How does a firm become a Cypriot Investment Firm, and what must it keep doing?

Providing investment services to others, or carrying on investment activities, as a regular business needs CySEC's authorisation in advance. A market operator in Cyprus may also run a multilateral trading facility (MTF) or an organised trading facility (OTF), but only once CySEC has checked beforehand that it meets the same rules.

The applicant must give CySEC all the information it needs, including a programme of operations describing the planned business and the organisational structure, so that CySEC can be satisfied that every requirement of the Law will be met from the first day. CySEC looks in particular at the people who will run the firm, the shareholders with qualifying holdings, the initial capital and the internal organisation. Where the applicant belongs to a group with a financial firm authorised in another Member State, for example as the subsidiary of an investment firm, bank or insurer, CySEC consults that Member State's authority before deciding, and the two authorities cooperate on the suitability of shareholders and management.

CySEC tells the applicant within six months of a complete application whether the authorisation is granted. The period runs from the point the application is complete, not from the first submission.

The authorisation names the investment services and activities the firm may carry on, and it may add ancillary services such as safekeeping of clients' instruments or foreign exchange linked to an investment service. An authorisation is never given for ancillary services on their own. A CIF that wants to add services later applies to CySEC to extend its authorisation.

Anything outside the authorisation is forbidden, with two exceptions: the activity leads to or contributes to the provision of the authorised services, or CySEC approves it, at its discretion, in exceptional cases.

The authorisation works as a passport: it is valid in every Member State, so a CIF can provide its authorised services elsewhere in the EU through a branch or across borders, after the notification procedure. Firms licensed elsewhere in the EU can use their own passports to work in Cyprus. CySEC keeps a public register of CIFs showing the services and activities each is authorised for, and notifies every authorisation to ESMA. The exam material also expects a CIF to state on its official documents and its website that it is authorised and supervised by CySEC, with its authorisation number and, on the website, what the authorisation covers.

Authorisation is not a one-off test. A CIF must meet the conditions at all times and tell CySEC about any material change to them, while CySEC monitors compliance and may ask for any information it needs. The firm must also monitor and regularly evaluate whether its systems, internal controls and arrangements are adequate and effective, and put right any deficiencies; the exam material describes this as a regular internal review keeping the arrangements appropriate, effective, comprehensive and in proportion to the business.

A standing concern is conflicts of interest, whether between the firm (including its managers, staff and tied agents) and a client, or between two clients. The firm needs arrangements that stop conflicts from damaging clients. Only where those arrangements cannot prevent that risk with reasonable confidence must it clearly disclose to the client, before acting for them, the general nature and/or sources of the conflict and the steps taken to mitigate the risks, on a durable medium and in enough detail for the client to make an informed decision. Disclosure is a last resort, never a substitute for managing the conflict.