Cyprus has tightened its anti-money laundering regime significantly. Revised obligations under Cyprus's AML and counter-terrorist financing legislation took effect in early 2025, following transposition of the latest EU anti-money laundering directives. Companies that have not yet reviewed their internal controls face a genuine risk of regulatory sanctions, suspended bank account access, and – in serious cases – loss of operating licences.
Cyprus's updated AML legislation imposes enhanced due diligence, stricter beneficial owner disclosure requirements, and expanded KYC obligations on a broad range of regulated entities and corporate service providers. The revised rules applied from Q1 2025, with full compliance expected across all in-scope businesses. Companies that fail to meet the updated threshold criteria risk enforcement action by the Cyprus Securities and Exchange Commission and the Central Bank of Cyprus.
This alert sets out what changed, which business categories are in scope, and the immediate actions your company should take now.
What changed – the regulatory update and its effective date
Cyprus's AML legislation was materially amended to align with the EU's updated anti-money laundering directives. The amendments entered into force in stages beginning January 2025. Full transposition obligations applied by March 2025 at the latest for most regulated entities.
The core changes affect three areas. First, beneficial owner identification and verification requirements are now more demanding. Entities must obtain documentary evidence of ownership chains and update beneficial owner registers more frequently. Passive holding structures – a common feature of international Cyprus companies – attract heightened scrutiny.
Second, the scope of enhanced due diligence has expanded. Correspondent banking relationships, high-value credit facility arrangements, and transactions involving politically exposed persons all now trigger mandatory enhanced checks. Standard KYC procedures are no longer sufficient for these categories.
Third, internal compliance governance has been strengthened. Regulated entities must designate a qualified compliance officer, maintain documented risk assessments, and report suspicious transactions within tighter timeframes. The Μονάδα Καταπολέμησης Αδικημάτων Συγκεκαλυμμένης Προέλευσης Εσόδων (MOKAS – the Cyprus Financial Intelligence Unit) now receives enhanced reporting from a wider range of obliged entities.
The updated rules also introduce clearer provisions on the use of digital identity verification tools for remote KYC. This is significant for international companies whose beneficial owners or directors reside outside Cyprus. Remote onboarding now follows a structured protocol, with defined document standards and re-verification intervals.
Who is affected – threshold criteria and business categories in scope
The updated AML obligations apply to a broad range of entities operating in or through Cyprus. The primary categories include:
- Licensed credit institutions and payment service providers, including those operating under Cyprus banking legislation
- Investment firms and fund managers regulated by the Cyprus Securities and Exchange Commission
- Administrative service providers and corporate trustees offering company formation or management services
- Lawyers, accountants, and auditors carrying out relevant financial or corporate services
- Real estate agents involved in transactions above prescribed thresholds
International holding companies and special purpose vehicles incorporated in Cyprus are not directly regulated as obliged entities. However, they are directly affected as clients of the regulated entities above. Banks will apply the new KYC and beneficial owner standards before opening or maintaining a bank account. A company that cannot satisfy updated documentation requirements may find its bank account frozen or closed.
Threshold criteria matter particularly for enhanced due diligence. Transactions or ongoing relationships involving amounts above the prescribed thresholds, dealings with high-risk jurisdictions, or complex ownership structures all move a client from standard to enhanced due diligence. Many Cyprus holding structures – particularly those with multi-layered beneficial owner chains or nominee arrangements – will fall into the enhanced category by default.
For international companies with a presence in Cyprus's capital markets sector, the updated rules interact closely with investor disclosure obligations. Our analysis of capital markets regulation in Cyprus addresses these intersecting requirements in detail.
To receive an expert assessment of your company's AML exposure in Cyprus, contact us at info@ferrazwhitmore.com.
What to do now – immediate actions and compliance timeline
Companies that have not yet reviewed their position against the updated requirements should act without delay. The following five steps address the most urgent compliance priorities.
1. Audit your beneficial owner documentation. Verify that all ultimate beneficial owners are identified to the required standard. Documentation must reflect current ownership. If the beneficial owner chain has changed since your last KYC cycle, updated materials are needed immediately. Gaps in beneficial owner records are among the most common grounds for enhanced scrutiny or bank account access issues.
2. Review correspondent banking and credit facility arrangements. Any existing correspondent banking relationship or credit facility with a Cyprus-regulated institution should be reviewed against the updated enhanced due diligence criteria. Where a relationship falls into a higher-risk category under the new rules, expect the bank to request additional documentation proactively. Preparing these materials in advance avoids delays.
3. Update internal AML policies and risk assessments. If your company is itself an obliged entity under Cyprus AML legislation, your documented risk assessment and AML policy must reflect the 2025 amendments. Outdated policies expose compliance officers to personal liability in addition to corporate sanctions.
4. Designate or re-confirm a compliance officer. The updated rules require a named, qualified compliance officer for in-scope entities. Confirm that the designation is current, properly documented, and that the individual has received up-to-date training on the amended requirements.
5. Prepare for re-KYC requests from your bank. Cyprus-based banks are conducting rolling re-KYC exercises under the updated rules. Companies should not wait to be contacted. Proactively gathering identity documents, beneficial owner declarations, source of funds evidence, and corporate structure charts reduces the risk of account suspension during a re-KYC review.
For comparable developments affecting companies with a regional presence, our alert on AML updates in Portugal covers the parallel Portuguese regulatory changes.
Companies operating across Cyprus and EU markets should also review how the updated AML rules interact with their banking and finance arrangements. Our team's analysis of banking and finance law in Cyprus provides a detailed foundation for that review.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our banking and finance practice covers AML compliance, KYC structuring, bank account opening strategy, and regulatory engagement with Cyprus's supervisory authorities. We combine Portuguese civil law expertise with English common law tradition to deliver clear, cross-border compliance strategies for international companies operating in Cyprus and the wider EU. Engaging a lawyer in Cyprus with genuine cross-border experience is essential when the regulatory environment shifts as quickly as it has in 2025. As a law firm in Cyprus with a presence across European markets, Ferraz & Whitmore helps international clients manage AML exposure before it becomes a supervisory or banking crisis. To discuss your company's compliance position, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.