CySEC has issued a whistleblowing guide for employees of regulated brokers, outlining eligible reports, submission channels, investigation timelines and confidentiality rules, while confirming it cannot compensate victims of retaliation.
CySEC Issues Whistleblowing Guide but Acknowledges Limits on Retaliation Protection
The Cyprus Securities and Exchange Commission (CySEC) published a practical guide on Tuesday, 14 July 2026, explaining how employees of regulated firms can report suspected breaches of European Union and national financial laws directly to the regulator. The document sets out who may submit a report, which conduct constitutes a reportable breach and how CySEC will handle each report, while expressly acknowledging that the regulator cannot compensate individuals who are penalised for whistleblowing. (Source: CySEC; published: July 2026)
The guide builds on the whistleblower protection framework tightened by Cyprus in early 2026. In March 2026, Cyprus moved its market abuse reporting rules from a regulatory circular into national law, making the suppression of whistleblowing a criminal offence punishable by up to three years’ imprisonment or a fine of €30,000, equivalent to approximately US$33,000. The document published on Tuesday provides the implementing guidance for those rules.
Eligible Whistleblowers and Reporting Channels
Almost anyone connected with a regulated firm may submit a report. The guide identifies the following eligible reporting persons:
Current, former and prospective employees.
Board members and shareholders.
Unpaid trainees and volunteers.
Reports may be submitted by telephone, email, post or an in-person meeting, either anonymously or under the whistleblower’s name.
Twenty-Two Categories of Reportable Breaches
Reportable conduct covers a list of 22 categories relating to CySEC’s supervision of Cyprus Investment Firms. These include insider dealing, naked short selling, undisclosed conflicts of interest and the sale of high-risk products to retail clients without conducting the suitability assessments required under the second Markets in Financial Instruments Directive (MiFID II). Similar issues have also attracted the attention of UK regulators, which have previously warned contract for difference (CFD) providers about shortcomings relating to fair value and disclosures.
Processing Timelines and Confidentiality Arrangements
CySEC stated that reports will be handled according to the following timetable:
Acknowledgement of receipt within seven days.
Follow-up on the outcome of the investigation within three months.
For complex cases, the follow-up period may be extended to a maximum of six months.
Reports will be handled confidentially, and personal data connected with a case will be deleted within three months after the case is closed, unless related legal proceedings remain ongoing. (Source: CySEC, Persons Who Report Breaches of Union and National Law; published: July 2026)
Limits of Protection: Seventeen Forms of Retaliation Identified
The guide is candid about the limited remedies available to whistleblowers. It identifies 17 forms of retaliation, including dismissal, demotion, industry-wide blacklisting, reputational attacks on social media and even compulsory psychiatric referral. Protection also extends to relatives and colleagues of the whistleblower, as well as anyone who assists in submitting the report. The document further states that providing information to CySEC does not breach any confidentiality clause or contractual obligation.
However, an exception follows. In its capacity as an external reporting channel, CySEC expressly states the limits of its authority as follows:
The Authority has neither the power nor the jurisdiction to remedy any harm suffered by a whistleblower as a result of retaliation.
Accordingly, whistleblowers who lose their employment or contracts because of a report must seek redress through the Ministry of Justice and the courts.
Comparison with Washington and London
Cyprus does not offer any financial rewards for whistleblowing, in sharp contrast with the United States. The table below compares the principal differences among the whistleblowing mechanisms operated by the three regulators.
| Regulator | Financial Rewards Provided | Key Data | Reporting Period |
|---|---|---|---|
| CySEC (Cyprus) | No | No figures disclosed for reports received or processed | July 2026 |
| SEC (United States) | Yes | More than US$1.3 billion awarded in total | Since the programme began in 2012 |
| FCA (United Kingdom) | No | 1,131 whistleblowing reports containing 2,684 allegations | Year ended March 2025 |
The US Securities and Exchange Commission (SEC) pays whistleblowers between 10% and 30% of the financial penalties recovered with the assistance of their information, with individual awards potentially reaching tens of millions of dollars. The UK Financial Conduct Authority (FCA) likewise does not pay financial rewards but publishes statistics on the reports it receives. During the year ended March 2025, compliance and consumer protection breaches ranked among the most frequently reported allegations. CySEC has not disclosed equivalent figures.
Nicosia Increases Regulatory Pressure on Brokers
The whistleblowing channel has been introduced as CySEC intensifies its supervision of brokers operating on the island. Chair George Theocharides has stated that regulatory scrutiny will continue to increase throughout 2026. The regulator has conducted on-site inspections of firms, focusing on their management of conflicts of interest, remuneration structures and trading platform design. CySEC has also fined several brokers, including BDSwiss and IC Markets, for directing clients towards offshore entities.
According to previous reporting by Finance Magnates, Cyprus has licensed more than 250 investment firms serving approximately 3.6 million clients, meaning that the potential pool of whistleblowers, including current and former employees of these firms, is substantial. For anyone considering whether to come forward, the guide makes one point clear: CySEC will receive and investigate reports, but any claim for compensation must be submitted to the Ministry of Justice and the courts.
Frequently Asked Questions About CySEC’s Whistleblowing Mechanism
Who may submit a whistleblowing report to CySEC?
Almost anyone connected with a regulated firm may submit a report, including current, former and prospective employees, board members, shareholders, unpaid trainees and volunteers. Reports may be submitted by telephone, email, post or an in-person meeting, either anonymously or under the whistleblower’s name.
Can CySEC protect whistleblowers from retaliation?
Not completely. The guide identifies 17 forms of retaliation and extends protection to the whistleblower’s relatives and colleagues, but CySEC expressly states that, as an external reporting channel, it has no power to remedy harm caused by retaliation. Related compensation claims must be submitted to the Ministry of Justice and the courts.
How long does CySEC take to process a whistleblowing report?
CySEC acknowledges receipt within seven days and provides follow-up on the investigation within three months. For complex cases, the period may be extended to a maximum of six months. Personal data connected with a case is deleted within three months after the case is closed, unless legal proceedings remain ongoing.
How does Cyprus’s whistleblowing mechanism differ from those in the United States and the United Kingdom?
Cyprus does not pay financial rewards to whistleblowers. The US SEC pays between 10% and 30% of recovered financial penalties and has awarded more than US$1.3 billion in total, while the UK FCA also pays no rewards but publishes whistleblowing statistics, including 1,131 reports received during the year ended March 2025. CySEC has not disclosed the number of reports it has received.
