PNYX HILL GRC ADVISORS | EUROPE
Regulatory and GRC Advisory Across Europe
From our offices in Nicosia and Athens, we advise investment firms, crypto-asset service providers (CASPs), payment and electronic-money institutions, fund managers, banks, family offices and other regulated financial-services businesses across Cyprus, Greece and the wider EU.
We determine the home jurisdiction, regulatory perimeter and authorisation pathway, then lead licensing, governance, compliance, financial crime, risk and assurance mandates through implementation, passporting and operational readiness.
An integrated view of the European
regulatory perimeter
European financial-services legislation establishes a common regulatory architecture, but authorisation, supervisory practice and local implementation remain jurisdiction-specific. We advise on the interaction between MiFID II and MiFIR, MiCA, AIFMD and UCITS, PSD2 and the developing PSD3 and PSR framework, CRD and CRR, DORA, the EU AML/CFT framework and applicable national requirements.
We determine which regime governs the proposed activities, which Member State should act as the home jurisdiction and what can be provided through passporting, a branch, local establishment or cross-border services. Particular attention is given to models combining investment services, crypto-assets, tokenisation, payments, fund management or banking, where different components may fall under different legislation or authorities.
Senior regulatory judgement,
carried through execution
Our advisory and delivery work is led as one mandate. The partner who establishes the jurisdiction, perimeter and authorisation strategy remains accountable as that position is translated into the application, governance, capital, people, policies, systems, controls and evidence required for launch and ongoing supervision.
We work from the institution’s intended business model rather than from a predetermined licence. This allows management to compare viable routes, understand the commercial and operating consequences of each and commit to an authorisation structure that can support the institution after approval.
The same discipline applies to M&A involving regulated businesses. We address regulatory due diligence, qualifying-holding and change-in-control requirements, licence continuity and post-completion governance as part of the wider transaction programme.
EUROPEAN COVERAGE
Institutions and authorisation pathways we advise
Our European practice is organised around the institutions, permissions and cross-border rights our clients require. Within these sectors, our scope extends from regulatory strategy and authorisation through compliance, financial crime, risk, internal audit and governance, including the regulatory workstreams arising from acquisitions and restructurings.
We advise investment firms, brokers, dealers, portfolio managers, investment advisers, arrangers and trading businesses on authorisation, permission scope, prudential classification, governance, conduct and cross-border distribution under MiFID II and MiFIR.
Mandates cover new investment-firm applications, licence variations, qualifying holdings, branch and passport notifications, product and client classification, safeguarding and client assets, market conduct, transaction reporting and supervisory remediation.
Principal relevance:
Cyprus Investment Firms and other EU investment firms; online and multi-asset brokers; portfolio managers; investment advisers; dealers; arrangers; market intermediaries; third-country groups establishing an EU-regulated presence.
We advise CASPs and financial institutions on MiCA authorisation, notification, qualifying holdings, governance, prudential safeguards, conduct, custody, market abuse, outsourcing, complaints, AML and operational resilience. Scope is aligned to the crypto-asset services the institution will perform and the jurisdictions in which it intends to operate.
Token and business-model classification is completed before the licence route is fixed. Where an instrument constitutes a financial instrument, e-money token, asset-referenced token or other regulated product, we map the resulting MiFID II, payments, banking or issuer requirements alongside MiCA.
Principal relevance:
Crypto-asset exchanges; brokers; custodians; wallet providers; trading platforms; transfer-service providers; portfolio managers; advisers; token issuers; tokenisation businesses; existing financial institutions entering digital assets.
We advise payment institutions, electronic money institutions, wallets, acquiring businesses, money-remittance providers and embedded-finance platforms on authorisation and operating requirements under PSD2 and the electronic-money framework, together with readiness for PSD3 and PSR.
Mandates address payment-service classification, safeguarding, own funds, governance, AML, fraud, consumer protection, agents and distributors, outsourcing, ICT, DORA, reporting and passporting across the EEA.
Principal relevance:
Payment institutions; EMIs; wallet and stored-value businesses; merchant acquirers; remittance providers; payment initiators; account-information providers; embedded-finance and cross-border payment platforms.
We advise AIFMs, UCITS management companies, self-managed funds, investment managers and fund sponsors on regulatory strategy, manager authorisation, fund establishment, delegation, governance, risk, compliance and European marketing arrangements.
The work connects the manager’s permissions and substance with the fund structure, investment strategy, target investors, service-provider model and intended distribution footprint. Passporting, national private-placement and third-country considerations are addressed before launch.
