Cyprus: Fintech Laws and Regulations (Contribution to the ICLG Guide)

1. FINTECH LANDSCAPE

1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market.  Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

The fintech landscape in Cyprus has seen tremendous expansion over these past years. Cyprus hosts a mature, robust and well-established financial services market, which has allowed the transition to fintech.  Fintech is expected to further develop in Cyprus after the publication of the Distributed Ledger Technologies (DLT) (Blockchain) National Strategy (“National Strategy”) produced by the legislative and executive branch of Cyprus.

One of the most prominent fintech-influenced markets is the foreign exchange.  Cyprus hosts an active foreign exchange market.  Foreign exchange is a financial product under the relevant investments law and is regulated by the domestic, competent authority, the Cyprus Securities and Exchange Commission (CySEC).  Cyprus is a recognised forex hub.  The use of technology tools to aid the delivery of foreign exchange services has been noticed over the last years.

The banking sector, consistently identified as one of the main economy pillars in Cyprus, has also turned to technology.  Payment service providers and electronic money issuers using technology and innovative business models have emerged.  Incumbent banks rely on the latest regulatory developments to integrate technological means towards payments, signing of contracts, remote onboarding, etc.  The continuing evolution of open banking channels, as necessitated by the relevant laws, has increased third-party providers (tech start-ups and developers) developing customer-centric financial solutions.  Incumbent banks have developed their own application programming interface platforms to capitalise the interaction afforded by the open banking channels.

CySEC, reporting on the operation of its Innovation Hub, revealed that it has been working with, and guiding a wide range of various financial businesses including:

• RegTech businesses developing tools for regulatory compliance and due diligence (based on Big Data and Analytics) especially by reference to remote onboarding possibilities;
• companies using artificial intelligence for fintech and RegTech purposes;
• Cryptoasset companies;
• entities that use DLT for trading facilities or the offering, transferring and verifying of the ownership of financial instruments; and
• businesses involved with asset management.

CySEC has also issued bespoke rules regarding investment-based crowdfunding in February 2020 and a significant growth in crowdfunding platforms is anticipated.

1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

Cyprus has not developed specific fintech legislation with potential prohibitions or restrictions on specific fintech businesses and products.  Yet, fintech entities/businesses/products are regulated under the existing framework to the extent they satisfy the regulatory criteria in place.  In this sense, typical prohibitions or restrictive requirements applying to conventional financial businesses would similarly apply to fintech businesses.

2. FUNDING FOR FINTECH

2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?

Various funding means are available for innovative businesses, such as:

• personal savings;
• financing through friends/family or angel investors;
• loans (mainly from incumbent banks);
• institutional investors;
• convertible loans (quite popular among innovative businesses);
• venture capitalists; and
• grants, subsidies and EU funding.

The crowdfunding rules issued by CySEC are expected to facilitate and increase funding of innovative businesses through investment-based crowdfunding, i.e. through the offering of transferable securities, such as shares and bonds, to retail investors.

Venture capitalists seeking to invest in new business models constitute a further funding source for innovative businesses.  CySEC has guided a venture capital fund investing in blockchain start-up projects.

The Cyprus Government, seeking to boost funding to innovation, has introduced a visa-granting scheme, whereby a condition to obtaining a Cyprus visa is the donation of a certain amount to any of a list of certified innovative enterprises (certified by the Cyprus Government based on given criteria).

2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

From a general tax-perspective, small/medium-sized enterprises, including fintech businesses, benefit from Cyprus’s business-friendly tax framework.  Cyprus has built a strong network of double-tax treaties, offers a low corporate tax of 12.5% and various tax advantages.

Cyprus encourages research and development by introducing an 80% tax exemption on qualifying profits from the exploitation of research and development-related intellectual property “qualifying assets” (including patents and copyrighted software).  Qualifying profits are calculated based on the nexus approach and capital expenditure on qualifying assets is written off over a five-year period.  The 80% tax exemption combined with the 12.5% corporate tax results in an effective tax rate of 2.5%.

