Authorisation and Supervision of Non-Credit Institutions and Credit Intermediaries providing Credit Agreements for Consumers relating to Residential Immovable Property Directive of 2018

1 CENTRAL BANK OF CYPRUS Τhe Authorisation and Supervision of Non-Credit Institutions and Credit Intermediaries providing Credit Agreements for Consumers relating to Residential Immovable Property Directive of 2018 This translation of the Directive is unofficial. It has been prepared by the Central Bank of Cyprus for information purposes. The Central Bank of Cyprus shall not be responsible for its content. The official text is in the Greek language.

2 CREDIT AGREEMENTS FOR CONSUMERS RELATING TO RESIDENTIAL IMMOVABLE PROPERTY LAWS OF 2017 (Directive under sections 29(2)(b)(iii), 34A(3), 34A(4)(b) and (c) and 54) 41(I)/2017 149(I)/2017. Official Journal of the EU.: L60, 28.2.2014, p. 34. The Central Bank of Cyprus (Central Bank) in exercise of the powers granted to it in accordance with the provisions of sections 29(2)(b)(iii), 34A(3), 34A(4)(b) and (c) and 54 of the Credit Agreements for Consumers relating to Residential Immovable Property Laws of 2017 (hereinafter “Law”) issues this Directive for the purposes of harmonisation with point (b) of paragraph (2) of section 29 and section 35 of the European Union act titled “Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010”. INDEX PART I TITLE, PURPOSE, SCOPE OF APPLICATION AND INTERPRETATION

1. Short title
2. Purpose of the Directive
3. Scope of Application
4. Interpretation PART II AUTHORISATION OF A NON CREDIT INSTITUTION
5. Submission of a non-credit institution’s application for authorisation
6. Assessment of a non-credit institution’s application for authorisation by the Central Bank
7. Authorisation of a non-credit institution
8. Withdrawal of a non-credit institution’s authorisation
9. Suspension of a non-credit institution's authorisation and deadline for compliance PART III SUPERVISION OF NON-CREDIT INSTITUTIONS
10. Supervisory powers of the Central Bank for non-credit institutions
11. Minimum capital requirement
12. Approval of shareholders and directors
13. Evaluation of a non-credit institution’s management body
14. Governance
15. Credit Register
16. Restructurings
17. Information to the Central Bank PART IV AUTHORISATION OF CREDIT INTERMEDIARIES
18. Application for authorisation of credit intermediaries
19. Authorisation of credit intermediaries PART V SUPERVISION OF CREDIT INTERMEDIARIES
20. Supervisory powers of the Central Bank for credit intermediaries
21. Approval of shareholders and directors
22. Assessment of credit intermediaries' fitness and probity
23. Information to the Central Bank by credit intermediaries
24. Entry into force

3 PART I TITLE, PURPOSE, SCOPE AND INTERPRETATION Short title. 1. This Directive shall be referred to as the Authorisation and Supervision of Non-Credit Institutions and Credit Intermediaries providing Credit Agreements for Consumers relating to Residential Immovable Property Directive of 2018. Purpose of the Directive. 2. The purpose of this Directive is- (a) to lay down the procedure for authorisation of a non-credit institution by the Central Bank; (b) to determine the procedure for suspension or withdrawal of the authorisation granted by the Central Bank to a non-credit institution; (c) to determine the supervisory framework of the activities of non-credit institutions by the Central Bank; (d) to determine the authorisation procedure by the Central Bank regarding the operation of a credit intermediary; (e) to determine the scope of supervision by the Central Bank regarding the activities of credit intermediaries; Scope. 3. This Directive applies to entities that carry out the activities defined in the Law and which are - (a) non-credit institutions, or (b) credit intermediaries. Interpretation. 4.(1) For the purposes of this Directive, the definitions in section 2 of the Law shall apply, unless the context otherwise requires and, in addition, the following definitions shall apply unless the context otherwise requires; "Applicant company" means a legal person applying to the Central Bank for authorisation to operate as a non-credit institution; "Outsourcing" means the use of a third person for the carrying out of services or activities which the non￾credit institution would otherwise perform at this stage or in the future and does not include the purchase of goods or services; "Purchase of goods or services" means the- (i) acquisition of standard products or services, such as information on current prices and the purchase of commodities and other goods and consumables; and (ii) obtaining consulting and other services that are not part of the non-credit institution's business activities, including legal advice;

