Crypto ATM / kiosk operator in Cyprus

Directive (EU) 2018/843 (5AMLD): Crucially extended the scope of EU AML rules to include crypto-asset exchanges and custodian wallet providers, requiring them to be regulated and subject to AML/CFT obligations.

The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (as amended) remains the foundational law, but CySEC has issued additional strengthened anti-money laundering guidelines beyond the original text, incorporating new risk requirements.

CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing (Regulatory Administrative Act 342/2021) for CASPs. This specific directive, issued by CySEC, outlines the detailed AML/CFT obligations for CASPs, including registration, operational requirements, and specific procedures.

Exchange between crypto assets and fiat currencies.

Management, transfer, holding, and/or safekeeping of crypto assets or cryptographic keys or means which allow the exercise of control over crypto assets.

CySEC Policy Statement PS-01-2021 currently outlines practical requirements for Crypto-Asset Service Provider (CASP) registration and ongoing compliance in Cyprus. However, this framework is in the process of being superseded by the EU's Markets in Crypto-Assets (MiCA) regulation, with CySEC mandating that existing CASPs in Cyprus must apply for authorization under MiCA by February 27, 2026.

Application Process: Submission of a detailed application to CySEC.

The entity must meet local management and control tests to maintain its status, not strictly be a legal person established in Cyprus.

Directors and key personnel must be "fit and proper," with adequate knowledge, experience, and integrity. For specific regulated entities, such as Cyprus Investment Firms (CIFs) under CySEC, at least four board members (two executive, two non-executive) must be present, with at least two executive directors managing day-to-day operations and physically residing in Cyprus. However, under general Cyprus company law, a private company requires at least one director, and a public company requires at least two directors.

Minimum initial capital requirements apply, typically tiered based on the scope of services. For custody and administration of crypto-assets, it falls under Class 2 services, requiring a minimum capital of €125,000.

Organisational requirements in Cyprus continue to include robust internal controls and compliance with data protection laws, while effective risk management systems, IT systems, security mechanisms, and business continuity plans have been significantly enhanced and made more prescriptive through the Security of Networks and Information Systems Law (N.89 (I)/2020 as amended by N.60 (I)/2025) implementing the NIS2 Directive, which mandates specific technical, operational, and organisational measures for essential and important organisations with compliance by October 2024.

AML/CFT Compliance: Comprehensive AML/CFT policies, procedures, and internal controls, including customer due diligence (CDD), ongoing monitoring, record-keeping, and suspicious transaction reporting.

Physical Presence: The CASP must have a physical presence in Cyprus and demonstrate substance.

Robust record-keeping to identify client holdings.

Strong internal controls to prevent misuse or commingling.

Safeguarding client assets through secure systems.

Mitigation of operational risks.

Robust security measures for cryptographic keys.

Identification and Verification of Customer Identity:

Natural Persons: Full name, date and place of birth, nationality, permanent residential address, unique identification number (e.g., passport or ID number). Verification requires reliable, independent source documents and/or data.

Legal Entities: Company name, legal form, registration number, registered address, names of directors and company secretary, articles of association, and proof of legal existence.

Identification of Beneficial Ownership: For legal entities, identifying and verifying the ultimate beneficial owner (UBO) who directly or indirectly holds 225% or more of the shares or voting rights, or otherwise exercises control.

Understanding the Purpose and Nature of the Business Relationship: CASPs must understand why the customer wants to use their services and the expected type and volume of transactions.

Source of Funds (SoF) / Source of Wealth (SoW): Especially for higher-risk clients or significant transactions, CASPs must take reasonable measures to establish the source of the funds and/or wealth involved.

Enhanced Due Diligence (EDD): Must be applied in high-risk situations, including:

Business relationships with Politically Exposed Persons (PEPs), their family members, or close associates.

Customers residing in or conducting transactions with high-risk third countries (as identified by the EU or FATF).

Non-face-to-face business relationships without adequate safeguards.

Transactions involving unusual patterns, high value, or complex structures.

Measures include: Obtaining additional information, senior management approval, increased monitoring, and requiring deeper SoF/SoW verification.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure consistency with the CASP's knowledge of the customer, their business, and risk profile. This includes monitoring for suspicious patterns or unusual deviations.

Internal Reporting: Employees must report suspicions to the appointed Money Laundering Reporting Officer (MLRO).

MLRO's Duty: The MLRO must evaluate the internal report and, if a suspicion is formed, submit an STR to the Unit for Combating Money Laundering (MOKAS), which is Cyprus's Financial Intelligence Unit (FIU).

Tipping-off: CASPs and their employees are strictly prohibited from disclosing to the customer or any third party that an STR has been or will be submitted, or that a money laundering investigation is underway.

Duration: Records must be kept for at least five (5) years from the completion of the transaction or the termination of the business relationship.

Copies of all documents obtained for CDD (identification data, verification documents).

Originals or copies of transaction records, including the amount, currency, date, and parties involved.

Records of internal policies, procedures, risk assessments, and training provided to staff.

Accessibility: Records must be readily accessible to CySEC, MOKAS, and other competent authorities upon request.

Internal Policies and Procedures: CASPs must establish and maintain robust internal AML/CFT policies, controls, and procedures, including a comprehensive risk assessment. These should be documented in an "AML Manual."

Money Laundering Reporting Officer (MLRO): Appointment of a suitably qualified and experienced MLRO at management level responsible for overseeing AML/CFT compliance.

Staff Training: Regular and ongoing training for all relevant employees on AML/CFT risks, regulations, and internal procedures.

Entity Targeted: eToro (Europe) Ltd (a major global trading platform also offering crypto services). Violation Type: Non-compliance with regulatory requirements related to organizational requirements, safeguarding clients' funds, and prevention of money laundering and terrorist financing (AML/CFT). This included deficiencies in operational risk management, internal controls, and measures taken to prevent money laundering and terrorist financing. Outcome: Imposition of an administrative fine. eToro (Europe) Ltd stated it has taken corrective measures.

Entity Targeted: Bitpanda GmbH (a well-known European digital investment platform operating as a registered VASP in Cyprus). Violation Type: Non-compliance with the AML/CFT Law, specifically regarding internal controls and measures for the prevention of money laundering and terrorist financing, and deficiencies in customer due diligence procedures. Outcome: Imposition of an administrative fine. Bitpanda GmbH took corrective measures.

Outcome: Imposition of an administrative fine. eToro (Europe) Ltd stated it has taken corrective measures.