# CySEC Limassol Substance, Four-Eyes & Board Residency

> Structure a compliant Cyprus Investment Firm board under Law 87(I)/2017 Sec. 10: Four-Eyes executive directors, Cyprus residency, and directorship caps.

Canonical: https://eurofirmledger.com/bulletins/cysec-limassol-substance-four-eyes-executive-director-residency
Last updated: 2026-11-14T19:40:50.721Z

**Publication:** Euro Firm Ledger
**Category:** Cysec Cif Icf Safeguarding Directives
**Published:** 2026-11-13T14:00:25.915Z
**Author:** Lukas Lindqvist, CEFA (Certified European Financial Analyst (EFFAS/CEFA, Frankfurt & Zurich))
**Reviewer:** Not recorded

## Answer-first summary

Letterbox CIF shells are extinct in Cyprus: Law 87(I)/2017 Section 10 and EBA/ESMA Suitability Guidelines require at least two full-time Cyprus-resident Executive Directors, independent Non-Executives, and strict directorship caps.

## Key takeaways

- Section 10(1)(b) of Law 87(I)/2017 enforces the Four-Eyes principle: at least two full-time Cyprus-resident Executive Directors must genuinely direct every CIF’s day-to-day operations.
- Significant CIF directors are statutorily capped at holding at most 1 executive + 2 non-executive directorships (or 4 non-executive seats) under Section 10(2) of Law 87(I)/2017.
- Open co-working desks and part-time remote Compliance/AML Officers are rejected by CySEC—every CIF requires lockable dedicated Cyprus premises and full-time certified local control heads.
- Realistic Limassol/Nicosia local substance costs EUR 600k–900k per year—generating an IFR 25% Fixed Overheads Requirement (FOR) of EUR 150k–225k CET1.

## Related financial entities

- **Cyprus Investment Services and Activities Law (CySEC)** (CYSEC-CIF) — license: Statutory framework administered by CySEC transposing MiFID II, governing the authorization and operational requirements of Cypriot Investment Firms.
- **Digital Operational Resilience Act (Regulation EU 2022/2554)** (EU-DORA) — license: Uniform European regulation consolidating and upgrading cybersecurity and ICT risk management requirements across all regulated financial entities in the EU.
- **European Securities and Markets Authority (ESMA)** (ESMA) — license: Independent European Union authority contributing to safeguarding the stability of the EU financial system by enhancing investor protection and promoting stable markets.

## Analysis

Can a foreign fintech founder incorporate a Cyprus Investment Firm in Limassol, rent a EUR 400/month serviced desk, hire two part-time local nominee directors who sit on 15 other boards, and run the entire brokerage from London, Dubai, or Tel Aviv? **Categorically NO.** Under **Sections 9, 10, and 17 of Law 87(I)/2017**, **Article 9 of MiFID II**, and the **Joint ESMA and EBA Guidelines on the Assessment of the Suitability of Members of the Management Body (ESMA35-36-2319)**, **[CySEC](/competent-authorities/cysec)** enforces uncompromising **physical mind-and-management substance** in Cyprus—summarily rejecting or suspending any "letterbox entity" whose day-to-day strategic, risk, and compliance decisions occur abroad!

Within our [CySEC CIF & ICF master guide](/bulletins/cysec-cif-authorisation-eur-20000-icf-safeguarding-guide-2026) and the [CySEC safeguarding hub](/topics/cysec-cif-icf-safeguarding-directives), building a board and physical office roster that survives unannounced CySEC inspections in Limassol or Nicosia—like established CIFs [CAPEX.com](/firms/capex), [Colmex Pro](/firms/colmex-pro), [B2Prime](/firms/b2prime), and [Broctagon Prime](/firms/broctagon-prime-ltd)—requires budgeting for genuine local C-suite presence from Day 1.

