Financial Integrity Monitor
Sign in

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

Cyprus CY

Domains covered
8 of 8
Sources
149
Role actions
8
Horizon <90d
0
Jurisdiction profile
FATF status: Compliant Tier: B Risk direction: Stable Enablement vs enforcement: Mixed

Cyprus applies the EU AML/CFT acquis via its AML/CFT Law, with MOKAS as FIU, CySEC as securities/CASP supervisor, and CBC as banking supervisor.

MoreAssessed by MONEYVAL under FATF standards, Cyprus remains in enhanced follow-up since its 2019 MER, rated partially compliant on non-profit organisations, correspondent banking, new technologies (crypto), and law-enforcement investigative powers. A national sanctions unit (NSIU/MEK), replacing a 2016 sanctions law, was legislated in 2025 after EU-deadline delays.

Key deficiencies
  • Partially-compliant FATF rating on new technologies/virtual assets (R.15), downgraded from largely compliant
  • Delayed operationalisation of the National Sanctions Implementation Unit past the EU's May 2024 deadline
  • Non-public beneficial ownership and trust registers limiting third-party/journalistic verification
  • Professional-enabler resistance (Bar Association) to sanctions-enforcement reforms affecting lawyer participation
  • Historically weak prosecutorial follow-through on citizenship-by-investment corruption (2026 acquittals)
Recent developments (18m)
  • ICIJ/OCCRP Cyprus Confidential fallout drove a three-pronged sanctions legislative package passed in 2025 criminalising sanctions evasion and creating a National Sanctions Implementation Unit
  • MONEYVAL/FATF published a further follow-up report on Cyprus's AML/CFT progress on 23 March 2026
  • OFAC designated multiple Cyprus-registered companies and Cypriot nationals under Russia-related EO14024 in November and December 2025
  • A Nicosia criminal court acquitted two former senior politicians in a golden-passport corruption case in February 2026, citing insufficient prosecution evidence
  • UK and Cyprus agreed cooperation (Dec 2024) on establishing the NSIU with OFSI/OTSI technical assistance and beneficial-ownership information sharing

Law made at European Economic Area level that applies in Cyprus is covered once, on the European Economic Area page. This page covers Cyprus’s own layer: implementation, national authorities, national options and local enforcement.

Brief

Lead signal

Lead Signal

The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced.

Read full brief

Lead Signal

The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced.

Alongside the sanctions package, Cyprus moved on its domestic crypto-enforcement architecture. The Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026, following Cabinet approval on 10 September 2026. The bill would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal investigatory and enforcement powers, including inspections, compliance orders, and suspension or withdrawal of MiCA authorisation, with corporate fines of at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse.

Other Developments

CySEC public warnings on unauthorised websites. Cyprus main financial watchdog warned investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. The warning sits alongside the pending enforcement bill as evidence of continued supervisory activity in the crypto-adjacent space even ahead of the bill formal powers taking effect.

UK divergent sanctions package. The United Kingdom issued a separate package on 8 October 2026 comprising 38 new designations, targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package is distinct in composition and timing from the EU 22nd package, illustrating the continued pattern of autonomous, non-synchronised EU and UK sanctions-listing activity that obliged entities operating across both jurisdictions must reconcile separately.

MONEYVAL standing assessment. Cyprus remains under MONEYVAL enhanced follow-up procedure, per the 4th Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. None of the FATF recommendations are assessed as non-compliant for Cyprus, and the sixth-round mutual evaluation on-site visit is scheduled for October 2028. This is a baseline-descriptive record rather than fresh movement this cycle, but it frames the compliance backdrop against which the new sanctions and crypto-enforcement developments land.

Cross-Monitor Connections

The domestic crypto-enforcement bill intersects directly with the crypto monitor track: the same Markets in Crypto-Assets Bill of 2026 that strengthens CySEC and the Central Bank of Cyprus enforcement powers for market-integrity purposes also forms the backbone of the licensing-enforcement architecture tracked on the digital-assets side. The EU sanctions package similarly connects to payments-sector screening obligations, since the expanded designee population, including hundreds of newly named corporate officers, extends the counterparty-screening surface that correspondent banks and cross-sector payment firms operating in or through Cyprus must apply.

Outlook

The Markets in Crypto-Assets Bill of 2026 remains before Parliament, with no primary bill text yet retrieved; confidence in its final scope and effective date is capped at probable pending the official text and any committee amendments. Enactment is not confirmed for a specific date; the matter is best tracked as a bill at the parliamentary stage rather than an enacted instrument, with the gap in independently confirmed detail expected to narrow once the House of Representatives advances the text. The EU 22nd sanctions package applies immediately and without a transition period, so the near-term compliance task for obliged entities in Cyprus is incorporation of the expanded designee list into existing screening systems rather than awaiting any further domestic implementing step.

