Market Abuse, Benchmarks, AML and PRIIPs (Κατάχρηση Αγοράς, Δείκτες Αναφοράς, Παρεμπόδιση Νομιμοποίησης Εσόδων και PRIIPs)
Scope
This composite domain tests the Market Abuse Regulation (EU) 596/2014, the Benchmarks Regulation (EU) 2016/1011, Cyprus AML law and the PRIIPs Regulation (EU) 1286/2014. Questions often mix conduct, disclosure and documentation.
Market abuse
MAR prohibits insider dealing, unlawful disclosure and market manipulation, including attempted manipulation and benchmark manipulation. Issuers must disclose inside information as soon as possible, subject to delayed disclosure where confidentiality is protected and investors are not misled. Insider lists and PDMR transaction notifications (within three business days) are required. Investment firms must submit suspicious transaction and order reports (STORs) to CySEC without delay when they suspect abuse. Market soundings must follow the MAR procedure.
Benchmarks and AML
Benchmark administrators need CySEC authorisation/registration, robust governance, methodology and input-data controls. Supervised entities must not use benchmarks from unauthorised administrators unless an equivalence or transitional route applies. AML is risk-based: identify and verify customers and beneficial owners (25% threshold), screen PEPs, apply enhanced due diligence to high-risk cases, monitor transactions, keep records for five years and report suspicious activity to MOKAS, not CySEC. Tipping off is prohibited.
PRIIPs
Manufacturers of packaged retail products must produce a KID before sale, maximum three pages, with a summary risk indicator (1–7), performance scenarios (stress, unfavourable, moderate, favourable), and costs in both percentage and monetary terms. The KID must be accurate, clear and not misleading, and reviewed at least annually.
Worked example
A client is a foreign politician and asks to invest €2m from an unexplained source. The firm must classify the client as a PEP, obtain senior-management approval, establish source of wealth and source of funds, apply enhanced ongoing monitoring and document the rationale. A standard CDD file is insufficient even if the client is otherwise low-risk.
Traps
STORs go to CySEC; suspicious activity reports go to MOKAS. A PEP is not automatically criminal. The PRIIPs risk indicator is not a credit rating. Delaying inside information requires conditions, not mere convenience.