CySEC issues Circular C700: DORA Reporting Requirements for Regulated Entities
On 8 April 2025, the Cyprus Securities and Exchange Commission (CySEC) issued Circular C700 to inform regulated entities of their reporting obligations under the Digital Operational Resilience Act (DORA), which entered into application across the EU on 17 January 2025. This circular provides further clarity on the requirements set out in Articles 15 and 28 of DORA, covering the two major areas of ICT-related incident reporting and the register of information on third-party ICT service providers, respectively.
As part of the transitional implementation of DORA, CySEC requires all regulated entities to submit their first register of information (ROI) by 30 April 2025, with reference date 31 March 2025. This requirement will be annually, with deadline 28th of February on subsequent years.
It is important to note that:
- The ROI must cover contractual arrangements with ICT third-party service providers that support critical or important functions.
- Submissions must follow the template and instructions developed by the European Supervisory Authorities (ESAs), which are available on ESMA’s website.
- The data must be submitted in XBRL file through the CySEC XBRL Portal
In line with Article 19(1) of DORA, regulated entities must report any major ICT-related incident to CySEC from 17 January 2025 onwards. The reporting timeline is as follows:
- Initial Notification: Within 4 hours of classifying an incident as major.
- Intermediate Report: Within 72 hours of the initial notification.
- Final Report: Within one month of the intermediate report.
Entities are also encouraged to voluntarily report significant cyber threats, using the same forms and submission through the TRS System.
If you require more information or support regarding the DORA reporting obligation, please contact our Regulatory Compliance team by email at info@salvusfunds.com .We are always ready to answer your questions and support you in achieving regulatory compliance.
#StayAhead