top of page

Regulatory Alert: NEW CySEC Directive 73-2009-07 concerning the Digital Operational Resilience for the Financial Sector (Fees and Subscriptions)

  • Antonis Hadjicostas
  • Aug 30
  • 2 min read

Updated: Sep 3

ree


Further to the CySEC’s consultation paper (refer to link à Consultation Paper (CP -01-2025),the new CySEC Directive ΟΔ 73-2009-07 (Fees & Subscriptions 2025) has been issued and published in the Official Gazette on 29 August 2025, which is immediately into effect.


Key points for consideration:


SCOPE:

Applies to financial entities falling under Regulation (EU) 2022/2554 (DORA), including CIFs, CASPs, issuers of asset-referenced tokens, CSDs, CCPs, trading venues, AIFMs, UCITS Management Companies, and crowdfunding service providers.


ANNUAL SUBSCRIPTION:

  • Microenteprise2: €2,000

  • Small enterprise3: €5,000

  • Medium enterprise 4: €10,000

  • Other than microenterprise, small enterprise, or medium enterprise: €20,000

 

CYSEC NOTIFICATION: 

Entities shall inform CySEC between 1st September – 15th September each year on their category, based on the latest annual audited financial statements. Along with CySEC notification, entities shall provide to CySEC extracts of Financial Statements, where the annual turnover and balance sheet of the entity will be clearly presented, as well as the number of employees as at the date of submission.


PAYMENT DEADLINE: 

Annual subscription due by 30 November of each year, for the period 1st January – 31st December.


ADDITIONAL FEES: 

Entities conducting Threat-Led Penetration Testing (TLPT) under Article 26 of DORA are required to pay a fee of €20,000.

 

2025 TRANSITIONAL ARRANGEMENTS:

  • Entities must notify CySEC of their classification between 2nd – 31st October 2025.

  • Payment for the period 15th August – 31st December 2025 must take place by 31 December 2025.

 

ACTIONS REQUIRED:

  • Review the Entity’s classification (very small, small, medium, or large) based on the definitions stipulated above.

  • Ensure timely submission of classification to CySEC along with the required information (i.e. extracts from latest audited FS and number of employees).

  • Proceed with the required payment to CySEC.

  • Perform an internal assessment as to whether the Entity is subject to TLTP based on DORA. If Yes, then additional fee of €20.000 shall be paid to CySEC.

 
 

The material reflected in our website, including Blog material, is for informational purposes only and does not constitute legal advice, consulting, or any other professional advice. Please seek independent professional guidance for your specific needs.

​

All rights reserved. No part of this work may be reproduced, stored in a retrieval system of any nature, or transmitted, in any form or by any means including photocopying and recording, without the prior written permission of the ENAH Services Ltd. The reproduction or transmission of all or part of the work, whether by photocopying or storing in any medium by electronic means or otherwise without the written permission of the owner is strictly prohibited and the commission of any unauthorised act in relation to the work will result in civil and/or criminal actions. 

bottom of page