## Mandatory CIF Board Composition & Cyprus Physical Substance Matrix

| Governance & Substance Role | Statutory Minimum | Residency & Time-Commitment Rule | Key Independence / Separation Rule |
| :--- | :--- | :--- | :--- |
| **Executive Directors ("Four-Eyes")** | **>= 2 Persons** (Sec. 10(1)(b) Law 87(I)/2017) | **Both MUST reside full-time in Cyprus** (tax/physical presence >183 days/yr) and work dedicatedly for the CIF! | Must jointly sign off material operational, treasury, and risk decisions ("Four-Eyes") |
| **Non-Executive Directors (NEDs)** | **>= 2 Persons** (>= 1 to 2 Independent NEDs) | Majority Cyprus/EEA accessible; must attend quarterly in-person Cyprus board & Risk Committee meetings | Independent NEDs cannot be shareholders, vendors, or recent employees (<5 yrs) |
| **Compliance Officer & AMLCO** | **1 Dedicated Officer** (or separate Compliance + AMLCO at scale) | **Full-time physical office presence in Cyprus**; holds **CySEC Advanced + AML** certificates! | Direct, unfettered reporting line to Board; **cannot** perform commercial/trading duties! |
| **Risk Manager (ICARA / K-Factors)** | **1 Dedicated Officer** (proportional at Class 3 SNI) | Cyprus resident; leads Risk Management Committee, [ICARA](/bulletins/ifd-article-24-icara-internal-capital-wind-down-stress-testing), & [K-factor monitoring](/bulletins/eu-ifr-ifd-class-1-2-3-prudential-capital-k-factor-guide-2026) | Independent from front-office dealing/sales; reports to Risk Committee |
| **Physical Cyprus Premises & IT** | **Dedicated Leased/Owned Office** | Lockable dedicated Limassol/Nicosia floor with independent badge access, local disaster-recovery access & WORM logs | Co-working open hot-desks shared with third parties **rejected** ([DORA](/passports/dora-regulation-eu-2022-2554) breach!) |

![Minimum compliant Cyprus Investment Firm organizational governance and physical Limassol/Nicosia substance chart under Law 87(I)/2017](/api/figure?type=flow&title=Compliant%20CySEC%20CIF%20Governance%20%26%20Physical%20Substance%20Blueprint&subtitle=Minimum%20Cyprus-resident%20C-suite%2C%20control%20functions%2C%20and%20board%20committee%20hierarchy&steps=Board%20of%20Directors%20%28%3E%3D4%29%3A%3A2%20Resident%20Full-Time%20Execs%20%28%22Four-Eyes%22%29%20%2B%20%3E%3D2%20Non-Execs%20%28incl.%20Indep.%29%7CCompliance%20%26%20AMLCO%3A%3AFull-time%20Cyprus%20office%20%2B%20CySEC%20Advanced%20%26%20AML%20Public%20Register%7CRisk%20%26%20Safeguarding%3A%3ADedicated%20Risk%20Manager%20%28ICARA%29%20%2B%20DI87-01%20Para.%209%20Single%20Officer%7CInternal%20Audit%20%283rd%20Line%29%3A%3AIndependent%20annual%20audit%20%28commonly%20co-sourced%20to%20specialist%20Cyprus%20CPA%29&metrics=FOUR-EYES%20EXECS%3A%3A%3E%3D%202%20Resident%3A%3AFull-time%20physical%20Cyprus%20base%7CSIGNIFICANT%20CIF%20CAP%3A%3A1%20Exec%20%2B%202%20Non-Exec%3A%3ALaw%2087%28I%29%2F2017%20Sec.%2010%282%29%28a%29%20max!%7CMIN%20HEADCOUNT%3A%3A6%E2%80%9312%20Local%20FTEs%3A%3ATypical%20EUR%20150k%E2%80%93750k%20CIF%20floor%7CHOT-DESK%20OFFICES%3A%3A100%25%20Rejected%3A%3AMust%20have%20isolated%20physical%20access)

## Directorship Caps & Time-Commitment Audits (Section 10(2) Law 87(I)/2017)

To stamp out "professional nominee directors" whorubber-stamped board minutes across 20 firms without reading a single reconciliation, **Section 10(2) of Law 87(I)/2017** (transposing MiFID II Article 9(2) and IFD Article 26) enforces strict quantitative caps and **Full-Time Equivalent (FTE) time budgets**:
- **Significant CIFs**: Members of the Board of Directors of a CIF significant in terms of size, internal organization, and complexity **may hold NO MORE THAN (a) ONE executive directorship with TWO non-executive directorships, OR (b) FOUR non-executive directorships** simultaneously (counting directorships within the same corporate group as one single directorship, with CySEC able to authorize at most one extra non-executive seat).
- **Non-Significant CIFs (Time-Budget Matrix)**: Even at smaller CIFs, CySEC's Personal Questionnaire (PQ) requires every director nominee to declare **exact annual days/hours committed to EVERY single external job, company, or charity**—summarily rejecting any Executive Director nominee claiming less than 0.80–1.00 FTE (>= 160 hours/month) physically in Cyprus!

