Cyprus CySEC Supervisory Regime 2026 — Capital, Reporting, Audit, On-Site Inspection

1. CySEC's role

Cyprus Securities and Exchange Commission (CySEC) is the competent authority for: MiFID II CIFs, MiCA CASPs, AIFMs, UCITS managers, listed companies (with the Cyprus Stock Exchange). CySEC operates a risk-based supervisory framework + thematic-review programmes + on-site inspections.

2. Capital adequacy — IFR / IFD

MiFID II Cyprus CIFs are supervised under EU Investment Firms Regulation 2019/2033 (IFR) + Investment Firms Directive 2019/2034 (IFD) — replacing the old CRR / CRD framework for investment firms from 2021. Three classes: Class 1 (largest, full CRR), Class 2 (full IFR), Class 3 (small + non-interconnected, simplified).

3. Quarterly + annual reporting

• Prudential — IFR/IFD quarterly + annual (Class 2 + 3); CRR quarterly (Class 1).
• MiFIR transaction reporting — daily on T+1.
• AML reporting — annual MLRO report to MOKAS + ad-hoc suspicious activity reports.
• ICAAP — annual Internal Capital Adequacy Assessment Process (Class 2).
• ILAAP — annual liquidity assessment.
• Best-execution reports — annual RTS 27 / RTS 28 disclosures.
• MiCA-CASP — quarterly + annual CySEC reporting starting from authorisation.
• AIFMD reporting — quarterly to ESMA via CySEC (Annex IV reporting).

4. Annual external audit

• Statutory audit of financial statements by ICPAC-registered audit firm.
• Long-form audit report for CySEC including testing of capital adequacy, client money handling, AML controls, governance.
• Audit findings reported to both the board and CySEC.
• Audit cost typically 0.5-2% of revenue depending on firm size + complexity.

5. AML + governance inspections

• AML / KYC reviews — sampling of customer files for due-diligence completeness.
• Transaction-monitoring effectiveness — were SARs filed on suspicious flows?
• Governance — board composition, committees, independent oversight.
• Conflicts of interest — disclosed + managed appropriately.
• Outsourcing oversight — robust monitoring of outsourced functions.

6. On-site inspections

CySEC conducts on-site inspections — risk-based, thematic, or for-cause. Inspection typical sequence:

1. 1Pre-inspection notification (30+ days; for-cause may be shorter or unannounced).
2. 2Document request — extensive list, response window 2-4 weeks.
3. 3On-site visit (1-2 weeks typical) — interviews + document review.
4. 4Draft findings — opportunity to respond.
5. 5Final report — published findings + remediation requirements + sanctions if applicable.
6. 6Follow-up — 6-12 month monitoring of remediation.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.