November 2025 Regulatory Roundup

Alternative funds

ESMA publishes implementing rules on loan-originating AIFs

On 21 October 2025, ESMA published the draft Regulatory Technical Standards (RTS) on open-ended loan-originating AIFs (‘OE LO AIFs’). 

The draft rules determine the requirements with which LO AIFs must comply to maintain an open-ended structure.  Those requirements include a sound liquidity management system, the availability of liquid assets and stress testing, as well as an appropriate redemption policy having regard to the liquidity profile of OE LO AIFs. The RTS also set out a list of factors AIFMs shall consider determining the redemption policy and assess the liquidity of OE LO AIFs. 

The draft RTS were mandated under the AIFMD and have been submitted to the European Commission for adoption. ESMA has included this RTS in the list of the non-essential Level 2 acts that the European Commission will not adopt before 1 October 2027 at the earliest.

Sustainable Finance

ESMA announces 2025 European Common Enforcement Priorities and results of fact-finding on materiality considerations in sustainability reporting

On 14 October 2025, ESMA outlined the European Common Enforcement Priorities (ECEP) for the 2025 annual financial reports of listed issuers.

ESMA asks issuers to focus on the following areas in their 2025 annual financial reports, in addition to general considerations:

• IFRS financial statements:
  • Geopolitical risks and uncertainties
  • Segment reporting
• Sustainability statements:
  • Materiality considerations in reporting under the European Sustainability Reporting Standards (ESRS)
  • Scope and structure of the sustainability statements
• ESEF digital reporting:
  • Common ESEF filing errors found in the Statement of Cash Flows

This year’s priorities reaffirm ESMA’s commitment to simplification and burden reduction, while maintaining a strong focus on investor protection and market stability.

In addition, the statement published today highlights the importance of connectivity between financial and sustainability information, recent IFRS developments, and consistent use of alternative performance measures.  

ESMA has also published a fact-finding exercise on the 2024 corporate sustainability reporting practices by European issuers under ESRS. It examines disclosures on the double materiality assessment process and its outcomes, providing insights on enforcement priorities and future regulatory improvements.

Issuers, auditors and supervisory bodies should consider the topics and recommendations when preparing, auditing, and supervising the 2025 annual financial reports. Issuers should take the recommendations into account based on their materiality and relevance for the issuer’s operations and annual financial report.

ESG Ratings

ESMA publishes final report on technical standards on transparency and integrity of ESG rating activities

On 15 October 2025, ESMA published its final report on three draft regulatory technical standards (RTS) under Regulation (EU) 2024/3005 on the transparency and integrity of environmental, social and governance (ESG) rating activities.

Key changes include:

• RTS on authorisation and recognition: ESMA has removed or simplified several information requirements.
• RTS on separation of business: The requirement for a physical separation of staff remains. However other requirements, such as those relating to network segmentation, have been clarified or removed where they were deemed as imposing excessive burden.
• RTS on disclosures: Several elements have been revised to ensure they are practically achievable by ESG rating providers. Others have been removed when it was judged they did not provide sufficient added value for the burden that was imposed.

ESMA has submitted the finalised draft RTS to the European Commission for adoption. They will also be subject to non-objection by the European Parliament and Council of the EU. They are expected to apply from 2 July 2026.

Green Bonds

ESMA finalises draft technical standards for external reviewers under European Green Bonds Regulation

On 15 October 2025, ESMA published its final report on the regulatory and implementing technical standards (RTS and ITS) under the European Green Bonds Regulation (Regulation (EU) 2023/2631).

The report provides ESMA’s feedback on various aspects of the external reviewer regime, covering criteria for assessing:

• the appropriateness, adequacy and effectiveness of the systems, resources and procedures;
• whether the compliance function has the authority to discharge its responsibilities properly and independently and for assessing the necessary resources, expertise and access to relevant information;
• the soundness of administrative and accounting procedures and internal control mechanisms and the effectiveness of control and safeguard arrangements for information processing systems;
• whether the information used when providing reviews is of sufficient quality and from reliable sources;
• information, form and content of applications for recognition; and
• standard forms, templates and procedures to notify ESMA of material changes in the information provided at registration.

ESMA has submitted the final draft RTS and ITS to the European Commission for adoption. They will apply exclusively to ESMA-registered external reviewers from 21 June 2026.

ESAs’ Joint Committee publishes Work Programme for 2026

On 16 October 2025, the Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) presented its 2026 Work Programme, outlining key areas of collaboration for the coming year.

The upcoming Programme aims to strengthen the financial system’s digital operational resilience, ensure the continued protection of consumers, and identify risks that could undermine financial stability.

