Regulatory inspections form an important part of ensuring that regulated entities continue to comply with their legal and regulatory obligations. For Cyprus Investment Firms (CIF), Crypto-Asset Service Providers (CASP) and other CySEC-regulated entities, being prepared for an inspection requires more than maintaining the appropriate policies and procedures. Firms should also be able to demonstrate that their governance arrangements, internal controls and operational procedures are effectively implemented in practice.
The Cyprus Securities and Exchange Commission (CySEC), as part of its supervisory mandate, conducts both onsite and desk-based inspections of the entities under its supervision. These inspections may examine different areas of a firm's operations, from governance and organisational arrangements to department-specific processes and compliance with applicable regulatory requirements.
In this blog post,
Evdokia Pitsillidou, Global Chief Risk & Compliance Officer at
SALVUS Funds and instructor at the Institute for Professional Excellence, introduces the key themes covered in the online course “
How to get prepared for an inspection by the regulator in 2026.” The course provides professionals with practical knowledge of CySEC's supervisory role and powers, key inspection areas, governance and organisational requirements, together with useful inspection tips and post-inspection expectations.
Strengthen your regulatory inspection readiness by understanding what CySEC may examine and how your organisation can maintain an effective compliance framework throughout 2026.
CySEC and Regulatory Inspections
CySEC is responsible for supervising entities falling within its regulatory remit, with the objective of ensuring investor protection and supporting the healthy development of the securities market.
As part of its supervisory responsibilities, CySEC conducts onsite and desk-based inspections of regulated entities. During an inspection, the regulator may assess whether the organisation's policies, procedures, governance arrangements and internal controls are appropriately designed and effectively implemented.
Inspection readiness should therefore be approached as an ongoing compliance responsibility rather than an exercise undertaken only once an inspection has been announced.
Maintaining accurate documentation, clearly allocating responsibilities and regularly reviewing the effectiveness of internal procedures can help firms demonstrate that regulatory requirements are embedded within their day-to-day operations.
Governance Arrangements and Organisational Requirements
Effective governance and appropriate organisational arrangements are central elements of regulatory compliance and therefore important areas when preparing for an inspection.
A regulated entity should be able to demonstrate that responsibilities are appropriately allocated, internal control functions operate effectively and senior management maintains adequate oversight of the firm's activities.
Preparation should therefore involve reviewing areas such as:
- the firm's governance arrangements and organisational structure,
- the roles and responsibilities of the Board of Directors and key function holders,
- the adequacy of internal policies and procedures,
- the operation of compliance and other control functions,
- the implementation of regulatory requirements across the organisation, and
- the firm's ability to evidence that established controls operate effectively in practice.
An inspection may therefore involve both reviewing the firm's documentation and assessing how its procedures are actually applied throughout the organisation.
Key Inspection Areas CySEC inspections may cover a broad range of regulatory and operational areas depending on the nature, size, complexity and activities of the regulated entity.
Accordingly, firms should maintain a comprehensive approach to inspection readiness and ensure that individual departments understand the regulatory requirements relevant to their responsibilities.
The course examines key inspection areas, governance arrangements, organisational requirements and department-specific considerations, helping professionals understand the areas that may attract regulatory attention during an inspection.
A practical preparation process should therefore include reviewing whether:
- policies and procedures remain current and reflect applicable regulatory requirements,
- staff understand their responsibilities and are appropriately trained,
- adequate records and supporting evidence are maintained,
- deficiencies identified through compliance monitoring or internal reviews have been addressed,
- governance and escalation arrangements operate effectively, and
- the firm's actual practices remain consistent with its documented procedures.
What is the “How to get prepared for an inspection by the regulator in 2026” course and what does it include? Delivered by
Evdokia Pitsillidou, Global Chief Risk & Compliance Officer at
SALVUS Funds, through the IforPE platform, the course has been developed as a practical guide for professionals preparing for inspections conducted by the Cyprus Securities and Exchange Commission.
The self-paced course is particularly relevant to Compliance Officers and Assistants, as well as professionals employed by Cyprus Investment Firms, Crypto-Asset Service Providers and other CySEC-regulated entities. It is also highly relevant to members of the Board of Directors, who bear ultimate responsibility for ensuring that the regulated entity complies with the applicable rules and regulations.
Professionals completing the course will strengthen their understanding of how CySEC conducts its supervisory activities, the governance and organisational arrangements examined during inspections and the practical steps firms can take to improve inspection readiness.
The course focuses on the following areas:
•
The Cyprus Securities and Exchange Commission - About CySEC
- CySEC Responsibilities
- CySEC Regulated Entities
- CySEC Powers
• Governance Arrangements and Organizational Requirements
- Governance Arrangements
- Organizational Requirements
• Part 1: Inspection Areas & Compliance tips - Policies & Procedures
- Organizational requirements – Inspection areas & Methodology
- Operating conditions – Inspection areas & Methodology
- Client accounts: opening & closing • Part 2: Inspection Areas & Compliance tips - Operating conditions – Inspection areas & Methodology
- Client accounts: opening & closing
• Departmental Inspection Areas & Compliance tips - Back Office Department
- AML Department
- Accounting & Finance
- Provision of Services
- Business Development & Marketing
- Customer Support
- Information Technology • ESMA Common Supervisory Actions - What is an ESMA CSA?
- National Competent Authorities
- MiFID II Product Governance rules
- MiFID II Cost and Charges disclosure rules
- MiFID II Marketing communications
- MiFID II Conflicts of Interest requirements • Inspection Tips & Results - Compliance tips
- Post-inspection communication
- Inspection results
- 2024 CySEC Investor Protection fine
The course is delivered through online video recordings and downloadable PDF study material, allowing professionals to learn whenever and wherever it suits them best. Participants can progress at their own pace, revisit topics as needed and reinforce their knowledge through accessible and structured learning resources.
Upon successful completion, participants receive a certificate awarding 5 CPD hours, recognised by CySEC, the Central Bank of Cyprus, and other professional supervisory bodies. The course contributes towards the annual CPD requirements of CySEC Advanced and Basic Certification holders, as well as professionals registered with ICPAC and the Cyprus Bar Association.
