CySEC Advanced cheat sheet

MiFID II scope: investment firms authorised in Cyprus providing investment services/activities to third parties on a professional basis; exemptions for dealing on own account, group services, and ancillary services.

Best execution (Art. 27): firms must take all sufficient steps to obtain best possible result for clients considering price, costs, speed, likelihood of execution and settlement, size, nature or other relevant considerations; execution policy must be reviewed annually.

Client categorisation: retail, professional (per se or elective), eligible counterparties; elective professional requires quantitative test (portfolio ≥ €500k, or ≥10 trades/quarter over 4 quarters) and qualitative assessment.

Suitability vs appropriateness: suitability applies to investment advice and portfolio management (know your client, risk tolerance, financial situation); appropriateness applies to non-advised complex products (knowledge and experience only).

Product governance (Art. 16a, 24): manufacturers must identify target market, undertake scenario analysis, and review product; distributors must ensure products match target market and provide sales information to manufacturers.

Inducements: third-party payments must be disclosed, must enhance service quality, and must not impair compliance with duty to act in client's best interests; inducements to independent advisers/portfolio managers are prohibited.

Passporting: MiFID II freedom of establishment (branch) or freedom of services (cross-border); host state notification via CySEC to ESMA; branch requires separate capital and governance arrangements.

Algorithmic trading: firms must have kill functionality, pre-trade controls, testing of algorithms, and notify CySEC; high-frequency trading requires authorisation as investment firm and records of orders for 5 years.

UCITS eligibility: transferable securities admitted to trading on regulated market, money market instruments, deposits ≤20%, derivatives for hedging/efficient portfolio management, and units of other UCITS/UCIs (≤10% each, ≤20% total).

UCITS diversification: ≤10% NAV in transferable securities of a single issuer (≤20% in same group); ≤20% in deposits with a single institution; ≤5% in OTC derivatives counterparty exposure (≤10% if counterparty is credit institution).

UCITS liquidity: may suspend redemption in exceptional cases; must calculate NAV at least twice a month and publish at least twice a month; redemption price may be adjusted (dilution levy) if disclosed.

AIFMD scope: AIFMs managing AIFs (including hedge funds, private equity, real estate) above thresholds (€100m with leverage, or €500m without leverage) require authorisation; below thresholds registration and lighter regime.

AIFM capital: initial capital ≥ €125,000; own funds ≥ 25% of previous year's fixed overheads (or €125k, whichever higher); additional own funds or professional indemnity insurance if assets under management exceed €250m.

Depositary: UCITS and AIFs must appoint a single depositary (credit institution or investment firm) responsible for safekeeping assets, cash monitoring, and oversight; liability for loss of assets unless external event beyond reasonable control.

Remuneration: UCITS and AIFM must have remuneration policies consistent with sound risk management, not encouraging excessive risk-taking; ESMA guidelines on sound remuneration apply to AIFMs and UCITS managers.

Cross-border marketing: UCITS passport via notification to host regulator; AIFMD passport for EU AIFMs marketing to professional investors; non-EU AIFMs subject to national private placement regimes until passport extended.

Prospectus Regulation (EU) 2017/1129: prospectus required for public offers of securities ≥ €8m (or admission to regulated market); exemptions for offers < €8m (national threshold), < 150 persons per Member State, and minimum denomination ≥ €100,000.

Prospectus summary: maximum 7 pages, must include key information on issuer, securities, risks, and offer; liability attaches to summary only if misleading, inaccurate or inconsistent with other parts.

Transparency Directive: issuers of shares admitted to regulated market must publish annual financial report within 4 months of year-end, half-yearly report within 3 months, and interim management statements (or quarterly reports) as required by national law.

Major holdings notification: acquisition or disposal of shares/voting rights reaching, exceeding or falling below 5%, 10%, 15%, 20%, 25%, 30%, 50%, 75% thresholds must be notified to issuer and CySEC within 4 trading days.

Market abuse disclosure: issuers must disclose inside information as soon as possible (Art. 17 MAR); delay permitted if disclosure would prejudice legitimate interests, no misleading effect, and confidentiality maintained; notify CySEC of delay.

Takeover bids: Cyprus Takeover Bids Law (based on EU Directive 2004/25/EC) applies to companies with registered office in Cyprus and securities admitted to trading on regulated market; mandatory bid at equitable price when control (30%) acquired.

Corporate governance: Cyprus Corporate Governance Code (CGC) applies to listed companies on a comply-or-explain basis; board composition, independent directors, audit committee, and remuneration policy requirements.

Insider lists: issuers must maintain and update insider lists (Art. 18 MAR) including all persons with access to inside information; must be provided to CySEC upon request and kept for 5 years.

Market abuse (MAR): prohibited conduct includes insider dealing (dealing on inside information), unlawful disclosure of inside information, and market manipulation (false/misleading signals, price distortion, abusive squeezes).

Inside information definition: precise, non-public information relating to financial instruments/issuers that, if made public, would likely have a significant effect on price; includes information on order book and commodity derivatives.

Market manipulation indicators: unusual trading volumes, order cancellations, layering, spoofing, wash trades, marking the close, and dissemination of false news; firms must have surveillance and STOR reporting to CySEC.

Benchmarks Regulation (BMR): administrators must be authorised/registered, have robust governance and control framework, and comply with IOSCO principles; critical benchmarks subject to enhanced oversight and mandatory contribution by supervised entities.

AML/CFT: CySEC-regulated entities must apply risk-based approach, customer due diligence (identification, verification, beneficial ownership), enhanced due diligence for PEPs and high-risk third countries, and ongoing monitoring.

Suspicious transaction reporting: obliged entities must report suspicious transactions/activity to MOKAS (Cyprus FIU) without tipping off; records kept for 5 years after end of relationship.

PRIIPs KID: retail investors must receive a Key Information Document (max 3 pages) before investment, including risk indicator (1-7), performance scenarios, costs (one-off, ongoing, incidental), and comprehension alert for complex products.

PRIIPs cost disclosure: must show total costs as reduction in yield (RIY) and summary cost indicator; ex-ante costs include entry, exit, management, transaction, and performance fees; ex-post costs reported annually.