What must CySEC do as supervisor, and how does it work with other authorities?

CySEC authorises and supervises CIFs, deciding within 6 months of a complete application; see How does a firm become a Cypriot Investment Firm, and what must it keep doing?. It keeps a public register of every CIF and its authorised services, updates it regularly, and notifies ESMA of every authorisation and every revocation. It may withdraw an authorisation or suspend it in whole or in part; see When can CySEC suspend or withdraw a CIF's authorisation, and what happens to clients?.

Before authorising, CySEC must know the direct or indirect shareholders or members with qualifying holdings and the size of their holdings. It refuses if it is not satisfied that they are suitable, given the need for sound and prudent management, and close links must not obstruct supervision. The exam material speaks of all shareholders and says rejections are reported to ESMA. Law 87, in force since 3 January 2018, requires CySEC to identify only holders of qualifying holdings. Its duties to notify ESMA cover authorisations and revocations, not rejections.

CySEC also reviews the arrangements, strategies, processes and mechanisms CIFs use to comply, and evaluates their risks. The exam material says this happens at least annually. Since 5 November 2021, Law 165(I)/2021, transposing the Investment Firms Directive, has let CySEC set the frequency and intensity by the firm's size, nature, scale, complexity and, where relevant, systemic importance; for small and non-interconnected firms it decides case by case whether to review at all. Law 97(I)/2021 requires at least annual updates only for firms still under the Capital Requirements Regulation that are in the supervisory examination programme.

CySEC and the Central Bank must cooperate with other Member States' authorities whenever needed. They assist them, exchange information and cooperate in investigations and supervision, even where the conduct is not a breach of Cyprus law. Contact points pass on the information needed immediately, and a sender may restrict further disclosure.

If CySEC has good reason to suspect that entities it does not supervise are breaching Law 87, MiFID II or MiFIR in another Member State, it notifies that state's authority and ESMA, as specifically as it can. On receiving such a notice, CySEC acts and tells the notifying authority and ESMA the outcome and, where possible, significant interim developments.

Asked for an on-site check or investigation, CySEC carries it out itself, lets the requesting authority do so, or lets auditors or experts do so. It has no general power to inspect firms elsewhere in the EU. The exception is a CIF's own branch in another Member State, which CySEC may inspect after informing that state's authority. Where a CIF trades as a remote member on a regulated market elsewhere in the EU, that market's authority may deal with it directly; in the reverse case CySEC may do the same and informs the firm's home authority. The exam material adds that ESMA may take part in supervisory work, including joint on-site checks by two or more authorities. That rule is in MiFID II Article 80(2), which has applied since 3 January 2018, and in Article 21 of the regulation establishing ESMA. Law 87 does not repeat it.

Professional secrecy does not stop CySEC passing confidential information to the European Systemic Risk Board, ESMA, the Central Bank of Cyprus, other Member States' central banks, the ESCB and the ECB as monetary authorities, and, where appropriate, overseers of payment and settlement systems. Recipients must keep it confidential; the media and the public never receive it.

The exam material lists three grounds for refusal: a threat to the Republic's sovereignty, security or public order; court proceedings already under way; and a final judgment already given. Since 3 January 2018, Law 87 Article 84, transposing MiFID II Article 83, has allowed CySEC to refuse a request from another EU authority only where judicial proceedings have already begun, or a final judgment has already been given, in Cyprus for the same actions and against the same persons. It must then inform the requesting authority and ESMA, giving as much detail as it can. Law 87 has no sovereignty ground. It remains in the CySEC Law, which covers requests from foreign supervisors generally.

CySEC gives ESMA the information it needs without undue delay. Every year it sends aggregated data on all sanctions and measures. It also tells ESMA of each sanction when it publishes it, and of any sanction it decides not to publish, with any appeal and its outcome. The exam material says CySEC reports complaints and remedial procedures to ESMA; since 3 January 2018, Law 87 Article 76 has required notice of the out-of-court complaint and redress procedures, not of individual complaints. As host authority, if a passporting firm persists in clearly harmful conduct despite the home authority's measures, CySEC informs that authority, takes its own measures, informs the Commission and ESMA, and may refer the case to ESMA. The exam material also says CIFs' difficulties in third countries are reported to the Commission; Law 87, in force since 3 January 2018, has no such rule.