What are the five stages of CySEC's SREP, and what happens at each?

The exam material describes the five-stage SREP from CySEC's 2012 guidelines, Circular C027. The first stage is planning: CySEC's internal planning of the review for each CIF, which includes asking the firm to submit its ICAAP report. The second is review and assessment of the ICAAP submission. CySEC typically reviews the report at its desk, together with the process the firm followed to prepare it and any supporting documents, and it may add an on-site assessment of how the ICAAP is applied in practice.

The third stage is the review of additional information. CySEC brings in the outcome of its ongoing supervision and of recent inspections or visits relevant to the ICAAP, and it may review the firm's controls and governance, the results of any SREP on-site review and its general compliance with the rules. The fourth stage is supervisory measures for risk mitigation: CySEC sets the Pillar 2 capital requirement and imposes any other measures needed to reduce risk. The fifth is SREP validation, CySEC's internal and independent check that its SREP work, method and results are sound and consistent. Dialogue between the firm and CySEC runs through every stage rather than forming a stage of its own.

Read the stages as a chain in which each one uses the output of the one before. Planning produces the request, so the ICAAP report exists before any review starts. The ICAAP review produces CySEC's first view of the firm's own assessment. Additional information then tests that view against what supervision and inspections have shown. Only with the combined evidence does CySEC decide on capital and other measures, and validation checks that decision before it is final. To place any event, ask what must already have happened for it to take place, and what it produces for the next step. The principles that guide the SREP, such as a risk-based approach and the identification of risks and deficiencies, apply across the stages rather than forming stages themselves; see What is the SREP, how intense is it, and what does it decide?.

CySEC still publishes Circular C027, but since 19 June 2023 joint EBA and ESMA guidelines, which CySEC lists on its website, have set common procedures for reviewing Class 2 firms under the IFD, and Class 3 firms where CySEC decides a review is needed. Instead of five stages, the guidelines describe ten components: categorisation of the firm; monitoring of key indicators; business model analysis; internal governance and firm-wide controls; risks to capital; risks to liquidity; adequacy of own funds; adequacy of liquidity resources; an overall SREP assessment and score; and supervisory measures, including early intervention where needed. The firm's category drives how often each element is reassessed. For the few CIFs still under the CRR (Class 1-minus), the review follows section 55 of Law 97(I)/2021 and the EBA's SREP guidelines for institutions (EBA/GL/2022/03), which apply from 1 January 2023. Revised EBA guidelines (EBA/GL/2026/06), published on 26 June 2026, will replace them from 1 January 2027.

Since 5 November 2021, Law 165(I)/2021 has set out the measures. CySEC may act early where a firm is likely to breach its requirements within the next 12 months. It may require the firm to present, within one year, a plan to restore compliance, and set a deadline for carrying it out. It may also require additional own funds and specific liquidity requirements, and it may give capital guidance. Its other powers include limiting variable pay as a share of net revenues and restricting distributions. The five-stage model remains the exam's framework, so learn it as the order in which CySEC's 2012 process runs.