Audit & Compliance · ICPAC · 2026
The IESBA Code has widened the definition of Public Interest Entity. The CSE Emerging Companies Market is now in scope. So is any Cyprus company listed on a secondary market abroad where PIE rules apply. Here is what changed and what it requires.
Your company may have become a Public Interest Entity without changing anything about itself. The rule changed around it.
For decades, the central concept in audit independence was the "listed entity": a company whose shares, stock or debt were quoted on a recognised stock exchange. That concept determined who needed a PIE-grade audit, which auditors could act, and when partner rotation kicked in.
The 2024 revision to Part 4A of the IESBA International Code of Ethics retires the term. In its place sits "publicly traded entity" (PTE): an entity that issues financial instruments that are transferable and traded through a publicly accessible market mechanism, including through listing on a stock exchange.
| Dimension | Old: Listed Entity | New: Publicly Traded Entity |
|---|---|---|
| Market scope | Recognised stock exchange only | Any publicly accessible market mechanism, including OTC |
| Instruments covered | Shares, stock or debt | Any financial instrument (including derivatives) |
| Alternative markets | Excluded unless classed as "recognised" | Included where publicly accessible |
| CSE Emerging Companies Market | Not within scope | Within scope (ICPAC TC 7/2026) |
| OTC-traded instruments | Not within scope | Within scope |
| Publicly available mutual funds | Uncertain | May qualify |
| IESBA Code reference | Previous Glossary definition | Revised Glossary, effective 15 Dec 2024 |
The practical effect of the change is that the boundary of PIE status has shifted. Formal exchange listing is no longer required. Accessibility to the public is the test, and that test reaches OTC platforms, multilateral trading facilities, and secondary markets that were previously outside the category.
The IAASB has aligned its standards to mirror this change, replacing "listed entity" with "publicly traded entity" across ISA 700, ISA 260, ISA 701, ISA 720, ISQM 1, and ISRE 2400 (Revised). Those IAASB amendments are effective for periods beginning on or after 15 December 2026, with early adoption permitted.
The revised IESBA Code sets out four categories of entity that must be treated as PIEs. The first three are "mandatory" in the sense that local bodies cannot remove them, though they may more precisely define them. The fourth is a local-law designation category.
Issues financial instruments transferable and traded through a publicly accessible market mechanism, including stock exchanges, OTC platforms, and alternative markets. This is the category that replaces "listed entity" and carries the broadest practical expansion.
An entity whose main function is to take deposits from the public. Primarily banks and licensed credit institutions. Electronic money institutions are not automatically in this category: e-money issued under the EMD2 framework is legally distinct from deposit-taking.
An entity whose main function is to provide insurance to the public. Insurance and reinsurance undertakings are within scope. This category was present before the revision and is unchanged in substance.
Any entity specified as a PIE by law, regulation or professional standards in a given jurisdiction, to serve the purpose described in paragraph 400.15 of the IESBA Code. Local bodies retain the authority to extend PIE status to additional entity types.
These categories operate as a floor. Relevant local bodies can refine or expand them but may not contract the mandatory coverage. Where a local definition already covers all four mandatory categories, it continues to apply without amendment: this is the basis on which ICPAC has assessed Cyprus's existing EU PIE definition.
Important: A CySEC licence, a CIF registration, or an EMI authorisation from the Central Bank of Cyprus does not by itself create PIE status. Classification depends on whether the entity has publicly traded instruments, takes deposits, or provides insurance as a main function. Regulated status and PIE status are separate tests.
Cyprus defines EU PIEs in the Auditor's Law of 2017. The four categories are: entities whose transferable securities are admitted to trading on a regulated market or organised market of any EU Member State; licensed credit institutions; insurance and reinsurance undertakings; and entities designated by the Council of Ministers.
ICPAC has assessed this definition and concluded that it already covers all four mandatory IESBA categories. No change to the Auditor's Law definition is required to adopt the revised IESBA Code. The EU PIE framework continues to apply as before for entities within that definition.
The CSE Emerging Companies Market (ECM) is a Multilateral Trading Facility (MTF), not a regulated market. Under the Auditor's Law of 2017, entities listed there are not EU PIEs. They were also outside the old "listed entity" definition because the ECM was not a "recognised stock exchange" in the traditional sense.
That position has now changed. ICPAC TC 7/2026 explicitly states that entities listed on the CSE Emerging Companies Market should be treated as PIEs for the purposes of the IESBA Code, ISQMs and ISAs. The basis is the new PTE definition, which captures entities whose instruments are traded through a publicly accessible market mechanism, and paragraph 400.24 A1 of the IESBA Code, which allows for consistent treatment in line with market practice.
In practice: If you are an ECM-listed company, your statutory auditor is now required to apply PIE-level independence requirements, issue Key Audit Matters in the audit report, carry out an Engagement Quality Review, and disclose publicly that PIE-specific independence requirements were applied. This is a material change from the pre-revision position.
Where a Cyprus company is listed on a non-regulated or secondary market outside Cyprus, ICPAC has set out a dual-jurisdiction test. The auditor must assess whether the entity meets the PIE definition either in Cyprus (the Home Market) or in the jurisdiction where the instruments are traded (the Target Market).
