Cyprus Securities and Exchange Commission (CySEC) issued new guidance on Tuesday, requiring financial firms under its supervision to calculate and report the annual costs and losses arising from major information and communications technology (ICT) incidents.

The requirements apply to a broad range of financial entities regulated in Cyprus, including investment firms, crypto-asset service providers, and certain issuers of asset-referenced tokens.

It also applies to central securities depositories, central counterparties, trading venues, alternative investment fund managers, management companies and crowdfunding service providers.

The new requirements follow the adoption of joint guidelines by Europe’s three financial supervisory authorities on how firms should calculate the combined annual financial impact of major ICT-related incidents.

CySEC said the guidance provided further information on how regulated entities should submit the reporting template required under the EU’s Digital Operational Resilience Act (DORA).

Under the rules, financial entities that have experienced major ICT-related incidents during the relevant reporting period must calculate the total costs and losses caused by those incidents and submit the information to CySEC.

The calculation is intended to capture all costs and losses associated with major ICT incidents that occurred during the selected reference year.

A regulated entity must choose whether to use the completed calendar year or the completed accounting year for which it has finalised its financial statements as its reference period.

CySEC said the chosen reference year must be clearly stated in the report and then used consistently in future calculations and submissions.

The regulator said firms should review the joint European guidelines carefully before completing the report.

Under the standard timetable, reports must be submitted by June 30 each year, following the reference year in which the major ICT incidents occurred.

The requirement applies only to financial entities that actually experienced major ICT-related incidents during the relevant reporting period.

CySEC has also introduced a special deadline for incidents that occurred during 2025.

Firms that experienced major ICT-related incidents in 2025 must submit their reports to CySEC by September 30, 2026.

The regulator provided examples to clarify how the reporting periods and deadlines should work.

If a financial entity experienced two major ICT-related incidents on January 10, 2026 and March 30, 2026, and chose the calendar year as its reference period, both incidents would be included in the report.

That report would then have to be submitted to CySEC by June 30, 2027, the regulator stated.

In another example, a financial entity that experienced a single major ICT-related incident on December 12, 2025 would include that incident in its report and would have to submit the report by September 30, 2026.

The new reporting framework is part of wider European efforts to make the financial sector more resilient to disruptions caused by cyber incidents, technology failures and other ICT-related problems.

For Cyprus, the rules place additional reporting responsibilities on firms operating under the country’s financial regulatory framework, with CySEC acting as the national authority receiving the information.

CySEC said reports must be submitted exclusively through its online portal under the title “Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents”.