4 Official Journal of the EU: L176 of 26th June 2013, p.1. “qualifying holding” has the meaning assigned to it at point 36 of paragraph 1 of article 4 of the Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26th June 2013 on the prudential requirements for credit institutions and investment firms and amending Regulation (EU) No. 648/2012; (2) In this Directive, any reference to a Directive, Regulation, Decision or other legislative act of the European Union means that act, as amended, modified or replaced, unless the text gives a different meaning. (3) In this Directive, any reference to a Law or administrative regulatory act of the Republic of Cyprus means the said Law or administrative regulatory act as amended, modified or replaced, unless the text gives a different meaning. PART II AUTHORISATION OF A NON-CREDIT INSTITUTION Submission of an application for authorisation to operate as a non￾credit institution. 5. (1) Any legal person wishing to obtain authorisation as a non-credit institution as defined by the Law, is required to submit to the Central Bank a relevant application for authorisation based on a model published on the Central Bank's website. (2) An application for authorisation as a non-credit institution's authorization should be accompanied by - (a) The documents referred to in points (a) to (e) of subsection (5) of section 34A of the Law and furthermore

(i) the founding document and the articles of association of the applicant company provided for in section 34A (5) (a) of the Law should include a provision which explicitly prohibits the issuance of bearer shares; (ii) correctly completed and signed personal or corporate questionnaire of the shareholders referred to in section 34A (5) (b) of the Law, based on templates published on the Central Bank's website, so that the Central Bank is satisfied that the shareholders in question have a good reputation and additionally satisfy the following fitness and probity criteria: (aa) they have a clean police record, (bb) they have not been declared bankrupt in the past, unless they have been re-established in accordance with the relevant legislation, (cc) have the financial soundness corresponding to the type of activities envisaged to be exercised by the non-credit institution, and 188(Ι) of 2007 58(Ι) of 2010 80(Ι) of 2012 192(Ι) of 2012 101(Ι) of 2013 188(Ι) of 2014 18(Ι) of 2016. (dd) there is no reasonable suspicion that, in relation to their participation in the applicant company, money laundering or terrorist financing is being or has been committed or attempted within the meaning of sections 4 or 5 of the Prevention and Suppression Of Money Laundering And Terrorist Financing Laws Of 2007 to 2016, or that there is an increased risk of such an act;

5 (iii) for each of the members of the management body of the applicant company referred to in section 34A (5) (c) of the Law, the personal questionnaire, duly completed and signed based on relevant templates posted on the Central Bank's website, so that the Central Bank is satisfied that such members have a good reputation, sufficient knowledge, skills and experience to exercise their duties and that they meet, mutatis mutandis, the criteria of fitness and probity as defined in the Directive on the Assessment of the Fitness and Probity of the Members of the Management Body and Managers of Authorised Credit Institutions of 2014; (iv) description of the responsibilities of each sector of the organisational structure under section 34A (5) (d) of the Law, so that the Central Bank is satisfied that, the non-credit institution has robust governance arrangements for its payment services business, provided for in the Law, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective procedures to identify, manage, monitor and report the risks to which it is or might be exposed, and adequate internal control mechanisms, including sound administrative and accounting procedures; those arrangements, procedures and mechanisms shall be comprehensive and proportionate to the nature, scale and complexity of its activities; (v) description of the credit products to be provided in the programme of operations under section 34A (5) (e) of the Law, including the forms of collateral and insurance required from the consumer as well as the advisory or other services that may be provided; (b) the following documents which the Central Bank considers important for the assessment of the application for authorisation of a non-credit institution which it requires under point (f) of subsection (5) of section 34A of the Law - (i) If the applicant company adopts and applies remuneration policies for the staff responsible for the creditworthiness assessment, the policy to be followed by the applicant company in relation to the remuneration or other form of financial consideration towards the members of its staff and the credit intermediaries and an analysis of how this policy is in conformity with subsections (3) and (4) of section 7 of the Law; (ii) if the applicant company requires consumers to make payments under point (a) of subsection (7) of section (7) of the Law, the description of the policy followed by the applicant company when imposing charges on the consumer prior to the conclusion of the credit agreement and after the conclusion of the agreement; (iii) copies of the contracts that the applicant company intends to conclude when assigning works to third parties, a list of the names of the tied and / or non-tied credit intermediaries with which it intends to cooperate, where these have been determined, and full details of the terms of their cooperation; (iv) a business plan with a budget forecast for both the baseline and the stress scenario for the first three financial years of the applicant company's operation which demonstrates that the applicant company will have the necessary resources to employ systems and procedures that are appropriate and proportionate to its activities , in order to ensure its sound operation; (v) comprehensive information in relation to the calculation of the cost of the investment and the origin of its funding; (vi) a description of the accounting system, the IT system and the management information system; (vii) a description of the procedures for the handling and monitoring of the complaints of the applicant company's customers; (viii) a description of the systems that will be implemented for the collection of statistical and supervisory data; (ix) a description of the internal control mechanisms including mechanisms to ensure compliance with the requirements of the Prevention and Suppression of Money Laundering Activities Laws of 2007 to 2016;

6 (x) the address of the applicant company’s head office as well as the contact details of the responsible officers; (xi) confirmation by an independent audit firm that the applicant company has the minimum initial capital required under paragraph (f) of subsection (4) of section 34A of the Law. If a shareholder does not wish to proceed with the payment of the minimum initial capital attributable to him before the application is approved, a confirmation from a credit institution operating in a Member State of the European Union that an amount equal to the amount of the initial capital shall remain committed throughout the assessment of the application and that the applicant company will be in a position to have the required share capital when approving its application; (3) The application for authorisation is accompanied by the original documents or where this is not possible, true copies. (4) The applicant company must authorise an appropriate person for the submission of the application and the details accompanying the application, as well as for any communication required with the Central Bank's officials for the purpose of the assessment of the application. Assessment by the Central Bank of an application for authorisation to operate as a non￾credit institution. 6. (1) In assessing the application for authorisation of a non-credit institution, the Central Bank may request the applicant company to submit any additional information and / or clarification and / or records and / or documents which the Central Bank deems necessary for the completion of the assessment of the application. (2) The Central Bank may request the additional information referred to in subparagraph (1) in writing by sending a relevant letter by post or by electronic mail. The applicant company must respond as soon as possible within the time frame set by the Central Bank for a specific request. If the applicant company does not submit the required additional information referred to in sub-paragraph (1) within the time period specified by the Central Bank, the Central Bank shall proceed with the assessment of the application on the basis of the data already submitted. (3) The Central Bank may, prior to granting authorisation with or without conditions as provided for in paragraph 9 of section 34A, consult with other competent public or supervisory authorities inside and outside the Republic, if it deems appropriate. (4) Should any change be made to the details of the application submitted to the Central Bank, the applicant company must notify the change in writing to the Central Bank, without any delay. Authorisation of a non-credit institution. 7. (1) The Central Bank, once fully satisfied that the applicant company complies with the provisions of the Law and this Directive, grants authorization to a non-credit institution with or without conditions as provided for in paragraph 9 of section 34A of the Law. (2) Any non-credit institution authorised by the Central Bank must maintain its registered office and head office in the Republic. (3) Any non-credit institution authorised by the Central Bank shall provide the Central Bank with the information required in order to be able to monitor on a continuous basis its compliance with the conditions set out in this section, the provisions of the Law and the Directives issued pursuant thereto.

