Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Cyprus Securities and Exchange Commission (CySEC) €511,500 97 % · 5 cases
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) €14,000 3 % · 5 cases
What for?
by area of lawAll areas of law
Who?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 0 | — |
| Q4 2024 | 2 | €4,000 |
| Q1 2025 | 4 | €235,000 |
| Q2 2025 | 0 | — |
| Q3 2025 | 1 | €70,000 |
| Q4 2025 | 1 | €100,000 |
| Q1 2026 | 0 | — |
| Q2 2026 | 2 | €116,500 |
| Q3 2026 | 0 | — |
10 cases
8 Jun 2026 A. Tsokkos Hotels Public LimitedCyprus: 16,500 EUR against A. Tsokkos Hotels for late annual financial report €16,500
The listed hotel group did not publish its 2024 annual financial report on time; the Cyprus Securities and Exchange Commission (CySEC) imposed a total of 16,500 EUR. At the same meeting, eleven other issuers were fined between 1,500 and 17,000 EUR for the same reason; a fine of 13,500 EUR had already been imposed on the company under the same law in 2025.
Publication deadlines for financial reports are not negotiable – repeated delays lead to fines and, in extreme cases, to suspension of trading.
- Authority / court
- Cyprus Securities and Exchange Commission (CySEC)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- Sec. 9(1), 37(2)(a) Transparency Requirements (Securities Admitted to Trading on a Regulated Market) Law 2007
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Repeat case
- yes
- Published
- 7 Aug 2026
- CySEC Board Decision – Fines under the Transparency Requirements Law (08.06.2026) Decision of an authority
- CySEC Board Decision – Fines under the Transparency Requirements Law (14.07.2025, Jahresbericht 2023) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
25 May 2026 Robomarkets LtdCyprus: Robomarkets pays 100,000 EUR under settlement over CFD sales to retail clients €100,000
For the period June 2023 to June 2024, the Cyprus Securities and Exchange Commission (CySEC) examined the investment firm’s organisational requirements, client information, appropriateness assessment and compliance with the restrictions on marketing CFDs to retail investors. The proceedings were concluded with a settlement of 100,000 EUR, which the company has already paid.
When selling CFDs to retail clients, the appropriateness assessment and product intervention rules are central points of supervisory scrutiny.
Appropriateness assessment when selling complex products
- Authority / court
- Cyprus Securities and Exchange Commission (CySEC)
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- Art. 22(1), 25(1), 26(3) Gesetz über Wertpapierdienstleistungen 2017; Art. 42 VO (EU) 600/2014; CySEC-Richtlinie DI87-09; Art. 37(4) CySEC-Gesetz
- Action
- Other
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 24 Aug 2026
- CySEC Board Decision – Robomarkets Ltd – Settlement €100.000 Decision of an authority
- CySEC Board Decisions Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
13 Oct 2025 Wonderinterest Trading LtdCyprus: 100,000 EUR against Wonderinterest Trading over misleading client information €100,000
For 2022 to 2024, the Cyprus Securities and Exchange Commission (CySEC) found that the investment firm had no adequate compliance procedures, did not define target markets for its financial instruments, did not act in the best interests of clients and did not inform clients in a fair, clear and not misleading manner. It imposed fines of 50,000, 30,000 and 20,000 EUR; a judicial review of the decision has been recorded.
Advertising statements by financial service providers must present risks in a balanced way – marketing belongs in the compliance approval process.
Fair and not misleading marketing communications
- Authority / court
- Cyprus Securities and Exchange Commission (CySEC)
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- Sec. 17(2), 17(3)(c), 22(1), 25(1), 25(3)(a) Gesetz über Wertpapierdienstleistungen 2017; Art. 22, 44 Delegierte VO (EU) 2017/565
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Financial services and insurance
- Published
- 17 Dec 2025
- CySEC Board Decision – Wonderinterest Trading Ltd – Total fine €100.000 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Blacktower Financial Management (Cyprus) LtdCyprus: Blacktower Financial Management pays 70,000 EUR over conflicts of interest €70,000
For the period November 2020 to May 2025, the Cyprus Securities and Exchange Commission (CySEC) investigated the investment firm’s handling of conflicts of interest and its general conduct of business and information obligations towards clients. The proceedings ended with a settlement of 70,000 EUR, which the company has paid.
Conflicts of interest must be identified, documented and managed vis-à-vis clients – adviser training is the basis for this.
Recognising conflicts of interest in investment advice
- Authority / court
- Cyprus Securities and Exchange Commission (CySEC)
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- Art. 24(1), 25(1) Gesetz über Wertpapierdienstleistungen 2017; Art. 37(4) CySEC-Gesetz
- Action
- Other
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 17 Nov 2025
- CySEC Board Decision – Blacktower Financial Management (Cyprus) Ltd – Settlement €70.000 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Mar 2025 FXNET LimitedCyprus: FXNET pays 225,000 EUR under settlement over organisational and CFD breaches €225,000
The investigation covering 2021 to 2022 concerned compliance organisation, product governance, record-keeping obligations, safeguarding of client funds, client information, suitability and appropriateness assessments and the CFD restrictions for retail investors. Following board resolutions of 17 and 31 March 2025, the Cyprus Securities and Exchange Commission (CySEC) concluded a settlement of 225,000 EUR, which has been paid.