Principal relevance:
AIFMs; UCITS management companies; self-managed funds; alternative investment funds; UCITS; private-equity, venture-capital, real-estate and liquid-strategy managers; fund sponsors and investment managers.
We advise banks, credit institutions and banking groups on regulatory strategy, authorisation readiness, governance, prudential frameworks, risk management, AML, internal controls, outsourcing, DORA and supervisory remediation under the applicable national and European architecture.
Mandates are calibrated to the role of the relevant national competent authority (NCA), the ECB and the Single Supervisory Mechanism (SSM). We also advise non-EU banking groups on branch, subsidiary and cross-border operating models for entering or expanding within Europe.
Principal relevance:
Credit institutions; specialist and digital banks; banking groups; finance and lending businesses; non-EU banks establishing or changing a European presence.
We advise single- and multi-family offices, private investment companies and wealth structures on whether their activities engage MiFID II, AIFMD, fund, AML or other regulatory requirements. The analysis covers investment decision-making, group services, third-party capital, co-investment, advisory activity and cross-border arrangements.
Where authorisation is required, we establish the appropriate regulated structure. Where activities remain outside the perimeter, we define governance, delegation and control arrangements that preserve that position as the organisation develops.
Principal relevance:
Single- and multi-family offices; private investment offices; holding and investment companies; co-investment platforms; private-wealth and external-asset-management businesses.
From our Nicosia office, we advise institutions selecting Cyprus as an EU home jurisdiction and established firms undertaking authorisation, expansion, a regulated transaction or material regulatory change. Our work spans CySEC-regulated investment firms, CASPs, fund managers and funds, together with CBC-supervised banks, payment institutions and EMIs.
Cyprus mandates are built around the operating institution and its intended European reach. We align the licence, ownership, capital, board and key functions, local substance, outsourcing, technology, policies and passporting plan before the application is submitted, then carry the programme through regulatory engagement and operational launch.
Our licensed Cyprus Administrative Services Provider (ASP) capability enables us to deliver permitted corporate-administration workstreams attached to transactions and restructurings. The scope is confined to the specific administrative services recorded in the applicable authorisation.
Our Cyprus capabilities include:
-
Regulatory strategy, perimeter analysis, Cyprus jurisdiction assessment and EU passporting
-
MiFID II investment-firm authorisations, licence variations and operating-readiness programmes
-
MiCA CASP authorisations, notifications and operating-readiness programmes
-
AIFM, UCITS management-company, fund and investment-management mandates
-
CBC payment-institution, EMI, credit-institution and related approval programmes
-
Regulatory due diligence, qualifying-holding, change-in-control and licence-continuity programmes for regulated transactions
-
Entity and SPV administration, company-secretarial processes, registered-office services and governance actions within our licensed ASP scope
-
Compliance, AML, risk, DORA, governance, regulatory reporting, co-sourced functions, internal audit and non-statutory assurance, subject to applicable requirements and independence
Principal relevance:
Investment firms and online brokers; CASPs and digital-asset firms; PIs and EMIs; banks; AIFMs and UCITS management companies; fund sponsors and managers; family offices and private-investment structures; acquirers, sellers and investors in regulated businesses.
OUR GRC SERVICESIN EUROPE
Regulatory, Jurisdictional and Sector Specific Services
We advise boards and executives on regulatory perimeter, home-jurisdiction selection, licence strategy, business-model viability, new products, regulated transactions, passporting, supervisory engagement and regulatory change.
The work establishes how MiFID II, MiCA, AIFMD, UCITS, PSD2, CRD, DORA and national requirements affect the institution’s structure, permissions, capital, capabilities and operating model. For acquisitions, disposals and restructurings, we identify the regulatory conditions, approval sequence, licence-continuity risks and post-completion changes that must be resolved before execution.
We lead authorisation, licence-variation, qualifying-holding and change-in-control mandates from activity mapping and jurisdiction selection through regulatory business plans, financial projections, governance, key-person readiness, policies, submissions and regulator engagement.
Each programme is built to the evidence, substance and operational-readiness standard of the relevant NCA. For acquisitions and restructurings, we align ownership approvals, licence continuity, governance and key-person changes, completion conditions and the post-transaction operating model.
We design, remediate and operate compliance frameworks for applicants, newly authorised firms and established institutions. Scope includes compliance-risk assessment, policies, monitoring, regulatory reporting, advice, training, management information and board reporting.
Delivery ranges from targeted co-sourced work to an integrated managed service. Named appointments are undertaken only where the applicable national framework permits the arrangement and the proposed individual or provider is accepted.
