Read the CySEC Circular C799
Memo #49-2026
CySEC Circular No: C799
Date: 09/09/2026
Subject: Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554
Purpose: To provide Regulated Entities with additional information concerning the submission of the reporting template set out in the ESAs Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents.
In Summary:
CySEC has issued the Circular C799 on 08/09/2026 to provide additional information to CIFs, Crypto-Asset Service Providers authorised by CySEC under the Regulation (EU) No 2023/1114, Issuers of Asset-Referenced Tokens when the Home Member State of the issuer of the said token is the Republic and which has been authorised by CySEC in accordance with Article 21 of Regulation (EU) 2023/1114, Central Securities Depositories that have been authorised in the Republic for the basic services of Section A of Regulation (EU) no.909/2014 and/or for non-banking ancillary services of Section B of Regulation (EU) no. 909/2014, Central counterparties that fall under Regulation (EU) No.648/2012 who are established in the Republic, Trading venues of the Republic, Alternative Investment Fund Managers of the Republic, Management companies authorised by CySEC and Crowdfunding services providers authorised by CySEC, regarding the submission of the reporting template set out in the ESAs Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents (the ‘Joint Guidelines’).
CySEC informs that this Circular C799 is issued following CySEC's Circular C735 and the adoption of the Joint Guidelines.
This Circular C799 refers to the obligation of Regulated Entities to submit to CySEC the Report on Aggregated Annual Costs and Losses from Major ICT-Related Incidents (the “Report”). The Report concerns the aggregated annual costs and losses arising from major ICT-related incidents by aggregating all costs and losses associated with major ICT-related incidents that occurred during the selected reference year.
The Report must be submitted to CySEC no later than 30 June each year, following the reference year that the major ICT-related incidents occurred. It is noted that, for major ICT-related incidents incurred in 2025, the Report must be submitted to CySEC by 30/09/2026. It is noted that the Report should be submitted only by financial entities that have experienced major ICT-related incidents during the relevant reporting period.
CySEC further notes that the Report should be submitted only through the CySEC’s Portal.
The ESAs Joint Guidelines can be found at the following link:
The Report can be found attached on Circular C799.
Read the CySEC Circular C799
Read more news at Regulatory News
