Guide

CySEC Circular C751 and the 2027 Register of Information

Circular C751 is the document that turned the register from a spreadsheet exercise into a software one. Issued on 19 January 2026, it withdrew the Excel route, made the EBA's validation rules the standard every package is checked against, and added two designations in the CySEC Portal. This is what it says and what it means for the filing due on 28 February 2027.

By Mark Pesah · Last reviewed 14 October 2026

What C751 requires

• xBRL-CSV only. The "Build in Excel" template that many firms used for their first register is no longer accepted. The register is submitted as an xBRL-CSV package, zipped, through the CySEC XBRL Portal.
• EBA validation rules. The software that produces the package must support the EBA's validation rules; a package that fails them is not a submission.
• Annual cycle. Reference date 31 December, deadline 28 February, every year. The register is filed in full for the reference date: every arrangement in force, not a list of changes.
• Two designations in the CySEC Portal for entities that are not micro-enterprises: the ICT auditor, and the person who owns the ICT risk control function.

The circular applies to Cyprus Investment Firms, crypto-asset service providers, authorised AIFMs, UCITS management companies, central securities depositories and trading venues.

What it means in practice for February 2027

The package is produced by software and validated before upload

Once Excel is out, the question is which software produces the package and whether it validates against the current EBA rules — the rules that applied to the 2026 filing are not the rules that apply now (see why an accepted 2026 register can fail in 2027). The sensible order is: validate what you filed last year under today's rules, then update the content, then validate again before the compliance officer signs off.

The entity uploads under its own credentials

The CySEC XBRL Portal is the entity's. Whoever prepares the package, the upload is done by the firm, and the sign-off before it is the compliance officer's. Papersmith is built around that split: the AI does the reading and the XBRL; the firm reviews, signs and uploads.

Identifiers take longer than contracts

Every ICT provider that is a legal person needs an LEI or, for EU companies, a EUID, and the LEI has to be current. Providers outside the EU need an LEI. For a firm authorised in 2026 preparing its first register, chasing providers for identifiers is the long pole; it can start before a single contract has been read.

Designations are a Portal task, not a register task

The ICT auditor and the ICT risk control-function owner are recorded in the CySEC Portal, separately from the register. They are worth doing early, because the ICT auditor is also the person who will want to see the register before it goes.