This country-specific Q&A provides an overview to banking and finance laws and regulations that may occur in Cyprus.
This Q&A is part of the global guide to Banking & Finance. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/practice-areas/banking-finance-2nd-edition/
What are the national authorities for banking regulation, supervision and resolution in your jurisdiction?
The national authority for banking regulation, supervision and resolution in the Republic of Cyprus is the Central Bank of Cyprus (“CBC’’) . The CBC is governed by the Central Bank of Cyprus Law 2002, as amended (‘’CBC Law’’). The CBC Law specifies the main responsibilities of the CBC in relation to banking regulation in the Republic of Cyprus. Since Cyprus is part of the Eurozone since November 2014 (and as such part of the Single Supervisory Mechanism (“SSM”)), the European Central Bank (“ECB") assumed a number of tasks concerning policies relating to the prudential supervision of credit institutions established in SSM participating member states, which have been conferred on it by the Council Regulation (EU) No 1024/2013. These include the task of authorisation of credit institutions within the SSM.
Which type of activities trigger the requirement of a banking license?
According to the Business of Credit Institutions Laws of 1997 to 2018 (“Law”), a bank is prohibited from carrying out any activities other than those permitted under the banking license granted by CBC (“Banking License”). The permitted activities are as follows: accepting deposits and other repayable funds, lending, financial leasing, factoring, money transmission services, issuing and administering other means of payment including travellers’ cheques and bankers’ drafts, issuing electronic money, guarantees and commitments, money broking, safe custody services, portfolio management and advice, trading for own account or on account of customers, advice to undertakings, participation and provision of services relating to securities (“Banking Services”).
Does your regulatory regime know different licenses for different banking services?
Different licenses are not required to carry out different Banking Services. Even though there are specific laws that regulate specific banking services, such as the Payment Services Law of 2018 for payment services and the Electronic Money Law of 2012 for issuance of electronic money, a single Banking License authorises the applicant to carry out all the Banking Services.
Does a banking license automatically permit certain other activities, e.g., broker dealer activities, payment services, issuance of e-money?
The Banking Licence automatically permits the Banking Services, as elaborated in question two, other activities are not automatically covered.
Is there a “sandbox” or “license light” for specific activities?
Yes, certain banks such as Hellenic Bank and Bank of Cyprus offer a sandbox service on their websites. Such a service enables the users to conduct specific activities, such as the performance of group and multiple payments between the bank’s accounts or a bank’s account and another institution. To date, the national banks of the Republic of Cyprus do not offer a “license light” for any activity.
Are there specific restrictions with respect to the issuance or custody of crypto currencies, such as a regulatory or voluntary moratorium?
The issuance or custody of crypto currencies is not an activity that can be licensed under the Law and therefore banks cannot deal with crypto currencies. Although there are no specific restrictions under the Law with respect to the issuance or custody of crypto currencies, the Law specifically states that an Authorised Credit Institution (‘’ACI’’) shall not exercise on its own account or on a commission basis a commercial activity unless such activity is permitted as stated in question 2.
What is the general application process for bank licenses and what is the average timing?
The applicant or its authorised representative submits an application for obtaining authorisation to carry out the Banking Services to the CBC. Such an application must be accompanied by a programme of operations specifying the types of business activities planned and the organisational structure of the bank and any other related information and documents as may be required by the CBC.
The CBC will either refuse authorisation and notify the applicant of its reasoned decision within 6 months of receipt of the application, or if the application is incomplete, the CBC will request from the applicant additional information and/or documents and will notify its decision within six months of the receipt of the complete application. The CBC will conduct a preliminary check of the application and will notify the applicant of its decision within 12 months of receipt of its complete application.
According to the Law, the applicant may oppose the decision of the CBC to refuse its application by way of appeal under the Constitution.
Is mere cross-border activity permissible? If yes, what are the requirements?
Yes, cross border activity is permissible.
An ACI of another Member State, that is an ACI situated in a member state of the European Union or other state which is party to the Agreement for the European Economic Area, may carry out the activities permitted by the Banking License in the Republic of Cyprus either through the establishment of a branch or through the provision of services. In order for this cross-border activity to take place, the CBC must be notified by the competent authority of the other Member State. Then, the CBC will supervise the branch so as to indicate, if needed the conditions under which those activities shall be commenced in the Republic of Cyprus.
