Cyprus -- AML/CFT Compliance Regulatory Overview
Methodology
AI-generated synthesis from web search results.
Limitations
- AI-generated content -- not reviewed by human expert
- Source URLs not independently verified
Cyprus has significantly strengthened its Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) framework, particularly concerning Virtual Asset Service Providers (VASPs), which it refers to as Crypto Asset Service Providers (CASPs). This was largely in response to the Fifth Anti-Money Laundering Directive (5AMLD) of the European Union, which brought virtual assets and their service providers into the scope of AML/CFT regulations.
Below is a comprehensive overview of the AML/KYC requirements for CASPs in Cyprus:
Regulatory Framework and Legislation
The AML/CFT framework for CASPs in Cyprus is primarily based on:
EU Anti-Money Laundering Directives:
- Directive (EU) 2015/849 (4AMLD): The foundational directive, establishing the risk-based approach, beneficial ownership registers, and enhanced due diligence.
- Directive (EU) 2018/843 (5AMLD): Crucially extended the scope of EU AML rules to include crypto-asset exchanges and custodian wallet providers, requiring them to be regulated and subject to AML/CFT obligations.
- Directive (EU) 2018/1673 (6AMLD): Harmonized the definition of money laundering offences and associated penalties across EU member states.
Cypriot National Legislation:
- The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law N. 188(I)/2007), as amended. This is the primary national law that transposes the EU AML Directives into Cypriot legislation. It has been amended multiple times to reflect the subsequent EU Directives.
- CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Regulatory Administrative Act 342/2021) for CASPs. This specific directive, issued by CySEC, outlines the detailed AML/CFT obligations for CASPs, including registration, operational requirements, and specific procedures.
Definition of a Crypto Asset Service Provider (CASP)
Under Cypriot law, a CASP is a person who provides or exercises one or more of the following services or activities to another person or on behalf of another person, which are not covered by investment services or activities, or other services subject to specific legislation:
- Exchange between crypto assets and fiat currencies.
- Exchange between crypto assets.
- Management, transfer, holding, and/or safekeeping of crypto assets or cryptographic keys or means which allow the exercise of control over crypto assets.
- Offering and/or selling of crypto assets, including the initial offering.
- Participation in and/or provision of financial services relating to the distribution, offering and/or selling of crypto assets, including the initial offering.
Key AML/KYC Requirements for CASPs
CASPs in Cyprus must adhere to a comprehensive set of AML/KYC requirements, primarily driven by a risk-based approach:
1. Customer Due Diligence (CDD) Requirements
CASPs must conduct CDD on all new and existing clients, adapting the intensity of due diligence to the assessed risk.
Standard CDD:
- Identification and Verification of Customer Identity:
- Natural Persons: Full name, date and place of birth, nationality, permanent residential address, unique identification number (e.g., passport or ID number). Verification requires reliable, independent source documents and/or data.
- Legal Entities: Company name, legal form, registration number, registered address, names of directors and company secretary, articles of association, and proof of legal existence.
- Identification of Beneficial Ownership: For legal entities, identifying and verifying the ultimate beneficial owner (UBO) who directly or indirectly holds 225% or more of the shares or voting rights, or otherwise exercises control.
- Understanding the Purpose and Nature of the Business Relationship: CASPs must understand why the customer wants to use their services and the expected type and volume of transactions.
- Source of Funds (SoF) / Source of Wealth (SoW): Especially for higher-risk clients or significant transactions, CASPs must take reasonable measures to establish the source of the funds and/or wealth involved.
- Identification and Verification of Customer Identity:
Simplified Due Diligence (SDD): May be applied in limited, specific low-risk situations, but generally, the inherent risks associated with virtual assets make SDD rare.
Enhanced Due Diligence (EDD): Must be applied in high-risk situations, including:
- Business relationships with Politically Exposed Persons (PEPs), their family members, or close associates.
- Customers residing in or conducting transactions with high-risk third countries (as identified by the EU or FATF).
- Non-face-to-face business relationships without adequate safeguards.
- Transactions involving unusual patterns, high value, or complex structures.
- Measures include: Obtaining additional information, senior management approval, increased monitoring, and requiring deeper SoF/SoW verification.
Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure consistency with the CASP's knowledge of the customer, their business, and risk profile. This includes monitoring for suspicious patterns or unusual deviations.
2. Suspicious Transaction Reporting (STR)
CASPs are obliged to report any suspicion of money laundering or terrorist financing to the relevant authority.
- Internal Reporting: Employees must report suspicions to the appointed Money Laundering Reporting Officer (MLRO).
- MLRO's Duty: The MLRO must evaluate the internal report and, if a suspicion is formed, submit an STR to the Unit for Combating Money Laundering (MOKAS), which is Cyprus's Financial Intelligence Unit (FIU).
- Tipping-off: CASPs and their employees are strictly prohibited from disclosing to the customer or any third party that an STR has been or will be submitted, or that a money laundering investigation is underway.
3. Record-Keeping Obligations
CASPs must maintain records for a specified period to assist in any potential investigations.
- Duration: Records must be kept for at least five (5) years from the completion of the transaction or the termination of the business relationship.
- Types of Records:
- Copies of all documents obtained for CDD (identification data, verification documents).
- Originals or copies of transaction records, including the amount, currency, date, and parties involved.
- Records of STRs made to MOKAS.
- Records of internal policies, procedures, risk assessments, and training provided to staff.
- Accessibility: Records must be readily accessible to CySEC, MOKAS, and other competent authorities upon request.
4. Other Key Obligations
- Internal Policies and Procedures: CASPs must establish and maintain robust internal AML/CFT policies, controls, and procedures, including a comprehensive risk assessment. These should be documented in an "AML Manual."
- Money Laundering Reporting Officer (MLRO): Appointment of a suitably qualified and experienced MLRO at management level responsible for overseeing AML/CFT compliance.
- Staff Training: Regular and ongoing training for all relevant employees on AML/CFT risks, regulations, and internal procedures.
- Independent Audit: Establishment of an independent audit function to test the effectiveness of the AML/CFT policies and procedures.
- Sanctions Screening: CASPs must screen customers and transactions against relevant national and international sanctions lists (e.g., UN, EU, OFAC).
Overseeing Authority
The primary authority overseeing AML/CFT compliance for Crypto Asset Service Providers (CASPs) in Cyprus is:
- Cyprus Securities and Exchange Commission (CySEC): CySEC is responsible for the registration, supervision, and enforcement of AML/CFT rules for CASPs in Cyprus. They issue directives, guidelines, and conduct on-site inspections.
- URL:
https://www.cysec.gov.cy/ - CASP Register: CySEC maintains a public register of authorized CASPs, which can be found here:
https://www.cysec.gov.cy/en-GB/casp/registers/
- URL:
The Financial Intelligence Unit (FIU) for Cyprus is:
- Unit for Combating Money Laundering (MOKAS): MOKAS is the central national authority responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other information related to money laundering and terrorist financing.
- URL:
https://www.mokas.gov.cy/
- URL:
Disclaimer: This information is for general informational purposes only and does not constitute legal advice. CASPs operating in Cyprus should seek professional legal and compliance advice to ensure full adherence to all applicable laws and regulations. The regulatory landscape is subject to change, and specific interpretations may evolve.
Source Data
**Regulator Name:** Cyprus Securities and Exchange Commission (CySEC)
**Entity Targeted:** eToro (Europe) Ltd (a major global trading platform also offering crypto services)
**Violation Type:** Non-compliance with regulatory requirements related to organizational requirements, safeguarding clients' funds, and prevention of money laundering and terrorist financing (AML/CFT). This included deficiencies in operational risk management, internal controls, and measures taken to prevent money laundering and terrorist financing.
**Date:** January 29, 2024 (The decision covered violations from January 2020 to December 2022).
**Outcome:** Imposition of an administrative fine. eToro (Europe) Ltd stated it has taken corrective measures.
**Source URL:** CySEC Official Announcement - eToro (Europe) Ltd
**Entity Targeted:** Bitpanda GmbH (a well-known European digital investment platform operating as a registered VASP in Cyprus)
**Violation Type:** Non-compliance with the AML/CFT Law, specifically regarding internal controls and measures for the prevention of money laundering and terrorist financing, and deficiencies in customer due diligence procedures.