Earlier periodic briefs (4)
25 Oct 2026 · fim-2026-10-25

Lead Signal

The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced.

Alongside the sanctions package, Cyprus moved on its domestic crypto-enforcement architecture. The Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026, following Cabinet approval on 10 September 2026. The bill would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal investigatory and enforcement powers, including inspections, compliance orders, and suspension or withdrawal of MiCA authorisation, with corporate fines of at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse.

Other Developments

CySEC public warnings on unauthorised websites. Cyprus main financial watchdog warned investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. The warning sits alongside the pending enforcement bill as evidence of continued supervisory activity in the crypto-adjacent space even ahead of the bill formal powers taking effect.

UK divergent sanctions package. The United Kingdom issued a separate package on 8 October 2026 comprising 38 new designations, targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package is distinct in composition and timing from the EU 22nd package, illustrating the continued pattern of autonomous, non-synchronised EU and UK sanctions-listing activity that obliged entities operating across both jurisdictions must reconcile separately.

MONEYVAL standing assessment. Cyprus remains under MONEYVAL enhanced follow-up procedure, per the 4th Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. None of the FATF recommendations are assessed as non-compliant for Cyprus, and the sixth-round mutual evaluation on-site visit is scheduled for October 2028. This is a baseline-descriptive record rather than fresh movement, but it frames the compliance backdrop against which the new sanctions and crypto-enforcement developments land.

Cross-Monitor Connections

The domestic crypto-enforcement bill intersects directly with the crypto monitor track: the same Markets in Crypto-Assets Bill of 2026 that strengthens CySEC and the Central Bank of Cyprus enforcement powers for market-integrity purposes also forms the backbone of the licensing-enforcement architecture tracked on the digital-assets side. The EU sanctions package similarly connects to payments-sector screening obligations, since the expanded designee population, including hundreds of newly named corporate officers, extends the counterparty-screening surface that correspondent banks and cross-sector payment firms operating in or through Cyprus must apply.

Outlook

The Markets in Crypto-Assets Bill of 2026 remains before Parliament, with no primary bill text yet retrieved; confidence in its final scope and effective date is capped at probable pending the official text and any committee amendments. Enactment is not confirmed for a specific date; the matter is best tracked as a bill at the parliamentary stage rather than an enacted instrument, with the gap in independently confirmed detail expected to narrow once the House of Representatives advances the text. The EU 22nd sanctions package applies immediately and without a transition period, so the near-term compliance task for obliged entities in Cyprus is incorporation of the expanded designee list into existing screening systems rather than awaiting any further domestic implementing step.

12 Oct 2026 · fim-2026-10-11

Lead Signal

Cyprus's financial-integrity posture this cycle is defined by two parallel tracks rather than a single headline event: a routine but consequential corporate-transparency compliance cycle, and a sanctions-architecture framework that continues to deepen under EU direction. The Department of the Registrar of Companies and Intellectual Property (DRCIP) opened the 2026 annual Beneficial Ownership Register confirmation window on 1 October 2026, running to 31 December 2026, and applicable to every Cyprus company, European company (SE) and partnership regardless of whether ownership has changed. Non-compliance carries an automatic penalty structure, beginning at EUR 100 on the first day of default and accruing EUR 50 per further day, capped at EUR 5,000 per entity. This is a procedural obligation rather than a substantive rule change, but its universality across the Cyprus corporate registry base, and the automaticity of the penalty mechanism, make it a material event for any entity with Cyprus corporate structures in its ownership chain.

Alongside this, the EU's 21st Russia sanctions package, adopted 23 July 2026, added 218 designations, comprising 48 individuals and 170 entities, and extended the shadow-fleet support-services regime while introducing the possibility of a blanket third-country crypto-services ban. Cypriot legal commentary followed closely on the package's scope and enforcement implications, reflecting the jurisdiction's continued sensitivity to Russia-linked sanctions exposure given its historical role as a financial centre for Russian and CIS-linked capital.

Other Developments

Beneficial ownership confirmation cycle reaches its annual checkpoint. The 2026 DRCIP window is not a new rule but a recurring procedural requirement under the Companies Law (Cap. 113) beneficial ownership regime, with the current penalty structure dating to Law L.141(I)/2024, effective February 2025. What makes this cycle notable is less the obligation itself than its blanket application: every registered entity must confirm, even where nothing has changed, and the automatic and escalating nature of the penalty removes most of the discretion that might otherwise soften enforcement against inadvertent late filers.

AMLA technical standards consultation reaches Cypriot non-financial obliged entities. CySEC Circular C800, dated 8 September 2026, notified Administrative Service Providers and Crowdfunding Service Providers of a public hearing convened by the Anti-Money Laundering Authority (AMLA) on draft Regulatory Technical Standards under Article 40(2) of Directive (EU) 2024/1640, concerning risk-assessment methodology for non-financial sectors. This is a consultation notice, not a finalised obligation, but it signals that the EU-level harmonisation of AML risk methodology is actively reaching into sectors beyond banks and investment firms that Cyprus hosts in volume.