Tax relief is granted to investors under certain criteria.  Qualifying investors making risk-finance investment in small/medium-sized enterprises may deduct the investment costs from their annual taxable income, provided that the deduction does not exceed €150,000 and provided that such deduction is limited to 50% of the investor’s taxable income in the year the investment was made.  A carry-forward option is also afforded to qualifying investors for any investment exceeding the referred limitation.

The Notional Deduction on Interest enables significant tax return on qualifying equity investment by allowing the deduction of notional interest from the taxable income of eligible businesses.  This tax provision seeks to align the current, beneficial tax treatment of debt financing with equity financing.  Relief is primarily intended for small/medium-sized enterprises.

2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

The first step to carrying out an IPO is the establishment of a public company (either established as such from the start or converted from a private company).

The public company must then be listed on the Cyprus Stock Exchange (CSE), which falls under the regulatory scope of CySEC.  A requirement for holding an IPO and listing securities on the CSE is the publication of a duly approved prospectus.  A public company must submit the prospectus with the CySEC unless an exemption applies.  CySEC may then decide to grant its approval for publication, within a confined time limit.  Cyprus exempts companies from the obligation to publish a prospectus for security offerings whose consideration in the EU does not exceed five million euro (€5,000,000), calculated over a period of 12 months or is addressed to less than 150 natural or legal persons per Member State, which are not qualified investors.  Other exemptions also apply in line with the relevant EU framework.

The CSE hosts both regulated (seven regulated markets) and unregulated markets (one unregulated market as the ‘Emerging Companies Market’).  To be listed and further to the obligation for the prospectus publication, a public company must observe certain general as well as specific-to-each-market conditions.  Depending on whether the listing was on a regulated or an unregulated market, the conditions and obligations imposed on the public company vary.  The Emerging Companies Market, as the unregulated market, is based on looser requirements, while the regulated market imposes stricter rules regarding minimum capital, minimum free float and other relevant obligations.

2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

No, there have not been any notable exits.

3. FINTECH REGULATION

3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

Cyprus has yet to develop comprehensive fintech legislation.  Fintech activity is, at large, regulated in a scarce manner by reference to existing laws and regulations.  Fintech businesses which engage in activities or offer services are regulated to the extent they fit the existing financial regulatory criteria.

The existing regulatory framework for financial services is mainly constituted of the following laws:

• Business of Credit Institutions Laws 1997 to 2019;
• various EU regulations (with direct effect in Cyprus) dealing with banking regulation, including EU Regulation 575/2013 on prudential requirements for credit institutions and investment firms;
• Electronic Money Law;
• Provision and Use of Payments Services and Access to Payment Systems Law;
• Securities and Exchange Commission Law;
• Transparency Requirements Law;
• Investment Services and Activities and Regulated Markets Law;
• Takeover Bids Law;
• Public Offer and Prospectus Law;
• Open-ended Undertakings of Collective Investments in Transferable Securities Law;
• Alternative Investment Fund Managers Law;
• Alternative Investment Funds Law;
• Securities and Stock Exchange Law; and
• Prevention and Suppression of Money Laundering and Terrorist Financing Law. The 5^th Anti-Money Laundering (“AML”) Directive renders cryptocurrency exchanges, involved with exchanges between cryptocurrencies and fiat currencies, and custodian wallet providers obliged entities under the law.  AML obligations will, thus, bind businesses operating in the fintech area.  Cyprus is expected to transpose the directive within the first half of 2020.

The regulatory authority for the authorisation, operation and supervision of payment institutions, including all Cyprus-incorporated commercial banks, is the Central Bank of Cyprus.

The financial regulator is CySEC, responsible for the supervision of the CSE.  Licensed investment services companies, collective investment funds, fund management companies and consultants are under CySEC’s control.   CySEC grants licences to investment firms and brokers and has the authority to impose disciplinary penalties for deviations from stock market legislation.

