Preparing Your CySEC DORA Annual Costs and Losses Report
Cyprus financial firms that experienced a major ICT-related incident in 2025 should check whether they must report its annual costs and losses to CySEC by 30 September 2026. Circular C799, dated 8 September, explains the first reporting deadline and submission arrangements. [1]
DORA is the EU’s Digital Operational Resilience Act. ICT means information and communication technology. In practical terms, this reporting exercise asks affected firms to bring together the financial consequences of major technology incidents, using the prescribed method.
Who needs to submit the report
C799 addresses specified CySEC-regulated entities, including Cyprus investment firms, authorised MiCA crypto-asset service providers, relevant fund managers and crowdfunding providers. Firms should check their exact regulatory category and the applicable DORA scope.
Only entities that experienced a major ICT-related incident in the relevant reporting period submit this report. The ordinary deadline is 30 June after the reference year; for incidents in 2025, the first deadline is 30 September 2026. Submission is through the CySEC Portal. [1]
This is an annual costs-and-losses report. It should not be confused with the separate notifications required when a major incident occurs, or with the annual DORA supervisory-fee process.
Agree the period and method
CySEC permits the completed calendar year or the completed accounting year for which financial statements have been finalised. The chosen reference year must be stated and applied consistently. Firms must use the report and methodology in the European Supervisory Authorities’ Joint Guidelines. [1]
The practical starting point is a meeting between compliance, finance and the team responsible for incident management. They should agree which incidents fall within the exercise and identify where the related financial information is held.
An IT record may explain what happened and when. It may not contain the final invoices, staff-cost information, insurance recoveries or other figures needed for the report. Conversely, an accounting entry may not identify the incident to which it relates.
Build a record that another person can follow
Use a working schedule that connects each reported amount to the relevant incident and supporting record. Where an estimate is necessary, record the assumption and the person who reviewed it. The aim is to make the calculation understandable without requiring the original preparer to explain it from memory.
Take care with insurance and other recoveries. The reporting method should determine how they are shown; the firm should not simply deduct them from costs without checking the required treatment. The same cost should not appear twice because it is recorded in both an incident file and a central finance schedule.
If records are incomplete, identify the gap early and assign someone to resolve it. A well-documented estimate prepared under the correct method is more useful than an unexplained number entered at the deadline.
Keep the different DORA submissions separate
The annual fee exercise and the incident-cost report serve different purposes. Completing one does not complete the other. Firms should check the current CySEC fee instructions separately and give each submission a named owner.
For C799, the immediate task is to finish the review of any relevant 2025 major incidents and submit the required report by 30 September 2026. Keep the final calculation, supporting records and submission confirmation together.
AGPLAW provides regulatory legal support to Cyprus financial businesses reviewing reporting duties and their internal compliance arrangements.
Sources [1]: CySEC Circular C799.
Disclaimer: This article provides general information and is not legal advice on a specific matter.