We establish, remediate and test financial-crime frameworks across enterprise risk assessment, customer onboarding, CDD and EDD, sanctions and screening, transaction monitoring, suspicious-activity governance, MLRO oversight and regulatory reporting.
The framework is calibrated to the institution’s licence, products, customers, delivery channels and geographic exposure, including the EU AML/CFT architecture and relevant national requirements.
We deliver independent internal audit and non-statutory regulatory assurance across governance, compliance, AML, risk, operations, technology, outsourcing and DORA. Risk-based plans, thematic reviews, control testing and remediation validation give boards and audit committees a clear view of control effectiveness and unresolved exposure.
Every mandate is subject to an explicit assessment of eligibility, prior involvement, conflicts and independence before scope and reporting arrangements are agreed.
We design and strengthen enterprise, prudential and operational-risk frameworks, risk appetite, risk and control self-assessments (RCSAs), key risk indicators (KRIs), incident and issue management, outsourcing, third-party risk, business continuity, technology governance and operational resilience.
The framework connects board oversight and management decisions with the institution’s licence obligations, capital position, critical services and DORA responsibilities.
We define board and committee structures, delegated authorities, decision rights, regulated-function responsibilities, management information and effectiveness-review processes for regulated European institutions.
Governance is designed around the institution’s legal form, home-state requirements, group structure and licence, with clear accountability between the board, executive management and control functions. Transaction mandates extend to governance due diligence, approval-ready board changes and post-completion accountability and committee design.
Engagement scope
Clear scope with Defined responsibilities
-
Transaction-related work is limited to commercial and regulatory advisory, regulatory due diligence, transaction readiness, approval programmes and permitted corporate administration.
-
Regulated investment services, legal and tax advice, valuations, statutory audit and other reserved services are undertaken only by appropriately authorised firms. Cyprus ASP services are limited to those recorded in the applicable authorisation.
-
Named regulated-function appointments and managed services are undertaken only where the applicable national framework permits the arrangement and any required approval or acceptance has been obtained.
-
Internal audit and assurance mandates are accepted only after eligibility, conflicts and independence have been confirmed.
WHEN CLIENTS ENGAGE US
Entering European Markets, Securing Authorisation and Strengthening Control
Clients engage us when selecting an EU home jurisdiction; preparing a MiFID II, MiCA, AIFMD, UCITS, payment, electronic-money or banking authorisation; acquiring, disposing of or restructuring a regulated business; varying permissions or ownership; designing a passporting strategy; or establishing an EU entity for an international financial group.
We are also engaged to address supervisory findings, implement DORA or wider regulatory change, strengthen governance, compliance, AML, risk or internal audit, and prepare an institution for entry into another European market.
INDUSTRIES WE ADVISE
Specialised Advisory in Highly Regulated Industries
Our Middle East practice is concentrated in regulated financial services and institution types where jurisdiction, authorisation and operating-model decisions must be resolved together.
Banks and Financial Institutions
Banks, finance companies, credit providers, exchange and remittance businesses and other licensed financial institutions undertaking market entry, authorisation, business-model change, governance transformation, supervisory remediation, risk management or internal audit programmes.
Funds and Asset Managers
Fund sponsors, fund managers, investment managers and operators requiring manager authorisation, fund registration or notification, management permissions, fund marketing, governance and operating frameworks.
Family Offices and Private Wealth
Single- and multi-family offices, private investment structures and wealth-management businesses requiring jurisdiction selection, regulatory-perimeter analysis, governance design or advice on regulated investment activities.
Investment Firms and Intermediaries
Investment advisers, arrangers, dealers, portfolio managers, brokers, custodians and other capital-market institutions establishing, expanding or changing their regulated activities.
Insurance, Reinsurance and Captives
Insurers, reinsurers, captive insurers, captive sponsors, insurance managers and intermediaries requiring authorisation, governance, risk, compliance, actuarial governance or internal audit capabilities.
Digital Assets and Tokenisation
VASPs, digital-asset platforms, token issuers and financial institutions developing exchange, brokerage, custody, transfer, settlement, lending, investment-management, tokenisation or payment-token propositions.
Payments and Fintech
Payment service providers, stored-value facilities, wallet providers, exchange and remittance businesses and technology-led financial institutions requiring regulatory strategy, licensing and institutional control frameworks.
speak with a partner
Discuss a European Regulatory Mandate
Whether the decision concerns Cyprus, Greece, another EU home jurisdiction, a new authorisation, a regulated transaction, an existing control environment or cross-border expansion, we establish the regulatory position and lead the programme required to execute it.
