AML Compliance in Cyprus

Cyprus, a strategic financial hub at the crossroads of Europe, Asia, and Africa, has long been recognized for its favorable business climate and robust legal framework. However, its position as an attractive destination for foreign investment has also made it a potential target for illicit financial activities, including money laundering and terrorist financing. 

To counter these risks and align with international standards, Cyprus has developed a comprehensive Anti-Money Laundering (AML) framework. This article explores the key elements of AML compliance in Cyprus, the regulatory landscape, and the obligations it imposes on businesses operating within its jurisdiction.

Introduction to Anti-Money Laundering in Cyprus

Money laundering—the process of concealing the origin, ownership, or destination of illegally obtained funds—poses significant threats to Cyprus's financial system integrity and economic stability.

The Central Bank of Cyprus plays a pivotal role in orchestrating anti-money laundering efforts across the nation. As the primary financial institution, it bears responsibility for developing comprehensive policies, enforcing sanctions, and conducting regular surveys to monitor underground transactions. Its fundamental mission remains making Cyprus less appealing for criminals seeking to launder funds derived from illegal activities.

Cyprus, as a European Union member state, has aligned its AML framework with international standards and EU directives. This alignment ensures that Cyprus maintains consistency with global best practices while addressing its unique challenges as a regional financial hub. The ongoing evolution of these regulations reflects Cyprus's commitment to combating financial crimes effectively while facilitating legitimate business activities.

The Legal Framework and Regulatory Environment

The cornerstone of Cyprus's anti-money laundering regime is the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007, as amended (the AML Law). This comprehensive legislation transposes relevant EU directives into Cypriot law and incorporates recommendations from the Financial Action Task Force (FATF), the global standard-setter for AML practices.

The AML Law extends its jurisdiction to a wide range of entities involved in providing financial or other services, including banks, investment firms, insurance companies, legal practitioners, accountants, auditors, real estate agents, and trust and company service providers. This broad application ensures comprehensive coverage across Cyprus's diverse financial and professional services sectors.

Since 2023, Cyprus has significantly strengthened its regulatory framework for banks and established a dedicated, stand-alone AML authority. These institutional changes demonstrate Cyprus's commitment to enhancing its AML infrastructure. Further reinforcing this commitment, in March 2024, Cyprus signed a memorandum of understanding with the United States specifically aimed at countering money laundering activities, signaling international cooperation in addressing these challenges.

The Cyprus Securities and Exchange Commission (CySEC) actively contributes to the regulatory landscape through its directives. On August 5, 2024, CySEC published Directive R.A.D 282/2024, amending the CySEC Directive for the Prevention and Combating of Money Laundering and Terrorist Financing 2020. These amendments were designed to enhance the framework for preventing money laundering and terrorism financing throughout the Republic of Cyprus.

AML Compliance Requirements in Cyprus

Customer Identification

KYC (Know Your Customer)

KYC procedures in Cyprus focus on verifying individual clients' identities and risk profiles. Key requirements include:

• Individuals: Valid passport, national ID, or driver’s license for identity proof.
• Proof of Address: Utility bills, bank statements, or government-issued documents (≤3 months old).
• Beneficial Ownership: Identification of individuals holding >25% shares in corporate entities.

KYB (Know Your Business)

KYB focuses on verifying legal entities, ensuring transparency in business relationships: Key requirement of KYB Requirements incldues:

• Corporate Documentation: Certificates of incorporation, articles of association.
• Beneficial Ownership: Mapping ownership structures and verifying ultimate beneficial owners (UBOs).
• Sanctions Screening: Checks against EU/UN lists for businesses and UBOs.

Customer Due Diligence

CDD is the foundation of AML compliance in Cyprus, requiring institutions to screen clients against sanctions lists, PEP databases, watchlists, and adverse media to identify high-risk users. The CySEC Directive R.A.D 282/2024 mandates these screenings as part of a risk-based approach, with stricter requirements for adverse media monitoring from 2024.

Key Screening Components in CDD

Sanctions Screening:

• Verify clients against EU Consolidated Sanctions List, UN Security Council Resolutions, and OFAC’s SDN list.
• Applies to customers, beneficial owners, and transactional counterparts.

PEP Screening:

• Identify domestic/foreign PEPs, their relatives, and close associates using FATF-aligned databases.
• High-risk PEPs trigger Enhanced Due Diligence (EDD) under Cyprus AML Law (Article 61).

Adverse Media Monitoring:

• Scan global news and databases for negative coverage (e.g., corruption, fraud).
• Use AI tools like AML Watcher for multilingual media analysis.

Watchlist Screening:

• Cross-reference clients with INTERPOL, Europol, and EU Terrorism lists.
• Flag links to money laundering, terrorism financing, or organized crime.

Risk-based approach: The intensity of due diligence measures should correspond to the level of risk associated with the client, business relationship, or transaction. Customers categorized as low, medium, or high risk, dictating due diligence intensity.

Enhanced Due Diligence (EDD) in Cyprus

In Cyprus, Enhanced Due Diligence (EDD) is a legal requirement under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007) and is reinforced by CySEC Directive R.A.D 282/2024. It applies to high-risk clients, including Politically Exposed Persons (PEPs), customers from high-risk third countries, and those engaged in unusually complex or large transactions.

EDD involves a more thorough verification process than standard due diligence. Obliged entities must collect detailed information about the client’s source of funds and wealth, assess the purpose and intended nature of the business relationship, and conduct ongoing monitoring to detect suspicious activity. In addition, senior management approval is typically required before establishing a relationship with high-risk clients.

These enhanced controls are essential for mitigating the elevated risk of money laundering or terrorist financing. They also ensure compliance with the risk-based approach mandated by CySEC and FATF guidelines, where due diligence intensity must be proportionate to the level of risk posed by the client or transaction.

EDD is not optional—it is a regulatory obligation for firms operating in Cyprus and a critical safeguard to uphold the integrity of the financial system.

Ongoing Monitoring:

• Reassess risk profiles biannually for high-risk clients.
• Update documentation for changes in business activities or ownership.

Transaction Monitoring and Reporting

Obligated entities must maintain systems for monitoring transactions to identify suspicious activities that might indicate money laundering. The recent amendments to the CySEC Directive included an updated internal suspicion report template for employees reporting suspicious activities to their AML compliance officers.

When suspicious transactions are identified, entities have a legal obligation under Articles 64a and 70 of the AML Law to report these to the appropriate regulatory authority. Failure to comply with these reporting obligations can result in severe penalties under Article 71.

Record-Keeping and Internal Controls

Effective record-keeping practices are essential for AML compliance in Cyprus. Obliged entities must maintain comprehensive records of customer identification, transactions, and due diligence measures for specified periods.

Internal controls, including written policies and procedures, are required to ensure consistent application of AML measures throughout the organization. These controls should encompass risk assessment processes, customer due diligence procedures, transaction monitoring systems, and reporting mechanisms.

Key Components of AML Laws in Cyprus

Critical Articles and Their Requirements

The Cyprus AML Law contains several pivotal articles that form the backbone of the nation's anti-money laundering framework:

Article 61 mandates that every legal entity, whether corporate or individual, must identify and assess money laundering and terrorism risks. This risk-based approach ensures that entities allocate resources appropriately based on identified vulnerabilities.

Article 64a imposes strict reporting obligations on entities that have knowledge or reasonable suspicion that funds derive from criminal activity. This requirement emphasizes the responsibility of financial institutions and other obliged entities to monitor transactions and report suspicious activities.

Article 70 specifically addresses the reporting of suspicious transactions related to money laundering and terrorism financing to the appropriate regulatory authority. This creates a formal channel for communicating potential illicit activities to responsible oversight bodies.

Article 71 establishes the potential penalties for non-compliance with AML regulations, creating significant deterrents for those who might otherwise neglect their AML responsibilities.

Reporting Obligations and Penalties

The reporting obligations under Cyprus AML laws are particularly stringent. All legal entities, including corporations, must report instances where they have knowledge or reasonable suspicion of transactions deriving from criminal activities. The central requirement for suspicion reporting creates an important surveillance network across the financial system.

Non-compliance with these reporting obligations can lead to severe consequences, including substantial financial penalties and potential imprisonment for responsible individuals. These punitive measures underscore the seriousness with which Cyprus treats AML violations and serves to encourage vigilant compliance across all sectors.

Recent Developments and Amendments (2023-2025)

The Cypriot AML regulatory landscape has evolved significantly in recent years, with several important developments occurring between 2023 and early 2025.

CySEC Directive R.A.D 282/2024

The August 2024 CySEC directive introduced several key updates to strengthen AML compliance:

1. Identification document definition: The directive provided clear parameters for acceptable identification documents, eliminating ambiguity in customer verification processes.

2. Updated internal suspicion report template: An enhanced template was introduced for employees of obliged entities to report suspicious activities or transactions to their AML compliance officers, streamlining internal reporting procedures.

3. Electronic verification protocols: The directive formally acknowledged electronic methods for remote identification and verification of client identities as permissible under a risk-based approach. Obliged entities must inform CySEC in advance about the electronic methods they intend to implement.

4. Enhanced due diligence and customer identification guidance: The amendments updated requirements for client documentation, including proof of address specifications and protocols for certified copies of identification documents for clients outside Cyprus. Additionally, these updates ensured alignment with due diligence requirements regarding economic sanctions imposed by the United Nations and European Union.

