PNYX HILL GRC ADVISORS | EUROPE
Regulatory and GRC Advisory Across Europe
From our offices in Nicosia and Athens, we advise investment firms, crypto-asset service providers (CASPs), payment and electronic-money institutions, fund managers, banks, family offices and other regulated financial-services businesses across Cyprus, Greece and the wider EU.
We determine the home jurisdiction, regulatory perimeter and authorisation pathway, then lead licensing, governance, compliance, financial crime, risk and assurance mandates through implementation, passporting and operational readiness.
EUROPEAN COVERAGE
Institutions and authorisation pathways we advise
Our European practice is organised around the institutions, permissions and cross-border rights our clients require. Within these sectors, our scope extends from regulatory strategy and authorisation through compliance, financial crime, risk, internal audit and governance, including the regulatory workstreams arising from acquisitions and restructurings.
We advise investment firms, brokers, dealers, portfolio managers, investment advisers, arrangers and trading businesses on authorisation, permission scope, prudential classification, governance, conduct and cross-border distribution under MiFID II and MiFIR.
Mandates cover new investment-firm applications, licence variations, qualifying holdings, branch and passport notifications, product and client classification, safeguarding and client assets, market conduct, transaction reporting and supervisory remediation.
Principal relevance:
Cyprus Investment Firms and other EU investment firms; online and multi-asset brokers; portfolio managers; investment advisers; dealers; arrangers; market intermediaries; third-country groups establishing an EU-regulated presence.
We advise CASPs and financial institutions on MiCA authorisation, notification, qualifying holdings, governance, prudential safeguards, conduct, custody, market abuse, outsourcing, complaints, AML and operational resilience. Scope is aligned to the crypto-asset services the institution will perform and the jurisdictions in which it intends to operate.
Token and business-model classification is completed before the licence route is fixed. Where an instrument constitutes a financial instrument, e-money token, asset-referenced token or other regulated product, we map the resulting MiFID II, payments, banking or issuer requirements alongside MiCA.
Principal relevance:
Crypto-asset exchanges; brokers; custodians; wallet providers; trading platforms; transfer-service providers; portfolio managers; advisers; token issuers; tokenisation businesses; existing financial institutions entering digital assets.
We advise payment institutions, electronic money institutions, wallets, acquiring businesses, money-remittance providers and embedded-finance platforms on authorisation and operating requirements under PSD2 and the electronic-money framework, together with readiness for PSD3 and PSR.
Mandates address payment-service classification, safeguarding, own funds, governance, AML, fraud, consumer protection, agents and distributors, outsourcing, ICT, DORA, reporting and passporting across the EEA.
Principal relevance:
Payment institutions; EMIs; wallet and stored-value businesses; merchant acquirers; remittance providers; payment initiators; account-information providers; embedded-finance and cross-border payment platforms.
We advise AIFMs, UCITS management companies, self-managed funds, investment managers and fund sponsors on regulatory strategy, manager authorisation, fund establishment, delegation, governance, risk, compliance and European marketing arrangements.
The work connects the manager’s permissions and substance with the fund structure, investment strategy, target investors, service-provider model and intended distribution footprint. Passporting, national private-placement and third-country considerations are addressed before launch.
Principal relevance:
AIFMs; UCITS management companies; self-managed funds; alternative investment funds; UCITS; private-equity, venture-capital, real-estate and liquid-strategy managers; fund sponsors and investment managers.
We advise banks, credit institutions and banking groups on regulatory strategy, authorisation readiness, governance, prudential frameworks, risk management, AML, internal controls, outsourcing, DORA and supervisory remediation under the applicable national and European architecture.
Mandates are calibrated to the role of the relevant national competent authority (NCA), the ECB and the Single Supervisory Mechanism (SSM). We also advise non-EU banking groups on branch, subsidiary and cross-border operating models for entering or expanding within Europe.
Principal relevance:
Credit institutions; specialist and digital banks; banking groups; finance and lending businesses; non-EU banks establishing or changing a European presence.
