Compliance Guidelines:

Compliance Guidelines in Cyprus

Cyprus Securities and Exchange Commission (CySEC)

The Cyprus Securities and Exchange Commission (CySEC) combats money laundering (AML) and terrorist financing by enforcing compliance with AML laws, supervising financial institutions, and conducting risk assessments.

The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 το 2023 (unofficial consolidation up to L. 98(Ι)/2023)(23 February 2024)(CySEC)

As per Section 6, a court which has convicted a person of a specified offense before imposing a sentence shall make an inquiry to ascertain whether the accused has derived any proceeds of any illegal activity or money laundering offense. 

As per Section 7, all payments made to him or to any other person either before or after the coming into force of this law in relation to illegal activities or with the offense of money laundering, regardless of whether this has been committed by the accused himself or by another person. 

• The defendant’s proceeds from illegal activities or from the commission of a money laundering offense are all payments or emoluments paid to him or the proceeds of illegal activities or a money laundering offense or proceeds such as this term is interpreted in article 2 of this Law.
• The Court, in order to establish whether the accused has obtained income from illegal activities or from the commission of the offense of money laundering from illegal activities and to calculate the amount of his income, may, unless the contrary is demonstrated in the specific case. ​​

As per Section 8 the court may issue a confiscation order if it determines that the accused has proceeds from illegal activities or money laundering, based on the calculations and inquiries specified in sections 6 and 7. ​​

As per Section 58 Every obliged entity shall establish and maintain effective procedures to prevent money laundering and terrorist financing. 

These procedures shall include, but not be limited to:

• The establishment of an internal control system to ensure compliance with the requirements of this Law and the Directives issued by the Competent Authorities
• The appointment of a compliance officer at a management level, responsible for ensuring compliance with the requirements of this Law
• The implementation of customer due diligence procedures and ongoing monitoring of business relationships
• The establishment of a record-keeping procedure for the retention of documents and information related to transactions and business relationships
• The implementation of risk assessment procedures to identify and assess the risks of money laundering and terrorist financing
• The provision of training to employees to recognize and handle transactions and activities that may be related to money laundering or terrorist financing
• The establishment of internal reporting procedures for the reporting of suspicious transactions to the Unit for Combating Money Laundering (MOKAS)
• The adoption of appropriate measures to ensure that branches and subsidiaries in third countries apply equivalent procedures for the prevention of money laundering and terrorist financing
• The establishment of procedures for the screening of employees to ensure that they are fit and proper to carry out their duties
• The implementation of policies and procedures to prevent the misuse of technological developments in money laundering and terrorist financing schemes.

As per Section 58B Every obliged entity shall establish an independent audit service to monitor and evaluate the adequacy and effectiveness of the procedures and measures implemented for the prevention of money laundering and terrorist financing.

As per Section 59 The Competent Authorities shall supervise the compliance of obliged entities with the requirements of this Law and the Directives issued pursuant to this Law.

As per Section 61 Every obliged entity shall apply customer due diligence measures, which shall include:

• Identifying and verifying the identity of the customer and the beneficial owner   before establishing a business relationship or conducting a transaction.
• Obtaining information on the purpose and intended nature of the business relationship.
• Conducting ongoing monitoring of the business relationship, including scrutiny of transactions, to ensure that they are consistent with the obliged entity’s knowledge of the customer and the customer’s business and risk profile.
• Taking appropriate measures to determine whether the customer or beneficial owner is a politically exposed person (PEP)
• Applying enhanced due diligence measures in cases of higher risk, such as transactions with politically exposed persons and, transactions involving high-risk third countries
• Maintaining records of the customer due diligence information and transaction records for at least five years after the end of the business relationship or the completion of the transaction.

As per Section 66 It is prohibited for a credit institution and a financial organization to enter into or continue a correspondence relationship with a fictitious bank​​.

As per Section 68 An obliged entity belonging to a group shall implement policies and procedures at group level, including policies for data protection and sharing information within the group for the purposes of preventing money laundering proceeds from illegal activities or the financing of terrorism​​.

• In the event that a customer of obliged entities, or a person authorized to act on behalf of the customer, or a third party knowingly provides false or misleading facts and information about the identity of the customer or the ultimate beneficial owner, or presents false or forged identification documents, are guilty of an offense and, on conviction, are liable to imprisonment for a term not exceeding two (2) years or to a fine not exceeding one hundred thousand euros (€100,000) or to both penalties​​

As per Section 69 Every obliged entity shall establish internal reporting procedures for the reporting of suspicious transactions. 

These procedures shall include:

• The appointment of a compliance officer responsible for receiving and evaluating internal reports of suspicious transactions
• The establishment of a reporting system to ensure that employees can report suspicious transactions promptly and confidentially
• The submission of reports of suspicious transactions to the Unit for Combating Money Laundering (MOKAS) without delay
• The protection of employees who report suspicious transactions in good faith from any adverse consequences 
• The prohibition of disclosure to the customer or other third parties that a report of a suspicious transaction has been made. 

Cyprus Gaming and Casino Supervision Commission (CGC)

The Cyprus Gaming and Casino Supervision Commission (CGC) enforces AML laws, ensuring casino operations comply with national and international standards to enhance AML efforts in the gaming sector​​

CYPRUS GAMING AND CASINO SUPERVISION COMMISSION DIRECTION ISSUED PURSUANT TO ARTICLE 59(4) OF THE PREVENTION AND SUPPRESSION OF MONEY LAUNDERING ACTIVITIES LAWS OF 2007 TO 2021 (188(I)/2007) AND REGULATION 18(3) OF CASINO OPERATIONS AND CONTROL LAW (GENERAL) REGULATIONS 2016 (R. 97/2016)

As per Article 69 obliged entities are obliged to apply the following internal reporting procedures and reporting to MOKAS: 

• Appoint as the AMLCO(Anti-Money Laundering Compliance Officer) a Senior Management level employee who has the relevant skills, knowledge and expertise, to whom to report any information or other matter which comes to their attention and which, in their opinion proves or creates suspicion that another person is engaged in money laundering and/or terrorist financing.
• Determine whether or not the information or other matter in the report proves this a fact or creates suspicion. 
• Have direct and timely access to any information, records and documents which may be of assistance to him/her and which is available to the Operator. 
• In cases where they know or have reasonable suspicion that funds, irrespective of their amount, are revenue from illicit activities or related to the financing of terrorism, ensure that MOKAS(Unit for Combating Money Laundering in the Republic of Cyprus) is immediately informed. 
• Provide to MOKAS directly, at its request, all necessary information.

As per Article 60, Enhanced Due Diligence measures must be applied under circumstances including:  

If the Operator has determined that a customer or beneficial owner is a PEP, or a family member or a close associate of a PEP 

• Is involved in any business relationship or transaction with a customer from a high-risk third country 
• Is involved in any  business relationship with a Junket operator 
• In any case where a transaction is complex or unusually large, or there is an unusual pattern of transactions, and the transaction or transactions have no apparent economic or legal purpose 
• In any other case which, by its nature or circumstances, can present a higher risk of money laundering and/or terrorist financing.

As per Article 64, In cases of business relationships or transactions with PEPs, in addition to the Customer Due Diligence measures laid down above, the following Enhanced Due Diligence measures must be applied: 

• Obtain Senior Management approval for establishing/continuing business relationships with such persons or performing a transaction.
• Take adequate measures to establish the source of wealth and source of funds that are involved in business relationships or transactions with such persons.
• Conduct enhanced, ongoing monitoring of those business relationships.

As per Article 69 and 70, the AMLCO must report to MOKAS for any transaction or activity that, after their evaluation, they know or suspect that may be linked to money laundering and/or terrorist financing. 

The obligation to report to MOKAS also includes any attempt to carry out suspicious transactions. 

• Report must be made as soon as is practicable after information comes to the AMLCO and the AMLCO performs their evaluation. The AMLCO has the responsibility to keep records of all reports made to MOKAS.
• If once a report is filed the Operator decides to maintain the business relationship with the customer who is the subject of the report, the Operator should:
  • classify the customer as a high-risk customer
  • monitor the activities of that customer to a larger extent. 

Sources: https://www.cysec.gov.cy/en-GB/legislation/financial-crimes/%CE%9A%CE%A5%CE%A1%CE%99%CE%91-%CE%9D%CE%9F%CE%9C%CE%9F%CE%98%CE%95%CE%A3%CE%99%CE%91/

https://www.cgc.org.cy/uploads/AML/c64a36ck7t.pdf