Report ESMA43-502934634-2902

ESMA sanctions report 2025: Cyprus third for MiFID II enforcement

European Securities and Markets Authority (ESMA)Report ESMA43-502934634-2902Issued 15 October 2026

By the ExamPass CY editorial teamPublished 19 October 2026

Enforcement
MiFID II
Market abuse

Short answer

On 15 October 2026 ESMA published its third report on sanctions in the EEA (ESMA43-502934634-2902). National supervisors imposed 955 sanctions and measures in 2025, with fines of almost €82 million. Under MiFID II and MiFIR, Cyprus ranked third both by number of measures (34) and by value of fines, and it was the only country to use temporary bans, suspension and withdrawal of authorisation. Cyprus imposed no MAR sanctions. The report sets no new obligation; ESMA calls for more convergence in enforcement.

At a glance

What it is: ESMA's third annual report, published on 15 October 2026, on the administrative sanctions and measures that national supervisors in the EEA imposed in 2025 under the EU acts in ESMA's remit.
Key points: 955 sanctions and measures and €81.9 million in fines. Under MiFID II and MiFIR, Cyprus ranked third by number (34) and by value of fines. First sanctions under MiCA. 16% of all measures were settlements.
Who should read it: Boards, compliance officers and risk officers of Cyprus investment firms, fund managers and CASPs, and anyone who follows how CySEC uses its sanctioning powers.
Cyprus investment firms (CIFs)
UCITS management companies and AIFMs
Crypto-asset service providers (CASPs)
Compliance officers, risk officers and boards
What to do: Nothing is required. Firms may want to note where supervisors focus, mainly MiFID II and MAR breaches, and the rising use of settlements.
What happens next: ESMA will keep fostering exchanges between national supervisors, including case discussions, and will publish the report every year.

What does the ESMA report show for the EEA?

Thirty national supervisors sent ESMA data on the sanctions and measures imposed in their countries in 2025. In total, 955 administrative sanctions and measures were imposed by 29 supervisors, including 510 fines with a combined value of €81,896,178. The number is stable against 976 in 2023 and 975 in 2024. The value of fines fell from €100,186,062 in 2024 but was higher than the €71,259,970 of 2023.

Most measures were imposed under the Market Abuse Regulation (350) and the AIFM Directive (268). The largest amounts were imposed under MiFID II and MiFIR (€36,598,918) and MAR (€33,392,952). Germany, France and Spain together account for two thirds of the value of fines. The two largest single fines, €7,400,000 each, were imposed in Germany for breaches of MiFID II organisational requirements, both through a settlement procedure.

Settlements were used in 13 Member States. 153 measures (16%) were settled, worth €35,577,141, which ESMA calls a significant increase on 2024. 2025 was also the first year with sanctions under MiCA: 10 measures in Austria, Germany, Liechtenstein and the Netherlands, including one fine of €600,000 in Germany.

Where does Cyprus stand?

Under MiFID II and MiFIR, 264 sanctions and measures were imposed in 24 Member States. Cyprus imposed 34, the third highest number after Hungary (43) and Italy (40). By value of fines under these rules, Cyprus also came third, after Germany and France, and the top three together account for 80% of the total of €36,598,918.

Cyprus was the only country that used some of the more rarely used measures under MiFID II and MiFIR in 2025: six temporary bans, one suspension and two withdrawals of authorisation. For how these measures work, see our study note on suspension and withdrawal of a CIF's authorisation.

Across all acts, Cyprus accounted for 3.19% of the value of fines in the EEA in 2025 (1.10% in 2024) and 3.56% of the number of sanctions and measures (0.82% in 2024). No sanctions or measures under MAR were imposed in Cyprus in 2025, and none under the UCITS Directive since 2016; ESMA notes that Cyprus has a small market by capitalisation and very few UCITS managers.

What does ESMA want to change?