Sanctions-criminalisation architecture remains the operative enforcement backdrop. Cyprus's Law No. 149(I)/2025, transposing EU Directive 2024/1226, criminalises intentional breach of EU sanctions, while the companion Law 150(I)/2025 established a National Sanctions Implementation Unit (EMEK) to coordinate enforcement with Europol, Eurojust and the European Public Prosecutor's Office. Neither law is new this cycle, but both form the legal environment into which the 21st sanctions package's expanded designations and shadow-fleet provisions land, and this standing architecture is the reason Cypriot firms have been receiving active compliance guidance following the July package.

Cross-Monitor Connections

The sanctions dimension of this cycle connects directly to crypto-asset and payments oversight: the 21st EU Russia sanctions package's introduction of a possible blanket third-country crypto-services ban sits alongside the separate expiry of Cyprus's MiCA Article 143(3) transitional regime on 1 July 2026, after which CySEC issued post-expiry warnings to crypto-asset service providers. Taken together, these developments narrow the population of entities that can lawfully provide crypto services from or into Cyprus without full authorisation, which bears on both financial-integrity screening obligations and payments-sector licensing scope. The beneficial ownership confirmation cycle is also structurally relevant to correspondent banking and enabler-jurisdiction due diligence conducted elsewhere in the EU and beyond: a jurisdiction's registry discipline, including whether filing obligations are enforced with automatic penalties, is itself an input into counterparty risk assessment of Cyprus-incorporated structures.

Outlook

The DRCIP confirmation window closes 31 December 2026, and the practical test of this cycle's development will be the scale of penalty accrual against non-filers once that deadline passes, which will not be visible until the following reporting period. On the sanctions side, Cypriot firms should expect continued compliance guidance to follow further EU Russia-sanctions escalation, given Cyprus's exposure through its historical position as a jurisdiction of choice for Russian and CIS corporate structuring. The AMLA RTS consultation under Article 40(2) remains at the draft stage, with no finalisation date yet identified; non-financial obliged entities in Cyprus, including Administrative Service Providers and Crowdfunding Service Providers, should anticipate that a harmonised EU risk-assessment methodology will eventually bind them, though the timeline for that is not yet fixed.

28 Sep 2026 · fim-2026-09-28

Lead Signal

Cyprus enacted a three-law package effective 25 July 2025 — Law 150(I)/2025, Law 149(I)/2025 and Law 48(I)/2025 — establishing the National Sanctions Implementation Unit (NSIU/EMEK) within the Ministry of Finance. The new unit replaces a fragmented 2016 sanctions-enforcement regime with a centralised body responsible for coordinating EU and UN sanctions implementation, licensing and derogation decisions, and administrative enforcement. The reform is explicitly linked to prior ICIJ Cyprus Confidential findings that exposed weaknesses in Cyprus's sanctions-enforcement architecture, and Law 149(I)/2025 separately creates a new criminal offence for violating EU restrictive measures, implementing EU Directive 2024/1226 on harmonising criminal sanctions-violation offences across member states.

This is a structural rather than episodic development: it consolidates what had been dispersed sanctions authority into a single body with defined licensing, derogation and enforcement powers, directly responsive to a documented prior gap.

Other Developments

MiCA CASP transition completed. The transitional period allowing crypto-asset service providers to operate in Cyprus under the pre-MiCA national registration regime closed entirely on 1 July 2026, with an application deadline of 27 February 2026 for firms seeking to carry over into full MiCA authorisation. Firms that did not file a complete application by the deadline were required to submit wind-down plans. From 1 July 2026, MiCA authorisation via CySEC is the sole lawful basis for providing crypto-asset services from Cyprus, and unauthorised-provider activity after that date is unlawful across the EU. CySEC accompanied the cutover with a circular, reported by a single legal-commentary source and not yet independently retrieved, directing regulated crypto and investment firms to strengthen anti-money-laundering controls as the transition concluded, citing new AMLA guidance.

MONEYVAL follow-up upgrade. Cyprus is assessed via MONEYVAL rather than direct FATF mutual evaluation, and its most recent enhanced follow-up reporting shows an upgrade on FATF Recommendation 13, covering correspondent banking, to largely compliant. Recommendation 8, covering non-profit organisations, remains partially compliant. Cyprus is not on the FATF grey list.

Cross-Monitor Connections

The MiCA CASP cutover intersects directly with the crypto monitor's licensing and stablecoin-regime coverage: the same transitional-period expiry that closes the national CASP registration route is the structural fact underpinning that monitor's token-classification and stablecoin analysis for Cyprus this cycle. The NSIU establishment also has a payments-adjacent dimension worth noting for the world-payments monitor's AML/CFT coverage, since sanctions-list screening obligations sit alongside the payment-institution and e-money-institution authorisation regime the Central Bank of Cyprus separately administers, though that authorisation process is not itself a sanctions matter.

