top of page

Regulatory Alert: CySEC Circular 731 - Annual DORA-Related Fees – What EU Financial Entities Must Know

  • Antonis Hadjicostas
  • Oct 2
  • 2 min read

Updated: Oct 3

ree


🧾 Key Provisions of Circular C731


Scope of Application


The Circular applies to all financial entities authorised by CySEC that fall within the DORA framework, including but not limited to: CIFs, Crypto-Asset Service Providers, issuers of asset-referenced tokens (when Cyprus is the home Member State), CSDs, CCPs, trading venues, AIFMs, UCITS management companies, and crowdfunding service providers.


Self-categorisation & Fee Calculation


Entities must complete a form (fields 1.1 to 1.7) to self-categorise and compute their Annual ICT (information & communications technology) fee for 2025.


Accompanying the Form, the firm must submit:

  • Excerpts from the most recent audited financial statements (turnover, balance sheet)

  • Evidence of the number of employees


Submission & Deadlines for 2025


  • The Form must be submitted via the CySEC Portal (or by email to accounts@cysec.gov.cy for entities without portal access) by 31 October 2025.

  • The 2025 fee will be pro-rated: it applies to the period 15 August – 31 December 2025.

  • Payment to be made by 31 December 2025.

  • From 2026 onward:

    • Self-categorisation to be submitted between 1–15 September.

    • Fees must be paid by 30 November of each year.


💶 Fee Bands & Additional Charges


CySEC’s prior Directive (DI 73-2009-07) and accompanying policy statements outline annual subscription tiers (based on enterprise size) and extra fees for certain activities. (As you covered in your previous blog on the same topic).


In particular:

  • Annual subscription tiers are divided by enterprise classification (micro, small, medium, large).

  • Additional fee of €20,000 is imposed for entities that carry out Threat-Led Penetration Testing (TLPT) under DORA Article 26.


These tiers and extra payments can materially affect your bottom line, especially for mid-sized or growing firms.


🛠️ Recommended Next Steps


  1. Assess whether your entity falls under DORA — check scope and existing operations

  2. Perform categorisation exercise (based on turnover, assets, staff)

  3. Gather supporting documents — annual audited statements, employee numbers

  4. Prepare and submit the self-categorisation form by 31 October 2025

  5. Perform the relevant payment (by 31 December 2025)

  6. Evaluate whether TLPT is required under your DORA obligations


 
 

The material reflected in our website, including Blog material, is for informational purposes only and does not constitute legal advice, consulting, or any other professional advice. Please seek independent professional guidance for your specific needs.

​

All rights reserved. No part of this work may be reproduced, stored in a retrieval system of any nature, or transmitted, in any form or by any means including photocopying and recording, without the prior written permission of the ENAH Services Ltd. The reproduction or transmission of all or part of the work, whether by photocopying or storing in any medium by electronic means or otherwise without the written permission of the owner is strictly prohibited and the commission of any unauthorised act in relation to the work will result in civil and/or criminal actions. 

bottom of page