**Date:** July 10, 2023 (The decision covered violations from December 2020 to September 2022).
**Source URL:** CySEC Official Announcement - Bitpanda GmbH
**Cyprus Securities and Exchange Commission (CySEC)**
Role: The primary regulator responsible for supervising and registering Virtual Asset Service Providers (VASPs) under the AML/CTF framework. It ensures compliance with AML directives, assesses the fitness and propriety of VASP management, and oversees operational requirements.
**Role:** Cyprus's Financial Intelligence Unit (FIU), responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other information regarding potential money laundering and terrorist financing activities. While not a direct regulator of VASPs, it is central to the AML/CTF ecosystem.
**The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (L. 188(I)/2007), as amended.**
**Date:** Originally enacted in 2007, but significantly amended over time, particularly in **2021**, to transpose the **5th Anti-Money Laundering Directive (AMLD5)** and bring VASPs under its scope. These amendments defined "Virtual Assets" and "Virtual Asset Service Providers" (VASPs) and designated CySEC as the supervisory authority.
**Key Provisions:** Requires VASPs to register with CySEC, implement robust AML/CTF measures (KYC, transaction monitoring, risk assessments), report suspicious activities, and adhere to internal control procedures.
**CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Regulatory Administrative Act No. 466/2021)**
**Key Provisions:** This directive provides the detailed operational requirements and guidelines for VASPs registered with CySEC. It covers:
Categorization of VASP services (e.g., exchange between virtual assets and fiat, transfer of virtual assets, safekeeping, initial coin offerings).
Specific AML/CTF obligations (customer due diligence, record-keeping, risk management, internal controls, reporting obligations).
Organizational requirements (management, capital adequacy, professional indemnity insurance).
**EU Markets in Crypto-Assets (MiCA) Regulation (EU) 2023/1114**
**Impact:** MiCA will be the overarching, harmonized regulatory framework for crypto-assets across the EU, including Cyprus. It will replace the existing national AML-driven frameworks for certain aspects and introduce comprehensive rules for crypto-asset issuance, operation, and services.
Rules concerning asset-referenced tokens (ARTs) and e-money tokens (EMTs) will apply from **30 June 2024**.
Rules concerning other crypto-assets and crypto-asset service providers (CASPs) will apply from **30 December 2024**.
**Cyprus's Stance:** CySEC is actively preparing for the implementation of MiCA, which will streamline the regulatory landscape and shift certain aspects from an AML-only focus to a broader prudential and market integrity framework.
**Permitted and Regulated:** Crypto trading and the operation of crypto exchanges (classified as VASPs) are **permitted** in Cyprus, provided they are properly **registered and supervised by CySEC**.
**Registration Requirement:** Any entity wishing to offer services related to virtual assets in or from Cyprus must apply for registration with CySEC as a VASP.
**Compliance Obligations:** Registered VASPs are subject to stringent AML/CTF requirements, including:
**Customer Due Diligence (KYC):** Verifying the identity of their customers.
**Transaction Monitoring:** Monitoring transactions for suspicious patterns.
**Risk Assessments:** Conducting regular risk assessments related to money laundering and terrorist financing.
**Reporting:** Reporting suspicious transactions to MOKAS.
**Operational Requirements:** Adhering to organizational, governance, and capital adequacy requirements set by CySEC.
**Consumer Protection:** While the current framework is heavily AML-focused, CySEC's oversight aims to instill a degree of market integrity and consumer protection through the fitness and propriety assessment of management and operational controls. MiCA will significantly enhance consumer and investor protection.
**Adopted:** Yes, the Travel Rule is considered adopted in Cyprus through its direct application of EU law and the integration of FATF standards into its national AML/CFT framework.
**EU Level:** The primary legal basis for the Travel Rule for crypto-assets across the EU, including Cyprus, is **Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (recast Transfer of Funds Regulation - TFR 2023)**. This regulation repeals the previous TFR (EU) 2015/847 and is part of the EU's AML/CFT legislative package alongside the Markets in Crypto-Assets Regulation (MiCA). As an EU Regulation, it is **directly applicable** in all member states, including Cyprus, without requiring national transposition, though national authorities issue guidance.
