Cyprus-based corporate service providers – including trust and company service providers, crypto-asset service providers holding or seeking a CASP licence, and other obliged entities operating under CySEC oversight – now face a materially altered AML/CFT landscape as the EU's new regulatory architecture comes into force. The Anti-Money Laundering Regulation (EU) 2024/1624 (AMLR) and the Sixth Anti-Money Laundering Directive (EU) 2024/1640 (AMLD6) are set to apply from 10 July 2027, while the newly operational Anti-Money Laundering Authority (AMLA), seated in Frankfurt, began work on 1 July 2025 and will assume direct supervisory responsibility over selected high-risk entities from 2028. For international clients and their Cyprus structures, the window to adapt internal controls, beneficial ownership documentation, and governance frameworks is narrower than it may appear.
The Regulatory Architecture: What Has Changed and What Is Still Settling
The EU's new AML/CFT framework is not a single instrument but a layered system. The AMLR applies directly across all member states without national transposition, establishing uniform obligations for obliged entities – including customer due diligence standards, a beneficial ownership threshold of 25% or more codified in the AMLR itself, and enhanced measures for high-risk third-country relationships. AMLD6 operates alongside it, governing the architecture of national supervisory authorities, beneficial ownership registers, and the interaction between member-state competent authorities and AMLA.
AMLA itself transferred AML/CFT mandates from the European Banking Authority on 1 January 2026 and published its Single Programming Document for 2026–2028 on 4 February 2026. This document outlines the authority's staffing priorities, supervisory methodology, and the timetable for developing binding technical standards. Of the 23 regulatory and implementing technical standards (RTS/ITS) within AMLA's first-cycle mandate, most carry a deadline of 10 July 2026 – meaning the detailed rules that will flesh out the AMLR's principles are still being finalised at the time of writing. Obliged entities in Cyprus should therefore treat current planning as a matter of managing a moving target, not a settled rulebook.
For a structured overview of AMLA's evolving technical standards and what they mean in practice, our alert at AMLA Technical Standards – EU Update tracks key drafts as they are published.
Who Is an Obliged Entity in Cyprus Under This Framework?
The AMLR's scope of obliged entities is broadly consistent with prior EU AML directives but contains important refinements. In Cyprus, the category relevant to corporate service providers encompasses, among others:
- Trust and company service providers (TCSPs) – entities providing registered office, directorship, secretarial, or nominee services as a business activity;
- Crypto-asset service providers (CASPs) – entities authorised or required to be authorised under MiCA (Regulation (EU) 2023/1114), which is already in force and for which CySEC is the competent authority in Cyprus;
- Auditors, accountants, and tax advisers operating in certain advisory capacities;
- Real estate intermediaries and, in specific circumstances, providers of virtual asset-related services not otherwise captured by MiCA.
The intersection of the MiCA and AMLR regimes is particularly significant for CASPs. A CASP licence obtained under MiCA does not discharge AML/CFT obligations; it operates in parallel with them. CySEC, as the relevant competent authority for financial-sector AML supervision in Cyprus, supervises CASPs on both tracks. Firms that assumed MiCA authorisation would simplify their compliance picture should review that assumption carefully.
Beneficial Ownership: The 25% Threshold and Its Practical Implications
One of the most operationally consequential provisions in the AMLR is the codification of the 25% or more beneficial ownership threshold as a directly applicable rule. Under prior Cypriot implementation of the Fourth and Fifth AML Directives, this threshold was transposed nationally and subject to some interpretive flexibility. Under the AMLR, it is a uniform EU standard.
For corporate service providers, this has two distinct consequences. First, as obliged entities, they must apply the threshold when conducting customer due diligence on their own clients – identifying and verifying the natural persons who ultimately own or control a corporate client. Second, as corporate vehicles themselves (where the CSP operates through a company or acts as nominee), their own beneficial ownership information must be maintained in the Cyprus beneficial ownership register administered by the Registrar of Companies, and must be accurate, current, and consistent with information held by CySEC or other supervisors.
The AMLD6 will require member states, including Cyprus, to upgrade their registers to meet strengthened data quality and access standards. National implementation details for Cyprus remain subject to domestic legislative action; as of the date of this analysis, those measures are pending final transposition within the AMLD6 deadline of 10 July 2027. Entities should nonetheless act now to audit their own beneficial ownership chains for accuracy, particularly where layered holding structures, trust arrangements, or nominee relationships are involved.
If your structure involves multiple jurisdictions or complex ownership layers, our team can assist in mapping beneficial ownership exposure before supervisory scrutiny intensifies. Please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
AMLA Direct Supervision: Who Should Be Concerned?
From 2028, AMLA will directly supervise a selected group of obliged entities across the EU – principally those operating in multiple member states and assessed as posing the highest money-laundering and terrorist financing risk. For most Cyprus-based corporate service providers, the immediate supervisor will remain CySEC or, for non-financial-sector entities, the relevant national competent authority. However, AMLA's indirect influence will be felt considerably earlier.
AMLA's supervisory methodology, peer review powers, and binding technical standards will set the de facto benchmark against which national supervisors – including CySEC – are assessed. CySEC's own supervisory practices in relation to AML/CFT are therefore likely to be recalibrated to align with AMLA's emerging standards, even before direct supervision commences. Entities that are comfortable with CySEC's current supervisory expectations should not assume that comfort level will persist unchanged through 2026 and 2027.
For Cyprus entities that are part of cross-border groups – including those with parent or affiliated entities in other EU jurisdictions – the question of which entity within the group might fall within AMLA's direct supervision perimeter in 2028 warrants early analysis. Group-level AML/CFT policies will need to satisfy the most demanding standard applicable to any entity within the structure.
Open Legal Questions and Interpretive Risks
The new framework leaves a number of questions unresolved at this stage, and Cyprus-based practitioners and their clients face genuine interpretive uncertainty in several areas:
- Interaction between AMLR and national procedural law: Where a District Court in Cyprus is involved in proceedings related to beneficial ownership disclosure or asset recovery, the interaction between the directly applicable AMLR and Cyprus civil procedure has not yet been authoritatively tested.
- Scope of "crypto-asset service" under MiCA and AMLR: The boundary between activities caught by MiCA (and therefore subject to CySEC authorisation and AML supervision) and activities that may fall outside MiCA but still constitute obliged-entity activity under the AMLR is not yet fully settled in practice. Firms operating at the margins of the MiCA definition should seek specific legal analysis.
- Timing of national transposition measures: AMLD6 requires member-state action by 10 July 2027. Until Cyprus enacts its implementing legislation, certain obligations – particularly those relating to supervisory architecture and register access – will depend on the existing domestic framework, which may not fully reflect AMLD6's requirements.
- Delegated and implementing acts: Several AMLR provisions are conditional on Commission delegated acts or AMLA technical standards that have not yet been published. Operating policies and procedures drafted today may require revision once those instruments are finalised.
Our AML/CFT practice in Cyprus monitors these developments on an ongoing basis. For guidance on how to structure compliance frameworks that are robust to interpretive change, see our AML compliance services page for Cyprus.
Cross-Border Implications: Cyprus Structures in International Contexts
Cyprus remains a significant hub for international holding and finance structures, and many entities administered here have shareholders, assets, or operating subsidiaries in third countries. The AMLR's enhanced due diligence requirements for relationships involving high-risk third countries – a list maintained and periodically updated at EU level – apply uniformly and without the national discretion that existed under prior directives.
For corporate service providers administering structures with connections to jurisdictions on the EU high-risk list, the practical implications include mandatory enhanced due diligence measures, senior management approval requirements for establishing or continuing business relationships, and enhanced ongoing monitoring obligations. The AMLR does not require termination of such relationships, but it does require a documented and defensible risk assessment.
Cross-border structures also raise questions of tax transparency, particularly where the same beneficial ownership and substance information is relevant to both AML/CFT and tax reporting obligations. The convergence of these regimes – and the data-sharing arrangements that exist between AML supervisors, tax authorities, and financial intelligence units – means that gaps or inconsistencies in one area can create exposure in another. Our tax law practice in Cyprus works alongside our AML/CFT team to address precisely these intersections.
Strategic Recommendations for Cyprus Corporate Service Providers
Against this backdrop, the following strategic priorities are relevant for entities operating in or through Cyprus in the period leading to the 10 July 2027 application date:
- Gap analysis against the AMLR now: The AMLR's customer due diligence, record-keeping, and risk assessment requirements are largely identifiable today, even where supporting technical standards remain outstanding. A structured gap analysis against the AMLR text will identify the most significant areas requiring policy revision.
- Beneficial ownership register hygiene: Audit the accuracy and completeness of Cyprus beneficial ownership register filings for all entities within the group. Inconsistencies identified by supervisors at or after the 2027 application date carry materially higher enforcement risk than those proactively corrected beforehand.
- CASP-specific review for MiCA-authorised entities: CASPs that obtained or are seeking a CASP licence under MiCA should ensure their AML/CFT programme is developed as a distinct and parallel framework, not treated as subsumed within the MiCA authorisation process.
- Monitor AMLA technical standards as they are finalised: With the 10 July 2026 deadline for most of AMLA's first-cycle RTS/ITS, the second half of 2026 will be the critical period for updating compliance frameworks. Build review cycles into governance calendars now.
- Engage legal and compliance advisers early: Given the volume of open questions and the pace of regulatory change, entities that delay engagement until 2027 face both a compressed implementation timeline and a higher risk of acting on incomplete information.
Outlook: A Framework Still in Formation
The EU's new AML/CFT architecture represents the most significant structural reform of anti-money laundering regulation in the EU in two decades. For Cyprus corporate service providers, the period between now and 10 July 2027 is best understood not as a waiting period but as a compliance construction phase. AMLA is operational, its technical standards are in development, and CySEC's supervisory approach is evolving in parallel.
Entities that treat this period as an opportunity to build genuinely robust AML/CFT frameworks – rather than simply updating existing documentation – will be better positioned both for the 2027 application date and for the more intensive supervisory environment that follows. Those that wait for final rules before beginning will face a significantly compressed and more costly implementation process.
Ferraz & Whitmore advises corporate service providers, CASP-licence holders, and international clients with Cyprus structures on the full range of AML/CFT, regulatory, and cross-border legal questions raised by this new framework. If you would like to discuss your entity's specific position, please write to us at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.