More specifically, the ESAs will undertake joint work in 2026 to:

• ensure the effective operation of the Oversight Framework for critical third-party ICT providers under the Digital Operational Resilience Act (DORA),
• perform joint risk analyses amid ongoing geopolitical tensions and heightened uncertainties,
• further financial education and consumer protection in the EU’s financial sector, including within the context of the European Commission’s Savings and Investments Union (SIU) initiative,
• monitor developments on the securitisation market,
• collaborate on other cross-sectoral matters such as financial conglomerates, innovation facilitators and credit assessment institutions,
• and support the planned review of the Sustainable Finance Disclosure Regulation (SFDR).

EU Supervisory Authorities warn consumers of risks and limited protection for certain crypto-assets and providers

On 06 October 2025, ESAs issued  a warning to consumers, reminding that crypto-assets can be risky and that legal protection, if any, may be limited depending on which crypto-assets they invest in. This warning is accompanied by a factsheet explaining what the new EU regulation on Markets in Crypto-Assets (MiCA) means for consumers.

While innovative financial products, including crypto-assets, may enhance the efficiency, resilience, and competitiveness of the EU’s financial system, consumers should be mindful that not all crypto-assets are the same. They should also be warned that their consumer protection (if any) might be limited depending on the types of crypto-assets and crypto-asset services they are using (e.g. lack of access to comprehensive information or a transparent and uniform claims handling procedure).

Consumers are recommended to:

• learn about the product or service and evaluate the risk before investing,
• check the provider of crypto-asset services is authorised in the EU and,
• make sure any wallets used to store their crypto-assets are sufficiently secured.

The Joint ESAs factsheet – also available in all EU languages – provides an overview of what crypto assets are, which ones are regulated under MiCA and which ones are not, and the providers consumers may encounter.

ESMA updates its Q&A in relation to MiCA

On 14 October 2025, updated the following Questions and Answer:

• How to distinguish between different execution services(2653)
• Offerors and CASPs’ responsibilities with regards to white papers for Title II tokens admitted to trading prior to 30 December 2024(2654)

Circular C731: Annual fees in relation to the Regulation (EU) 2022/2554 on Digital Operational Resilience Act of the Financial Sector (the ‘DORA Regulation’)

On 02 October 2025, CySEC issued Circular C731, with which informs regulated entities that following the publication of Directive DIR73-2009-07 and Policy Statement (PS-03- 2025) regarding the fees payable by the entities falling under the scope of DORA, Financial entities are requested to use the Form for self-categorisation and calculation of the first Annual ICT fee for the year 2025.

For the self-categorisation and calculation of the Annual ICT fee, entities must complete the grey cells in the fields 1.1 – 1.7 of the Form, according to the instructions in the Form.

Furthermore, when submitting this Form to CySEC, Financial Entities should attach as Appendixes the following:

• the extracts from the most recent audited financial statements where the annual total turnover and the annual balance sheet of the corresponding year are disclosed;
• evidence regarding the number of persons employed.

The completed and duly signed Form must be submitted to CySEC, through the portal, by 31st of October 2025 the latest, along with the extracts from the latest audited financial statements.

The annual fee for the year 2025, according to the DIR73-2009-07, will be calculated for the period of 15th of August 2025 to 31st of December 2025 on a pro rata basis. The payment must be completed by 31st of December 2025 the latest. From 2026 the relevant fee must be paid by 30th of November of the respective year.

Circular C733: Strategic Analysis Report of the Unit for Combating Money Laundering (MOKAS) for 2023 – 2024

On 03 October 2025, CySEC issued Circular C733, informing Regulated Entities of the publication of the Strategic Analysis Report for 2023-2024 of the Unit for Combating Money Laundering (“MOKAS”, or the “Unit”), prepared following a thematic analysis of the Suspicious Transaction Reports (“STRs”) submitted to the MOKAS during the years 2023-2024.

The Report provides the Regulated Entities with information regarding the trends and methods of Money Laundering/Terrorism Financing (the ‘ML/TF’), as they emerge from the STRs. Furthermore, it provides valuable information on trends and practices for ML/TF, based on the data held by MOKAS, thereby contributing to the categorisation of ML/TF threats, prioritising the analysis of Reports (STRs/SARs) in a risk-based approach and more effective allocation of existing resources.

Similarly, it is an equally valuable tool and aims to provide the Regulated Sector with important feedback information for addressing ML/TF risks, through typologies and examples, red flag indicators and crime analysis trends, with the aim of timely detection of illegality and interruption of illicit money flows, based on a targeted risk-based approach.

Circular C734: ESMA publication of thematic notes on clear, fair & not misleading sustainability-related claims – First Note: ESG Credentials

On 14 October 2025, CySEC issued Circular C734, to inform Cyprus Investment Fund Managers (CyIFMs) in relation to the ESMA publication of a series of thematic Notes on clear, fair & not misleading sustainability-related claims (‘the Thematic Notes’).

The Thematic Notes aim to guide and educate market participants on sustainability claims by highlighting good and bad practices on specific topics. Kindly note that the first Thematic Note was published on July 1^st 2025, while the second Thematic Note is expected to be published by the end of 2025.

