ESMA Recommendations on the Supervision of Cross-Border Activities of Investment Firms

10 March 2022 - ESMA42-110-3354 Recommendations To the Cyprus Securities and Exchange Commission on the supervision of cross-border activities of investment firms

2 Table of Contents I. Scope............................................................................................................................. 3 II. Legislative references, abbreviations and definitions...................................................... 4 III. Purpose.......................................................................................................................... 5 IV. Compliance and reporting obligations............................................................................. 6 V. Recommendations on supervision of cross-border activities of investment firms............ 7

3 I. Scope Who?

1. These recommendations apply to one competent authority, the Cyprus Securities and Exchange Commission (CySEC). What?
2. These recommendations apply in relation to the supervision of the cross-border activities targeting retail clients carried out by firms under the freedom to provide investment services and activities in accordance with Article 34 of MiFID II. 1 When?
3. These recommendations apply from two months of the date of publication of the recommendations on ESMA’s website. 1 As indicated in the peer review report (ESMA42-111-5534) the peer review covered the supervision of cross￾border activities of investment firms and credit institutions targeting retail clients, under the freedom to provide investment services in accordance with Article 34 of MiFID II.

4 II. Legislative references, abbreviations and definitions Legislative references ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC2 MiFID II Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU3 CRR Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/20124 Abbreviations CySEC Cyprus Securities and Exchange Commission ESMA European Securities and Markets Authority EU European Union NCA National Competent Authority Definitions firms investment firms (as defined in Article 4(1)(1) of MiFID II) and credit institutions (as defined in Article 4(1)(1) of the CRR) when providing investment services and activities under the freedom to provide investment services in accordance with Article 34 of MiFID II peer-reviewed activities cross-border activities targeting retail clients carried out by firms under the freedom to provide investment services and activities in accordance with Article 34 of MiFID II 2 OJ L 331, 15.12.2010, p. 84. 3 OJ L 173, 12.06.2014, p. 349. 4 OJ L 176, 27.6.2013, p. 1.

5 III. Purpose 4. These recommendations are based on Article 16(1) of the ESMA Regulation and are issued in accordance with Article 30(4) of the ESMA Regulation. The objectives of these recommendations are to establish consistent, efficient and effective supervisory practices within the European System of Financial Supervision. 5. The recommendations follow the supervisory expectations laid out in the mandate of the peer review on supervision of cross-border activities of investment firms5 . The recommendations take into account the results of that peer review and the report prepared by the independent ad hoc peer review committee established to carry out the peer review in accordance with Article 30(3) of the ESMA Regulation. Given the above, ESMA considered it was not appropriate to hold a public consultation or to seek advice from the Securities and Markets Stakeholder Group. 6. The recommendations refer to several aspects of the supervisory cycle, encompassing ongoing supervision, investigations and enforcement / sanctioning. The aim of these recommendations is to ensure that CySEC puts in place a fit-for-purpose organisational framework to monitor, promote and enforce compliance by authorised firms. This should help prevent illegal and harmful behaviour by the authorised firms providing the peer-reviewed activities in other Member States and put infringements to an end effectively, as well as promote sustainably compliant behaviours. Conducting effective ongoing supervision of cross-border activities is key to achieving an adequate level of investor protection and to the well-functioning of the single market. 5 ESMA42-111-5043 of 28 January 2021, which is annexed in the Peer review report.

6 IV. Compliance and reporting obligations Status of the recommendations 7. In accordance with Article 16(3) of the ESMA Regulation, CySEC must make every effort to comply with these recommendations. 8. CySEC should comply by incorporating these recommendations into its national legal and/or supervisory frameworks as appropriate. Reporting requirements 9. Within two months of the date of publication of the recommendations on ESMA’s website, CySEC must notify ESMA whether it (i) complies, (ii) does not comply, but intends to comply, or (iii) does not comply and does not intend to comply with the recommendations. 10. In case of non-compliance, CySEC must also notify ESMA within two months of the date of publication of the recommendations on ESMA’s website of their reasons for not complying with the recommendations.

7 V. Recommendations on supervision of cross-border activities of investment firms 11. Effective supervision by NCAs of entities providing investment services and activities on a cross-border basis is of key importance to ensure that clients, especially retail, are given the adequate level of protection regardless of the jurisdiction of origin of the entities offering these services and activities. 12. Under the freedom to provide services referred to in Article 34 of MiFID II, the supervision of cross-border activities of investment firms and credit institutions rests with the NCA of the home Member State6 . V.I. Arrangements to carry out ongoing supervisory activities 13. In light of the issues observed in the peer review, CySEC should increase the resources directly dedicated7 to the entire supervisory cycle (authorisations, ongoing supervision and enforcement) of the peer-reviewed activities, to be closer to the average ratio of supervisory FTEs per supervised firms observed in the referenced peer review. This means that CySEC should enlarge its supervisory teams with around 30-40 new members.8

14. Since firms can still provide activities while new supervisory resources are recruited, CySEC should endeavour to conclude the resources increase in a reasonable amount of time and implement interim solutions, including by considering the possibility to temporarily use staff from other non-strategic or less risky areas to strengthen this key area of CySEC supervision.
15. This recommendation is made in accordance with Article 16 of the ESMA Regulation. For the purpose of this, CySEC should provide to ESMA a plan to implement the recommendation, including the timeline for the gradual recruitment of resources and the interim solution identified. 6 ‘Home Member State’ means the Member State in which the investment firm’s head / registered office is situated. 7 i.e., not including support staff. 8 considering that almost the totality of firms supervised by CySEC at the time of this peer review has notified to CySEC a passport to operate cross-border.

8 V.II. Carrying out of day-to-day supervision 16. CySEC should put in place a revised annual supervisory plan, spanning ongoing supervision, investigations and – as applicable – enforcement, to increase the supervisory work performed on firms providing the peer-reviewed activities and aiming to improve the effectiveness of CySEC’s supervision in addressing supervisory risks at an earlier stage and responding more forcefully to problems identified. In particular, this supervisory plan should lay down a concrete strategy on firms’ peer-reviewed activities aimed at ensuring (i) intense supervision of all High and Medium-High risk firms carrying out those activities, as classified by CySEC; and (ii) sustainably compliant behaviour by the firms, with an increased focus on those firms perceived as particularly problematic, which could, where necessary, involve removing the authorisation of firms exhibiting aggressive behaviours. 17. The outcome of such a plan should result in taking or requesting, in a timely way, actions commensurate to the nature and scale of risks, problems and shortcomings identified, to effectively prevent, mitigate or bring them to an end (including by taking measures - vis-à-vis firms and individuals - whose severity takes into account the repetition or continuation over time as aggravating factors). 18. The effectiveness of such a plan should be assessed over time against, inter alia, the following indicators in relation to firms’ peer-reviewed activities: (i) the number of complaints9 is significantly reduced; (ii) the number of requests received from host NCAs is significantly reduced; (iii) measures are taken taking into account the repetition or continuation over time as aggravating factors; (iv) remedial actions required from firms are effectively overseen by CySEC, not only based on observations from the firm’s internal or external auditor, but also based on own observations (e.g. review of revised firms’ files and agreements with third parties/clients, actual samples, follow-up on-site visits). 19. This recommendation is made in accordance with Article 16 of the ESMA Regulation. For the purpose of this, CySEC should provide to ESMA a plan to implement the recommendation and periodic statistics on the above indicators. 9 Considering the total number of the following types of complaints: (i) complaints received by CySEC from host NCAs; (ii) complaints received by CySEC from stakeholders (e.g. clients, investors associations, financial ombudsman etc.) other than host NCAs; and (iii) complaints received directly by supervised firms.