Cyprus: filing with the Cyprus Securities and Exchange Commission
xBRL-CSV only.
| Accepted formats | xbrl-csv-only C751 (19/01/2026) §3-4: « As communicated in Circular C719, CySEC has discontinued the submission of the "Build in Excel" file via its XBRL portal. Consequently, Regulated Entities are required to submit the Register of Information in XBRL-CSV format, which is the only format accepted by the European Banking Authority (EBA). Regulated Entities shall use XBRL Compatible Software that supports mapping and validation against EBA rules and enables the generation of fully compliant XBRL files. The XBRL files shall be compressed (zipped) and submitted through the CySEC XBRL Portal. » Historically (C700, 8/04/2025): « Regulated Entities must fill in the Register of Information Form and submit it to CySEC » and « Regulated Entities may submit an XBRL file » – i.e. in 2025 an Excel 'Register of Information Form' (published 3/04/2025) was accepted via the portal's 'Build in Excel' option. C719 (27/06/2025) is the IFR prudential-reporting circular that ended the Excel option on the XBRL Portal from the 30/06/2025 period. excel template url https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=ead24636-68dd-4a38-a71c-42616f065624 source high confidence |
|---|---|
| Portal | CySEC XBRL Portal (« Create filing » function); the separate CySEC Portal (portal.cysec.gov.cy) is used for ICT-auditor/control-function designations and the TRS system for incident forms – not for the RoI url https://xbrl.cysec.gov.cy/ login prerequisites Registration on the XBRL Portal: « click on Sign Up to create an account ... Fill in your personal data including your desired user name, your business email address and your company name. After clicking on Sign Up, you will get an email which you have to confirm ... After this confirmation a CySEC employee will ultimately activate the account and your account will be ready for use before noon time on the next business day » (Manual for User Registration v1.0, April 2022). C700 §26: « Regulated Entities that have not yet registered in CySEC's XBRL Portal, should do so as soon as possible. » No certificate requirement is mentioned. Contact for queries: prudential@cysec.gov.cy. source high confidence |
| File naming | Not specified by CySEC for the RoI in any circular read; C751 requires fully EBA-compliant XBRL-CSV files, so the ESA default zip name (<LEI>.<CON|IND>_CY_DORA010100_DORA_<YYYY-MM-DD>_<timestamp>.zip) applies by implication. Notes CySEC's own naming rule « Username_DATDIR_IIRN-Version_YY.xlsx » (e.g. XX_DATDIR_0000000001-0_25.xlsx) applies only to incident forms submitted via TRS, not to the RoI. source medium confidence |
| Packaging | other rules
source high confidence |
| 2026 cycle (reference date 31 Dec 2025) | Notes C700 §21: « Regulated Entities must fill in the Register of Information Form and submit it to CySEC on an annual basis, by February 28, each year, with reference date 31 December preceding the reporting date. For the first submission due the deadline is Wednesday, April 30, 2025, with a reference date of March 31, 2025. » C751 §5 (19/01/2026) restates: « no later than 28 February of each year, with reference date 31 December of the year preceding the reporting date ». CySEC's 28 February deadline is a month earlier than the ESA-driven 31 March used by most NCAs. No opening date, extension or correction window is stated. Consolidation levels per Art. 3 of the ESAs' Decision of 8/11/2024 (individual if not in a group or if the parent is outside the EU; otherwise highest EU consolidation level). reference date 2025-12-31 deadline 2026-02-28 source high confidence |
| 2027 cycle (reference date 31 Dec 2026) | reference date 2026-12-31 esa transmission deadline 2027-03-31 announced no deadline 2027-02-28 changes No 2027-specific CySEC circular found as of 2026-10-31. The deadline is the standing annual rule in C700/C751 (« no later than 28 February of each year ») unless amended. 28 February 2027 falls on a Sunday (my calendar computation); CySEC states no next-working-day rule. Later DORA circulars found (C784, June 2026) concern incident-reporting templates v1.3 via TRS, and the 2026 DORA annual-fee forms (Aug/Sep 2026), not the RoI. source medium confidence |
| Test window | No test environment or dry-run window mentioned in CySEC circulars or on the XBRL Portal pages read. low confidence |
| Sign-off | Not described for the XBRL Portal in the sources read (registration is per user; a CySEC employee activates accounts). source low confidence |
| LEI required | Not addressed in C700/C751; the EBA-compliant package and zip name require the entity LEI. low confidence |
| Who files here | Cyprus Investment Firms (CIFs); Central Securities Depositories; Trading Venues; Crypto-Asset Service Providers (CASPs); Alternative Investment Fund Managers (AIFMs); UCITS Management Companies source high confidence |
| Quirks | Earlier-than-ESA deadline: 28 February each year (reference 31 December), set in C700 and repeated in C751.; The Excel-based 'Build in Excel' route was withdrawn by C719 (27/06/2025, an IFR prudential-reporting circular) and confirmed for the RoI by C751; only zipped XBRL-CSV produced with EBA-rule-validating software is accepted.; Portal housekeeping obligations in C751: designate the ICT auditor under the CySEC Portal 'Auditors' section with the « Is ICT » option, and the person responsible for the ICT-risk control function under 'Personnel' (entities other than microenterprises).; « It is noted that the Register of Information will be forwarded to European Supervisory Authorities. » C700 also repealed CySEC Circular 512.; Incident and cyber-threat forms go through the TRS system only (Excel, not digitally signed, feedback file with NO ERROR indication) – a different channel from the RoI's XBRL Portal.; The XBRL Portal's public 'Reporting Requirements' page listed only IPU and Remuneration Benchmarking (EBA 4.2) requirements on 2026-10-31; the DORA RoI filing type is visible only after login. |
| Notes | Solid on format/deadline (C700 + C751 read in full), thin on portal mechanics (no RoI-specific XBRL Portal user guide, feedback format or naming rule published; the portal's public pages show nothing DORA-specific). Circular C719 itself was not read (only cited by C751; a reproduction on gpglobalcy.com returned HTTP 500); secondary sources date it 27 June 2025 and describe it as ending the Excel option for IFR prudential reporting via the XBRL Portal. Central Bank of Cyprus (competent for credit institutions, payment institutions and EMIs): no RoI submission channel, circular or deadline was found on centralbank.cy as of 2026-10-31 – only the 05/12/2024 announcement on DORA's application date (https://www.centralbank.cy/en/announcements/dora-05-12-2024), which does not mention the RoI. No 'cy-cbc' object was therefore created; a CBC-supervised entity should ask the CBC directly. |
The authority's own documents
- Circular C700 – Digital Operational Resilience Act - Reporting Obligations (a) Incident Reporting (b) Register of Information (2025-04-08)
- Circular C751 – Digital Operational Resilience Act – Reporting, Governance and Portal-related obligations (2026-01-19)
- Key aspects of the implementation of DORA (CySEC) (2024-11-12)
- CySEC XBRL Portal – Manual for User Registration, Version 1.0 (2022-04)
- CySEC – Digital Resilience (DORA) page (legislation, circulars, forms)
- CySEC – DORA circulars listing (C735, C731, C701, C700, Key aspects)
- CySEC – DORA notification forms (Register of Information Form 03/04/2025 – NOT downloaded; annual fee forms 2026)
- Register of Information Form (CySEC, 2025 Excel-era template – NOT downloaded, file type unconfirmed) (2025-04-03)
Compiled from the authority's published guidance on 31 October 2026, with a source and confidence per field. Low confidence means the authority has not published it in writing and the statement is an inference from standing rules or a third party. Check the authority's page before the window opens, and send corrections to hello@roifile.com.