7 (4) The Central Bank may amend any of the conditions imposed on a non-credit institution's authorisation, pursuant to section 34A (10) of the Law, on a permanent or temporary basis in the following cases - (a) where there is a change in the data on which it assessed the application; (b) when it is established that the non-credit institution omits or fails to comply with the terms of its authorisation or the provisions of the Law; (c) when the legal or regulatory framework governing the operation of the non-credit institution is amended. Withdrawal of a non￾credit institution’s authorisation 8. The Central Bank may withdraw the authorisation of a non-credit institution when the non-credit institution- (a) has not made use of the authorisation within the first 12 months of its granting, expressly renounces its authorisation or has not exercised activities of a non-credit institution for a period longer than six (6) months, unless the Central Bank has laid down a condition that in such cases the authorisation ceases to apply; or (b) has obtained authorisation on the basis of false and / or misleading information and / or information and / or by other irregular means and / or has submitted and / or disclosed and / or otherwise published in any way false and / or misleading information and / or false and / or misleading data and / or documents; or (c) no longer fulfils the conditions under which its authorisation was granted and / or fails to inform the Central Bank of any significant developments in this respect; or (d) would be a threat to stability or to the confidence in financial stability, if it continued to provide its credit related operations. Suspension of a non￾credit institution's authorisation and deadline for compliance. 9. The Central Bank, instead of withdrawing the authorisation, or immediately upon the commencement of the withdrawal procedure, may suspend wholly or partially the authorisation of a non-credit institution while setting a deadline for compliance with the Law and the directives issued thereunder, after which, the authorisation shall be withdrawn. PART III SUPERVISION OF NON-CREDIT INSTITUTIONS Supervisory powers of the Central Bank for non-credit institutions. 10. (1) The Central Bank supervises non-credit institutions to ensure that they comply with the requirements of the Law for which it has been designated as competent authority. (2) Non-credit institutions, if required by the Central Bank, shall allow duly authorised Central Bank officers or qualified persons who have been appointed or authorised for this purpose by the Central Bank to enter their premises and examine their functions and activities, and are required to provide them with all the books, documents or records and information necessary for the conduct of their supervisory activities. (3) Qualified persons referred to in subparagraph (2) shall be subject to the same confidentiality obligations as those of the Central Bank's officers. (4) Any non-credit institution, senior management and members of its management body shall be required, when requested by the Central Bank, to make available to it information, documents or data relating to the non-credit institution they hold or have under their control and to come to the venue of the Central Bank's business if it so requires. (5) The Central Bank may entrust verifications or investigations to approved auditors whose costs the non￾credit institution is obliged to pay. Minimum capital requirement. 11. The non-credit institution shall at all times maintain own funds which shall not be less than the minimum capital required under paragraph (f) of subsection (4) of section 34A of the Law. Own funds are defined on the basis of the International Accounting Standards as they are applied for the purpose of preparing audited financial statements of companies. Approval of shareholders and directors. 12. The Central Bank in the event of disclosure of the appointment of a new member of the management body or the acquisition by a person, directly or indirectly, of a qualifying holding in a non-credit institution, or disclosure by an existing shareholder to further increase such qualifying holding so that the proportion of

8 the voting rights or the shareholding exceeds twenty percent (20%), thirty percent (30%) or fifty percent (50%), shall evaluate the proposed member or shareholder within three months of the date that the application is completed, and in any case the decision shall be issued within six (6) months from the date of receipt of the notification. The proposed new members of the management body as well as the shareholders who intend to hold or further increase their qualifying holding, shall complete and submit to the Central Bank the personal or corporate questionnaire based on templates published on the Central Bank's website: It is provided that no person may hold a qualifying holding in a non-credit institution or act as a director without the prior written consent of the Central Bank: It is further understood that the Central Bank shall not approve the acquisition of a qualifying holding in a non-credit institution by a person who is not of good repute or does not fulfil any of the fitness and probity criteria provided for in paragraph 5 (2) (a) (ii). Evaluation of a non￾credit institution’s management body. 13. (1) The Central Bank assesses the fitness and probity of members of the non-credit institution's management body, proportionately applying the Directive on the Assessment of the Fitness and Probity of Members of the Management Body and Managers of Authorised Credit Institutions of 2014.

