Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU 2022/2554

1
_______________________________________________________________ TO : Regulated Entities:
i. CIFs
ii. Crypto-Asset Service Providers authorised by CySEC under the
Regulation (EU) No 2023/1114
iii. Issuers of Asset-Referenced Tokens when the Home Member
State of the issuer of the said token is the Republic and which has been authorised by CySEC, in accordance with Article 21 of Regulation (EU) 2023/1114
iv. Central Securities Depositories that have been authorised in the
Republic for the basic services of Section A of Regulation (EU) no. 909/2014 and/or for non-banking ancillary services of Section B of Regulation (EU) no. 909/2014
v. Central counterparties that fall under Regulation (EU) No.
648/2012 who are established in the Republic
vi. Trading venues of the Republic
vii. Alternative Investment Fund Managers of the Republic
viii. Management companies authorised by CySEC
ix. Crowdfunding services providers authorised by CySEC
FROM : Cyprus Securities and Exchange Commission DATE : 8 September 2026 CIRCULAR No : C799 SUBJECT : Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU 2022/2554 Following CySEC’s Circular C735 and the adoption of Joint Guidelines of the European Supervisory Authorities (“ESAs”) on the estimation of aggregated annual costs and losses caused by major ICT-related incidents (the ‘Joint Guidelines’), the Cyprus Securities and Exchange Commission (‘CySEC’) hereby provides Regulated Entities with additional information concerning the submission of the reporting template set out in the Joint Guidelines.

2
Specifically, regulated entities are required to:

1. Estimate and report to CySEC the aggregated annual costs and losses arising from
   major ICT-related incidents by aggregating all costs and losses associated with major ICT-related incidents that occurred during the selected reference year using the Report on Aggregated Annual Costs and Losses from Major ICT-Related Incidents (the “Report”).
2. Select the reference year for the estimation of aggregate annual costs and losses.
   The reference year may be either:

• the completed calendar year, or
• the completed accounting year for which the financial entity has finalized its
  financial statements.
  The chosen reference year must be clearly stated in the Report and should be applied consistently in future estimations and reporting.

3. Carefully review the Joint Guidelines and submit the Report no later than 30 June
   each year, following the reference year that the major ICT-related incidents occurred. The Report should be submitted only by financial entities that have experienced major ICT-related incidents during the relevant reporting period. It is noted that, for major ICT-related incidents incurred in 2025, the Report must be submitted to CySEC by 30 September 2026. Examples:
   a) A financial entity had two major ICT-related incidents on the 10 January 2026 and 30 March 2026. The financial entity has chosen to report on the calendar year (ie 1 January 2026 – 31 December 2026). The Report should cover both incidents and must be submitted to CySEC by 30 June 2027. b) A financial entity had one major ICT – related incidents on 12 December 2025. The Report should cover this incident and submitted to CySEC by 30 September 2026.
4. Submission Method
   The Report should be submitted only through the CySEC’s Portal under the title "Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents". Yours sincerely, Panikkos Vakkou Vice Chairman Cyprus Securities and Exchange Commission