CySEC tightens cross-border oversight of Cyprus investment firms

The Cyprus Securities and Exchange Commission (CySEC) has issued a new circular requiring certain Cyprus Investment Firms (CIFs) to complete a new electronic cross-border reporting form covering their 2025 activities across the European Economic Area.

The circular forms part of an exercise initiated by the European Securities and Markets Authority (ESMA).

The exercise is addressed to all investment firms providing services in member states of the European Economic Area, including Norway, Iceland and Liechtenstein, other than their home Member State during 2025.

As in the previous year, the process will be conducted through an EU online platform in the format of an electronic questionnaire.

However, ESMA has introduced technical improvements to this year’s reporting template, particularly regarding the collection of data on cross-border activity carried out under the freedom to provide investment services and activities.

The updated template places emphasis on services provided to retail clients, including clients treated as professionals on request under Section II of Annex II of MiFID II, with data to be analysed for each host Member State.

CySEC explained that the cross-border online questionnaire must be completed by CIFs that were authorised by December 31, 2025 and that provided cross-border services to more than 50 active retail clients in at least one host Member State during the year.

For the purposes of the exercise, retail clients include those treated as professionals on request under the relevant MiFID II provisions.

The information to be submitted covers the reporting period from January 1, 2025 to December 31, 2025, with December 31, 2025 serving as the reference date where applicable.

The circular clarifies that only services provided on a freedom to provide services basis must be reported, while services delivered through a branch or permanent presence in another country under the freedom of establishment framework must not be included.

CIFs are required to exclude inactive clients from their reporting, with inactivity defined strictly and cumulatively.

A client is considered inactive only if the inactivity lasted at least one year, no investment or ancillary services were provided during that time, and the firm no longer received any revenue from the client.

If a firm continues to receive any form of remuneration from a client during a period of inactivity, such as account maintenance fees for an open but unused securities account, that client must still be included in the reporting, CySEC stated.

Firms may use the residence of their clients to determine whether services were provided in another member state.

CySEC urged firms to carefully assess whether they fall within the scope of the exercise by consulting all relevant criteria outlined in the circular.

CIFs that meet the threshold of more than 50 active retail clients in at least one EEA member state must submit a single valid company email address to which the electronic form will be sent.

This email address, such as compliance or general information accounts, must be sent to riskstatistics.cifs@cysec.gov.cy no later than Wednesday February 18, 2026.

CySEC will send the link to the electronic form only to those firms that fall within the scope of the exercise.

Firms that do not meet the threshold of more than 50 active retail clients in at least one EEA member state must inform CySEC that they are not required to complete the form by emailing the same address by Wednesday February 18, 2026.

Further detailed guidance on how to complete the electronic form and the final submission deadline will be issued through a new circular to be published in due course.

Failure to comply promptly and properly with the requirements may result in administrative penalties, the commission warned.

CySEC also made clear that it will not send reminders to firms that fail to comply within the specified timeframe.