## Outsourcing Red Lines: Avoiding the "Empty Shell" Trap (Delegated Reg. 2017/565 Art. 31)

While a Limassol CIF may lawfully outsource cloud infrastructure (under [DORA Regulation (EU) 2022/2554](/passports/dora-regulation-eu-2022-2554)), statutory internal audit, or specific liquidity technology bridges, **Article 31 of Commission Delegated Regulation (EU) 2017/565** prohibits outsourcing critical operational functions to the extent that the CIF becomes an **"empty shell"**:
1. **Senior Management Duties Can NEVER Be Delegated**: Strategic direction, risk-appetite sign-off, client-onboarding final approval, and [daily DI87-01 safeguarding oversight](/bulletins/cysec-directive-di87-01-client-money-segregation-reconciliation) must be exercised in Cyprus.
2. **Dealing / Execution Desk Presence**: A EUR 750k principal market-making CIF ([Law 87(I)/2017 authorization tiers](/bulletins/cyprus-law-87-i-2017-cif-authorisation-tiers-6-month-timeline)) must maintain CySEC-certified dealing/risk execution officers in Cyprus capable of intervening on live bridges in real time.

## Modeling Annual Minimum Limassol Substance Payroll & Premises Overhead (FOR Input)

Budget realistic **2026 Limassol / Nicosia Substance Operating Costs**—remembering that 100% of these fixed salaries and leases feed directly into next year's **25% Fixed Overheads Requirement (FOR)** under [IFR Article 13](/bulletins/eu-ifr-ifd-class-1-2-3-prudential-capital-k-factor-guide-2026)!

```formula
Annual_Minimum_Compliant_Cyprus_CIF_Substance_Budget (Limassol_2026_EUR):
 Board_And_Executive_Management:
 2 * Full_Time_Cyprus_Resident_Executive_Directors (CEO + Exec_Dir) = EUR 190,000 - EUR 280,000
 2 * Independent_Non_Executive_Directors (Quarterly Board + Risk Comm) = EUR 36,000 - EUR 56,000

 Mandatory_Local_Control_And_Core_Staff:
 1 * Full_Time_Compliance_Officer_And_AMLCO (Adv + AML Certified) = EUR 72,000 - EUR 105,000
 1 * Risk_Manager_And_Safeguarding_Finance_Controller = EUR 65,000 - EUR 92,000
 2 * CySEC_Certified_Dealing_BackOffice_Operations_Officers = EUR 76,000 - EUR 110,000
 Employer_Social_Insurance_GESY_Contributions (~14.5%) = EUR 58,000 - EUR 85,000

 Premises_Audits_And_Governance_Retainers:
 Dedicated_Limassol_Office_Lease_IT_DORA_Security = EUR 54,000 - EUR 96,000
 Co_Sourced_Internal_Audit + External_Statutory_DI87_01_Audit = EUR 48,000 - EUR 78,000

 Baseline_Compliant_Annual_Fixed_Substance_Cost (FO_Base) = EUR 599,000 to EUR 902,000 / year
 Implied_IFR_Pillar_1_FOR_Capital_Floor (25% * FO_Base) = EUR 149,750 to EUR 225,500 CET1!
 Implied_IFR_Art_43_Liquid_HQLA_Floor (1/3 * FOR) = EUR 49,917 to EUR 75,167 Cash/Bubills!
```