**National Level:** The overarching national AML/CFT framework in Cyprus is the **Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2000 (Law 188(I)/2007, as amended)**. This law incorporates various EU AML Directives (AMLDs) and grants regulatory powers to authorities like CySEC. CySEC issues directives and guidance under this national law to ensure compliance.
**URL (CySEC's page referencing AML/CFT law):** CySEC - Prevention and Suppression of Money Laundering and Terrorist Financing Law
For the EU as a whole, **Regulation (EU) 2023/1113 applies from 30 December 2024.**
Therefore, this is the de jure effective date for the full application of the Travel Rule for crypto-asset transfers in Cyprus as per the EU regulation. Cypriot Crypto Asset Service Providers (CASPs) must be fully compliant by this date.
**No lower threshold:** TFR 2023/1113 significantly amends the Travel Rule for crypto-asset transfers by eliminating the de minimis threshold. This means that for **all crypto-asset transfers, regardless of amount**, CASPs must obtain and verify originator and beneficiary information if they are involved in the transfer.
This removes the previous €1,000 threshold that existed for traditional wire transfers in earlier iterations of the TFR for the specific case of crypto-assets.
The TFR 2023/1113 applies to **Crypto-Asset Service Providers (CASPs)** as defined under the upcoming MiCA Regulation.
In Cyprus, these entities are currently registered with the Cyprus Securities and Exchange Commission (CySEC) as **Crypto Asset Service Providers (CASPs)** under the Prevention and Suppression of Money Laundering and Terrorist Financing Law.
Are involved in the transfer of crypto-assets on behalf of a customer.
Provide other services related to crypto-assets that facilitate transfers.
**URL (CySEC CASP Register):** CySEC - Register for Crypto Asset Services Providers
Crypto-asset account number of the originator (or unique transaction identifier).
Address of the originator (or national identification number, or customer identification number, or date and place of birth).
Crypto-asset account number of the beneficiary (or unique transaction identifier).
**Information Verification:** CASPs must verify the accuracy of the originator information on the basis of documents or data obtained from a reliable and independent source.
**Information Transmission:** The required information must be transmitted with the crypto-asset transfer (or immediately after) to the beneficiary CASP, using secure and reliable communication channels. Interoperability solutions (e.g., TRP, OpenVASP, Travel Rule Universal Protocol - TRUP) are expected for efficient information exchange between CASPs.
**Record Keeping:** CASPs must retain the collected information for a period of five years, in line with general AML/CFT record-keeping requirements.
**Sanctions Screening:** CASPs are required to screen originator and beneficiary information against relevant sanctions lists.
**Missing or Incomplete Information:** CASPs must have policies and procedures for handling transfers with missing or incomplete information. This may include:
Reporting suspicious activity to the Unit for Combating Money Laundering (MOKAS), Cyprus's Financial Intelligence Unit (FIU).
CySEC's existing directives on AML/CFT compliance for CASPs (e.g., Circular C367 and Circular C446) set the broader expectation for robust internal controls, risk assessment frameworks, and the use of appropriate technology to manage AML/CFT risks.
**URL (CySEC Circulars - search for AML/CFT and CASP):** CySEC Circulars
**Monetary Fines:** Substantial fines can be imposed. For legal persons (CASPs), fines can reach up to **€5 million or 10% of their total annual turnover**, whichever is higher, or even up to twice the amount of the benefit derived from the breach, if that can be determined. For individuals, fines can reach up to **€1 million**.
**Withdrawal or Suspension of Authorization/Registration:** CySEC has the power to suspend or completely withdraw a CASP's registration if serious breaches occur, effectively preventing them from operating in Cyprus.
**Public Reprimands:** Disciplinary measures can include public statements identifying the non-compliant entity and the nature of the breach.
**Cease and Desist Orders:** Orders requiring the CASP to stop specific non-compliant activities.
**Referral for Criminal Prosecution:** In cases involving severe breaches, particularly those linked to actual money laundering or terrorist financing, the matter can be referred to the Attorney General's Office for criminal investigation and prosecution, which may lead to imprisonment for individuals.
38 fact(s) collected but awaiting source verification. View in explorer →
Sources & Attribution
This article was generated by SearXNG+LLM .
Primary Sources
Edit History
This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →