From 10 July 2027, Regulation (EU) 2024/1624 (the AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) will apply directly and simultaneously across the European Union, including Cyprus, replacing the patchwork of transposed national rules with a single, binding framework. For businesses operating in Cyprus – whether as regulated financial institutions, crypto-asset service providers holding or seeking a CASP licence under MiCA, or obliged entities in the real estate, professional services or corporate-services sectors – the transition demands active preparation now, not in 2027. Cyprus has its own supervisory architecture, its own register infrastructure, and its own transposition timeline under AMLD6, which together create a specific compliance path that differs in material respects from other EU jurisdictions.
Why Cyprus Has a Distinct Compliance Path
Cyprus sits at the intersection of several regulatory streams. CySEC is the primary financial-sector AML/CFT supervisor for investment firms, payment institutions, electronic money institutions, and – critically – crypto-asset service providers. The Cyprus Securities and Exchange Commission (CySEC) took on AML/CFT mandates that were previously coordinated by the European Banking Authority (EBA); that transfer was formalised on 1 January 2026, aligning CySEC's supervisory expectations with the Anti-Money Laundering Authority (AMLA) framework. The Registrar of Companies and the District Court system remain central to beneficial ownership registration and verification procedures respectively, creating a multi-authority compliance map that foreign clients frequently underestimate.
The broader EU institutional change is also material context. AMLA became operational in Frankfurt on 1 July 2025 and published its Single Programming Document 2026–2028 on 4 February 2026. The deadline for most of the 23 AMLA regulatory technical standards (RTS) and implementing technical standards (ITS) is 10 July 2026. That date is the practical signal for obliged entities in Cyprus: once those standards are finalised, there will be just twelve months to embed them in internal policies, systems, and training before the AMLR and AMLD6 apply from 10 July 2027. Direct AMLA supervision of selected entities is expected to begin from 2028.
The Legislative Framework in Brief
Two instruments define the post-2027 landscape. The AMLR (Regulation (EU) 2024/1624) is directly applicable and requires no national transposition for its substantive obligations – it will override conflicting national rules from its application date. AMLD6 (Directive (EU) 2024/1640), by contrast, governs the architecture of beneficial ownership registers and the designation and powers of national supervisors; Cyprus must transpose AMLD6 into national law before 10 July 2027. The status of that transposition is, at the time of writing, pending national legislative action, and businesses should monitor the progress of the relevant Cyprus parliamentary bill.
The AMLR sets a beneficial ownership threshold of 25% or more as the standard trigger for identification and verification obligations. This is a directly applicable rule: once the AMLR applies, Cyprus-licensed entities cannot rely on looser national definitions. The interaction between the AMLR's customer due diligence (CDD) and enhanced due diligence (EDD) requirements and CySEC's existing AML/CFT guidelines is an area requiring careful analysis, because CySEC guidance issued under the current framework will need to be reviewed for compatibility with the new Regulation.
Step-by-Step Compliance Preparation for Cyprus-Based Obliged Entities
Step 1 – Scoping and Gap Analysis (Now to Q2 2026)
The first task is to confirm whether your entity is an obliged entity under the AMLR and, if so, in which category. Financial institutions, credit institutions, and crypto-asset service providers (CASPs) fall within the financial sector; lawyers, notaries, accountants, trust and company service providers, and real estate agents fall within the non-financial sector. Cyprus market practice shows that many international holding structures use Cyprus-registered entities that simultaneously carry regulatory licences (e.g. a CASP licence or a Cyprus Investment Firm authorisation) and provide corporate-services functions – meaning they may straddle both categories. A scoping exercise should produce a written mapping of each entity's obligations under both the AMLR and any applicable CySEC directive.
Step 2 – Review and Update AML/CFT Policies (Q2–Q3 2026)
Once the AMLA RTS/ITS are finalised by 10 July 2026, obliged entities must review their AML/CFT policy frameworks against the technical standards. Key documents to update include: the AML/CFT risk assessment, the customer risk-scoring methodology, the CDD and EDD procedures (paying particular attention to the 25% beneficial ownership threshold), the politically exposed persons (PEP) policy, and the suspicious transaction reporting (STR) procedure for reporting to MOKAS, Cyprus's Financial Intelligence Unit. Where entities operate cross-border – a common feature of Cyprus structures – the group-wide AML/CFT policy must also align with AMLR Chapter VI on group obligations.
Step 3 – Beneficial Ownership Register Compliance
Cyprus companies are currently required to file beneficial ownership information with the Registrar of Companies under the existing framework. Under AMLD6, the register regime will be updated – the precise form of Cyprus's transposition is subject to national legislative action, but the direction of travel is greater accuracy, broader access rights, and stronger verification obligations for obliged entities that rely on register data. Entities should audit their existing beneficial ownership filings now, correct any discrepancies, and build a process for the ongoing verification that the AMLR will require when onboarding or re-reviewing clients.
Step 4 – Technology and Data Infrastructure
The AMLR's requirements for record-keeping, risk scoring, and transaction monitoring are more prescriptive than the current Directive-based framework. Obliged entities should assess whether their existing compliance technology – screening tools, transaction monitoring systems, customer data platforms – can accommodate the AMLR's data retention periods and the technical formats likely to be specified in the AMLA ITS. Cyprus branches of international groups should confirm that group-level systems will be configured to cover the Cyprus-specific supervisory reporting requirements to CySEC.
Step 5 – Staff Training and Governance
The AMLR strengthens requirements for the compliance function and for management-body oversight of AML/CFT risk. In Cyprus, CySEC has consistently treated failures of governance – particularly inadequate Money Laundering Compliance Officer (MLCO) oversight – as aggravating factors in enforcement actions. Ahead of 2027, entities should document a training programme aligned with the new Regulation, update terms of reference for the MLCO and the compliance committee, and ensure that management-body minutes reflect active engagement with AML/CFT risk.
If your entity is at the scoping or gap-analysis stage and you would like a structured assessment of your obligations under the AMLR as they apply in Cyprus, the team at Ferraz & Whitmore is available to assist. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Cost Drivers and Realistic Timelines
Preparation costs vary substantially depending on the size of the entity, the complexity of its client base, and the maturity of its existing AML/CFT programme. The main cost drivers in Cyprus engagements are: legal analysis of the interaction between AMLR/AMLD6 and Cyprus-specific rules (which is ongoing as transposition progresses); technology upgrades to screening and monitoring systems; external audit or gap-assessment fees; and staff training. Entities that have maintained a robust programme under the current framework will face lower marginal costs than those that have relied on minimal compliance. Timeline pressure is real: with most AMLA technical standards due by 10 July 2026, entities that begin their gap analysis in late 2026 will face compressed implementation windows.
Detailed guidance on the AML/CFT compliance framework for service providers operating in Cyprus, including the interaction with CySEC's existing supervisory expectations, is available in our AML Rulebook analysis for service providers in Cyprus.
Common Errors by Foreign Clients
Ferraz & Whitmore's AML/CFT practice in Cyprus regularly encounters a set of recurring errors made by foreign investors and international groups establishing or operating Cyprus entities. Understanding these errors is a useful checklist for preparation.
- Treating Cyprus as a low-risk jurisdiction without tailoring the risk assessment. Cyprus is an EU member state with a sophisticated regulatory framework; CySEC expects risk assessments that reflect the actual client base and transaction profile, not a generic EU template.
- Assuming group AML/CFT policies automatically satisfy Cyprus requirements. Group policies must be reviewed for compatibility with both CySEC's directives and, from 2027, the AMLR's directly applicable requirements.
- Incorrect or incomplete beneficial ownership filings at the Registrar of Companies. Discrepancies between filed information and actual ownership structures are a consistent enforcement trigger.
- Underestimating the CASP/MiCA dimension. Entities providing crypto-asset services in or from Cyprus require a CASP licence under MiCA and are subject to CySEC's AML/CFT supervision; the combined MiCA and AMLR compliance burden is more demanding than either framework alone.
- Delaying the appointment or empowerment of the MLCO. Cyprus law and CySEC's framework require a qualified, empowered MLCO; this role cannot be treated as a nominal appointment.
- Failing to account for AMLD6 transposition gaps. Until Cyprus enacts its transposition legislation, the precise scope of certain obligations – particularly in relation to registers and supervisory powers – remains subject to change. Compliance programmes built on assumptions about the final national rules carry transposition risk.
- Overlooking the tax-law interface. AML/CFT obligations intersect with substance and reporting requirements under Cyprus and EU tax law; a siloed approach that treats AML compliance separately from Cyprus tax law obligations often produces gaps in the overall compliance architecture.
Decision Checklist: Is Your Entity Ready?
The following checklist summarises the key questions an obliged entity in Cyprus should be able to answer affirmatively before 10 July 2027.
- Has the entity confirmed its classification as an obliged entity under the AMLR and identified its competent authority (CySEC or otherwise)?
- Has a written gap analysis been completed against the AMLR's CDD, EDD, and beneficial ownership requirements?
- Has the entity reviewed its beneficial ownership filings with the Registrar of Companies for accuracy?
- Has the entity monitored and begun incorporating the AMLA RTS/ITS as they are finalised (deadline: 10 July 2026)?
- Is the entity tracking the progress of AMLD6 transposition in Cyprus?
- Has the MLCO's mandate been reviewed and updated to reflect the AMLR's governance requirements?
- Where the entity holds or is applying for a CASP licence, has the combined MiCA and AMLR compliance programme been designed as an integrated whole?
- Has the entity assessed whether it may fall within the category of entities subject to direct AMLA supervision from 2028?
- Has a staff training programme aligned with the new Regulation been scheduled?
- Has the entity's AML/CFT legal counsel confirmed that group-level policies are compatible with Cyprus-specific and AMLR requirements?
Our AML/CFT practice supports clients at each stage of this checklist. Further detail on the full compliance service offering in Cyprus is available at our AML compliance page for Cyprus. To discuss your entity's specific position, please write to info@ferrazwhitmore.com or use our contacts page.
Looking Ahead: AMLA Direct Supervision from 2028
From 2028, AMLA will directly supervise a selected group of financial-sector entities across the EU. The selection criteria are set out in the AMLR and relate principally to the cross-border footprint and risk profile of the entity. Cyprus-based financial institutions and CASPs that operate across multiple EU member states should assess, as part of their 2026–2027 preparation, whether they are likely to fall within AMLA's direct supervisory perimeter. If so, the compliance programme must anticipate AMLA's supervisory expectations in addition to CySEC's, and engagement with both authorities may be necessary during the transition.
The regulatory landscape between now and July 2027 will continue to evolve, particularly as Cyprus advances its AMLD6 transposition and AMLA publishes further technical standards. Ferraz & Whitmore monitors these developments on an ongoing basis. If you would like to be informed as material changes occur, or to discuss how the incoming framework applies to your structure, please contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.