CySEC Circular C799: yearly DORA report on the costs and losses of major ICT incidents

CySEC issued Circular C799 on 8 September 2026. We have not read the circular itself; according to published summaries and a press report, it is addressed to CIFs, crypto-asset service providers, certain issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, AIFMs, management companies and crowdfunding service providers. It asks them to estimate and report to CySEC the aggregated annual costs and losses of their major ICT-related incidents, following the ESAs' Joint Guidelines and their template.

Reports are submitted only through the CySEC Portal, under the title 'Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents', by 30 June following the reference year. For 2025 there was a special deadline of 30 September 2026. That date has passed, so firms in scope should check that their report was filed. For a firm that reports on calendar years, the report for 2026 is due by 30 June 2027.

The duty comes from Article 11(10) of DORA (Regulation (EU) 2022/2554): financial entities other than microenterprises must report to their competent authority, on its request, an estimate of the aggregated annual costs and losses caused by major ICT-related incidents. Article 11(11) asked the ESAs (EBA, EIOPA and ESMA) to issue common guidelines on the estimate. They published them on 17 July 2024 (JC 2024 34), and the guidelines apply from 19 May 2025. ESMA's compliance table, updated on 27 August 2026, records that CySEC complies or intends to comply: its Board decided on 5 May 2025 to adopt the guidelines once CySEC was designated as a competent authority under DORA, and that designation has since been completed.

Each firm chooses its reference year: either the completed calendar year or its completed accounting year for which the financial statements have been finalised. Once chosen, the same basis is used for later estimates; a firm may switch by notifying the competent authority, provided the authority does not object within two months. Costs and losses of incidents that fall before or after the reference year are left out.

The estimate includes every ICT-related incident classified as major under Delegated Regulation (EU) 2024/1772 for which the firm submitted its final incident report under Article 19(4)(c) of DORA in the reference year. It also includes incidents whose final report was submitted in an earlier year but which had a quantifiable financial impact in the reference year. Costs and losses of incidents that were not major are outside the guidelines.

For each incident the firm first estimates the gross costs and losses, using the types listed in Article 7 of Delegated Regulation (EU) 2024/1772: expropriated funds or financial assets, including theft; replacing or relocating software, hardware or infrastructure; staff costs; fees for breaching contracts; redress and compensation to customers; forgone revenues; communication costs; and advisory costs such as legal, forensic and remediation services. Day-to-day costs, such as general maintenance, improvements made after the incident and insurance premiums, are excluded. The firm then estimates the financial recoveries for each incident, as specified in Annex II to Implementing Regulation (EU) 2025/302, and aggregates both figures across incidents. Only gross figures are requested: the ESAs dropped net figures because supervisors can calculate them.

The starting point is the costs, losses and recoveries shown in the financial statements of the reference year, such as the profit and loss account, or in supervisory reporting where it applies. Accounting provisions in the financial statements are included. Where accurate data is not available, firms estimate from other available data. Adjustments to an estimate submitted for an earlier year are included in the year in which they are made.

The template in the Annex to the guidelines asks for the firm's name, its Legal Entity Identifier, the start and end dates of its reference year and the currency. It then has one line for each major incident: the date the final incident report was submitted, the incident reference number (the same code as in the final report), and the gross costs and losses and the recoveries in the reference year, in thousands of units, with totals for the year. The breakdown by incident supports the aggregate figures.

In practice, this works best when the incident register and the finance records use the same incident codes and agree on which costs count. According to the same published summaries and press report, only firms that had major ICT-related incidents in the reporting period need to submit the report. For background on how DORA fits into firms' organisational requirements, see our study note on organisational requirements.