A branch of a third country institution is allowed to perform the activities permitted by the Banking License in the Republic of Cyprus, provided that it is entitled under the laws of that third country to carry on business of a credit institution. In order for this cross-border activity to take place, the third country institution must obtain the authorisation of the CBC.
Also, an ACI incorporated in the Republic of Cyprus may establish or maintain a branch or a representative office outside the Republic of Cyprus, provided it obtains the approval of the CBC. The CBC shall also be notified and provided with information specified in the Law, before the ACI establishes a branch within the territory of another member state.
What legal entities can operate as banks? What legal forms are generally used to operate as banks?
Companies that have been incorporated in the Republic of Cyprus under the Companies Law (CAP 113), or a credit institution that is established in another Member State, or in a third country, may be granted authorisation by the CBC.
What are the organizational requirements for banks, including with respect to corporate governance?
The organisational requirements are specified under the Directive to Credit Institutions on Governance and Management Arrangements in Credit Institutions of July 2014 (“CBC Governance Directive”). In brief, the CBC Governance Directive provides that: institutions must ensure that they have an independent member in their management who holds the position of the Chairman; a non-executive member who holds the position of the vice chairperson to carry out the role and the responsibilities of the Chairman when the latter is absent; an independent member appointed as a senior member but shall not also hold the position of the chairman; to establish committees of appropriate size, composition, structure and responsibilities to effectively carry out the role and responsibilities of the management body.
In addition, the CBC Governance Directive requires that: the management body must have a minimum of seven members and a maximum of 13 members; that 50% plus one of its members must be independent; there must be at least two executive members constituting not more than 25% of the total members of the management body and of whom one must be the chief executive officer. There must also be diversity with respect to gender, age, education, profession, in order to have a wide range of experience, independent opinions and critical challenge; the members of the management body must have the required knowledge, skills and expertise to enable the management body to understand the bank’s risks and activities.
Do any restrictions on remuneration policies apply?
In accordance with the CBC Governance Directive, the following restrictions apply on remuneration policies:
- The remuneration policy must be consistent with and endorse effective risk management. It should not encourage engaging in risk management as well as risk-taking that exceeds the level of risk which the institution can tolerate.
- The remuneration policy must be in line with the institution’s objectives, values, strategy, and interests. It should also implement measures in order to prevent conflicts of interest.
- The general principles of the remuneration policy should be adopted in the supervisory functions of the management body of the institution which should be responsible for overseeing the remuneration policy’s implementation.
- The remuneration policy’s implementation shall be reviewed at least once a year so as to ensure that it complies with the remuneration policies and procedures adopted by the management body in its supervisory function.
- The staff that in the control functions shall be independent from the business units they supervise, they should have the requisite authority, and should be remunerated in accordance with the performance of the objectives related to their functions, independent of the performance of the areas of the business they manage.
- The remuneration committee must oversee the remuneration of the senior officers in the control functions. This is done by combined nomination and remuneration committee.
- The remuneration policy distinguishes between criteria for setting basic fixed remuneration - which should mainly reflect significant professional experience and organisational responsibility - and variable remuneration - which should reflect a risk adjusted and sustainable performance as well as performance that exceeds that needed to fulfil the employee's job description as part of the terms of employment.
Has your jurisdiction implemented the Basel III framework with respect to regulatory capital? Are there any major deviations, e.g., with respect to certain categories of banks?
The Basel III framework has been transposed into the Law to the extent that it has been incorporated in EU Directive 2013/36/EU (Access to the Activity of Credit Institutions and the Prudential Supervision of Credit Institutions and Investment Firms).
Are there any requirements with respect to the leverage ratio?
Banks in the Republic of Cyprus are required to calculate their leverage ratio and report it to the CBC but there are still no particular leverage ratio requirements.
What liquidity requirements apply? Has your jurisdiction implemented the Basel III liquidity requirements, including regarding LCR and NSFR?
The Republic of Cyprus has implemented the Basel III liquidity requirements in relation to liquidity coverage ratio (‘’LCR’’), as specified in the Capital Requirements Regulation (EU) 575/2013 which is directly applicable in Cyprus. The specified liquidity requirements are:
- Banks shall hold liquid assets, the sum of the values of which covers the liquidity outflows less the liquidity inflows under stressed conditions in order to make sure that banks preserve levels of liquidity buffers that are sufficient to face any probable imbalance between liquidity outflows and inflows under highly stressed conditions over a period of thirty days. During times of stress, banks are able to use their liquid assets so as to cover their net liquidity outflows.
