Cyprus Money Laundering Laws: Due Diligence, Penalties, and 2026 Changes

Cyprus money laundering laws are anchored in the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), amended repeatedly to transpose successive EU directives. The statute imposes customer due diligence, reporting, and record-keeping duties on banks, investment firms, and a long list of non-financial professionals, and it backs those duties with criminal penalties reaching 14 years in prison and €500,000 in fines, alongside separate administrative sanctions from sector regulators.

The Governing Statute

Law 188(I)/2007 is the single piece of legislation that underpins almost every AML obligation in Cyprus.¹ Its current form reflects transposition of the EU’s 4th Directive (2015/849), 5th Directive (2018/843), and 6th Directive (2018/1673).

The 6th Directive, which took effect in December 2020, pushed the criminal side of the regime harder. Core money laundering offenses must carry a maximum of at least four years’ imprisonment, criminal liability extends to aiding, inciting, and attempting the offense, and companies themselves can be prosecuted where senior management’s failure to supervise made the offense possible.² The directive also fixed a standard list of 22 predicate offenses across the EU, covering tax crimes, cybercrime, environmental offenses, and market manipulation among others.

Who Enforces the Rules

Cyprus has no single AML regulator. Supervision is split by sector, so a firm’s compliance reporting line depends on what it does.

The Central Bank of Cyprus supervises credit institutions, payment institutions, electronic money institutions, currency exchange firms, and leasing companies. It issues its own AML directive, currently in its fifth edition, and can impose administrative sanctions directly.³
The Cyprus Securities and Exchange Commission (CySEC) oversees investment firms, fund managers, administrative service providers, and crypto-asset service providers through a dedicated AML/CFT department.⁴
MOKAS, the Unit for Combating Money Laundering, is the national Financial Intelligence Unit. It receives and analyzes suspicious transaction reports, can seek court freezing orders over suspected criminal proceeds, and registers and enforces foreign freezing and confiscation orders.⁵
The Cyprus Bar Association supervises lawyers, and the Institute of Certified Public Accountants of Cyprus (ICPAC) supervises accountants and auditors, each issuing sector-specific guidance.

Who the Law Applies To

Obliged entities include credit institutions, investment firms, payment processors, insurance companies, and a broad group of designated non-financial businesses and professions (DNFBPs). Lawyers and notaries fall within scope when they help buy or sell real property, manage client money, create or run companies or trusts, or handle any financial transaction for a client. External accountants and auditors are covered, with ICPAC focusing on engagements involving corporate structuring or client funds. Real estate agents must perform due diligence on both sides of a transaction, with heightened scrutiny of cash deals. Trust and company service providers, often the first contact for complex ownership structures, draw particular regulatory attention. Dealers in precious metals and stones fall within scope above certain thresholds.

Crypto-asset service providers (CASPs) have been subject to AML obligations since CySEC began registering and supervising them, performing the same know-your-customer checks, source-of-funds analysis, transaction monitoring, and suspicious transaction reporting as traditional financial institutions.⁴

Customer Due Diligence

Before opening a business relationship or executing an occasional transaction above the specified thresholds, an obliged entity must identify the client, verify identity against reliable documents or data, and identify the beneficial owner of any legal entity involved. These are not one-off checks. Ongoing monitoring is required, with transactions scrutinized against the client’s known profile, business activities, and declared source of funds.

The law requires a risk-based approach. Low-risk relationships may qualify for simplified due diligence; higher-risk situations trigger enhanced measures. Regulators expect documented risk assessments both at the entity level and for individual clients, and a one-size-fits-all program will not pass inspection.

Enhanced Due Diligence

Enhanced due diligence (EDD) is mandatory in defined situations: business relationships connected to high-risk third countries identified by the FATF or the EU, complex or unusually large transactions with no apparent economic purpose, and any relationship involving a politically exposed person. The EU’s single-rulebook regulation (Regulation 2024/1624) adds a mandatory EDD threshold for high-net-worth individuals holding assets of at least €50 million, counting financial assets, investments, and real estate other than a primary residence.⁶

Politically Exposed Persons

Politically exposed persons, together with their family members and close associates, are automatically treated as higher risk. Obliged entities must have systems in place to identify them, which in practice usually means subscribing to a commercial screening database. Senior management approval is required before a PEP relationship can proceed or continue, and enhanced monitoring must remain in place for at least 12 months after the person leaves their public role.⁶

Beneficial Ownership

Cyprus maintains a central register of beneficial owners run by the Department of Registrar of Companies and Intellectual Property. Companies and other legal entities registered in Cyprus must identify and disclose their ultimate beneficial owners. Under the standard EU threshold, beneficial ownership arises at 25 percent or more of the shares, voting rights, or other ownership interest; for higher-risk entities, member states may set a lower threshold, generally no higher than 15 percent.⁶ Obliged entities cannot simply rely on the register. They remain independently responsible for identifying and verifying beneficial owners.

