Who supervises investment firms in Cyprus, and what happens if someone misleads them?

Law 87 designates two competent authorities. CySEC, which operates under the CySEC Law 73(I)/2009, supervises investment firms and enforces the Law generally. The Central Bank of Cyprus, which draws its powers from its own statute and from banking legislation, supervises the provisions that apply to banks providing investment services or selling structured deposits. Each works within EU directives and regulations. They cooperate closely, exchange any information essential or relevant to their functions, and work with the Cyprus supervisors of pension funds and of insurance undertakings and intermediaries. For money laundering the split is similar: the Central Bank supervises banks, CySEC supervises CIFs, and suspicious transactions are reported to MOKAS. See Who supervises firms for AML in Cyprus, and what fines can CySEC impose? and What is MOKAS and what powers does it have?.

CySEC is Cyprus's single contact point for cooperation and information exchange with other Member States. The exam material ties this role to Directive 2004/39/EC (MiFID I). Since 3 January 2018, Law 87 Article 80, mirroring MiFID II Article 79, has made CySEC the contact point for the purposes of Law 87 and MiFIR. When the Central Bank must notify another Member State's authority or ESMA, it does so through CySEC.

The exam material presents a list of powers as the Central Bank's 'in relation to CySEC'. Since Law 87 applied on 3 January 2018, the list in Article 70(2) has belonged to both authorities, on top of the powers each has under its own law. They may see any document; demand information from anyone and summon and question them; inspect on site and investigate; require existing telephone, electronic-communication and data-traffic records held by firms; require assets to be frozen or sequestrated; temporarily ban a person from professional activity; require information from auditors; appoint auditors or experts; order a practice to stop; refer matters for criminal prosecution; and take any measure needed to keep supervised persons compliant. They can also suspend trading or the marketing of products, and remove a person from a CIF's board.

CySEC can act directly, in cooperation with other authorities, by delegation, or by applying to the courts. Imprisonment is for the criminal courts, after a prosecution. Where a suspected breach may be a criminal offence, CySEC prepares a report and sends it, with the evidence, to the Attorney General; it may still impose administrative fines whatever the criminal outcome. Confidential information the authorities receive may be used only in performing their duties under Law 87 or MiFIR, and it is covered by professional secrecy.

The exam material describes a public register of everyone who acts for a CIF or for another Member State's investment firm. Since 3 January 2018, Law 87 Article 30 has required CySEC to keep a public register of tied agents established in Cyprus. It covers tied agents established here whether they act for a CIF or for another Member State's investment firm. CySEC enters a tied agent only if it is of sufficiently good repute and has appropriate general, commercial and professional knowledge and competence. The register is updated regularly and open to the public. A CIF may appoint only tied agents entered in the Cyprus register or in another Member State's register. The appointing firm's duties are covered in What are the rules for tied agents, eligible counterparties and crowdfunding?.

Anyone who must, under Law 87, its directives or MiFIR, submit or notify information, data, documents or forms to CySEC or the Central Bank, or make them public or announce them, must ensure they are correct, complete and accurate. Giving false or misleading material, or withholding material information, in any application, notification or other procedure under those rules is prohibited.

A breach is a criminal offence. On conviction a court may impose imprisonment of up to five years, a fine, or both. When a company commits the offence, the members of its board and of its management, supervisory or audit bodies are also criminally liable, but only if it is proved that they consented to it or took part in it. They answer for damage caused to third parties together with the company, or separately. The same breach is also an administrative infringement: CySEC or the Central Bank may impose an administrative fine under Article 71(8). The criminal fine can reach €700,000; the administrative fine is capped at €350,000, or €700,000 if the breach is repeated or continues. For a comparable two-track regime, see What sanctions apply to market abuse in the EU and in Cyprus?.