- Banks shall not count double liquidity inflows and liquid assets.
- Banks are able to use the abovementioned liquid assets to meet their obligations under stressed circumstances.
- Banks must maintain a minimum LCR requirement.
It is also stated under the Law that the CBC may set a minimum ratio of liquefiable assets to be held by ACIs in relation to the liabilities and other obligations of ACIs that may arise or mature within a period.
Regulation (EU) 575/2013 has not implemented the liquidity requirements regarding the net stable funding ratio (‘’NSFR’’), and it states that institutions shall observe a general funding obligation until the introduction of the NSFR.
Do banks have to publish their financial statements? Is there interim reporting and, if so, in which intervals?
Banks incorporated in the Republic of Cyprus must publish, within six months from the end of each financial year, their balance sheets and profit and loss accounts for that year, as well as the approved report of the auditor. Banks, other than those incorporated in the Republic of Cyprus, must publish their balance sheets and profit and loss accounts for each financial year covering their business as a whole, in the manner provided by the CBC.
There is no requirement under the Law for interim reporting. To the extent that a bank is subject to other regulations (for example if a listed entity the Stock Exchange Rules), then more frequent reporting or other requirements may apply.
Does consolidated supervision of a bank exist in your jurisdiction? If so, what are the consequences?
Consolidated supervision of banks exists in the Republic of Cyprus and is carried out by the CBC. Consolidated supervision is exercised when the parent undertaking of an ACI incorporated in the Republic is a parent credit institution established in another member state in relation to an ACI incorporated in the Republic of Cyprus which has a parent financial holding company or a parent mixed financial holding company Where the ACI incorporated in the Republic of Cyprus has a parent financial holding company or a parent mixed financial holding company which is a member state or which is established in the European Union, the CBC shall exercise supervision on a consolidated basis.
The consequences of carrying out a consolidated supervision are:
- Coordination of the gathering and sharing of important information in going concern and emergency situations.
- Planning and coordination the supervision of activities in going concern situations, in cooperation with the competent authorities involved.
- Planning and coordination, in cooperation with the competent authorities involved or in emergency situations the European Central Bank and other national central banks, of supervisory activities.
What reporting and/or approval requirements apply to the acquisition of shareholdings in, or control of, banks?
An acquisition of shares in the capital of an ACI established in the Republic of Cyprus by any natural or legal person individually or in concert with other persons, directly or indirectly, which results to the proportion of the voting rights or of the capital held to reach or exceed, a qualifying holding of 10% or to further increase such holding to 20%, 30% or 50% ,or so that the ACI would become its subsidiary shall give prior notice to the CBC, specifying the size of the proposed holding and the relevant information. The CBC will then examine the notification and information provided by taking into account a number of criteria specified under the provisions of the Law. The ACI also has an obligation to inform the CBC of any acquisitions or disposals of qualifying holdings in its capital that cause holdings to exceed or fall below one of the thresholds referred to above .
In addition to the above:
The ACI must disclose to the CBC in relation to any legal person who holds 5% or more of an ACI’s issued share capital the names of its ultimate beneficial owners to whom each legal person belongs to at least once a year or when such information is amended or changed. and
In accordance with the Law on Transparency Requirements (Law 190(1) 2007), the acquisition or disposal of listed shares (including those of ACIs), either listed in the Cypriot Stock Exchange (“CSE”) or in any organised market of any other EU member state, crossing directly or indirectly 5%, 10%, 15%, 20%, 25%, 30%, 50%, 75% thresholds of the total voting rights of the issuing company must be notified to the issuer, the Cypriot Securities and Exchange Commission and/or the CSE.
Does your regulatory regime impose conditions for eligible owners of banks (e.g., with respect to major participations)?
A natural or legal person who plans to acquire a proportion of voting rights or capital in an ACI which reaches or exceeds twenty percent (20%) should notify the CBC, specifying the size of the proposed holding. A natural or legal person who decides to dispose its qualifying holding in an ACI must first notify in writing in advance the CBC indicating the size of its qualified holding.
In addition to the above and in accordance with the Law on Transparency Requirements (Law 190(1) 2007), the acquisition or disposal of listed shares (including those of ACIs), either listed in the Cypriot Stock Exchange (“CSE”) or in any organised market of any other EU member state, crossing directly or indirectly 5%, 10%, 15%, 20%, 25%, 30%, 50%, 75% thresholds of the total voting rights of the issuing company must be notified to the issuer, the Cypriot Securities and Exchange Commission and/or the CSE.
Are there specific restrictions on foreign shareholdings in banks?
There are no specific restrictions on foreign shareholdings in banks.
Is there a special regime for domestic and/or globally systemically important banks?
Regarding the domestic or otherwise other systematically important institutions (‘’O-SII’’) and globally systematically important institutions (‘’G-SII’’), the CBC recognises a special regime:
- by setting the additional G-SII capital buffer that each G-SII credit institution must maintain, and
- by setting the additional O-SII capital buffer that each O-SII institution must maintain.
What are the sanctions the regulator(s) can order in the case of a violation of banking regulations?
The infringement of any provisions of the Law or any regulations or directives issued by the CBC under the said Law is an offence punishable by the following ways:
- imprisonment not exceeding 5 years
- a fine not exceeding one million Euros (€1.000.000)
- by both aforementioned ways.
In case of a continuing offence by a further fine not exceeding 5 thousand Euros (€5.000) for each day during which the offence continues.
What is the resolution regime for banks?
The resolution regime for banks is based on the Resolution of Credit Institutions and Investment Firms Law (‘’Resolution Law’’). The Resolution Law designates the CBC as the resolution authority. The resolution authority shall draw up a resolution plan for each ACI that is not part of a group subject to consolidated supervision. The resolution plan will include the actions that the CBC can take. The resolution measures that the resolution authority may apply include (a) the sale of operations measure, (b) the measure to transfer assets, rights or liabilities to a bridge institution, (c) the measure to transfer assets and rights to an asset management company, (d) the bail-in measure.
How are client’s assets and cash deposits protected?
The Law on Deposit Guarantee and Resolution of Credit Institutions and Other Institutions Scheme of 2016, modelled after the relevant EU Regulation, is meant to provide limited protection (up to €100,000 , the so-called “Deposit Guarantee”) of a bank client’s cash deposits . Thus, according to the Law an ACI may accept deposits provided that it participates in the Deposit Guarantee Scheme.
The following deposits are covered up to fifty thousand Euros (€50.000), in addition to the aforementioned amount: (a) deposits from immovable property transactions that concern private residence, (b) deposits that serve social purposes.
Does your jurisdiction know a bail-in tool in bank resolution and which liabilities are covered?
As already mentioned, the bail-in tool was first applied within the Eurozone in Cyprus in 2013. The bail-in tool is meant to cover the following liabilities :
(a) To recapitalise an ACI or a relevant person that meets the conditions for resolution to the extent sufficient to:
- restore its ability to comply with the conditions for authorisation of the entity or, where such conditions exist for the relevant person, of the relevant person and
- to continue to carry out the activities for which it is authorised under the Investment Services and Activities and Regulated Markets Law or the Business of Credit Institutions Law as applicable, and
- to sustain sufficient market confidence in the institution or relevant person;
(b) To convert to equity or reduce the principal amount of claims or debt instruments that are transferred:
- To a bridge institution with a view to providing capital for that bridge institution; or
- Under the sale of operations measure or the measure to transfer assets and rights to an asset management company.
Is there a requirement for banks to hold gone concern capital (“TLAC”)?
The Financial Stability Board's standards on Total Loss-Absorbing Capacity (‘’TLAC’’) have not yet been implemented in Cyprus. The implementation of the TLAC standards into EU law and hence into Cyprus law, is still under discussion.
In your view, what are the recent trends in bank regulation in your jurisdiction?
The implementation of the leverage ratio and TLAC standards are planned for introduction into the Republic of Cyprus. The Cyprus banking sector currently applies one of the most stringent compliance and know-your-client frameworks within the EU.
What do you believe to be the biggest threat to the success of the financial sector in your jurisdiction?
Non-performing loans (‘’NPLs’’) and international competition from less regulated financial centres as well as the restoration of trust in local banks are the biggest threats. As the International Monetary Fund (‘’IMF’’) has recently noted, “a set of legislative reforms aimed at addressing the crisis legacy of NPLs has been approved, catalyzing the cleanup of bank balance sheets. Nevertheless, challenges remain. Risks have partially been transferred to the public sector as part of the bank clean-up strategy, but high debt will remain a burden on the private sector until NPLs, which constrain investor confidence and growth prospects, are resolved”. Moreover, the application of the most stringent regulatory obligations on banks in Cyprus has not only created significant and disproportionate operational hurdles and costs for every Cyprus based business but also to the banks themselves.