Anti-Money Laundering in Cyprus: The Current Rules and the EU Single Rulebook from July 2027

3 hours ago

6 min read

Anyone opening a bank account, forming a company or buying property in Cyprus meets anti-money laundering (AML) requirements early and often. For most clients they are a source of questions and delay rather than a legal concept. They are also about to change in structure. Cyprus today enforces AML rules through national legislation that implements EU directives. From 10 July 2027, a directly applicable EU regulation takes over the substance of those rules, and a new EU authority, AMLA, begins to supervise the largest cross-border financial groups. This article sets out where the law stands now, what changes and when, and what businesses and private clients should do in the meantime.

The current framework

The core of Cyprus AML law is the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), as amended. It criminalises money laundering and the financing of terrorism, imposes preventive obligations on regulated businesses and professionals, and provides for confiscation. It has been amended repeatedly to implement successive EU directives, including the Fifth Anti-Money Laundering Directive through Law 61(I)/2021, which also introduced the national register of beneficial owners.

The law applies to a wider group than banks. Obliged entities include credit and financial institutions, auditors and accountants, administrative service providers, estate agents, gambling operators, crypto-asset service providers and lawyers when acting in the activities the law specifies. Anyone trading goods who accepts cash payments of EUR 10,000 or more, in one transaction or a series of linked ones, is also caught.

Supervision is sectoral. The Central Bank of Cyprus supervises credit institutions, the Cyprus Securities and Exchange Commission (CySEC) supervises investment firms and crypto-asset service providers, the Institute of Certified Public Accountants of Cyprus (ICPAC) supervises accountants and auditors, and the Cyprus Bar Association supervises lawyers and law firms, which means this firm is itself subject to the rules it applies to clients. Suspicious transaction and activity reports go to MOKAS, the Cyprus financial intelligence unit. Its 2024 annual report recorded 3,870 such reports, a rise of 62 per cent on the previous year, with crypto-asset service providers accounting for close to a fifth of them. The direction of travel is towards more reporting, not less.

What the rules mean in practice

Four duties account for most of what clients experience. First, customer due diligence: before a business relationship begins, the obliged entity must identify and verify the customer and, for companies and trusts, the individuals who ultimately own or control them. Second, source of funds and source of wealth: higher-risk clients are asked not only who they are but where the money comes from and how it was accumulated, with documents to support the answer. Third, ongoing monitoring, so that a client cleared at onboarding is still reviewed when circumstances change. Fourth, reporting: where an obliged entity forms a suspicion, it must report to MOKAS and may not tell the client.

This is why a bank account for a newly formed Cyprus company can take weeks, as we note in our step-by-step relocation guide. The delay is rarely a reflection on the client. It is the time the institution needs to complete a due diligence file it is legally obliged to complete. Clients who arrive with certified identity documents, recent proof of address, a clear ownership chart and evidence of source of funds move faster than those who do not.

Beneficial ownership registers

Cyprus companies must record their ultimate beneficial owners in the national register, confirm the information annually, and update it when it changes. Express trusts are covered separately by the Trusts Register maintained by CySEC, as we describe in our article on Cyprus international trusts. Public access to beneficial ownership registers ended after the Court of Justice of the European Union held in November 2022, in WM and Sovim, that unrestricted public access was incompatible with fundamental rights. Access is now limited to competent authorities, obliged entities carrying out due diligence and persons who can show a legitimate interest.

Enforcement has also tightened. Amendments published in December 2024 introduced a penalty of EUR 100 for the first day of default and EUR 50 for each further day, capped at EUR 5,000 per entity, together with provisions on director liability, deletion from the register and court orders for compliance. A dormant holding company that has not confirmed its beneficial owners is therefore not merely untidy; it is exposed.

The EU single rulebook

The reform at the centre of this article consists of three separate instruments adopted in 2024, and they are easily confused.

Regulation (EU) 2024/1624 (the AML Regulation, or AMLR) is the single rulebook. It sets the substantive obligations on obliged entities and applies directly in every Member State from 10 July 2027, with no national transposition. Where it conflicts with Cyprus legislation, the Regulation prevails.
Directive (EU) 2024/1640 (the new AML Directive) deals with matters that remain national: the organisation of supervisors and financial intelligence units, and the design of beneficial ownership registers. Cyprus must transpose it by 10 July 2027, which means Law 188(I)/2007 will need to be amended or replaced.
Regulation (EU) 2024/1620 established the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), based in Frankfurt.

A point of terminology is worth making. Both the 2024 Directive and an earlier criminal law directive, Directive (EU) 2018/1673, which Cyprus implemented by amendment in 2022, have been described as the "sixth" AML directive. Advice or commentary referring to the sixth directive needs to be read with that in mind.

What changes substantively

For clients and businesses, the changes with the most practical effect are these.

Ownership threshold. A natural person is a beneficial owner through ownership where they hold 25 per cent or more of the shares, voting rights or ownership interest. The current test in the directives is more than 25 per cent. An individual holding exactly one quarter, which is common in four-way joint ventures and family structures, will be caught.
Occasional transactions. The threshold at which due diligence applies to an occasional transaction falls from EUR 15,000 to EUR 10,000. Persons carrying out occasional cash transactions of between EUR 3,000 and EUR 10,000 will have to be identified.
Cash limit. The AMLR sets an EU-wide limit of EUR 10,000 on large cash payments for goods and services. Member States may set lower limits.
Nominees. Nominee shareholders and nominee directors must maintain accurate, up-to-date information on their nominator and the nominator's beneficial owners, and disclose both the nominee status and that information to the legal entity.
High-net-worth clients. Credit and financial institutions face additional enhanced due diligence obligations for clients holding substantial assets, and for relationships with links to high-risk third countries.

AMLA and the timetable

AMLA became operational in 2025 and took over the anti-money laundering mandates of the European Banking Authority on 1 January 2026. Its role needs to be described precisely. It does not replace national supervisors. Its main functions are to draft the technical standards that sit beneath the AMLR, to coordinate and oversee national supervisors, including those responsible for non-financial professions, and to supervise directly a limited number of the highest-risk cross-border financial groups.

The selection of those groups starts by 1 July 2027 and must conclude within six months. Up to 40 groups operating in several Member States will be chosen, and direct supervision is due to begin in 2028. A single Cyprus company is unlikely to find AMLA at its door. The Central Bank, CySEC, ICPAC and the Cyprus Bar Association will remain the supervisors most clients deal with, but they will do so applying a common rulebook and under AMLA's oversight. Cyprus is not on the FATF lists of jurisdictions under increased monitoring, and the new framework is likely to raise, rather than lower, the standard of scrutiny applied to Cyprus structures.

Practical implications

Four steps are worth taking now rather than in mid-2027. First, map beneficial ownership against the new test. Any individual at exactly 25 per cent should be identified, and the register and shareholder records should be checked for consistency. Second, review nominee arrangements and make sure the documentation that will be required of nominees is available. Third, check that annual beneficial ownership confirmations are up to date, given the daily penalty regime. Fourth, assemble source of funds and source of wealth evidence in advance, and keep it current, since both banks and professional advisers will expect more of it, not less.

The new rules will not change the purpose of the system. They will change the consistency with which it is applied across Member States and the evidence trail clients are expected to produce. Preparation that costs little now will save time at every onboarding after July 2027.

This article is provided for general informational purposes only and does not constitute legal advice. Specific legal advice should be sought before taking any action in reliance on the contents of this article.