Suspicious Transaction Reports and Tipping-Off

When an obliged entity knows or suspects that funds are the proceeds of criminal activity, or that a transaction relates to terrorist financing, it must file a suspicious transaction report with MOKAS.⁵ Attempted transactions that raise suspicion are also reportable. Internal procedures must channel information from employees to a designated compliance officer, who makes the filing decision.

Tipping-off is a separate criminal offense. Disclosing, directly or indirectly, that a report has been or will be filed, or that an investigation is underway, carries up to two years’ imprisonment and a fine of up to €50,000.⁷ The instinct to warn a client or colleague is itself where compliance officers sometimes commit the offense.

The €10,000 Cash Ban

Cyprus prohibits cash transactions above €10,000 for goods, services, and real property. Breach is a criminal offense carrying fines of up to 10 percent of the transaction amount and up to five years’ imprisonment. For a real estate agent, accepting a cash payment over the threshold during a property sale is not merely a compliance failure. It is a standalone crime.

Criminal Penalties

An individual who knowingly launders the proceeds of criminal activity faces up to 14 years in prison and a fine of up to €500,000, or both. A lower tier applies where the person ought to have known that the funds were derived from crime: up to five years’ imprisonment and a fine of up to €50,000.¹

The “ought to have known” standard carries real weight. Willful blindness does not protect anyone, and compliance professionals or business owners who ignore obvious red flags can be prosecuted even without proof of actual knowledge.

Companies can also be prosecuted. A legal entity whose leadership participated in, authorized, or failed to prevent money laundering through inadequate supervision faces sanctions including exclusion from public funding, judicial supervision, and in extreme cases court-ordered dissolution.²

Administrative Sanctions

Supervisory authorities can act even where no criminal case is brought.⁸ Administrative sanctions target procedural failures: inadequate due diligence, poor record-keeping, missed suspicious transaction reports. Available measures include financial fines, public statements naming the entity and the breach, suspension or withdrawal of licenses, and temporary bans on individuals holding management positions in regulated entities. Legal entities may face fines of up to €5 million, or 10 percent of annual turnover for natural persons in supervisory roles, with the specific amount depending on the severity of the breach and the authority involved.

What Is Changing in 2026 and Beyond

Two major shifts are already in motion. The first affects crypto. CySEC required all CASPs operating under national rules to apply for authorization under the EU’s Markets in Crypto-Assets Regulation (MiCA) by February 27, 2026. Firms that met the deadline may keep operating while their application is processed, but the transitional window closes on July 1, 2026. Any CASP that missed the application deadline must submit a wind-down plan and stop operating by that date. Operating without MiCA authorization after July 1, 2026 is simply illegal.

The second is the EU’s new single rulebook. Regulation 2024/1624, directly applicable in Cyprus without transposition, introduces a €10,000 threshold for customer due diligence on occasional transactions, a €3,000 threshold for cash transactions requiring at least basic identification, a €2,000 threshold for gambling services, and the mandatory EDD rule for individuals with €50 million or more in assets.⁶ Compliance programs built around the current directive-based framework will need to be reviewed against the regulation’s more uniform and granular requirements.

Alongside the regulation, the EU has established the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), a new decentralized agency created in June 2024 with operations starting in mid-2025.⁹ From 2028 AMLA will directly supervise selected high-risk cross-border financial entities, the first time AML enforcement will happen at EU level rather than through national regulators alone.

Cyprus obliged entities must also screen against FATF lists of high-risk and monitored jurisdictions, EU restrictive measures, and United Nations Security Council sanctions.¹⁰ Where a client or transaction touches a call-for-action jurisdiction, enhanced due diligence is mandatory and countermeasures up to refusal of the relationship may be required. Failures to detect sanctioned persons in a client base have been a recurring enforcement priority.

1
Central Bank of Cyprus. The Prevention and Suppression of Money Laundering and Terrorist Financing Laws of 2007 – 2021
2
EUR-Lex. Directive 2018/1673 on Combating Money Laundering by Criminal Law
3
Central Bank of Cyprus. Prevention and Suppression of Money Laundering Activities and Financing of Terrorism
4
Cyprus Securities and Exchange Commission. AML – CFT
5
Law Office of the Republic of Cyprus. The Unit for Combating Money Laundering (MOKAS)
6
EUR-Lex. Regulation EU 2024/1624
7
United Nations Office on Drugs and Crime. Directive to Cyprus Bar Association Members on AML and Terrorist Financing – Section A.5
8
Central Bank of Cyprus. Administrative Sanctions and Measures
9
Authority for Anti-Money Laundering and Countering the Financing of Terrorism. About AMLA
10
Financial Action Task Force. High-Risk and Other Monitored Jurisdictions