What must a CIF's board and senior management do to govern the firm?

The board sets up, watches over and answers for the governance arrangements that keep the CIF run effectively and prudently, including a split of duties and measures against conflicts of interest, in a way that serves market integrity and clients' interests. It has overall responsibility for the firm: it approves and oversees the strategic objectives, the risk strategy and the internal governance, makes sure the firm's accounts and financial reporting can be trusted, backed by financial and operational controls and legal compliance, oversees public disclosures and communications, and supervises senior management effectively. The chair of the board may not also act as chief executive unless the CIF justifies it and CySEC approves.

The board also defines, approves and oversees three things: the way the firm is organised to provide its services, including the skills and resources its staff need; a policy on the services and products offered, in line with the firm's risk tolerance and its clients' characteristics and needs, with stress tests where appropriate; and a remuneration policy for the people who serve clients, designed to encourage responsible conduct and fair treatment and to avoid conflicts of interest. It monitors and periodically assesses whether these arrangements work, fixes deficiencies, and must have adequate access to the information it needs to do so. Since 2021 loans to directors and their related parties must be documented and available to CySEC.

A significant CIF must set up a nomination committee made up of board members with no executive role in the firm, unless Cypriot law gives the board no say in choosing its own members. The committee finds and recommends candidates for vacancies, weighs the board's mix of knowledge, skills, diversity and experience, describes the role and the time it needs, and sets a target for the underrepresented gender on the board with a policy to reach it; the target, the policy and how they are implemented are published.

At least once a year it assesses the board's structure, size, composition and performance, and the knowledge, skills and experience of each director and of the board as a whole, reporting and recommending changes to the board. It also reviews the policy for selecting and appointing senior management, keeps in mind that no single person or small group should dominate the board's decisions, and may use any resources it considers appropriate, including external advisers, with adequate funding.

Senior management, and the supervisory function where the firm has one, are responsible for making sure the firm complies with its MiFID obligations. They assess and periodically review how well the firm's policies, arrangements and procedures work, and act on deficiencies. When significant functions are shared among senior managers, the allocation must make clear who oversees and maintains the firm's organisational requirements, and records of that allocation are kept up to date.

Compliance, risk management and internal audit must each report to senior management in writing, frequently and at least once a year, saying whether any deficiencies found have been put right. The supervisory function, meaning the body within the firm that oversees its senior management, also receives such reports regularly.