Which transactions must be reported to CySEC, by when, and how?

Under Article 26(1), an investment firm that executes transactions in financial instruments must report complete and accurate details to its competent authority as quickly as possible, and no later than the close of the following working day. The scope in Article 26(2) is broad. It covers instruments traded on a trading venue or admitted to trading there, including those awaiting admission; instruments whose underlying is traded on a venue; and instruments whose underlying is an index or basket made up of venue-traded instruments. A derivative on a listed share is therefore reportable even if the derivative itself is not traded on any venue. The duty applies whether the transaction is executed on a venue or not. This is still the rule in practice. The 2024 review narrows it for some OTC derivatives, but only once RTS 22 is revised, and ESMA put that revision on hold in June 2025.

When a firm transmits an order to another firm for execution, it either passes on all the details needed for the report, so that the executing firm can report, or it reports the executed order itself as a transaction, stating that it relates to a transmitted order. Trades carried out through a venue's systems by members or participants that are not subject to MiFIR are reported by the venue.

The content is set in Article 26(3) and, in detail, in RTS 22. A report gives the instrument, the quantity, the date and time of execution and the price. It identifies the client for whom the trade was done, with a legal entity identifier (LEI) for clients that are legal persons, and the people and algorithms in the firm that took the investment decision and that executed it. It shows the waiver under which the trade took place, identifies the firms involved and, for shares and sovereign debt, flags whether the trade was a short sale. For commodity derivatives it shows whether the trade objectively and measurably reduces risk. Trades not executed on a trading venue also carry a flag showing the transaction type. The exam material ties that flag to trades executed on a venue; Article 26(3) has attached it to trades outside a venue since MiFIR first applied on 3 January 2018.

The 2024 review rewrote Article 26(3), but RTS 22 has not been amended, so firms still report the fields above, including the waiver and short-sale flags.

A firm may report itself, through an ARM that acts for it, or through the venue on whose system the trade was executed. It is not responsible for failures attributable to the ARM or venue, but must take reasonable steps to check the reports made for it. A venue that reports for firms needs sound security that keeps the transfer channel secure and authenticated, limits the risk of corrupted data and unauthorised access, and prevents leakage of information, plus adequate resources and back-up facilities. The exam material puts this duty on "trading firms" reporting for investment firms; Article 26(7) puts it on trading venues. A firm reporting through a trade repository that is approved as an ARM has met its duty once the report reaches the authority in time. Errors or omissions are corrected by whoever submitted the report, which sends a corrected report.

The exam material says CySEC may approve reporting or trade-matching systems, trade repositories among them, as ARMs. That sentence survives in Article 26(7), but since 1 January 2022 ARMs have been authorised and supervised by ESMA under Article 27b, except derogated ARMs, which national authorities supervise (in Cyprus, CySEC). Under Article 27i an ARM reports by the end of the following working day, checks reports for completeness and obvious errors, and keeps sound security, governed since 17 January 2025 by the Digital Operational Resilience Act (DORA). See also What are APAs, ARMs and CTPs, and who supervises them today?

The authority that receives reports makes sure the authority of the most relevant market by liquidity also receives them. The exam material says CySEC gives the information to ESMA on request. That was the rule until 31 December 2021. Since 1 January 2022 authorities have made all reported information available to ESMA without undue delay. The 2024 review adds that reports must also reach the authorities of transmitting firms, of branches involved and of the venues used. ESMA has said that, until a revised RTS 22 applies, reports are shared as before.

Transactions executed wholly or partly through a branch are reported to the authority of the firm's home Member State. RTS 22 has required this since 3 January 2018, unless the home and host authorities agree otherwise. The 2024 review wrote this rule into Article 26(8), together with another rule RTS 22 has applied since 2018: branches of third-country firms report to the authority that authorised them. Where a host authority such as CySEC receives branch reports under MiFID II, it passes them to the home authority unless that authority does not want them. The rule concerns investment firms' branches, not trading venues.