CySEC requires firms to report annual costs of major ICT incidents

Nicosia, Cyprus. The Cyprus Securities and Exchange Commission (CySEC) has issued guidance requiring financial firms under its supervision to calculate and report the annual costs and losses arising from major information and communications technology (ICT) incidents.

The requirements follow joint guidelines adopted by Europe’s three financial supervisory authorities under the EU’s Digital Operational Resilience Act (DORA).

Entities covered

The requirements apply to a broad range of financial entities regulated in Cyprus, including investment firms, crypto-asset service providers and certain issuers of asset-referenced tokens.

They also apply to central securities depositories, central counterparties, trading venues, alternative investment fund managers, management companies and crowdfunding service providers.

Reporting requirements

Financial entities that experienced major ICT-related incidents during the relevant reporting period must calculate the total costs and losses caused by those incidents and submit the information to CySEC.

The calculation is intended to cover all costs and losses associated with major ICT incidents occurring during the selected reference year.

Reference period

Regulated entities must select either the completed calendar year or the completed accounting year for which they have finalised financial statements as their reference period.

CySEC said the selected reference year must be clearly stated in the report and used consistently in future calculations and submissions.

European guidance

CySEC said its guidance provides further information on completing the reporting template required under DORA. The regulator advised firms to review the joint European guidelines before submitting their reports.