We advise single- and multi-family offices, private investment companies and wealth structures on whether their activities engage MiFID II, AIFMD, fund, AML or other regulatory requirements. The analysis covers investment decision-making, group services, third-party capital, co-investment, advisory activity and cross-border arrangements.
Where authorisation is required, we establish the appropriate regulated structure. Where activities remain outside the perimeter, we define governance, delegation and control arrangements that preserve that position as the organisation develops.
Principal relevance:
Single- and multi-family offices; private investment offices; holding and investment companies; co-investment platforms; private-wealth and external-asset-management businesses.
Cyprus | CySEC and CBC
From our Nicosia office, we advise institutions selecting Cyprus as an EU home jurisdiction and established firms undertaking authorisation, expansion, a regulated transaction or material regulatory change. Our work spans CySEC-regulated investment firms, CASPs, fund managers and funds, together with CBC-supervised banks, payment institutions and EMIs.
Cyprus mandates are built around the operating institution and its intended European reach. We align the licence, ownership, capital, board and key functions, local substance, outsourcing, technology, policies and passporting plan before the application is submitted, then carry the programme through regulatory engagement and operational launch.
Our licensed Cyprus Administrative Services Provider (ASP) capability enables us to deliver permitted corporate-administration workstreams attached to transactions and restructurings. The scope is confined to the specific administrative services recorded in the applicable authorisation.
Our Cyprus capabilities include:
-
Regulatory strategy, perimeter analysis, Cyprus jurisdiction assessment and EU passporting
-
MiFID II investment-firm authorisations, licence variations and operating-readiness programmes
-
MiCA CASP authorisations, notifications and operating-readiness programmes
-
AIFM, UCITS management-company, fund and investment-management mandates
-
CBC payment-institution, EMI, credit-institution and related approval programmes
-
Regulatory due diligence, qualifying-holding, change-in-control and licence-continuity programmes for regulated transactions
-
Entity and SPV administration, company-secretarial processes, registered-office services and governance actions within our licensed ASP scope
-
Compliance, AML, risk, DORA, governance, regulatory reporting, co-sourced functions, internal audit and non-statutory assurance, subject to applicable requirements and independence
Principal relevance: Investment firms and online brokers; CASPs and digital-asset firms; PIs and EMIs; banks; AIFMs and UCITS management companies; fund sponsors and managers; family offices and private-investment structures; acquirers, sellers and investors in regulated businesses.
From our Nicosia office, we advise institutions selecting Cyprus as an EU home jurisdiction and established firms undertaking authorisation, expansion, a regulated transaction or material regulatory change. Our work spans CySEC-regulated investment firms, CASPs, fund managers and funds, together with CBC-supervised banks, payment institutions and EMIs.
Cyprus mandates are built around the operating institution and its intended European reach. We align the licence, ownership, capital, board and key functions, local substance, outsourcing, technology, policies and passporting plan before the application is submitted, then carry the programme through regulatory engagement and operational launch.
Our licensed Cyprus Administrative Services Provider (ASP) capability enables us to deliver permitted corporate-administration workstreams attached to transactions and restructurings. The scope is confined to the specific administrative services recorded in the applicable authorisation.
Our Cyprus capabilities include:
-
Regulatory strategy, perimeter analysis, Cyprus jurisdiction assessment and EU passporting
-
MiFID II investment-firm authorisations, licence variations and operating-readiness programmes
-
MiCA CASP authorisations, notifications and operating-readiness programmes
-
AIFM, UCITS management-company, fund and investment-management mandates
-
CBC payment-institution, EMI, credit-institution and related approval programmes
-
Regulatory due diligence, qualifying-holding, change-in-control and licence-continuity programmes for regulated transactions
-
Entity and SPV administration, company-secretarial processes, registered-office services and governance actions within our licensed ASP scope
-
Compliance, AML, risk, DORA, governance, regulatory reporting, co-sourced functions, internal audit and non-statutory assurance, subject to applicable requirements and independence
Principal relevance:
Investment firms and online brokers; CASPs and digital-asset firms; PIs and EMIs; banks; AIFMs and UCITS management companies; fund sponsors and managers; family offices and private-investment structures; acquirers, sellers and investors in regulated businesses.