Outlook

Watch for independent retrieval and corroboration of the CySEC 9 July 2026 AML circular text, currently resting on a single T3 legal-commentary source. Watch also for confirmation of Cyprus's beneficial-ownership registry status, which was not independently re-verified this cycle, and for any enabler-jurisdiction or professional-facilitator findings that may emerge as a consequence of the NSIU's expanded coordination role.

25 Aug 2026 · fim-2026-08-05

Lead Signal

The most structurally significant development for Cyprus this cycle is the formal close of the Markets in Crypto-Assets Regulation's national grandfathering window for crypto-asset service providers on 1 July 2026, following a 27 February 2026 application deadline. This retires Cyprus's AML-only national crypto registration regime in favour of full Markets in Crypto-Assets Regulation authorisation, with unauthorised providers required to wind down their operations. The finding carries a High confidence rating, anchored by a Tier 1 CySEC press release and corroborated across three independent secondary sources on both the application-deadline and expiry dates. This is treated as a structural regime transition rather than an incremental development, because it closes the last national-registration pathway available to crypto-asset firms operating in Cyprus and materially raises the compliance bar for CY-domiciled providers entering their first full MiCA supervisory cycle. Providers that have not secured full MiCA authorisation by the relevant deadline no longer have a national fallback registration to rely on, which sharpens the operational stakes of the transition considerably relative to prior cycles. The transition also converges with Cyprus's broader efforts to tighten its financial-crime architecture this cycle, discussed below, even as the crypto-specific compliance burden is assessed independently on its own evidentiary merits.

Other Developments

Sanctions enforcement build-out. CySEC's sanctions-breach criminalisation framework, implementing EU Directive 2024/1226, has been in force since 1 August 2025, and a National Sanctions Implementation Unit is now operational within the Ministry of Finance. This finding is assessed with moderate confidence, corroborated across two independent trade-press mirrors describing the same circular, though no Tier 1 CySEC circular text was located directly this cycle to confirm the precise scope of the new criminalisation framework.

AMLA data-collection groundwork. CySEC Circular C748, as amended by Circular C749, set a 12 January 2026 submission deadline for obliged entities to provide AMLA-related data, forming part of the groundwork for the EU AML Regulation becoming directly applicable across the European Union. This is an assessed-confidence finding, drawn from two independent vendor sources; no Tier 1 or Tier 2 anchor was located this cycle for the underlying circular text itself, so the precise scope of the data-collection exercise remains a research gap.

AMLR and 6AMLD direct applicability. The EU AML Regulation and the sixth Anti-Money Laundering Directive are moving toward, respectively, direct applicability and per-Member-State transposition, marking the first time EU anti-money-laundering law takes the form of a directly applicable Regulation rather than a directive requiring national transposition alone. This assessment rests on two independent Tier 4 sources only; no Tier 1 or Tier 2 anchor was located this cycle, and it is flagged accordingly as thinner-sourced than the MiCA finding above.

Cross-Monitor Connections

The MiCA transition intersects directly with the World Payments Monitor's own tracking of Cyprus's crypto-asset-service-provider licensing lifecycle, since the same 1 July 2026 grandfathering expiry that closes the AML-only national registration pathway also determines which providers may continue to offer payment-adjacent digital-asset services in Cyprus going forward. Separately, the sanctions-enforcement build-out and the AMLA data-collection groundwork under Circular C748/C749 both feed the same underlying supervisory infrastructure that Cyprus obliged entities will depend on as the EU AML Regulation and the Anti-Money Laundering Authority's direct and indirect supervision architecture come into force across the European Union. Both threads reflect Cyprus obliged entities preparing simultaneously for a new sanctions-enforcement architecture and a new EU-level AML supervisory architecture, on parallel but related timelines.

Outlook

The immediate item to watch is how CySEC applies its new sanctions-enforcement powers in practice now that the National Sanctions Implementation Unit is operational, since the current finding rests on secondary trade-press coverage rather than a located primary circular; a primary-source confirmation next cycle would materially firm up this finding's confidence. On the AMLA side, sources diverge on whether full AMLA direct supervision of high-risk cross-border obliged entities begins in 2027 or 2028; this date discrepancy is flagged for reconciliation and would sharpen the compliance-timeline picture for Cyprus obliged entities once resolved. On crypto, the practical test of the MiCA transition will be how many previously AML-registered Cyprus crypto-asset firms successfully convert to full MiCA authorisation versus wind down their Cyprus operations, a question this cycle's research could not yet answer and which next cycle should target directly. Taken together, these three threads point to a Cyprus financial-integrity posture that is genuinely building out formal architecture across sanctions, AML supervision, and crypto authorisation in parallel, even though the primary-source evidentiary base for two of the three threads remains thinner than ideal this cycle.

