CySEC Advanced common mistakes
CySEC Advanced · Understand the traps and how to avoid them.
Treating MiFID II 'investment advice' as any recommendation about a financial instrument, without checking that it is personal, presented as suitable, and given to a specific client (or with the client's request in a distance channel).
Candidates memorise the list of ancillary services and the definition of investment advice from summaries, then apply a loose everyday meaning of 'advice' to scenario questions. The distinction between generic advice (which is not a MiFID service) and personal recommendation is exactly what the examiner tests.
What to do instead
For every 'is this investment advice?' item, run a three-part check: (1) is it a personal recommendation to a specific person? (2) is it presented as suitable for that person? (3) is it about a specific financial instrument or a transaction in one? If any element is missing, classify it as something else (e.g. reception and transmission of orders, or a non-MiFID generic communication) and say so explicitly in the reasoning.
Applying the product-governance and suitability rules to the wrong entity - for example, assuming an investment firm must approve the target market of a product it merely distributes, or that a manufacturer must collect the full suitability information of end clients.
The distribution chain has two distinct obligations: manufacturers identify a target market and distribute appropriately; distributors identify their own target market and use the manufacturer's information. Candidates collapse the two because both are described under 'product governance'.
What to do instead
Draw the chain before answering: manufacturer → distributor → client. Assign each obligation to the correct link, and check whether the product is manufactured for a specific client (bespoke) or for a general market. State the entity and the obligation in the answer, not just the rule.
Confusing UCITS eligibility criteria with AIF scope criteria - e.g. stating that a UCITS may hold 100% of a single issuer's debt, or that an AIF must publish a KIID because it is sold to retail investors.
Both regimes use 'eligible assets', 'diversification' and 'investor protection' language, and candidates study them side by side. The 5/10/40 rule, the 10% issuer limit, and the eligible-market requirement are UCITS-specific; AIFMD is a manager-level regime with different disclosure tools.
What to do instead
Build a two-column comparison table from the underlying directives: UCITS (eligible assets, 5/10/40, 10% single-issuer, KID/PRIIPs KID) versus AIFMD (authorisation of the manager, depositary, AIFM remuneration, annual report, investor disclosure). When a question names the vehicle, first identify the regime, then retrieve the rule from that column only.
Assuming that the AIFM's depositary is always liable for the loss of all financial instruments held in custody, without distinguishing custody assets from other assets and without considering the contractual discharge of liability.
Candidates remember 'depositary is liable for loss of assets' as a slogan and apply it uniformly. In fact the depositary's strict liability applies to financial instruments held in custody, while for other assets the standard is loss caused by negligent or intentional failure to perform its duties; liability can be contractually discharged only under strict conditions.
What to do instead
Split the answer into two asset categories: financial instruments that can be held in custody (strict liability for loss, with a possible discharge only if the depositary can prove the loss arose from an external event beyond its reasonable control) versus other assets (liability for negligent or intentional failure). Name the category before stating the liability standard.
Treating the prospectus approval and passporting process as automatic and instantaneous - e.g. saying a prospectus approved in one member state may be used in another immediately, without the notification to the host regulator.
The Prospectus Regulation's single-passport concept is often summarised as 'approval in one state works everywhere', and candidates miss the procedural step and the role of the home competent authority.
What to do instead
Memorise the sequence: home competent authority approves → issuer (or the authority, depending on the notification model) notifies the host authority → passported prospectus may be used in the host state. If a question asks about timing or who notifies whom, answer with the procedural step, not just 'passporting applies'.
Applying the market-abuse prohibitions only to regulated markets and to listed shares, ignoring that they extend to multilateral trading facilities, organised trading facilities, and to a broader set of financial instruments including derivatives and benchmark-related instruments.
The term 'market abuse' is intuitively associated with stock exchanges, and the scope provision (which instruments are covered) is a dense list that candidates skim. Scenario questions often place the conduct on an MTF or in a commodity derivative to test exactly this.
What to do instead
Before analysing the conduct, state the scope test: is the instrument admitted to trading on a regulated market, MTF or OTF, or is it a related instrument (including derivatives and instruments referencing a benchmark)? Only then apply the insider-dealing, market-manipulation or unlawful-disclosure prohibition. Write the scope sentence in your answer even when it feels obvious.
Mixing up the insider-dealing offence with the disclosure offence and with market manipulation when describing a single set of facts - e.g. labelling a person who trades on inside information as having committed 'unlawful disclosure' because they also told a colleague.
The three prohibitions often co-occur on the same facts, and candidates describe the whole story under one heading rather than separating the acts, the actors and the mental elements.
What to do instead
Use an actor-by-act grid: for each person, list what they did (dealt, disclosed, manipulated), whether they possessed inside information, and whether they knew or ought to have known it was inside information. Then assign the specific prohibition to each act. This also captures secondary liability and the 'ought to have known' standard.
Assuming a benchmark administrator is always a separate authorised entity and that all benchmarks require authorisation, rather than applying the exemption thresholds and the distinction between critical, significant and non-significant benchmarks.
The Benchmarks Regulation's scope is layered: it covers administrators of benchmarks used in the EU, with exemptions for certain central-bank, public and small-scale benchmarks, and it imposes graduated obligations by benchmark category. Candidates flatten this into 'administrators must be authorised'.
What to do instead
For each benchmark question, first classify the benchmark (critical / significant / non-significant) using the criteria, then check whether the administrator falls within an exemption, then apply the obligations appropriate to that class (governance, input data, methodology, transparency). State the classification explicitly before the obligation.
Applying a single AML risk-based approach uniformly - e.g. stating that simplified due diligence is prohibited for all high-risk situations or that enhanced due diligence always requires the same fixed measures, without distinguishing the risk factors, the PEP regime, and the timing of identification.
The AML framework is principle-based and layered (risk assessment, CDD, SDD, EDD, PEPs, ongoing monitoring), and candidates memorise individual rules without the decision tree that links them.
What to do instead
Answer AML scenarios with an explicit decision tree: (1) identify the customer and beneficial owner before or during the relationship; (2) assess risk using the prescribed factors; (3) choose SDD, standard CDD or EDD; (4) apply ongoing monitoring proportionate to risk. For PEPs, state the specific additional measures (senior management approval, source of funds/wealth, enhanced monitoring). Name the step you are applying.
Confusing the PRIIPs KID with the UCITS KIID and applying the wrong content, length or timing rules - e.g. stating that the PRIIPs KID must be a maximum of three pages but also that it follows the UCITS 'key investor information' structure, or that it must be provided only on request.
The two documents overlap historically and share a retail-investor purpose, so candidates merge their features. The PRIIPs KID has its own prescribed sections (purpose, product, what is this product, what are the risks and what could I get in return, what happens if the manufacturer is unable to pay out, how long should I hold it, how can I complain, other relevant information) and its own delivery rules.
What to do instead
Learn the PRIIPs KID section list and the delivery rule (provided in good time before the retail investor is bound, free of charge, in a durable medium or on a website under the prescribed conditions). When a question mentions a UCITS, check whether the PRIIPs KID replaces the KIID for that product and answer with the PRIIPs content and timing, not the UCITS structure.