Further to the existing financial laws, specific rules have been issued in relation to fintech businesses.  CySEC issued the Crowdfunding Directive/rules as secondary rules substantiating the domestic investment law that transposed MiFID II.  The scope of the Directive is limited to investment-based crowdfunding, excluding loan-based or reward-based crowdfunding.  The Directive provides that Cyprus Investment Firms (CIFs) may operate as crowdfunding providers where they abide by the existing regulation and the additional rules imposed by the Directive (regarding, mainly, conflict of interest, due diligence, transparency and handling of investor funds).

3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?

Cryptocurrencies or cryptoassets are not specifically regulated in Cyprus.  While no overt prohibition is directed at cryptocurrencies, CySEC and CBC have issued specific warnings and announcements regarding dealing with, trading in or promoting cryptocurrencies.

CBC, in warning the public in relation to purchasing, holding, or trading in virtual currencies, explained that such currencies do not constitute legal tender and the CBC does not authorise or licence any activity involving virtual currencies falling within its regulatory competence.  Further, the CBC issued warnings about the risks associated with these virtual currencies (volatility, no legal obligation to reimburse owners for the face value of the currencies, not backed-up and susceptible to be used for money-laundering activities).

CySEC has highlighted the risk of investing in, or dealing with, virtual currencies, since early 2014 (identifying volatility, theft and money-laundering risk and loss of investment without any guaranteed protection).  In 2017, CySEC warned investors, once again, of the risks associated with virtual currencies, stressing the lack of EU regulatory framework in the area and the risk of losing their investment.  CySEC explained that Initial Coin Offerings (ICOs) should be held by entities with experience and knowledge regarding these fund-raising vehicles.

In 2018, CySEC further clarified the framework for virtual currencies and derivatives on virtual currencies.  While CySEC acknowledged that cryptocurrencies are not specifically regulated, ICOs, depending on their function and whether they fall under the existing regulatory criteria, would need to comply with all applicable capital markets and other relevant regulation in Cyprus and the EU (including, the Prospectus Directive, the Markets in Financial Instruments Directive, the Alternative Investment Fund Managers Directive and the AML Directive).  CySEC, further to a relevant European Securities and Markets Authority (ESMA) decision, explicitly provided that derivatives on virtual currencies may now qualify as “financial instruments” under the applicable investment law.

CIFs, when dealing with derivatives on virtual currencies, must obtain specific authorisation by CySEC and abide by their general obligations under the existing investment law framework and the rules and restrictions issued specifically for derivatives on virtual currencies by CySEC and ESMA.  CIFs are required to give detailed information to their clients, and issue specific warnings to their clients, about the relevant risks of investing in derivatives on virtual currencies, conduct proper pricing source evaluation by seeking publicly available pricing sources of good reputation, account for the heightened associated risks in relation to their capital adequacy and adhere to the ESMA intervention measures relating to contracts for differences and binary options.

 

The National Strategy favours regulating the DLT area, including cryptocurrencies.  In specific, the National Strategy contemplates a bill that will address the operation of cryptocurrencies and trading in cryptocurrencies.  To do so, the National Strategy assumes a categorisation of tokens into Security Tokens and Non-Security Tokens (constituted of utility and payment tokens).

Of interest in the relevant Strategy is the regulation of trading systems and exchanges involved with virtual currencies.  CySEC will be the competent authority for supervising and observing compliance, in this regard.  The contemplated DLT bill, will seek to impose requirements for the transparency of trading, the deterrence of unfair trading practices, manipulation and market disruption, and the proper management of large exposures and default risk, all in relation to virtual currencies.  The Strategy also examines the regulation of market intermediaries by discussing the potential for minimum entry standards and capital and other prudential requirements.  Following the National Strategy, trading in virtual currencies shall become the subject of specific and comprehensive regulation.

