CySEC outlines procedures for whistleblowing

The Cyprus Securities and Exchange Commission (CySEC) today issued a circular on whistleblowing, detailing the procedures to be used for submitting a report of an infringement.

A report of infringement can be submitted either by name or anonymously. CySEC has the following communication channels for receiving a report of infringement and for contacting the dedicated staff members of the competent department:

• a) Phone line: +357 22 506 750. When using this phone line, the conversations are recorded, only with the consent of the reporting person.
• b) Electronic address: [email protected]
• c) Postal address: Diagorou 19, 1097 Nicosia, Cyprus, for the attention of Market Surveillance and Investigations Department marked as “CONFIDENTIAL”.
• d) Arrangement of a physical meeting with the dedicated staff members of the competent department which can be scheduled following an oral request of the reporting person to the phone line.

The reporting person may submit written report of infringement by completing the “Whistleblowing External Disclosure Form” and sending it through the communication channels.

CySEC upon receipt of an oral or written report of infringement, informs in writing the reporting person within how many days will be notified about the results of the inquiry to his/her postal or electronic address, if such has been provided, and ensures that the relevant notification will be sent within the timeframe set.

In case that postal or electronic address has not been provided, CySEC provides the above information orally to the reporting person, given that a contact number has been provided. In case that the reporting person has not provided any contact details, he/she can be provided with the above information orally, by contacting the dedicated staff members of the competent department to the phone line set out in the provisions of paragraph A3a above.

CySEC promptly sends a receipt confirmation in relation to the receipt of written reports of infringements to the postal or electronic address indicated by the reporting person, unless the reporting person explicitly requested otherwise or CySEC reasonable believes that acknowledging receipt of a written report would jeopardise the protection of the reporting person’s identity.

Where a telephone line is used for the reporting of infringements, with the exception of those cases in which the reporting person has not provided his/her consent for the recording of the conversation, CySEC has the right to document the oral reporting in the form of:

• a) an audio recording of the conversation in a durable and retrievable form; or
• b) a complete and accurate transcript of the conversation prepared by the dedicated staff members of the competent department.

In cases where the reporting person has disclosed his/her identity, CySEC offers the possibility to the reporting person to check, rectify and agree with the transcript of the call by signing it.

With regards to the confidentiality regime applicable to the report of infringement, CySEC draws the attention of the reporting person to the following circumstances in which the confidential information of a reporting person may be published:

• in the context of a civil or criminal or other legal proceeding or in the context of arbitration or out of court settlement, where CySEC is requested to provide evidence or give testimony or during the provision of statements in criminal or disciplinary proceedings,
• in the context that CySEC lodges complaints to any other competent authorities, associations, organizations or bodies in the Republic or abroad,
• in the context of the right to be heard of the reported person or any other person who is invited to representations to CySEC, giving access to such person to the information of the relevant administrative file.

It is highlighted that personal data, in the context of the report of infringement, is kept for a maximum period of five years.

It is pointed out that, in accordance with article 6(6) of the Market Abuse Law of 2016 (N.102(I)/2016), a person providing information to CySEC, in accordance with the Regulation, is not considered to be infringing any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, nor will the said person have liability of any kind related to such disclosure.