Home / DORA in Cyprus
Regulation (EU) 2022/2554 and CySEC Circular C700 · For CIFs, fund managers, CASPs, and banks in Cyprus
Your ICT provider can run the systems. The responsibility stays with your board. Article 5 of DORA makes the management body define, approve, and oversee ICT risk management, and gives it the ultimate responsibility for the firm's ICT risk.
The Digital Operational Resilience Act (DORA) has applied directly in Cyprus since 17 January 2025. CySEC supervises Cyprus Investment Firms (CIFs), AIFMs, UCITS management companies, and crypto-asset service providers (CASPs). The Central Bank of Cyprus supervises banks, payment institutions, and electronic money institutions. Under DORA and CySEC Circular C700, a major ICT-related incident has to be reported within four hours of being classified as major, and no later than 24 hours after the firm became aware of it.
You classify every ICT-related incident against the criteria of Article 18: clients, counterparts, and transactions affected, reputational impact, duration, geographical spread, data losses, the criticality of the services hit, and economic impact. Once an incident counts as major, these deadlines apply.
| Deadline | What is due | To whom |
|---|---|---|
| Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it | Initial notification. | CySEC or the Central Bank of Cyprus |
| Within 72 hours of the initial notification | Intermediate report. Update it when the status changes significantly or when the supervisor asks. | CySEC or the Central Bank of Cyprus |
| Within one month of the latest intermediate report | Final report with the root cause and the actual costs and losses. | CySEC or the Central Bank of Cyprus |
| Without undue delay | Inform your clients when the incident affects their financial interests, and tell them what you have done about it. | Your clients |
Source: Article 19 of Regulation (EU) 2022/2554 and Commission Delegated Regulation (EU) 2025/301.
Firms supervised by CySEC file their reports through the channel the regulator sets out in its circulars, starting with Circular C700 of 8 April 2025. Check the latest circular for the current templates.
Four sets of duties, and your board answers for all of them. Small firms under the simplified framework of Article 16 and microenterprises have lighter versions of the first three.
A documented framework, approved by your management body and reviewed at least once a year and after every major incident. It covers identifying your ICT assets, protecting them, detecting anomalies, and responding and recovering. Backups have to be restorable on systems kept physically and logically apart from the source.
A process to detect, classify, and record every ICT-related incident, and to report the major ones to your supervisor within fixed deadlines.
Tests of the ICT systems that support critical or important functions, at least once a year for every firm that is not a microenterprise. Threat-led penetration tests every three years apply only to the firms the supervisor identifies.
A register of information on every contract with an ICT provider, the contract terms Article 30 prescribes, and an exit strategy for the providers behind critical or important functions.
For financial entities, DORA takes precedence. The Cypriot NIS law steps back where a sector-specific EU act sets duties of at least equivalent effect, so a bank manages ICT risk and reports incidents under DORA, to its financial supervisor. The IT company that serves it can still fall under NIS2 in its own right, as a managed service provider.
Hardware in your rack, a record of what happened, and a security lead who prepares what your board has to approve.
AuraLink is a separate 2U appliance in your own rack. It locks every snapshot in its storage controller, out of reach of an administrator account stolen on your servers.
Article 10 asks for mechanisms that detect anomalous activity promptly. AuraCore watches servers, virtual machines, and containers from the inside and records what it finds and removes.
When AuraLink contains an attack at your network, its record shows what was hit and when. Your classification and your initial notification start from facts.
Identiqa prepares the ICT risk framework, the register of information, and the incident procedure for your board to approve, and gets the evidence ready for an inspection.
Tell us who supervises you and what your last review or inspection asked for. We reply to arrange a first briefing with our team in Cyprus, free of charge.
cyprus@identiqa.comYes. DORA applies to financial entities whatever their size, in proportion to their risk profile and the complexity of their services. Small and non-interconnected Cyprus Investment Firms (CIFs) follow the simplified ICT risk management framework of Article 16, and microenterprises are exempt from several individual duties. The duty to report major ICT-related incidents applies to all of them.
Under Article 19 of DORA and Delegated Regulation (EU) 2025/301, a firm supervised by CySEC sends the initial notification within four hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours, and the final report within one month. CySEC set out the submission procedure and templates in Circular C700 of 8 April 2025.
DORA sets no fine amounts for financial entities. Under Articles 50 to 54, national law gives the supervisors the power to impose administrative penalties and remedial measures, to apply them to members of the management body, and to publish their decisions. In Cyprus, CySEC and the Central Bank of Cyprus supervise compliance.
DORA binds you, the financial entity. You remain responsible for the services you outsource, and your contracts with ICT providers have to contain the terms Article 30 prescribes and, for critical or important functions, access and audit rights and exit arrangements. Providers designated as critical at EU level are overseen directly by the European Supervisory Authorities.
Yes, separately. If the incident affects personal data, the GDPR requires a notification to the Commissioner for Personal Data Protection within 72 hours of becoming aware of a breach that is likely to put people's rights at risk (Article 33 GDPR). The DORA report to your financial supervisor does not replace it.
This page summarises Regulation (EU) 2022/2554 and its technical standards. It is not legal advice. Check the current circulars of your supervisor before you rely on a deadline or a template.