3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?

Competent public authorities and regulators have been interested and active towards fintech development.  The Cyprus Government had already laid down a national Digital Strategy in 2012 seeking to enhance information and communication technology.  A cybersecurity, and an e-government strategy were also introduced towards the need to ensure secure development of the cyberspace.

Cyprus has also placed special emphasis on innovation and research, which are closely related to fintech development.  The Institute for Research and Innovation supports innovative projects and research, by granting funding opportunities and overseeing the participation of research/innovation-oriented projects to domestic and international competitions.  As of 1^st March 2020, the Cyprus government operates a Deputy Ministry of Research, Innovation and Digital Policy, as part of the Ministry of Finance, established with the objective to promote, guide and develop the digital transformation of Cyprus, while facilitating the operation of startup businesses and supporting the Institute for Research and Innovation.  Cyprus recognises that innovation and research are instrumental for the horizontal development of the Cyprus’s economy.  Financial services, recognised as foundational for the economy, are bound to receive specialised support from the Deputy Ministry.

Cyprus participates in many blockchain initiatives, which are expected to impact the delivery of fintech services (indicatively, European Blockchain Partnership, Declaration on the utilisation of DLT together with France, Italy, Portugal, Greece, Malta and Spain and Blockchain Technology for Algorithmic Regulation and Compliance (CySEC)).

The government and the legislature, aided by domestic competent partners, including CBC and CySEC, have issued the National Strategy.  Cyprus now offers a comprehensive strategic plan aiming at the integration of blockchain to the public and private sector.  The Strategy discusses the need for proper regulation of DLT, addressing the risks associated with the said technology.  The preparation of a comprehensive bill on DLT is extensively discussed in the Strategy.  This indicates that policymakers are actively considering the development of the regulatory framework underpinning blockchain, and, potentially, fintech.  At the same time, the Strategy sets out a road map for blockchain implementation and offers specific use cases.  The ultimate objective is the digital transformation of Cyprus using DLT as a cost-efficient and effective solution.

The Strategy prioritises the potential for blockchain in financial services; the need for regulation focuses to a significant extent to virtual currencies and cryptoassets, while a whole section is dedicated to the discussion of the potential opportunities afforded by DLT in financial services.  Further, a relevant ad hoc committee, which has been established to serve the objectives identified in the Strategy, is constituted by a subcommittee specifically empowered with exploring the application of DLT in the financial industry.  Clearly, fintech is prioritised by the executive and legislative branches in Cyprus.

CySEC has been actively involved with the development of fintech.  Further to the regulatory initiatives taken (virtual currencies and investment-based crowdfunding rules), CySEC has also established the Innovation Hub.  The Hub was established as a knowledge share-point between CySEC and interested Fintech and RegTech entities (either regulated or not), as a guidance and testing space regarding regulation and as a supervision-enhancing space for CySEC.  The need to foster innovation while maintaining investor protection was the underpinning objective of the Hub.  CySEC has announced that the innovative businesses participating in the Hub took a proactive approach in relation to their regulatory obligations and, in turn, received valuable supervisory feedback.  The Innovation Hub is expected to welcome more participants interested in deciphering their regulatory obligations and guiding their innovative tools in a compliant manner.

3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

The nature of financial activities and the country of establishment (EU-based or outside EU-based) determine the type of licence and kind of requirements imposed to foreign fintech businesses.

Foreign banking or credit institutions, credit acquiring companies, financial leasing companies or payment institutions, electronic money companies, foreign exchange companies, investment funds or insurers involved with fintech shall seek specific licences from relevant competent authorities as provided by law.

Generally, EEA-based businesses may offer fintech services through establishing branches, subsidiary companies or representative offices based in Cyprus or by establishing EEA-based representative offices, where the business is undertaken and licensed in Cyprus.  Also, EEA-businesses may offer their services on a cross-border basis.

