What must an issuer's annual financial report contain, and when is it due?

Every issuer within the Law must publish its annual financial report as soon as it can, and no later than four months after its financial year ends, and keep it publicly available for at least 10 years. The period was five years until 8 April 2016, when Law 35(I)/2016 extended it. The report has three parts: the audited financial statements, the management report and the responsibility statements.

The responsibility statements are made by the board members and also by the chief executive and the chief financial officer, or their equivalents, insofar as they are not board members, with each person's name and function clearly shown. The exam material says the CEO and CFO give statements if they are both not board members. Since 2007 the Law has said only 'if they are not members of the board'. Read sensibly, that applies to each person: a CEO who sits on the board signs as a director, and a CFO who is not on the board signs in that capacity.

The signatories confirm, to the best of their knowledge, that the financial statements follow the applicable accounting standards and present a true and fair view of assets, liabilities, financial position and profit or loss for the issuer and the undertakings it consolidates, and that the management report fairly reviews how the business developed and performed and where the issuer stands, describing its principal risks and uncertainties. The exam material presents the true-and-fair confirmation as a statement by the auditors. Since 2007, following the Directive, the Law has given it to the persons responsible within the issuer; the auditor's contribution is the separate audit report. Since 29 July 2025 the statement also confirms, where applicable, that sustainability reporting follows the European Sustainability Reporting Standards (ESRS) and the Taxonomy disclosure rules.

An issuer incorporated under the Cyprus Companies Law that does not consolidate prepares its accounts under that Law; one from another Member State follows its home law. A Cypriot group parent presents consolidated accounts under the Companies Law or the IAS Regulation, (EC) No 1606/2002, with its own accounts under the Companies Law. A parent from another Member State uses the IAS Regulation for the consolidated accounts and its home law for its own. A third-country issuer prepares consolidated accounts under the IAS Regulation and the parent's own accounts under the Accounting Directive, 2013/34/EU, which also governs a third-country issuer that does not consolidate. The exam material says a third-country parent's accounts follow 'the EU regulation on consolidated accounts'. Since 29 July 2025, Law 161(I)/2025 has referred to the Accounting Directive; from 2012 until then the reference was the Seventh Council Directive on consolidated accounts, 83/349/EEC, a directive rather than a regulation.

A Cypriot issuer's accounts are audited under section 152A of the Companies Law; the statutory auditor or audit firm also gives an opinion on the management report, and the signed audit report is published in full with the annual report. Other EU issuers are audited under their home law implementing the Accounting Directive, and third-country issuers under that Directive's audit rules, again with the signed report published in full. The exam material describes a qualified auditor applying international standards on auditing. That matches the text in force until 29 July 2025; since then the Law has referred to the Companies Law and the Auditors Law instead. Management reports follow the Companies Law for Cypriot issuers, and home law or the Accounting Directive for others. CySEC Directive DI190-2007-04 adds further items: an explanation of any material gap between results and a published forecast, each director's direct and indirect holding and share options, and details of the capital structure, transfer restrictions and change-of-control arrangements.

For financial years beginning on or after 1 January 2021, the whole report is prepared in the European single electronic format (ESEF) of Delegated Regulation (EU) 2019/815: the document is in XHTML, and IFRS consolidated financial statements carry Inline XBRL tags. The EU start was financial year 2020, but Cyprus used the one-year deferral that Regulation (EU) 2021/337 allowed; Law 161(I)/2025 wrote the rule into the Law on 29 July 2025.

Law 161(I)/2025 also brought the Corporate Sustainability Reporting Directive into the report. Where the Companies Law requires sustainability reporting, it forms part of the management report, an assurance opinion on it is published in full and the responsibility statement covers it. Under the Companies Law as amended by Law 162(I)/2025, this applies to large public-interest entities with more than 500 employees for financial years from 1 January 2025 (2024 voluntarily), to other large undertakings from 1 January 2027 and to listed SMEs from 1 January 2028. The exam material covers neither the format nor sustainability reporting.