9 (2) Only natural persons may act as members of the management body of a non-credit institution established in the Republic. (3) In determining whether a person is fit and proper to hold a position as a member of a management body, the Central Bank takes into account his integrity, ability and sound judgement in fulfilling the position’s requirements and whether the interests of borrowers of the non-credit institution may be threatened in any way by him holding that position. (4) The members of the management body must ensure that senior managers are fit and proper to carry out the functions and responsibilities assigned to them. (5) If, during the carrying out of its supervisory duties, the Central Bank assesses that any person is unable or unfit to act as a member of the non-credit institution's management body, it may order that such person ceases to act as a member of the management body of that non-credit institution. Governance. EU Annex III (I), 8.8.2014 N. 4808 R.A.A. 375/2014. 14. (1) Each non-credit institution must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and adequate internal control mechanisms, including sound administrative and accounting procedures and remuneration policies and practices that are consistent with and promote sound and effective risk management. (2) The framework, procedures and mechanisms referred to in subparagraph (1) shall be comprehensive and proportionate to the nature, scale and complexity of the risks of the business model and the activities of the non-credit institution. (3) The Central Bank assesses the internal governance and risk management processes that non-credit institutions will implement in line with the Governance and Management Arrangements Directive of 2014, including all the provisions of this Directive on outsourcing. (4) The Central Bank, taking into account the nature, scale and complexity of the risks of the activities of the non-credit institution, may, by a letter to the non-credit institution, exempt it from specific provisions of the Governance and Management Arrangements Directive of 2014. Credit Register. Official Gazette Annex III(I) 19.6.2015: N. 4898 R.A.A. 207/2015. 15. Non-credit institutions are required to keep a credit register which they submit to the Central Bank if and when so requested. The credit register shall include the information contained in the statement attached to Annex A (Table 1) of the Directive for the Operation of a System or a Mechanism for the Exchange, Collection and Provision of Data of 2015. Restructurings. EU Annex III(I) 3.4.2015 N. 4862 R.A.A. 107/2015 16. In cases where borrowers present, or are likely to present, delays in repaying their credit, non-credit institutions apply the provisions of the Code of Conduct annexed to the Directive on Arrears Management of 2015, in order to effect mutually acceptable and sustainable restructuring solutions to the credit agreement. Information to the Central Bank. 17.(1) Each non-credit institution shall send to the Central Bank the audited financial statements of the year, including the auditor's report, no later than six months after the end of the financial year. (2) Each authorised non-credit institution shall make available to the Central Bank, if and when so requested, information regarding the level of knowledge and competence of its staff for the purpose of monitoring its compliance with the requirements of section 9 of the Law. (3) The Central Bank may require from a non-credit institution, at any time it sees fit, any other additional information deemed necessary for carrying out its supervisory tasks. PART IV AUTHORISATION OF CREDIT INTERMEDIARIES

10 Application for authorisation of credit intermediaries 18. (1) Any natural or legal person wishing to be authorised as a credit intermediary in accordance with the provisions of section 29 (1) of the Law, shall submit to the Central Bank a relevant application for authorisation based on a model published on the website of the Central Bank. (2) An application for authorisation of a credit intermediary should be accompanied by evidence regarding the requirements of section 29 (2) of the Law and, in addition, (a) if the credit intermediary is a legal person - (i) a list of the names of the natural and legal persons holding a qualifying holding in the credit intermediary, a properly completed and signed company questionnaire and a personal or corporate questionnaire for each of the natural or legal persons holding a qualifying holding in the credit intermediary based on a model published on the Central Bank website; (ii) a list of the names of the members of its management body who are responsible for the activities of a credit intermediary or the provision of counselling services under the Law and for each of the members of its management body, a properly completed and signed personal questionnaire, based on models published on the Central Bank's website; (b) if the credit intermediary is a natural person, a properly completed and signed personal questionnaire, based on the template published on the Central Bank's website; (c) the details of the non-credit institutions with which the credit intermediary works or is tied to, together with copies of the relevant agreements; (d) a copy of the professional indemnity insurance covering the territories in which the credit intermediary intends to provide services or a comparable guarantee against liability arising from professional negligence on the part of the credit intermediary and its staff; (e) if the credit intermediary is a legal person, the address of its head office and the contact details of the relevant officers and, if the credit intermediary is a natural person, the address of the place of business. (3) The credit intermediary must notify the Central Bank in writing of any change that has occurred and submit new information regarding the information submitted under subparagraphs (1) and (2). Authorisation of credit intermediaries. 19. (1) The Central Bank grants a credit intermediary authorisation, with or without conditions, only if it is satisfied with the following: (a) in case of a legal person - (i) the reputation and suitability of the shareholders holding a qualifying holding; (ii) the fitness and probity, the good repute and integrity of the members of the management body; (b) in the case of a natural person who performs duties equivalent to a credit intermediary but does not have a board of directors, the fitness and probity of that person.