Further to the above, EEA-based businesses may benefit from EU passporting rights in Cyprus by passporting a single licence across the EEA, through the relevant regime.  In general, and briefly, passporting rights accrue to EEA businesses that obtain a licence in a single Member State for the provision of financial services and may use it, subject to potential, minimum additional requirements, to offer services across the EEA through the establishment of a branch or the provision of cross-border services.  The following entities can passport their single licence across the EEA:

• alternative investment fund managers;
• credit intermediaries;
• credit, payment or electronic money institutions;
• insurers and reinsurers;
• insurance intermediaries;
• investment firms; and
• undertakings for collective investment in transferable securities managers.

Businesses from third countries could also provide fintech services in Cyprus, by establishing a branch or a subsidiary company, again with the approval of the relevant authority, depending on the nature and scope of the concerned services.  Such businesses must overcome more stringent regulatory hurdles to obtain a relevant licence for specific financial services in Cyprus.

4. OTHER REGULATORY REGIMES/NON-FINANCIAL REGULATION

4.1       Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

Cyprus regulates the processing of personal data in line with the relevant EU framework.  The principal legislation concerned with personal data processing, potentially applicable to fintech businesses, is the EU General Data Protection Regulation (2016/679) (GDPR), and the accompanying transposing, domestic law (Law 125(I)/2018).  The GDPR applies to processors or controllers processing (a term that denotes a wide range of use of personal data) data that relates to natural persons.

4.2       Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

EU-based countries are bound by the provisions of the GDPR in processing personal data of Cypriot citizens.  Further to this, the GDPR specifically provides for extra-territorial regulation for businesses established outside the EU to the extent that these businesses process data in offering their services to, or online monitoring the behaviour of, EU natural persons (“data subjects”).

Personal data transfer from Cyprus to EU-based jurisdictions is free, given that Cyprus-based entities abide by the normal GDPR and domestic requirements.

Transferring personal data from Cyprus to non-EU third countries or international organisations is specifically regulated.  Personal data transfer to countries or organisations covered by Adequacy Decisions (as issued by EU Commission) is subject to the normal provisions of the data protection framework for EU-wide personal data processing and transfer.

In the absence of Adequacy decisions, entities must implement recognised safeguards, as provided by the relevant law, to make any international transfer of personal data.  Such safeguards include:

• the inclusion of standard contractual terms;
• binding corporate rules for transfers within a group of undertakings;
• consent of subjects, whose personal data are implicated; and
• for special categories of personal data, as defined in the GDPR, consultation with the domestic competent data protection authority, or an impact assessment.

4.3       Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

Lack of compliance might result in a wide range of sanctions:

• The competent regulatory authority may impose fines, not exceeding the upper limits as provided by the EU Directive.
• Aggrieved individuals have a right to seek redress at court, and a right to compensation; this effectively enables the pursuit of class actions.
• Processors or controllers may be held personally liable in case they commit specific offences as provided in law. Personal liability includes imprisonment (of up to one, three or five years depending on the gravity of the offence), and/or imposition of fines.  In case processors or controllers are legal persons, then certain officers may be held liable.

4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

Cyprus has an information and communication technology regulatory framework, with cybersecurity being particularly addressed.  This framework may apply to fintech businesses.

The following legislation and regulations contain cybersecurity-related provisions:

• Electronic Commerce Law (156(I)/2004);
• Law for the Protection of Confidentiality of Private Communications (92(Ι)/1996);
• Law Regulating Electronic Communications and Postal Services (112(I)/2004) as amended by Law 76(I)/2017;
• Law transposing Regulation 910/2014/EC on electronic identification and trust services for electronic transactions in the internal market (Law 55(I)/2018); and
• Data Protection Framework, including the GDPR and the domestic law (Law 125(I)/2018).

Cyprus is a party to the Council of Europe Convention on Cybercrime, which was incorporated into domestic law through Law 22(III)/2004.  The Law mainly deals with illegal access or interception, data or system interference, the misuse of devices, computer-related forgery or fraud, offences relating to child pornography or copyright infringement and related rights.

4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

Cyprus has introduced a framework towards combatting money laundering in line with the EU framework.

The provisions of the EU Fourth AML Directive (2015/849/EC), regarding the prevention of the legalisation of proceeds from illegal activities or terrorist financing, have been transposed by the relevant domestic law to Cyprus.

All persons that conduct financial services activities, including fintech businesses, must introduce adequate procedures and mechanisms to prevent money laundering.  The necessary procedures and mechanisms include measures to identify and report suspicious transactions and the know-your-client principle, which requires the obliged entities to adhere to and apply strict procedures for maintaining accurate and up-to-date records of their clients.

As of early March, Cyprus has not implemented the EU Fifth AML Directive, which brings custodian wallet providers and providers of exchange services (involving exchange of cryptocurrencies with fiat currencies) within the scope of AML regulation.  This is expected to affect innovative, fintech businesses.

Cyprus, as per a relevant consultation paper issued by CySEC and the National Strategy, considers transposing the relevant AML directive by expanding its scope, in line with the FATF recommendations, to further regulate entities involved in: a) exchange between cryptoassets and cryptoassets; b) transfer of virtual assets; and c) participation in and provision of financial services related to an issuer’s offer and/or sale of a cryptoasset.  In this way, Cyprus would impose AML obligations to entities involved with cryptoassets in a more holistic and comprehensive manner.

4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?

Fintech businesses may be subject to the consumer protection regime.  Other regimes may apply depending on the nature of services offered by fintech businesses.

5. ACCESSING TALENT

5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction?  Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

Employments are usually governed by the contractual terms agreed between employers and employees.  Employment contracts are either written or oral, but for oral contracts, employers must provide the basic employment terms and conditions to their employees, in writing.  Collective agreements may be in place for specific industries.  The content of collective agreements may determine employment relationships, where employers make such agreements with trade unions.

Regarding the dismissal of staff, employers are obliged to give notice to terminate the employment contract of their employees who have completed at least 26 weeks of continuous employment.  The longer the period of employment, the longer the dismissal notice-period required.  In turn, employees may claim their salaries as specified by law, depending on the period of their employment.

In case of unlawful termination, employees are entitled to compensation for unfair dismissal.  Further, compensation is given where employees are dismissed on the grounds of redundancy.

5.2 What, if any, mandatory employment benefits must be provided to staff?

Certain basic benefits are provided to employees:

• Minimum wage for a limited list of occupations.
• Employees are entitled to 20 or 24 days paid leave (based on a five-day or six-day employment, respectively).
• Unpaid parental leave of 18 weeks is allowed.

5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

EEA citizens may freely work in Cyprus, without permission.

Non-EEA residents may work in Cyprus, once they obtain a work permit, which may be granted once the competent authority is satisfied that the relevant criteria are met.  To that end, the employer seeking to hire foreign labour force must demonstrate that they have made efforts to hire EEA employees, who were appropriate to take up the relevant work position, but no such employees were available.  Cyprus authorities impose a national maximum percentage of foreign workforce that may be employed in Cyprus at a given point in time.

Certain limited categories of employees, such as employees of high quality of academic and/or professional skills, are exempt from certain restrictions regarding foreign workforce employment in Cyprus, and in some cases obtaining a work permit is a matter of formality for them.  Highly skilled professionals might, under circumstances, not be counted towards the national maximum percentage of international employees that may be employed in Cyprus at a given point in time.

The Cyprus Startup Visa Scheme runs up until March 2021.  Pursuant to the scheme, non-EEA entrepreneurs involved with innovative businesses may be granted a visa to work, either as a team or individually, in Cyprus, subject to certain criteria.  The startup project owners must have access to €20,000 funding, while the relevant business must be innovative, with Cyprus-based business headquarters and effective control.