OUR GRC SERVICES
Regulatory, Jurisdictional and Sector Specific Services
We advise boards and executives on regulatory perimeter, jurisdiction selection, business-model viability, new products, transactions, supervisory strategy and regulatory change. We compare available routes, expose the permissions and constraints attached to each option and establish a defensible regulatory position before capital and management time are committed.
The advice is translated into clear decisions on entity structure, permissions, governance, capital, capabilities, operating model and regulatory sequencing.
We lead new authorisations, licence variations and change-in-control mandates from activity mapping and pre-application strategy through regulatory business plans, financial projections, governance, policies, key-person readiness, submissions and regulator engagement.
Each programme is built to the evidence and readiness standard of the relevant authority and carried through to operational launch.
We design, remediate and operate compliance frameworks for applicants, newly authorised firms and established institutions. Scope includes compliance-risk assessment, policies, monitoring, regulatory reporting, advice, training, management information and board reporting.
Delivery ranges from targeted co-sourced work to an integrated compliance service. Named appointments are undertaken only where the applicable regime permits the arrangement and the proposed individual is accepted by the relevant authority.
We establish, remediate and test financial-crime frameworks across enterprise and business risk assessment, customer onboarding, CDD and EDD, sanctions and screening, transaction monitoring, suspicious-activity escalation, MLRO governance and regulatory reporting.
The control model is calibrated to the institution’s products, clients, channels and geographic exposure, then embedded through accountable ownership, evidence standards, training and quality assurance.
We deliver independent internal audit and non-statutory regulatory assurance across governance, compliance, AML, risk, operations, technology and outsourcing. Risk-based plans, thematic reviews, control testing and remediation validation give boards and audit committees a clear view of control design, operating effectiveness and residual exposure.
Every mandate is subject to an explicit assessment of eligibility, conflicts and independence, with scope and governance established before work begins.
We design and strengthen enterprise and operational risk frameworks, risk appetite, policies, registers, KRIs, incident and issue management, business continuity, outsourcing and third-party risk, technology governance and resilience testing.
The framework connects risk ownership, escalation and board oversight to the institution’s licence obligations, business model and critical operations.
REGIONAL COVERAGE
Headline
Text
INDUSTRIES WE ADVISE
Specialised Advisory in Highly Regulated Industries
Our Middle East practice is concentrated in regulated financial services and institution types where jurisdiction, authorisation and operating-model decisions must be resolved together.
Banks and Financial Institutions
Banks, finance companies, credit providers, exchange and remittance businesses and other licensed financial institutions undertaking market entry, authorisation, business-model change, governance transformation, supervisory remediation, risk management or internal audit programmes.
Funds and Asset Managers
Fund sponsors, fund managers, investment managers and operators requiring manager authorisation, fund registration or notification, management permissions, fund marketing, governance and operating frameworks.
Family Offices and Private Wealth
Single- and multi-family offices, private investment structures and wealth-management businesses requiring jurisdiction selection, regulatory-perimeter analysis, governance design or advice on regulated investment activities.
Investment Firms and Intermediaries
Investment advisers, arrangers, dealers, portfolio managers, brokers, custodians and other capital-market institutions establishing, expanding or changing their regulated activities.
Insurance, Reinsurance and Captives
Insurers, reinsurers, captive insurers, captive sponsors, insurance managers and intermediaries requiring authorisation, governance, risk, compliance, actuarial governance or internal audit capabilities.
Digital Assets and Tokenisation
VASPs, digital-asset platforms, token issuers and financial institutions developing exchange, brokerage, custody, transfer, settlement, lending, investment-management, tokenisation or payment-token propositions.
Payments and Fintech
Payment service providers, stored-value facilities, wallet providers, exchange and remittance businesses and technology-led financial institutions requiring regulatory strategy, licensing and institutional control frameworks.
WHEN CLIENTS ENGAGE US
Headline
Text
