What sanctions apply to market abuse in the EU and in Cyprus?

MAR does not impose fines itself. It requires Member States to give regulators minimum powers for breaches of the main prohibitions and duties: insider dealing, unlawful disclosure and market manipulation; the duties to prevent, detect and report abuse; public disclosure of inside information; insider lists; managers' transactions; and investment recommendations. Failing to cooperate with an investigation, an inspection or a request for information can be sanctioned too.

The minimum measures are: an order to stop the conduct and not repeat it; disgorgement of the profits gained or losses avoided, as far as they can be determined; a public warning naming the person responsible and the nature of the breach; and withdrawal or suspension of an investment firm's authorisation. Regulators must also be able to ban a manager of an investment firm, or another responsible individual, from management functions for a time. Repeated breaches of the bans on insider dealing, unlawful disclosure or manipulation allow a longer ban. A temporary ban on dealing for own account is also available. The exam material, the original MAR text and the Cyprus law call the longer ban permanent; the Listing Act changed MAR's minimum to a ban of at least ten years, for Member States to apply by 5 June 2026, which a permanent ban satisfies.

MAR's figures are floors for the maximum fines: each Member State must allow at least these ceilings and may set higher ones. Where the profit gained or loss avoided can be determined, the maximum must be at least three times that amount. For individuals, the ceilings are at least €5 million for insider dealing, unlawful disclosure and manipulation, €1 million for detection and public-disclosure failures, and €500,000 for insider lists, managers' transactions and recommendations. For companies the exam material gives €15 million or 15% of annual turnover, €2.5 million or 2%, and €1 million. The Listing Act, which Member States had to apply by 5 June 2026, keeps €15 million or 15% and, for detection failures only, €2.5 million or 2%. It sets public-disclosure failures at 2% of turnover and insider lists and managers' transactions at 0.8%, both with fixed minimum amounts (lower for SMEs) where the percentage would be disproportionately low, and sets recommendations at 0.8% or €1 million.

In Cyprus, Law 102(I)/2016 lets CySEC, without prejudice to criminal proceedings, impose maximum fines of €5,000,000 on individuals and €15,000,000 on companies for insider dealing, unlawful disclosure and manipulation; €1,000,000 and €2,500,000 for detection and public-disclosure breaches; and €500,000 and €1,000,000 for insider lists, managers' transactions and recommendations. These are fixed amounts with no turnover percentage, and the law had not been amended for the Listing Act when this note was reviewed. Law 102(I)/2016 also allows fines of up to three times the profit gained or loss avoided, where that amount can be determined. Where no specific fine applies, or a person ignores a CySEC order or ban, the fine is up to €350,000, or €700,000 for a repeat, or up to double the proven benefit if that is higher. Giving CySEC false, misleading or inaccurate information, or withholding material information, is also a crime punishable by up to five years' imprisonment and/or €700,000.

Law 136(I)/2016 makes serious insider dealing, unlawful disclosure and manipulation committed intentionally criminal offences, tried in the courts. Seriousness turns on factors such as market impact, the profit made and the value traded. Insider dealing, including recommending or inducing it, and market manipulation carry up to five years' imprisonment and/or a fine of up to €350,000, and a convicted person is automatically barred from dealing in financial instruments for five years; unlawful disclosure carries up to three years and/or €200,000. Attempts, incitement and aiding are punishable too. A company is liable for offences committed for its benefit by persons in a leading position, or made possible by their lack of supervision, with a fine of up to €500,000 and possible exclusion from public benefits, bans on its business, winding-up or closure of establishments.

CySEC publishes each sanction decision on its website immediately after informing the person concerned, stating at least the type and nature of the breach and the person's identity, and keeps it online for at least five years. It may defer publication, publish anonymously or, in limited cases, not publish, where naming the person would be disproportionate or would put an investigation or market stability at risk.