Plain-English summaries of new publications from CySEC, the Central Bank of Cyprus, ESMA, the EBA, AMLA, the FATF and the EU institutions that matter to Cyprus investment firms. Each update says what changes, who is affected, what to do and by when, and links to the official text.
Written for certified persons, compliance and AML officers, and candidates preparing for the CySEC exams. We add updates as the authorities publish them and send a weekly e-mail brief on Mondays. Where an update touches the exam syllabus, it links to the matching study notes.
11 updatesLast updated By the ExamPass CY editorial teamRSS feed
The last quarter of 2026 brings a cluster of dates for Cyprus firms. CySEC's quarterly statistics returns are due on 30 October (QST-MC for fund managers, QST-ASP for administrative service providers) and 4 November (QST-CIF for investment firms). A press…
On 1 October 2026 AMLA published its final draft regulatory technical standards (RTS) on customer due diligence under Article 28(1) of Regulation (EU) 2024/1624 (AMLR), together with RTS on business relationships and on group-wide requirements. The CDD standards set out…
On 30 September 2026 the Central Bank of Cyprus (CBC) announced a €750,000 fine on a credit institution, decided on 29 September 2026. The fine follows findings from an examination carried out in 2023 and concerns failures to comply with…
In September 2026 the EBA (24 September) and ESMA (30 September, ESMA75-113276571-1721) answered the Commission's consultation on reviewing MiCA. ESMA wants stricter marketing and cost rules, duties for staking, lending and borrowing, an express ban on CASP services for non-compliant…
On 29 September 2026 CySEC issued Circular C801 to Cyprus investment firms (CIFs). It withdraws Circular ΕΓ144-2009-07 with immediate effect and applies ESMA Q&A 2785, in which the European Commission confirms that the MiFID II ban on using client funds…
On 18 September 2026 the EBA published final Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09). They are addressed to credit institutions, investment firms that are not small and non-interconnected, payment and e-money institutions and…
On 16 September 2026 staff of the European Supervisory Authorities (ESAs) issued operational instructions on reporting major ICT-related incidents under DORA. The 14 points aim to improve data quality and consistency: for example, monetary fields are reported in thousands of…
On 8 September 2026 the European Commission adopted C(2026) 6179, which extends the EU standards on AML/CFT central contact points to crypto-asset service providers (CASPs). A host Member State may require a CASP from another Member State that runs establishments…
Commission Delegated Regulation (EU) 2026/1092, published in the Official Journal on 4 September 2026, sets the EU code of conduct that research paid for by an issuer must follow to carry the label 'issuer-sponsored research'. It entered into force on…
ESMA's statement of 20 July 2026 (ESMA74-2119945926-3773), relayed by CySEC Circular C797 on 26 August 2026, sets two dates. From 7 December 2026, under amended settlement discipline rules still awaiting publication in the Official Journal, professional clients' allocations and confirmations…
On 3 July 2026 ESMA launched an EU-wide common supervisory action on the risk management function of UCITS management companies and AIFMs, to run through 2026 and 2027. CySEC Circular C795 of 12 August 2026 tells Cyprus fund managers that…