Domain intelligence (D1–D8)

D1 Sanctions

no_changeno_change

Sanctions

The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, the largest-ever single round of listings against the architecture of Russia's military-industrial complex. The package designates 1,569 individuals and entities, comprising 826 companies and 743 chief executives. Analytically, the structural significance lies less in novel evasion-architecture mechanisms than in the depth of the designee population: by naming the chief executives of already-sanctioned firms rather than confining itself to headline corporate entities, the package pushes the screening burden into the management layer of the sanctioned supply chain. As a Council Regulation, this is directly applicable across the European Union, binding Cyprus immediately without a national transposition step. Domestic implementation and enforcement in Cyprus runs through the National Sanctions Implementation Unit, which becomes the practical point of contact for Cyprus-based obliged entities seeking guidance on the expanded list.

Continue reading

For Cyprus specifically, the architecture point is that a directly applicable EU instrument removes any domestic discretion over scope or timing; the obligation is immediate and self-executing. This stands in explicit contrast to the United Kingdom's approach: on 8 October 2026 the UK issued its own, separate package of 38 new designations targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package differs in composition and in timing from the EU's, reflecting the continuing pattern of autonomous UK and EU sanctions-listing activity post-Brexit. For firms with cross-border exposure between EU member states and the UK, including many Cyprus-domiciled financial and corporate-services firms given the jurisdiction's historical role as a conduit for cross-border structuring, this divergence means two independently maintained designee lists must be reconciled rather than one harmonised list applied.

The enablement-versus-enforcement lens is also relevant here. Cyprus's standing compliance record, assessed under MONEYVAL's enhanced follow-up procedure, shows no FATF recommendation currently rated non-compliant, with the most recent Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. This is a favourable baseline against which the sanctions package lands: the expanded designee population tests the practical screening capacity of a jurisdiction that has, on paper, a sound technical-compliance record, rather than testing a jurisdiction with known technical gaps. The absence of any Cyprus-specific enforcement action connected to the new package this cycle is itself a data point, not an omission: it indicates the screening and implementation burden is still being absorbed rather than having already generated an enforcement response.

Outlook

The EU 22nd package took effect on adoption, with no transition period, so Cyprus-based obliged entities face an immediate task of incorporating the expanded designee list, including the newly listed corporate officers, into transaction-screening and customer due-diligence systems. No further national implementing measure is required or expected, since the regulation is self-executing. The divergence between EU and UK listings is a structural feature of the post-Brexit sanctions landscape that is likely to persist and recur with each new package on either side, rather than a one-off feature of this cycle; firms with dual EU-UK exposure should expect continued reconciliation work between the two designee lists going forward. Cyprus's next MONEYVAL assessment point, a fifth-round follow-up report, is anticipated in the first quarter of 2027, though the precise submission date has not been independently confirmed this cycle.

Judgment: NSIU/EMEK remains the standing sanctions-enforcement architecture; no new designation or evasion-architecture finding this cycle. Uncertain
Cumulative analysis

Sanctions Architecture and Evasion — Cumulative Analysis

The standing of Cyprus in the Russian sanctions-evasion architecture has moved through several confirmatory phases culminating in this cycle finding of a criminalised domestic enforcement regime. Two prior OFAC designation waves within a six-week window hit Cyprus-registered structures: Hightrail Ltd and a Cypriot national linked to Alisher Usmanov, then Veles International Limited and Hadlerco Limited linked to Dmitry Bugayenko. Read against the earlier Cyprus Confidential investigative dataset, which documented rapid oligarch-asset restructuring executed by Cypriot professional-services firms including PwC Cyprus as EU sanctions loomed in 2022, these designations corroborated the architectural thesis that Cyprus functions as a persistent enabler node rather than a jurisdiction with isolated historical exposure.

A second, structurally distinct evasion channel documented across prior cycles operates through shipping. Corporate structures spanning Cyprus, the UAE and Liberia layer tanker ownership to preserve port access and insurance for vessels otherwise subject to shadow-fleet designation, with resold ageing tankers resurfacing as shadow-fleet vessels within weeks. The EU responded across the prior cycle with an expanding designation net reaching nearly 600 vessel listings, and extended measures in its 19th sanctions package to crypto-asset infrastructure for the first time, alongside a 2027 LNG import ban and removal of remaining Rosneft and Gazprom Neft exemptions.

Against this accumulating enforcement and architectural evidence sat a persistent domestic capacity constraint: the National Sanctions Implementation Unit was legislated only in mid-2025, after Cyprus missed the EU May 2024 transposition deadline amid Bar Association objections to the design of the unit, and its operational capacity remained unconfirmed through the prior cycle.