If entities listed on that foreign market are treated as PIEs in that jurisdiction, the Cyprus statutory auditor must apply equivalent treatment. By illustration: a Cyprus holding company admitted to trading on an AIM-equivalent market in a country that treats such entities as PIEs would carry PIE obligations in its Cyprus audit, even without any regulated-market listing anywhere in the EU.
The test is bilateral. Meeting the PIE definition in either jurisdiction is sufficient to trigger PIE treatment in the Cyprus audit.
Being treated as a PIE under the IESBA Code and IAASB standards is not a cosmetic classification. It carries a specific set of obligations that apply to both the audit firm and the audited entity. These obligations are materially more demanding than the standard framework.
For ECM-listed companies that have been audited under a standard (non-PIE) framework to date, the shift is immediate. Audit firms should already be applying the revised classification. Companies that have not yet discussed the implications with their auditor should do so now.
TC 7/2026 reinforces a distinction that is frequently blurred in practice: being a PIE and being an EU PIE are not the same thing. Every EU PIE is a PIE, but a PIE is not necessarily an EU PIE.
The two classifications carry different regulatory architectures:
For ECM-listed companies specifically, this means the practical requirements are substantial but not as extensive as those applying to a regulated-market-listed company. The distinction matters when planning the audit, reviewing non-assurance services, and drafting the auditor's report.
Effective dates summary: IESBA Code revisions (PIE definition, independence requirements, disclosure) apply to audits for periods beginning on or after 15 December 2024. IAASB standard amendments (ISQMs, ISAs, ISRE 2400) apply for periods beginning on or after 15 December 2026, with early adoption permitted. ISA 700 and ISA 260 amendments (transparency disclosure) already apply from 15 December 2024.
Yes. ICPAC Technical Circular 7/2026 explicitly states that entities listed on the CSE Emerging Companies Market should be treated as PIEs for the purposes of the IESBA Code, ISQMs, and ISAs. This applies even though such entities do not meet the definition of an EU PIE under the Auditor's Law of 2017. The basis is the new "publicly traded entity" category in the revised IESBA Code, which ICPAC has determined captures ECM-listed companies in line with paragraph 400.24 A1 of the Code and consistent with prior market practice.
An EU PIE is a subset of PIE. In Cyprus, EU PIEs are defined in the Auditor's Law of 2017 and include entities whose transferable securities are admitted to trading on a regulated market in any EU Member State, licensed credit institutions, and insurance and reinsurance undertakings. EU PIEs are subject to both the IESBA Code requirements and the EU Audit Regulation (537/2014), as well as Cyprus Public Oversight Board circulars. A PIE under the IESBA Code is broader: it includes EU PIEs but also entities such as CSE ECM-listed companies, which carry PIE-level audit obligations under IESBA and IAASB standards but not EU Audit Regulation requirements.
Not directly. A CIF licence or an EMI authorisation from the Central Bank of Cyprus does not by itself create PIE status. Classification depends on whether the entity has financial instruments that are transferable and traded through a publicly accessible market mechanism, whether it takes deposits from the public, or whether it provides insurance as a main function. A Cyprus investment firm or EMI that does not have publicly traded instruments falls outside the mandatory PIE categories. However, if such an entity issues shares or other instruments traded on an OTC platform accessible to the public, that could bring it within the publicly traded entity definition and warrant review.
PIE treatment triggers more demanding requirements for both the audit firm and the company. For the firm: mandatory partner rotation, restrictions on long association, limits on non-assurance services with TCWG pre-approval requirements, fee restrictions, a mandatory Engagement Quality Review before the opinion is signed, and public disclosure in the audit report that PIE independence requirements were applied. For the company: Key Audit Matters must be reported in the auditor's report under ISA 701; the auditor must formally communicate independence matters to those charged with governance under ISA 260; and specific transparency obligations apply under ISA 720.
The revised IESBA Code definitions of "publicly traded entity" and "public interest entity" are effective for audits of financial statements for periods beginning on or after 15 December 2024. This means they already apply to audits of 31 December 2025 financial statements. The IAASB narrow-scope amendments to ISQMs, ISAs, and ISRE 2400 (Revised) are effective for periods beginning on or after 15 December 2026, with early adoption permitted. The ISA 700 and ISA 260 amendments relating to transparency disclosures are already effective from 15 December 2024.
Potentially, yes. ICPAC TC 7/2026 sets out a dual-jurisdiction test: if a Cyprus company is listed on a secondary or non-regulated market abroad, the Cyprus statutory auditor must determine whether the entity qualifies as a PIE either in Cyprus (Home Market) or in the jurisdiction where it is listed (Target Market). If entities listed on that foreign market are treated as PIEs in that jurisdiction, the Cyprus auditor must apply equivalent PIE treatment. A Cyprus holding company listed on an AIM-equivalent market or a local OTC board in a country that classifies such entities as PIEs would carry PIE obligations in its Cyprus audit, even without any regulated-market listing in the EU.
The boundary of public interest has moved. For ECM-listed companies and their auditors, that movement is already in effect. The question is not whether the new framework applies. It is whether the engagement has been structured to comply with it.
Audit & Compliance
We advise on audit committee governance, independence assessments, and compliance readiness for companies moving into PIE classification. Regulated advisory from Limassol since 1990.
Book a Consultation