What does the Prospectus Regulation cover, and how is it enforced in Cyprus?

Regulation (EU) 2017/1129, the Prospectus Regulation, sets out how a prospectus is drawn up, approved and distributed for public offers of securities and for admissions to a regulated market anywhere in the EU. It was adopted on 14 June 2017, entered into force on 20 July 2017 and has applied in full since 21 July 2019. It applies directly and replaced the Prospectus Directive (2003/71/EC). Delegated Regulations 2019/980 and 2019/979 add the detail.

The Listing Act, Regulation (EU) 2024/2809, amended it in three stages: 4 December 2024 (new exemptions and shorter deadlines, among other changes), 5 March 2026 (two new lighter prospectuses) and 5 June 2026 (a Union-wide small-offer exemption, a standard format and a 300-page cap for share prospectuses). All three stages now apply. A prospectus approved before 5 June 2026 stays governed by the text in force at its approval until its validity ends.

CySEC is the competent authority in Cyprus, designated by the Minister of Finance in 2019. The exam material says Law 114(I)/2005, the older public offer and prospectus law, is pending repeal and will be replaced by a new law. None had been enacted when this note was reviewed, so Law 114 remains in force as far as it still applies. It supplies the rules on signatories and civil liability (sections 20 to 24) and CySEC's fees (section 43). The language directive the exam material cites (RAD 270/2016) was repealed on 14 February 2025 and replaced by CySEC Directive DI 73-2009-05. The exam material also refers once to 'Law 114(I)/2015'; the year is 2005.

Six kinds of securities fall outside the Regulation altogether: units of open-ended funds, such as a UCITS (What is a UCITS, and how do common funds and VCICs differ?), while units of closed-end funds, for example a closed-ended AIF (What is an AIF in Cyprus, what forms can it take, and how must it be organised?), stay in scope; non-equity securities of Member States and their regional or local authorities, of public international bodies that include a Member State, of the ECB and of national central banks; shares in the capital of a Member State's central bank; securities that a Member State, or one of its regional or local authorities, guarantees unconditionally and irrevocably; securities that recognised non-profit bodies or associations with legal status issue to fund their non-profit aims; and non-fungible shares mainly giving a right to occupy a flat or other property, which cannot be sold without giving up that right.

Excluded is not the same as exempt. An exempt offer or admission stays inside the Regulation, but an exemption removes the duty to publish (see When is a prospectus required, and which offers and admissions are exempt?). For an exempt offer or admission a prospectus can still be prepared voluntarily; once approved, it has all the rights and duties of a required one, including the passport.

The exam material lists a further exclusion: public offers raising less than €1,000,000 in the Union over 12 months. The Listing Act deleted that floor on 4 December 2024. Small offers are now inside the Regulation and rely on an exemption from the duty to publish instead: since 5 June 2026, offers below €12 million per issuer or offeror over 12 months that are not passported, unless a Member State sets €5 million.

Member States must give their competent authority power to impose effective, proportionate and dissuasive administrative sanctions and measures for breaches of the Regulation and for failures to cooperate with investigations, inspections or requests. The minimum toolkit is a public statement naming the person responsible and the breach; an order to stop the conduct; and maximum fines of at least twice the profit made or loss avoided, where that can be calculated, at least €5 million or 3% of annual turnover for a legal person, and at least €700,000 for a natural person. These are floors for the maximum, not set fines, and Member States may go higher.

In Cyprus, CySEC imposes these sanctions. Section 37(1A) of the CySEC Law (Law 73(I)/2009) obliges it to apply the sanctions and measures of any EU act for which it is the competent authority. In choosing a sanction, CySEC weighs factors such as the gravity and duration of the breach, the person's responsibility and financial strength, harm to retail investors, cooperation and past breaches. Decisions must be reasoned and open to appeal before a tribunal. See also Who supervises investment firms in Cyprus, and what happens if someone misleads them? and, for a parallel EU design, What sanctions apply to market abuse in the EU and in Cyprus?.

Authorities must also run secure whistleblowing channels that protect reporting employees against retaliation and keep both the reporter's and the accused person's identity confidential; financial rewards are optional. Sanction decisions are published on the authority's website immediately after the person concerned is told, identifying the breach and the person, and stay online for at least five years. Publication may be deferred, anonymised or, rarely, omitted where naming the person would be disproportionate or would endanger market stability or an investigation.