This cycle supplies the clearest evidence yet that the capacity gap is closing, though not without a countervailing signal. A sanctions-breach criminalisation framework, implementing EU Directive 2024/1226, has been in force since 1 August 2025, and the National Sanctions Implementation Unit is now described as operational within the Ministry of Finance rather than merely legislated, coordinating enforcement alongside CySEC. This represents the institution-building outcome that the prior cycle flagged as unresolved. At the same time, this cycle also surfaced a countervailing negotiating-posture finding: Cyprus, alongside Greece and Malta, secured softened maritime and tanker restrictions within the EU 20th Russia-sanctions package, adopted 23 April 2026 with 120 new listings, protecting shipping-fleet interests even as the domestic enforcement regime tightens.

Read as a single integrated trajectory across cycles, the pattern is now reasonably clear: Cyprus is simultaneously closing its domestic enforcement-capacity gap through the criminalisation framework and the operational National Sanctions Implementation Unit, while continuing to use its EU-level negotiating leverage, alongside Greece and Malta, to soften the substantive restrictions that would otherwise affect its own flag-state shipping and vessel-layering exposure. External designations against Cyprus-registered corporate vehicles, professional-services facilitation of pre-sanctions asset restructuring, and shadow-fleet tanker layering through Cyprus-UAE-Liberia structures remain the three enforcement-confirmed evasion channels; the criminalisation framework and National Sanctions Implementation Unit are the domestic response mechanism now operational rather than merely legislated; and the maritime-restriction softening is the clearest evidence that enforcement-tightening and enablement-adjacent negotiating behaviour continue to coexist within the same jurisdiction rather than resolving in either direction.

The trajectory to monitor going forward is whether the now-operational National Sanctions Implementation Unit produces measurable enforcement outcomes against the professional-services and shipping-layering channels already documented, or whether its operational status remains primarily a coordinating function without independent enforcement output distinguishable from CySEC's existing supervisory actions.

domain_sub_briefs · D1 · Cumulative analysis
Standing baseline position

The EU adopted its 22nd Russia sanctions package on 12 October 2026, designating 1,569 individuals and entities (826 companies, 743 CEOs) in Russia's military-industrial complex; directly applicable in Cyprus via the NSIU/EMEK enforcement point.

Cyprus assessed as an active enabler node in Russian sanctions-evasion architecture via CSP/legal/accounting shell networks and shadow-fleet corporate layering (Cyprus-UAE-Liberia); risk_direction stable pending NSIU full operationalisation.

Periodic updates (4)
25 Oct 2026 · fim-2026-10-25

Sanctions

The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, the largest-ever single round of listings against the architecture of Russia's military-industrial complex. The package designates 1,569 individuals and entities, comprising 826 companies and 743 chief executives. Analytically, the structural significance lies less in novel evasion-architecture mechanisms than in the depth of the designee population: by naming the chief executives of already-sanctioned firms rather than confining itself to headline corporate entities, the package pushes the screening burden into the management layer of the sanctioned supply chain. As a Council Regulation, this is directly applicable across the European Union, binding Cyprus immediately without a national transposition step. Domestic implementation and enforcement in Cyprus runs through the National Sanctions Implementation Unit, which becomes the practical point of contact for Cyprus-based obliged entities seeking guidance on the expanded list.

For Cyprus specifically, the architecture point is that a directly applicable EU instrument removes any domestic discretion over scope or timing; the obligation is immediate and self-executing. This stands in explicit contrast to the United Kingdom's approach: on 8 October 2026 the UK issued its own, separate package of 38 new designations targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package differs in composition and in timing from the EU's, reflecting the continuing pattern of autonomous UK and EU sanctions-listing activity post-Brexit. For firms with cross-border exposure between EU member states and the UK, including many Cyprus-domiciled financial and corporate-services firms given the jurisdiction's historical role as a conduit for cross-border structuring, this divergence means two independently maintained designee lists must be reconciled rather than one harmonised list applied.

The enablement-versus-enforcement lens is also relevant here. Cyprus's standing compliance record, assessed under MONEYVAL's enhanced follow-up procedure, shows no FATF recommendation currently rated non-compliant, with the most recent Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. This is a favourable baseline against which the sanctions package lands: the expanded designee population tests the practical screening capacity of a jurisdiction that has, on paper, a sound technical-compliance record, rather than testing a jurisdiction with known technical gaps. The absence of any Cyprus-specific enforcement action connected to the new package is itself a data point, not an omission: it indicates the screening and implementation burden is still being absorbed rather than having already generated an enforcement response.

Outlook

The EU 22nd package took effect on adoption, with no transition period, so Cyprus-based obliged entities face an immediate task of incorporating the expanded designee list, including the newly listed corporate officers, into transaction-screening and customer due-diligence systems. No further national implementing measure is required or expected, since the regulation is self-executing. The divergence between EU and UK listings is a structural feature of the post-Brexit sanctions landscape that is likely to persist and recur with each new package on either side, rather than a one-off feature of this cycle; firms with dual EU-UK exposure should expect continued reconciliation work between the two designee lists going forward. Cyprus's next MONEYVAL assessment point, a fifth-round follow-up report, is anticipated in the first quarter of 2027, though the precise submission date has not been independently confirmed.