CySEC urges CyIFMs to ensure they remain updated regarding the publication of such Thematic Notes and expects that the guidance provided in the Thematic Notes is considered when complying with their relevant ESG obligations.

Directive DI87-03 (F): For the charges and annual fees

On 17 October 2025, CySEC issued Directive DI87-03(ΣΤ) of 2025, amending its Directive DI87-03 of 2018 on the Fees and Annual Subscriptions of Cyprus Investment Firms (CIFs).

The amendment involves the deletion of Section 3 of Part I, which previously required the payment of €5,000 for applications submitted by CIFs to conduct business beyond their current authorisation, specifically in relation to:

• any cryptocurrency, and/or
• contracts for differences (CFDs) on cryptocurrencies.

This update removes the above-mentioned application fee.

Amendment to Law 87(I)/2017 transposing Directive (EU) 2024/790

On 17 October 2025, Law 183(I)/2025 was published in the Official Gazette of the Republic of Cyprus, amending the Investment Services and Activities and Regulated Markets Law of 2017 (L. 87(I)/2017) (hereinafter ‘the Law’). The said Law transposes Directive (EU) 2024/790 into Cyprus Law, amending provisions of MiFID II (Directive 2014/65/EU).

See below a brief description of the amending rules.

1. Directive (EU) 2024/790 aims to further clarify the prohibition of payment for order flow, already applicable across the EU through Regulation (EU) 2024/791 amending Regulation 600/2014 (MiFIR). With the amendments to the Law the prohibition for payment for order flow is further strengthened.
2. The best execution reports under RTS 27 and RTS 28 are now abolished. Cypriot Investment Firms that were previously obligated to generate said reports can effectively cease their production. We note that ESMA had opined that NCA’s should not focus their supervisory activities on the interrogation of said reports, informally suspending the obligation. With the amendments that obligation has now been formally abolished.
3. Investment Firms are now required to assess on a frequent basis their execution arrangements and notify clients of any material change to the aforesaid arrangements. ESMA has been assigned to develop technical standards with respect to:
   1. Factors determining the choice of execution venues
   2. The frequency of assessing and updating the execution policy, etc.
      It is noted that the aforesaid technical standards have yet to be published.  

Finally, the amendments bring changes to:

• the definitions of Systematic Internalisers (SIs) and Multilateral Trading Facilities (MTFs),
• operating conditions for regulated markets to:
  • temporarily halting or constraining trading in emergency situations.
  • for listed shares which are dual listed in non-EEA venues to apply the same tick-size as applicable to the non-EEA venues (under conditions).
    etc.
• Position limits in commodity derivatives and position management controls in commodity derivatives and derivatives of emission allowances.

Circular C735: Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554

On 22 October 2025, CySEC issued Circular 735 with which it informed the financial entities that fall under the responsibility of CySEC, as defined in Article 46 of Regulation (EU) 2022/2554 1 (“DORA Regulation”), that it has adopted the Joint Guidelines of the European Supervisory Authorities (“ESAs”) on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Article 11(11) of Regulation 2022/2554 (the “Guidelines”), which were issued on July 17, 2024.

The Joint Guidelines are issued pursuant to Article 16 of Regulation (EU) No 1093/2010, Article 16 of Regulation (EU) No 1094/2010, and Article 16 of Regulation (EU) No 1095/2010, ‘the ESAs’ Regulations’ aiming to develop common guidelines on the estimation of aggregated annual costs and losses of major ICT-related incidents referred to Article 11(10) of DORA Regulation. The Guidelines also specify a common template for the submission of the aggregated annual costs and losses.

Circular C736: Observations and recommendations on the implementation of the prudential framework of Investment Firms

On 24 October 2025,  CySEC published Circular C736, highlighting key findings from its reviews of Cyprus Investment Firms (CIFs) under Law 165(I)/2021 and Regulation (EU) 2019/2033 (IFR).

Key observations identified by CySEC include:

• Late or missing prudential reports via the XBRL portal
• Ongoing breaches of capital and liquidity requirements
• Data inconsistencies between prudential reports, financial statements, and management accounts
• Non-compliant remuneration policies (deferral, instruments, governance)
• Weak governance structures, including improperly composed Risk/Remuneration Committees
• Incorrect treatment of liquid assets (e.g., funds held with EMIs/PSPs)
• Gaps in prudential consolidation assessments

CySEC expects CIFs to:

• Submit all prudential and remuneration reports on time
• Ensure accuracy and consistency across submitted data
• Strengthen governance and internal control frameworks
• Align remuneration and risk policies with EBA Guidelines
• Regularly review prudential consolidation obligations

Implications:

CySEC emphasises that CIFs should conduct a thorough internal review of their prudential and governance frameworks. Failure to comply may result in administrative sanctions or other supervisory measures.