ESMA finds significant differences between countries in the number and type of sanctions, the level of fines and the use of settlements. It sees a need for stronger convergence, in particular where limited enforcement activity cannot be explained by market size. ESMA adds that supervisory effectiveness should not be measured only by the number or value of sanctions in a Member State.

As a next step ESMA will continue to foster exchanges among national supervisors, including through case discussions. The underlying data are published in an Excel table, with a one-page enforcement snapshot. The report sets no new obligation and no deadline for firms. For the MAR sanctions regime, see our study note on market abuse sanctions, and for CySEC's powers, our note on CySEC and CBC powers.

In the official wording

“The objective is to ensure that similar breaches result in similar enforcement outcomes across the EU, irrespective of where they have been committed.”

ESMA, ESMA's third Sanctions Report highlights the need for greater convergence in enforcement, Next steps

When does it apply?

Applies now

Nothing new applies: the report sets no new obligation and no deadline for firms.

Applies later

No later dates announced.

What to do

Optional: brief the board and the compliance function on the 2025 enforcement figures for Cyprus, in particular the MiFID II measures.No fixed deadline
Optional: note that most sanctions across the EEA concern MAR and MiFID II breaches and that settlements are used more often.No fixed deadline

In the exam

Administrative sanctions and measures under MiFID II and MAR, and the powers CySEC uses to impose them, are part of the CySEC Advanced and Basic exam material.

Related study notes

Cypriot Investment Firms (CIFs)When can CySEC suspend or withdraw a CIF's authorisation, and what happens to clients?The grounds for withdrawal, how total, partial and immediate suspension work, and what a firm must do for its clients when it gives up or loses its licence.Market Abuse (MAR)What sanctions apply to market abuse in the EU and in Cyprus?The administrative measures and maximum fines MAR requires, the Listing Act changes, CySEC's fines under Law 102(I)/2016, criminal penalties under Law 136(I)/2016, and publication of decisions.Investment Services Law and the ICFWho supervises investment firms in Cyprus, and what happens if someone misleads them?The two competent authorities and how they split the work, their shared powers, professional secrecy, the tied-agent register, CySEC's contact-point role, and the duty of accuracy with its criminal and administrative consequences.

Preparing for an exam?

Practise the topics behind this update

Exam-style questions with a hint before you answer and a full explanation after, chapter by chapter.

CySEC AdvancedTry 10 free questions for CySEC Advanced See the All-in-One for CySEC Advanced
CySEC BasicTry 10 free questions for CySEC Basic See the All-in-One for CySEC Basic

Sources

Report on sanctions and measures imposed in Member States in 2025 (ESMA43-502934634-2902) (opens in a new tab)
ESMA15 October 2026Official text
ESMA's third Sanctions Report highlights the need for greater convergence in enforcement (opens in a new tab)
ESMA15 October 2026Official text
Enforcement snapshot: sanctions and measures under EU acts in 2025 (ESMA43-502934634-2953) (opens in a new tab)
ESMA15 October 2026Official text

Summary prepared by the ExamPass CY editorial team; it is not the official text. Quotations are reproduced from the source for the purpose of reporting and review.

This document has been drafted using material downloaded from ESMA's website. ESMA does not endorse this publication and in no way is liable for copyright or other intellectual property rights infringements nor for any damages caused to third parties through this publication.

Important information

Our regulatory updates are a general information service published by ExamPass CY. Each item is a summary, prepared and reviewed by the ExamPass CY editorial team, of material published by the authority named in the source line. It is not legal, regulatory, tax or investment advice, and it is not a recommendation to buy, sell or hold any financial instrument or to use any service. It does not take account of your circumstances. Summaries are selective and may not reflect later changes; only the official text published by the authority is authoritative. Read the official source, and take professional advice where needed, before acting on anything you read here. ExamPass CY is not affiliated with, or endorsed by, CySEC or any other authority mentioned. To the extent permitted by law, ExamPass CY accepts no liability for decisions taken on the basis of this content.

Reviewed by the ExamPass CY editorial team before publication. Errors are corrected promptly and marked with a dated note.

Editorial policy Report an error