Most of these changes took immediate effect upon publication, though provisions relating to electronic verification became effective from December 1, 2024.

Institutional Reforms and International Cooperation

Since 2023, Cyprus has implemented fundamental reforms to its AML institutional structure, including the establishment of a dedicated AML authority. This significant change has created a specialized body focused exclusively on monitoring and enforcing AML compliance across all sectors.

In March 2024, Cyprus signed a memorandum of understanding with the United States aimed specifically at countering money laundering. This agreement represents an important step in international cooperation and demonstrates Cyprus's commitment to addressing money laundering concerns through collaborative approaches.

Entities in Cyprus Subject to AML Regulations

Financial Institutions in Cyprus

Financial institutions form the cornerstone of the Cypriot economy and consequently play a pivotal role in AML efforts. Banks and credit institutions, being primary targets for money laundering schemes, bear significant responsibilities in monitoring and reporting suspicious activities.

These institutions must implement robust know-your-customer (KYC) procedures, transaction monitoring systems, and suspicious activity reporting mechanisms. Non-compliance attracts heavy criminal penalties for both the institutions themselves and the individuals responsible for AML oversight within them.

Law and Investment Firms in Cyprus

Law and investment firms in Cyprus shoulder substantial AML responsibilities similar to those of financial institutions. These entities must maintain stringent AML measures to ensure the integrity of the financial system is preserved through their operations.

For these professional service providers, attentiveness to transaction monitoring, regular communication with national authorities, and implementing measures to avoid penalties for non-compliance must remain priority areas. Their position as gatekeepers to the financial system makes their role in AML compliance particularly significant.

Designated Non-Financial Businesses and Professions (DNFBPs)

Beyond traditional financial institutions, the Cyprus AML framework extends to various designated non-financial businesses and professions, including:

• Real estate agents
• Accountants and auditors
• Legal practitioners
• Trust and company service providers
• Casinos and gaming operators (particularly relevant in Northern Cyprus)

These entities must comply with similar AML obligations as financial institutions, including customer due diligence, record-keeping, and suspicious transaction reporting.

In Northern Cyprus specifically, casinos and gaming operators occupy a unique position in the AML framework. As key components of the DNFBP category, they play a vital role in preventing the misuse of the financial system for illicit purposes. Regular audits by dedicated regulatory bodies ensure their compliance with AML obligations, with substantial penalties and reputational damage resulting from failures to meet these standards.

Best AML Practices in Cyprus

Implementing Effective AML Policies

The development and implementation of robust AML policies stand as a critical component in the fight against financial crime in Cyprus. Effective policies should provide clear guidelines for identifying and responding to suspicious transactions, enabling institutions to actively contribute to combating money laundering.

These policies must consider the specific articles of the AML Law related to laundering activities and facilitate the identification of underlying criminal activities (predicate offenses). A comprehensive AML policy serves as an effective sanction scanner regardless of the banking sector's complexities.

Organizations should ensure their AML policies address:

• Risk assessment methodologies
• Customer acceptance procedures
• Transaction monitoring systems
• Suspicious activity reporting protocols
• Record-keeping requirements
• Staff training programs

Regular AML Training

Regular and comprehensive AML training plays a fundamental role in creating an effective defense against money laundering. Such training develops a keen understanding within financial institutions about identifying and flagging suspicious transactions that might indicate laundering activity.

With proper training, employees become conversant with the legal complexities surrounding AML mandates, including the relevant articles of law concerning predicate offenses and underlying criminal activities. This knowledge amplifies their contribution to combating financial crimes.

Training programs should be tailored to different roles within the organization, with more specialized training for those directly involved in AML compliance functions and broader awareness training for all staff members who might encounter potential red flags.

Leveraging Technology for AML Compliance

Technological advancements are transforming AML approaches in Cyprus. Automation of monitoring processes enables the identification of unusual patterns that may reveal potential money laundering activities. Artificial intelligence and big data analytics play crucial roles in rapidly analyzing vast amounts of data, flagging suspicious transactions, and ensuring reporting obligations are met efficiently.

The implementation of technological solutions helps mitigate the risk of penalties by enabling more effective adherence to stringent laws. However, these advancements also introduce new challenges, such as cyber-attack vulnerabilities and data protection concerns, which regulatory authorities are actively addressing.

The recent amendments to the CySEC Directive formally acknowledged electronic methods for remote identification and verification of client identities, demonstrating the regulatory acceptance of technological solutions in AML compliance.

Northern Cyprus AML Practices

AML practices in Northern Cyprus focus primarily on monitoring financial activity to prevent terrorism financing and other illicit operations. Stringent regulations and controls are implemented to identify suspicious transaction reports and trace their origins, helping to identify individuals or entities misusing financial systems for illegal purposes.