![Annual fixed substance operating cost breakdown for a compliant Limassol Cyprus Investment Firm across resident directors, compliance/AML, dealing staff, and audits](/api/figure?type=bars&title=2026%20Limassol%20CIF%20Minimum%20Substance%20Cost%20Breakdown%20%28EUR%2FYr%29&subtitle=Realistic%20mid-point%20EUR%20745k%20annual%20fixed%20overhead%20budget%20for%20a%20lean%2C%20inspection-proof%20CIF&steps=2%20Resident%20Execs%20%2B%202%20NEDs%3A%3AEUR%20281k%2Fyr%20%28Four-Eyes%20CEO%2FED%20%2B%202%20Independent%20NEDs%29%7CCompliance%2FAML%20%2B%20Risk%3A%3AEUR%20166k%2Fyr%20%28Full-time%20Adv%2FAML%20certified%20second%20line%29%7C2%20Certified%20Dealing%2FOps%3A%3AEUR%20158k%2Fyr%20%28incl.%20Cyprus%20Social%20Insurance%20%26%20GESY%29%7CDedicated%20Office%20%26%20Audits%3A%3AEUR%20140k%2Fyr%20%28Private%20Limassol%20lease%20%2B%20IFRS%2FDI87-01%2FIA%29&metrics=TOTAL%20FIXED%20BASE%3A%3A~EUR%20745k%20%2F%20yr%3A%3ARealistic%20lean%20Limassol%20CIF%7CIMPLIED%2025%25%20FOR%3A%3AEUR%20186.3k%20CET1%3A%3AExceeds%20EUR%20150k%20Class%202%20PMR!%7CCYPRUS%20CORP%20TAX%3A%3A12.5%25%20%2F%2015%25%20MNE%3A%3ARequires%20genuine%20local%20substance%7CCYSEC%20INTERVIEW%3A%3AMandatory%20Oral%3A%3ALive%20Nicosia%2Fvideo%20grilling%20of%20EDs)

## The Live CySEC Pre-Approval Oral Interview Gate!

Notice a practical hurdle that catches unprepared nominees off guard: before approving a new **Executive Director, Compliance Officer, AMLCO, or Risk Manager**, CySEC does not merely review paper CVs and clean criminal records—CySEC's Authorization and Supervision officers summon candidates to a **live technical regulatory interview**, testing unscripted mastery of the CIF's exact K-factor drivers, [DI87-01 daily reconciliation flow](/bulletins/cysec-directive-di87-01-client-money-segregation-reconciliation), AML risk scoring, and client-onboarding controls!

## Frequently asked questions

### Can one of the two Executive Directors of a Cyprus CIF live in Athens, London, or Frankfurt and fly into Limassol monthly?

In general practice, NO: CySEC requires the two Four-Eyes Executive Directors directing daily operations to reside permanently in Cyprus so local supervisors can hold management physically accountable during unannounced on-site inspections (an additional 3rd executive director sitting on the board may reside in another EEA state if justified).

### Can a newly authorized Class 3 SNI advisory CIF combine the Compliance Officer and AML Compliance Officer (AMLCO) roles in one person?

Yes, under proportionality rules for smaller low-complexity CIFs, a single full-time Cyprus-resident professional holding BOTH the CySEC Advanced Examination AND the CySEC AML Examination certificates may serve simultaneously as Compliance Officer and AMLCO—subject to CySEC approval.

### Can Internal Audit (the Third Line of Defense) be outsourced to a Cyprus accounting firm?

Yes! Unlike Executive Direction and Compliance/AML (which must be in-house), CySEC routinely permits CIFs to outsource the Internal Audit function to an independent Big-4 or specialist Cyprus ICPAC audit firm—provided that firm is NOT the CIF’s external statutory/safeguarding auditor!

### What happens if one of a CIF’s two Executive Directors resigns unexpectedly?

The CIF must notify CySEC immediately via the TRS portal and submit an interim/replacement Personal Questionnaire urgently—operating prolonged periods with only "two eyes" breaches Section 10(1)(b) of Law 87(I)/2017 and risks suspension of new client onboarding!


## Source URLs

- https://www.cysec.gov.cy/en-GB/legislation/services-markets/cifs/
- https://www.esma.europa.eu/sites/default/files/library/esma35-36-2319_joint_esma_and_eba_guidelines_on_the_assessment_of_suitability.pdf
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0565

## Citation

- APA: Lukas Lindqvist, CEFA. (2026). CySEC Limassol Substance Rules: Four-Eyes Principle, Resident Directors & Board Time Limits. Euro Firm Ledger. https://eurofirmledger.com/bulletins/cysec-limassol-substance-four-eyes-executive-director-residency
- Canonical article: [CySEC Limassol Substance Rules: Four-Eyes Principle, Resident Directors & Board Time Limits](https://eurofirmledger.com/bulletins/cysec-limassol-substance-four-eyes-executive-director-residency)
- Site research index: [Euro Firm Ledger](https://eurofirmledger.com/llms-full.txt)