CySEC imposes €2.3 million in fines, tightens AML and sanctions enforcement

The Cyprus Securities and Exchange Commission (CySEC) on Wednesday set out an extensive account of its supervisory activity during the previous year, along with its priorities for 2026, during a press conference in Nicosia.

Speaking against a backdrop of rising regulatory complexity, rapid technological change and geopolitical uncertainty, the commission framed the past year as one of intensified oversight and institutional preparation ahead of Cyprus assuming the Presidency of the Council of the European Union in the first half of 2026.

The presentation was delivered by the commission’s chairman George Theocharides, who underlined that investor protection, transparency and financial sector resilience remain central to the regulator’s mandate.

“CySEC continues to approach supervision with consistency, evidence, and adaptability, investing in strengthening both its regulatory and supervisory frameworks, as well as in transparency, technology, and financial literacy,” he said.

“Investor protection, transparency and the resilience of the financial system remain at the core of our mission, particularly at a time of heightened uncertainty and rapid change,” Theocharides added.

The Cypriot regulator described 2025 as a year of sustained supervisory pressure across the investment services ecosystem, coupled with heavy engagement at European level on major legislative reforms.

According to the commission, preparation for Cyprus’ EU presidency was treated as a strategic priority throughout 2025.

“The Cyprus Presidency of the Council of the European Union is not a ceremonial exercise for CySEC, but a responsibility that requires substance, preparation and active contribution,” Theocharides said.

More than 15 CySEC officials were assigned expert roles in close coordination with the Finance Ministry, contributing to the handling of interconnected legislative files shaping the future of European capital markets.

These included the Market Infrastructure Package, the Retail Investment Strategy, the Savings and Investments Union and the ongoing revision of the Sustainable Finance Disclosure Regulation.

“Our involvement in these legislative initiatives allows us to contribute practical supervisory experience to the European debate shaping the future of capital markets,” the CySEC chairman said.

The regulator also confirmed it will host meetings of the ESMA Management Board and the ESMA Board of Supervisors in April 2026, following extensive logistical and organisational preparation completed during 2025.

“CySEC sees the Cyprus Presidency as another opportunity to make a substantive contribution to the European dialogue in shaping a modern, reliable, and resilient framework for the EU capital markets,” the CySEC chairman added.

Turning to supervision, the commission reported that around 600 on-site and off-site inspections were carried out in 2025 across Cyprus Investment Firms, asset managers, collective investment entities, issuers and market infrastructures.

“Our supervisory activity in 2025 was both extensive and targeted, focusing on areas where risks to investors and market integrity were most pronounced,” Theocharides explained.

Supervisory focus covered professional conduct, organisational requirements, sustainability risks, capital adequacy, governance and data quality, alongside compliance with MiFID II, DORA and MiCA.

Particular attention was paid to emerging risks linked to the promotion of investment products through social media influencers, with a dedicated thematic review of so-called finfluencers.

“The rise of investment promotion through social media presents new challenges, and we are addressing these risks proactively to safeguard retail investors,” Theocharides stressed.

The regulator also placed strong emphasis on anti-money laundering and counter-terrorist financing controls.

During the year, 43 thematic AML inspections were completed, examining due diligence practices, risk assessments, internal reporting procedures and disclosures to Cyprus’ anti-money laundering unit (Mokas).

“Effective anti-money laundering controls and strict compliance with sanctions are non-negotiable elements of a credible financial system,” the CySEC chief stated.

What is more, enhanced monitoring was conducted on entities with current or past exposure to persons subject to EU restrictive measures against Russia.

Cases involving potential breaches of sanctions were forwarded to the police and the attorney general for further investigation, with relevant information also shared with the National Sanctions Implementation Unit established under the new sanctions framework that entered into force in July 2025.

As a result of supervisory actions, administrative fines and settlements totalling approximately €2.3 million were imposed during 2025.

Of this amount, €1.3 million related to Cyprus Investment Firms, while total sanctions over the past three years reached €7.3 million.

All imposed amounts were deposited into the general fund of the Republic of Cyprus.

Beyond financial penalties, corrective measures were required in more than 170 cases, while licences were suspended or revoked in four instances involving investment firms.

In addition, trading in the securities of five issuers on the Cyprus Stock Exchange (CSE) was suspended until compliance with ongoing obligations was restored or until deadlines set by the commission.

The regulator also referred two cases to the police, five cases to the attorney general and transmitted information to Mokas in two further instances.

Alongside enforcement, CySEC issued dozens of warnings to alert the public to unauthorised online entities and intensified awareness campaigns aimed at protecting citizens from digital fraud.

Furthermore, the commission highlighted a rise in attempts by malicious actors to impersonate the regulator through fake websites, emails and social media accounts, describing this as a growing international challenge for supervisory authorities.

Through cooperation with other competent bodies, complaints were lodged and targeted actions taken to limit the activity of such entities, CySEC mentioned.

On market development, the Cypriot regulator approved 47 new licences during 2025 despite a difficult economic environment driven largely by external factors.

These included 26 entities in collective investments, 12 providing investment services, eight crypto-asset service providers and one administrative services provider.

One application for an investment firm licence was rejected, while five applications were withdrawn.

By the end of 2025, the number of supervised entities stood at 808, reflecting both new approvals and exits from the market.

Over the five-year period from 2020 to 2025, the total number of supervised entities increased by 2.53 per cent, a trend the commission described as evidence of Cyprus’ continuing appeal as an investment destination.

In addition, assets under management in collective investment schemes reached €11.4 billion in the third quarter of 2025, with around 25 per cent invested in the Cypriot economy.

The commission supervised 252 Cyprus Investment Firms with total assets of €4.5 billion and 128 administrative service providers with assets of €134.79 million at the end of the third quarter of 2025.

As of December 2025, CySEC also oversaw 19 crypto-asset service providers and continued to accept applications through its Regulatory Sandbox.

Meanwhile, digital transformation featured prominently in the regulator’s agenda.

During 2025, CySEC invested in advanced IT systems, data analytics, artificial intelligence and cybersecurity tools to support more effective supervision and risk analysis.

“Technology is a critical enabler of modern supervision, allowing us to identify risks earlier and respond more efficiently in an increasingly complex market,” Theocharides said.

A multi-year project was launched to automate licensing procedures and examination management, with implementation expected to span three years.

The regulator also initiated certification of an information security management system in line with ISO IEC 27001 standards.

The commission also stated that human resources reinforcement is a priority for 2026, with plans to recruit 31 officers, five secretarial assistants and three IT specialists.

Elsewhere, investor education remained a core pillar of the commission’s work throughout 2025.

CySEC participated in Global Money Week and World Investor Week, delivered school and university lectures across all districts and reached more than 1,700 students in 44 schools.

The regulator expanded its digital presence through social media, television and podcasts, while enriching its Financial Education Portal with new guides and interactive tools.

A new knowledge quiz and a citizen storytelling initiative were completed in collaboration with the University of Cyprus, with results used in public awareness campaigns.

Theocharides also underlined the scale and responsibility of the regulator’s role in a rapidly evolving European and international environment.

“As we move into 2026, CySEC will continue to invest in people, technology and knowledge to meet higher supervisory demands and maintain trust in the Cypriot market,” Theocharides concluded.