The regulatory framework includes severe penalties and consequences for non-compliance with AML guidelines, creating a robust system that preserves the integrity of Northern Cyprus's economic standing.

Casinos and gaming operators in Northern Cyprus occupy a distinctive position within the AML framework. As key components of the designated non-financial businesses and professions (DNFBPs), they contribute significantly to preventing financial system misuse. Regulatory bodies conduct intermittent audits of these gaming operators, with substantial penalties and reputational damage resulting from failures to meet AML obligations.

Impact of AML Rules on Investments in Cyprus

The comprehensive AML regime in Cyprus significantly influences the investment landscape by imposing specific obligations on financial institutions and professionals serving investors. These requirements encompass client identification and verification, beneficial ownership determination, due diligence procedures, ongoing relationship monitoring, suspicious activity reporting, and implementation of internal policies.

While these requirements may initially appear burdensome, they ultimately strengthen Cyprus's reputation as a legitimate and transparent financial center. According to the Association of Cyprus Banks (ACB), the implementation of reforms to enhance AML compliance has proven beneficial, attracting investment opportunities from countries previously reluctant to invest in Cyprus due to concerns about AML weaknesses.

The reforms implemented by Cypriot banks included de-risking from over-reliance on the Russian market and implementing enhanced AML compliance measures. These changes were validated by independent bodies such as Moneyval, reinforcing Cyprus's improved reputation in the international financial community.

However, these moves have not been without financial consequences. In 2014, the Cypriot banking sector held deposits worth eight times the country's gross domestic product; by 2023, this ratio had declined significantly, indicating the economic impact of stricter AML regulations and derisking practices.

Challenges and Future Outlook of AML in Cyprus

Balancing Derisking and Financial Inclusion

One of the significant challenges facing Cyprus's AML efforts is finding the appropriate balance between derisking and maintaining financial inclusion. U.S. Treasury Department officials warned as recently as July 2024 that derisking—the indiscriminate termination of banking relationships with broad ranges of customers—has led to a decline in international banking connections in areas considered high risk.

While derisking may reduce exposure to potential money laundering risks, it can also exclude legitimate businesses and individuals from the financial system, potentially driving financial activity underground where it becomes less transparent and harder to monitor.

Technological Evolution and Cybersecurity

As Cyprus increasingly adopts technological solutions for AML compliance, new challenges emerge related to cybersecurity and data protection. The formal recognition of electronic verification methods in the recent CySEC directive reflects this trend toward digital solutions.

Financial institutions and other obliged entities must invest in robust cybersecurity measures to protect the sensitive customer data collected for AML purposes. Additionally, they must ensure their electronic verification systems remain effective against increasingly sophisticated attempts to circumvent them.

International Cooperation and Standards Alignment

Cyprus's signing of a memorandum of understanding with the United States in March 2024 demonstrates the importance of international cooperation in addressing money laundering concerns. As global standards continue to evolve, Cyprus will need to maintain alignment with international best practices while addressing its unique challenges as a regional financial hub.

The establishment of a stand-alone AML authority since 2023 positions Cyprus well to coordinate these international efforts and ensure consistent application of standards across different sectors of the economy.

Bottom Line

Cyprus has made significant strides in strengthening its anti-money laundering (AML) framework, particularly since 2023. The establishment of a dedicated AML authority, recent amendments to the CySEC Directive R.A.D 282/2024, and expanded international cooperation reflect Cyprus’s clear commitment to fighting financial crime—while preserving its reputation as a competitive and attractive investment hub.

The country's AML regime is anchored by the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007). This comprehensive legislation outlines clear obligations around risk assessment, customer due diligence, reporting requirements, and penalties for non-compliance.

For banks, law firms, fintechs, and other obliged entities, maintaining compliance involves more than ticking boxes. It requires well-defined AML policies, ongoing staff training, and the use of technology to ensure efficient and accurate compliance processes. Though resource-intensive, these obligations are key to building a safer and more transparent financial environment.

One solution increasingly used by Cypriot institutions is Binderr—a fully automated AML compliance platform. Binderr helps organisations meet regulatory expectations by offering:

• ID Verification (KYC)
• Business Verification (KYB)
• CDD and EDD
• Sanctions Screening
• PEP Detection and EDD triggers,
• Adverse Media Monitoring
• Watchlist Screening

By automating critical checks and reducing manual effort, Binderr enables firms in Cyprus to enhance risk management, meet compliance obligations, and focus on strategic growth. As Cyprus continues to refine its AML regime, platforms like Binderr will play a pivotal role in ensuring sustainable, secure financial activity across the jurisdiction.