6. TECHNOLOGY

6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.

Innovation in Cyprus is protected under a nexus of intellectual property laws and regulations.  Innovation, including fintech innovation, is protected at a national, EU and international level, owing to Cyprus’s membership in the EU and participation to leading international conventions regarding intellectual property protection.  Specific intellectual property rights (such as copyright, patents, trademarks, and industrial designs) are granted to the creators, authors and inventors of innovative and inventive products.

Copyrights and patents are pertinent to the protection of innovative works and inventions.

Copyright
Copyright is protected under Law 59/76 on the Protection of Intellectual Property.  While copyrights are not registrable in Cyprus, authors may take measures to prove their ownership through storing or certifying relevant evidence.

Cyprus is a signatory to the Berne Convention for the Protection of Literary and Artistic Works, which covers a broad range of rights, including software copyrights and computer programs and the World Intellectual Property Organization Copyright Treaty.

Patents
Fintech innovation and products, such as hardware, may be protected through the registration of a patent.  However, under Cyprus patent law, computer programs are explicitly excluded as potentially patentable products.

6.2 Please briefly describe how ownership of IP operates in your jurisdiction.

Ownership of intellectual property rights depends on the type of intellectual property rights involved.  Trademarks are registered at a central registry, indicating ownership.  As to copyright, the author of a work is considered the first copyright owner, unless such work is produced within the scope of employment, where employers are, typically, the copyright owners.  Independent contractor services agreements do not confer ownership rights to the business engaging such contractors, unless this is agreed by contract.  A patent for an invention is owned by the inventor, who may register their patent.  Ownership in intellectual property rights may be transferred via assignments in return for valid consideration.

6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

Enforcement of intellectual property rights depends on the width of protection afforded to these rights by reference to the system of registration pursued in each case.

Regarding copyright, Cyprus is member to international conventions that provide reciprocal protection to Cyprus-based copyrighted works in other signatory countries.  Cyprus is a contracting party to the Berne Convention, the Rome Convention, and the World Intellectual Property Organization Copyright Treaty.

Patents can be enforced upon their registration.  Patents may be registered  through: a national patent process with the Department of the Registrar of Companies and Official Receivers; a European patent issued by the European Patent Office; or an international patent under the provisions of the Patent Cooperation Treaty, administered by the World Intellectual Property Organization.  The patents granted under the European Patent Office or the Patent Cooperation Treaty may be enforced as national patents to any relevant jurisdiction, subject to the national patent rules of such jurisdiction.

Trademarks may be registered with the competent domestic authority or with the European Union Intellectual Property Office.  An EU-registered trademark is protected in all EU Member States and may be enforced in Cyprus.

6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

Exploitation of intellectual property rights in Cyprus is a matter of contractual arrangements between the interested parties.  Typical arrangements for intellectual property exploitation in Cyprus involve assignment/transfer of intellectual property rights or licensing of such rights; with assignment ownership passes to the assignee, while a licence grants limited use rights to the licensee.

Assignment, in general, must be in writing and signed.  In case of licensing, copyright licensing must be made in writing only to the extent it involves an exclusive licence.  A non-exclusive licence of copyright may be oral or inferred from conduct.  Patent licensing is not specifically regulated in Cyprus and may take oral form.

Trademark or patent assignment or licensing may be registered with the competent authority; involved parties are encouraged to register their assignments/licences.  For trademark assignment, the assignment agreement must be signed and sealed and must be accompanied by a duly signed and sealed Power of Attorney.  For trademark licence registration, the application to the competent authority must include a Statutory Declaration describing the terms of licence and any licensing agreement in place.  Patent licensing or assignment may be registered following the submission of specific forms.

Christiana Aristidou, Evdokia Marcou

Published in the International Comparative Legal Guides by the Global Legal Group