11 PART V SUPERVISION OF CREDIT INTERMEDIARIES Supervisory powers of the Central Bank for credit intermediaries 20. (1) Credit intermediaries, who are directly supervised by the Central Bank in accordance with the provisions of section 34 of the Law, shall allow, when required by the Central Bank, duly authorised Central Bank officers or qualified persons who have been appointed or authorised for that purpose from the Central Bank, to enter their premises and examine their functions and activities, and the credit intermediaries are required to provide them with all the books, documents or records and information necessary for the conduct of their supervisory activities. (2) Each credit intermediary and its staff must, when asked by the Central Bank, make available to it information, documents or data held or controlled by it in relation to the activities of the credit intermediary that fall under the provisions of the Law, and to present himself or herself at the working location of the Central Bank, if so required. (3) Qualified persons appointed by the Central Bank are subject to the same confidentiality obligations as those of Central Bank officers. (4) The Central Bank may entrust audits or investigations to approved auditors whose costs are paid by the credit intermediary. Approval of shareholders and directors. 21. The Central Bank in the event of disclosure of the appointment of a new member of the management body or the acquisition by a person, directly or indirectly, of a qualifying holding in a non-credit institution, or disclosure by an existing shareholder to further increase such qualifying holding so that the proportion of the voting rights or the shareholding exceeds twenty percent (20%), thirty percent (30%) or fifty percent (50%), it shall evaluate the proposed member or shareholder within three months of the date that the application is completed, and in any case the decision shall be issued within six (6) months from the date of receipt of the notification. The proposed new members of the management body as well as the shareholders who intend to hold or further increase their qualifying holding, shall complete and submit to the Central Bank the personal or corporate questionnaire based on templates published on the Central Bank's website: It is provided that no person may hold a qualifying holding or act as director in an entity that has been authorised to act as a credit intermediary without the prior written consent of the Central Bank: Assessment of credit intermediaries' fitness and probity 22. The Central Bank assesses the fitness and probity of the credit intermediary when he is a natural person and the members of the management body when the credit intermediary is a legal person, proportionately in line with the Directive on the Assessment of the Fitness and Probity of Members of the Management Body and Managers of Authorised Credit Institutions of 2014. Information to the Central Bank. 23. (1) Each credit intermediary makes available to the Central Bank, if and when requested, the information regarding the level of knowledge and competence of its staff for the purpose of monitoring compliance with the requirements of section 9 of the Law. (2) The Central Bank may request from a credit intermediary, whenever deemed appropriate, any other additional information deemed necessary for the performance of its supervisory functions: It is provided that the Central Bank may request any information deemed necessary for the performance of its supervisory duties with respect to a tied credit intermediary, from the creditor to which it is tied. Entry into force. 24. (1) This Directive shall enter into force on the day of its publication in the Official Gazette of the Republic. Official Gazette Annex III(I) N. 5056 22.12.2017 R.A.A. 447/2017 (2) The Authorisation and Supervision of Non-Credit Institutions and Credit Intermediaries providing Credit Agreements for Consumers relating to Residential Immovable Property Directive of 2017 issued by the Central Bank for the same purposes of harmonisation with the European Union law as this Directive, shall be repealed with the entry into force of this Directive.