When can CySEC suspend or withdraw a CIF's authorisation, and what happens to clients?

Law 87 lists the grounds. Three are about inactivity or choice: the firm has not used its authorisation within twelve months of receiving it, it has expressly given it up, or it has provided no investment services and carried on no investment activities for the preceding six months. The others are about fitness: the authorisation was obtained through false statements or other irregular means, the firm no longer meets the conditions on which it was granted (including the prudential rules of Regulation (EU) 2019/2033), it has committed serious and systematic breaches of the rules, or another Cypriot law provides for withdrawal. CySEC notifies every withdrawal to ESMA.

The same twelve-month and six-month tests apply to regulated markets, covered in How is a regulated market authorised and supervised, and when must it alert CySEC?

Suspension is an administrative measure, used when a firm breaches Law 87, MiFIR, the AML/CFT Law or the acts made under them. It can cover the whole authorisation or only part of it, and it also reaches third-country firms operating a branch in Cyprus. The firm must show CySEC, within the deadline set, that it now complies. If CySEC is satisfied it lifts the suspension; if it is not, or the firm stays silent, CySEC may withdraw the authorisation immediately, without further notice or procedure.

Where CySEC suspects non-compliance that could put clients or investors at risk or threaten the orderly operation and integrity of the market, it may suspend the authorisation at once. That decision is taken by CySEC's Chairman or Vice-Chairman, who inform CySEC at its next board meeting.

While suspended, and unless CySEC decides otherwise, the firm may not provide investment services, enter into business with anyone or accept new clients, or advertise itself as an investment firm, and it must post a notice about the suspension on all its websites. If existing clients wish, it may still complete their pending transactions and return their money and instruments.

A firm that renounces its authorisation tells CySEC in writing, giving its reasons and a reasonable timetable, and returns its original authorisations. It must then announce the closure on its websites and explain the procedure to clients, inform every client individually, return every client's money and instruments together with any profits, pay what it owes, CySEC included, deal with all client complaints, provide only the services strictly needed to complete pending transactions, and keep a functioning office with staff, including at least one director or senior manager. The same duties apply when CySEC withdraws an authorisation on its own initiative, and the firm stays under CySEC supervision until everything is done.

If CySEC considers clients' interests at risk, it may require an escrow account run by an appointed person to repay clients; any shortfall comes from the firm's own funds, and CySEC may demand extra money for future claims. Money that still cannot be returned is paid into a bank account of the Investor Compensation Fund. When CySEC is satisfied, supported by an auditor's confirmation, it revokes the authorisation and updates the register, and the former firm must remove every reference to its investment services and its CySEC licence. CySEC may also require records to be kept for up to two years beyond the usual five.

The exam material also mentions CySEC's right to apply to court for the firm's liquidation. That paragraph was deleted from the CySEC directive on 11 November 2022.