12 Oct 2026 · fim-2026-10-11

Sanctions

Cyprus's sanctions exposure this cycle is shaped principally by the EU's 21st Russia sanctions package, adopted 23 July 2026, which designated 218 targets, 48 individuals and 170 entities, and extended the shadow-fleet support-services regime while introducing the possibility of a blanket third-country crypto-services ban. Cypriot legal commentary followed the package closely, reflecting the jurisdiction's historical exposure as a financial centre with significant Russian and CIS-linked corporate activity, a profile that has made Cyprus a persistent focus of EU sanctions-compliance scrutiny since 2022. The package's extension of shadow-fleet support-services coverage is architecturally significant: it widens the category of ancillary services, insurance, ship management, bunkering and related logistics support, that can trigger sanctions exposure for firms with shipping or maritime-finance links, a sector in which Cyprus maintains substantial commercial presence.

This cycle's sanctions signal sits on top of a standing legal architecture rather than introducing a new one. Cyprus's Law No. 149(I)/2025, which transposed EU Directive 2024/1226 on 25 July 2025, criminalises intentional breach of EU sanctions, and the companion Law 150(I)/2025 established a National Sanctions Implementation Unit (EMEK) tasked with enforcement cooperation across Europol, Eurojust and the European Public Prosecutor's Office. Neither law is new, but both represent the legal environment into which the 21st package's expanded designations and shadow-fleet provisions land, and it is this architecture, criminal liability plus a dedicated coordination unit, that gives the current escalation its enforcement teeth in Cyprus specifically, as distinct from EU sanctions exposure generally. The combination of an expanding designation list and an already-operative domestic criminalisation and coordination framework is the structurally important reading of this cycle: Cyprus is not merely a passive recipient of EU-level sanctions escalation but has, over the past year, built the domestic apparatus to enforce it directly.

A further point of architectural interest is the package's introduction of a possible blanket third-country crypto-services ban. This provision, if implemented, would intersect directly with Cyprus's crypto-asset services sector, which has itself just passed through the expiry of the MiCA Article 143(3) transitional regime on 1 July 2026, after which CySEC issued post-expiry warnings to crypto-asset service providers. The timing is not coincidental in effect even if not in design: a jurisdiction narrowing its population of authorised crypto-asset service providers under MiCA is simultaneously facing a sanctions provision that could further restrict third-country crypto-services access, compounding the compliance burden on any Cyprus-domiciled or Cyprus-licensed crypto entity with cross-border exposure.

Cyprus's MONEYVAL standing remains a relevant backdrop to this cycle's sanctions signal, even though it did not itself move this cycle. Cyprus is not FATF grey-listed, and the Council of Europe's Committee of Ministers papers of 23 September 2026 reference a 4th Enhanced Follow-Up Report noting continued progress, with Cyprus found compliant on 16 and partially compliant on 2 of the remaining recommendations under the 2024 follow-up report. A 6th-round onsite MONEYVAL visit is scheduled for October 2028. This status is unchanged this cycle but is worth holding alongside the sanctions-escalation signal: Cyprus is simultaneously absorbing an expanding EU sanctions designation list while maintaining a MONEYVAL compliance trajectory that external evaluators regard as broadly satisfactory, a combination that supports a reading of enablement risk being actively managed rather than structurally embedded.

Outlook

The near-term test for Cyprus's sanctions posture will be how EMEK and Cypriot financial institutions operationalise the expanded shadow-fleet and crypto-services provisions of the 21st package, particularly given the absence yet of a finalised blanket third-country crypto-services ban. Firms with shipping, maritime-finance or crypto-asset exposure in Cyprus should expect continued compliance guidance from Cypriot law firms and regulators as the EU's sanctions architecture against Russia continues to escalate. The interaction between the sanctions track and the MiCA transitional-regime expiry is likely to remain a live compliance theme through the remainder of 2026, as both tracks narrow the population of entities permitted to operate without full authorisation or exposure to criminal liability under Law 149(I)/2025.

28 Sep 2026 · fim-2026-09-28

Sanctions Architecture and Evasion

Cyprus's sanctions architecture underwent a structural overhaul effective 25 July 2025 with the enactment of a three-law package — Law 150(I)/2025, Law 149(I)/2025 and Law 48(I)/2025 — establishing the National Sanctions Implementation Unit (NSIU/EMEK) within the Ministry of Finance. Before this reform, sanctions enforcement in Cyprus sat under a fragmented 2016 regime; the new unit centralises coordination of EU and UN sanctions implementation, licensing and derogation decisions, and administrative enforcement under a single body. The reform is directly and explicitly linked to prior ICIJ Cyprus Confidential findings, which had exposed gaps in Cyprus's sanctions-enforcement capacity, giving this development the architecture-over-incident character that FIM's analytical register prioritises: a durable institutional change responsive to a documented structural weakness, rather than a one-off enforcement episode.