Safeguarding client funds and keeping proper records are basic duties of every investment firm – gaps quickly add up in a settlement.
- Authority / court
- Cyprus Securities and Exchange Commission (CySEC)
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- Art. 17, 22(1), 25, 26(3)(a) Gesetz über Wertpapierdienstleistungen 2017; Art. 42 VO (EU) 600/2014; Art. 37(4) CySEC-Gesetz
- Action
- Other
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 11 Nov 2025
- CySEC Board Decision – FXNET Limited – Settlement €225,000 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Mar 2025 Αρχή Ηλεκτρισμού Κύπρου (Electricity Authority of Cyprus, EAC)Cyprus: reprimand for electricity supplier EAC over insecure app registration Reprimand or warning
A customer denied having registered in the EAC Mobile App and having changed his billing address there; the supplier could not prove that the mobile number used for identification originated from the customer himself. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) found breaches of accountability and data security, issued a reprimand and ordered the delivery address to be clarified with the customer in writing.
Self-registration in customer portals needs robust identity verification – otherwise invoices and data can be redirected.
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 24, Art. 32 DSGVO
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Energy and utilities
- Απόφαση – Γνωστοποίηση παραβίασης, Εφαρμογή EAC Mobile App (11.03.2025) Decision of an authority
- 11/08/2025 Αποφάσεις: Ιανουάριος – Απρίλιος 2025 Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
10 Mar 2025 Οργανισμός Χρηματοδοτήσεως Στέγης (Housing Finance Corporation)Cyprus: 10,000 EUR against housing finance corporation for storing data too long €10,000
The housing finance corporation retained data of a former customer in its loan system beyond the permissible retention period because deletion there is only possible manually, record by record. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 10,000 EUR and ordered erasure within 10 days as well as technical and organisational corrections within six months.
Retention periods need technical support – a system without a deletion function turns every expired period into an infringement.
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 5 Abs. 1 lit. d und e, Art. 24 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Απόφαση – Διατήρηση δεδομένων πέραν της νόμιμης περιόδου (ΟΧΣ, 10.03.2025) Decision of an authority
- 11/08/2025 Αποφάσεις: Ιανουάριος – Απρίλιος 2025 Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Feb 2025 Trust International Insurance Company (Cyprus) LimitedCyprus: reprimand for Trust International Insurance – accident file given to insurance agent Reprimand or warning
An insurance agent who was himself involved in an accident received, on request, the roadside assistance file from the insurer, including data of the other party to the accident, and subsequently contacted that person. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand because there was no legal basis for the disclosure and internal procedures did not cover this case, and ordered a procedure for data requests from agents and employees.
Own agents or employees are also third parties when they request data in their own matters – this must be governed in the disclosure process.
Disclosure of customer data to agents and colleagues in their own matters
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. a und f, Art. 6 Abs. 1, Art. 32 Abs. 1 DSGVO
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Mitigating circumstances
- The company implemented the order
- Απόφαση – Γνωστοποίηση περιστατικού παραβίασης δεδομένων (Trust International Insurance, 07.02.2025) Decision of an authority
- 11/08/2025 Αποφάσεις: Ιανουάριος – Απρίλιος 2025 Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Dec 2024 Eurolife LtdCyprus: reprimand for insurer Eurolife – unsealed dismissal letter delivered to father Reprimand or warning
A courier of the insurer delivered an employee’s dismissal letter unsealed to his parents’ home and, when the father refused to accept it, left it there, so that third parties could read its contents. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand for breaches of lawfulness, confidentiality and accountability and ordered the delivery procedure for dismissal letters to be revised within one month.
HR letters such as dismissals must be sealed and delivered only to the person concerned – couriers need clear instructions.
Confidential delivery of HR correspondence
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. a und f, Art. 6, Art. 24 Abs. 1 DSGVO
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Απόφαση – Παράπονο vs Eurolife Ltd (23.12.2024) Decision of an authority
- 28/03/2025 Αποφάσεις: Οκτώβριος – Δεκέμβριος 2024 Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
26 Nov 2024 CMC Certus Management Consultants LtdCyprus: 4,000 EUR against visa service provider CMC Certus – client documents on Scribd €4,000
Without informing them, the residence permit consultancy sent a client couple’s marriage certificate and proof of salary to a sister company in Georgia for translation; the documents subsequently appeared publicly on the Scribd platform. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 2,000 EUR each for an impermissible transfer to a third country and for lack of security measures, as well as a reprimand for insufficient cooperation.
Translation by a group company in a third country is also a data transfer – requiring safeguards, information and confidentiality rules.
Passing client documents on to translators and group companies
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 5 Abs. 1 lit. f, Art. 31, Art. 44 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Decision – Complaint against CMC Certus Management Consultants Ltd (26.11.2024) Decision of an authority
- 28/03/2025 Αποφάσεις: Οκτώβριος – Δεκέμβριος 2024 Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link