credit contracts, payment institutions and stock-exchange listings fall under other laws.

Its key term is the authorised credit institution (ACI): a credit institution incorporated and licensed in Cyprus, or the Cyprus branch of a third-country bank. A branch of a bank from another EU or EEA state is not an ACI; it works under the EU passport and answers mainly to its home supervisor. Only ACIs, and EU banks using the passport, may take deposits or other repayable funds from the public. Only a bank may call itself a 'bank', in any language, and only a cooperative credit institution may use 'savings bank', unless the CBC gives prior written approval. A foreign bank's branch may still use the name it uses at home, with an explanatory addition if the CBC requires one.

The exam material presents the CBC as the supervisor of ACIs, the authority that approves new shareholders and the one that can revoke a licence. Since 4 November 2014 Cyprus has been part of the Single Supervisory Mechanism (SSM). The European Central Bank (ECB) now grants and withdraws the licences of all euro-area banks and decides on acquisitions of qualifying holdings in them. It also directly supervises significant banks: for example, those with assets above €30 billion, or above 20% of national GDP unless below €5 billion, and the three most significant in each participating Member State.

The CBC remains the national competent authority. It supervises less significant banks and the Cyprus branches of third-country banks, which stay outside the SSM. It receives licence applications and acquisition notices, and prepares draft decisions for the ECB. It also supervises banks' investment business (Who supervises investment firms in Cyprus, and what happens if someone misleads them?) and their anti-money-laundering controls (Who supervises firms for AML in Cyprus, and what fines can CySEC impose?).

The CBC must publish on its website the laws, regulations, directives and general guidance on prudential regulation; how it has used the options and discretions in EU law; the general criteria and methods of its supervisory review; and aggregate statistics on the prudential framework, including the number and nature of supervisory measures and penalties. The information must allow comparison between Member States, follow a common format, be updated regularly and sit at one single electronic location.

The CBC may work with, and share information with, supervisors of banks, insurers, investment firms, other financial institutions and markets, in Cyprus or in third countries, and with other Member States' authorities. Asked to verify information about an institution, it may do the checking itself or leave it to the requesting authority, to an auditor or to an expert.

The exam material says any home authority needs the CBC's consent before it inspects a branch in Cyprus. Under the Law, only a third-country authority needs the CBC's consent, given after prior consultation. The home authority of an EU bank's branch need only inform the CBC before its on-the-spot checks, and the CBC keeps its own right to inspect as host.

The exam material describes a cooperation agreement between the CBC and the EBA. Under the Law, the CBC and the EBA may each agree with third-country authorities to exchange information, provided the professional-secrecy guarantees are at least equivalent and the information serves supervisory tasks. Information that came from another Member State needs the express consent of the authority that sent it before it is disclosed, and may be used only for the purposes that authority agreed.

As consolidating supervisor of a banking group, the CBC coordinates the collection and exchange of essential information and plans supervisory activity with the other authorities, both in normal times and in emergencies; in emergencies it also involves central banks where needed. If the CBC cannot do this, or the other authorities do not cooperate enough, any of them may refer the matter to the EBA for help.