Which issuers must follow the Transparency Law, how do they publish, and what sanctions apply?

Law 190(I)/2007 transposes the EU Transparency Directive, 2004/109/EC. It sets the disclosure duties of issuers whose securities are admitted to a regulated market and whose home Member State is Cyprus, and the notification duties of people holding voting rights in them. An issuer may be a company, a natural person or a public body, a State included. Admission to a regulated market is the test: securities traded only on a multilateral trading facility, such as an SME growth market, or only over the counter are outside the Law, and so are units of open-ended collective investment undertakings. Issuer transparency also differs from the trade transparency MiFIR requires of trading venues: see What must trading venues publish before and after trades in shares and ETFs?

An EU issuer of shares, or of debt below €1,000 a unit, has as its home Member State the state of its registered office; a third-country issuer of such securities picks one Member State where they are admitted. Other issuers choose between their registered-office state and the states of admission, and the choice holds for at least three years. Every issuer whose home Member State is Cyprus publishes that fact and notifies it to CySEC. If an issuer that must choose has not published and notified its choice within three months of first admission, and its securities are admitted to a regulated market in Cyprus, Cyprus becomes its home Member State by default. If they are also admitted in other Member States, those states are home Member States too until the issuer chooses, publishes and notifies a single one.

The exam material cites the Law as amended up to 2017. Two amending laws have followed: Law 115(I)/2025, in force since 10 July 2025, for the European single access point (ESAP), and Law 161(I)/2025, in force since 29 July 2025, for sustainability reporting and the electronic format of the annual report.

Regulated information is everything an issuer must disclose under the Transparency Law or the market abuse rules, from periodic reports to inside information. The issuer announces it to the regulated market in Cyprus and on its website, and disseminates it through media that the public in Cyprus and across the EU can reasonably rely on. At the same time it files it with CySEC and makes it available to the officially appointed mechanism, the central store for regulated information; ESMA lists the Cyprus Stock Exchange as Cyprus's mechanism. Investors pay nothing for access. For inside information, see also When and how must an issuer disclose inside information, and when may it delay?

Since 10 July 2026, under Law 115(I)/2025, the issuer must also file each item, at the same moment, with the ESAP collection body, which in Cyprus is the officially appointed mechanism. The file must be data-extractable and carry metadata: the issuer's names, its legal entity identifier (LEI), which it must obtain, its size and sector, the type of information and whether it contains personal data. The exam material does not cover this filing.

Responsibility for preparing and publishing the annual report, the half-yearly report and the separate report on payments to governments lies with the issuer and with its administrative, management or supervisory bodies (for that last report, see Who is exempt from periodic reporting, and who must report payments to governments?). The exam material says those bodies are personally liable if the reports are not produced. Since 2007 the Law has made this a presumption: they are presumed personally liable unless they prove that the failure was not due to their fault, wilful omission or negligence.

Since 8 April 2016, when Law 35(I)/2016 transposed Directive 2013/50/EU, a periodic-reporting breach can lead to a public statement naming the person responsible and the breach, an order to stop and not repeat it, and a fine: up to €10,000,000 for a legal person and €2,000,000 for a natural person, or up to twice the profit gained or loss avoided, where that can be determined, whichever is higher. Cyprus has not adopted the Directive's alternative cap of 5% of annual turnover. The same menu covers the duties to disclose own-share holdings, to publish the major-holding notifications the issuer receives and to disclose changes in rights. It also covers the major-holdings rules, where voting rights can also be suspended if the breach gave the holder significant influence over the issuer.

Two duties have their own lower scale of up to €85,000, or €170,000 for a repeated breach, depending on gravity: the monthly total of voting rights and capital, and the duties towards security holders. The same caps, or twice any proven benefit if that is higher, apply to any breach for which the Law sets no specific sanction, such as the dissemination, filing and ESAP duties. Ignoring a CySEC order also carries these caps. If periodic information is deficient, CySEC can require a corrective statement, a restatement or a fix in the next period's statements. If the issuer does not comply, CySEC can suspend trading for up to 10 days, prohibit it, or fine the issuer up to €170,000 (€340,000 if repeated) or €1,000 a day.