Alongside the institutional consolidation, Law 149(I)/2025 creates a new domestic criminal offence for violating EU restrictive measures, transposing EU Directive 2024/1226, the EU's harmonising directive on criminal sanctions-violation offences. This pairs administrative centralisation (via NSIU/EMEK) with a criminal-law backstop, giving Cyprus both a coordinating body and a prosecutable offence where sanctions violations occur — a combination that was previously absent or, at minimum, fragmented across different authorities.

CySEC's own 2026 sanctions-outlook commentary treats the July 2025 NSIU stand-up as the domestic mechanism reconciling EU autonomous sanctions listings with UN Security Council designations, underscoring that the reform's significance extends beyond enforcement capacity to reconciling two potentially divergent listing regimes under one coordinating unit.

Cyprus is not FATF grey-listed and continues to be assessed through MONEYVAL rather than direct FATF mutual evaluation. This places the D1 development in context: it is not a response to an international listing pressure but appears to be a domestically and EU-driven structural reform, reinforcing the enablement-versus-enforcement distinction FIM applies across jurisdictions — Cyprus is tightening its own architecture proactively rather than reactively.

Outlook

Watch for the NSIU's first substantive licensing or derogation decisions under its new powers, which would test whether the centralised structure translates into materially different enforcement outcomes than the prior fragmented regime. Also watch for any enabler-jurisdiction or professional-facilitator findings that may emerge from the unit's expanded coordination role, an area where no Cyprus-specific finding surfaced this cycle beyond the institutional reform itself.

25 Aug 2026 · fim-2026-08-05

Sanctions

Cyprus's sanctions-architecture posture this cycle shows two forces moving in parallel rather than in the same direction. On the enforcement-build-out side, CySEC's sanctions-breach criminalisation framework, implementing EU Directive 2024/1226, has been in force since 1 August 2025, with a National Sanctions Implementation Unit now operational within the Ministry of Finance. This is an assessed-confidence finding, corroborated across two independent trade-press mirrors describing the same circular, though the underlying CySEC circular text itself was not located directly this cycle, which caps confidence below the highest tier pending primary-source confirmation. Read on its own, this finding would suggest a jurisdiction tightening its domestic sanctions-enforcement machinery in a durable, institutional way: a dedicated implementation unit, sitting inside the Ministry of Finance rather than a sector regulator alone, is architecture rather than a single enforcement episode, and it should be weighted accordingly against a lighter, incident-level finding.

On the enablement side, however, Cyprus joined Greece and Malta this cycle in securing a softened maritime and tanker-restriction posture within the European Union's twentieth Russia-sanctions package, which added 120 new listings when adopted on 23 April 2026. This finding rests on a single quality-journalism source, with no corroborating Tier 1 or Tier 2 anchor located this cycle for the specific blocking role attributed to Cyprus, so it is treated as assessed rather than high confidence. The substantive point, however, is architectural rather than evidentiary: a jurisdiction with an economically significant shipping-registry interest lobbying to soften the maritime dimension of a collective EU sanctions package is a different kind of signal than an isolated non-enforcement episode. It sits alongside the criminalisation build-out as the other half of a genuinely mixed picture, in which Cyprus is simultaneously strengthening enforcement architecture that targets designated persons and entities while working to protect a specific economic sector, shipping, from the sharpest edges of the same sanctions regime.

Absence of enforcement action is itself a legitimate analytical signal in a jurisdiction with an economically significant permissive sector, and the maritime-softening finding should be read with that principle in mind rather than dismissed as a mere trade dispute. Neither finding individually determines Cyprus's overall sanctions-architecture trajectory; read together, they describe a jurisdiction building formal criminal-enforcement capacity for sanctions breaches while simultaneously exercising its negotiating leverage within the EU to protect a specific national economic interest from collective sanctions design.

The institutional placement of the National Sanctions Implementation Unit inside the Ministry of Finance, rather than housed within a single financial-sector regulator, is itself an architectural detail worth noting: it suggests a whole-of-government sanctions-implementation function rather than a narrower, sector-specific compliance unit, consistent with the broader EU push under Directive 2024/1226 to harmonise sanctions-breach criminalisation across member states as a matter of general criminal law rather than sector-specific financial regulation alone. On the EU package side, the addition of 120 new listings on 23 April 2026 represents one of the larger tranches within the ongoing sanctions-designation programme, and the negotiating role Cyprus played alongside Greece and Malta in softening its maritime dimension should be read against that scale: the softening applied to a specific sectoral carve-out within a substantially larger package, not to the package's core designations.

Both findings carry CTF-pillar significance under the three-pillar framework this monitor applies: the criminalisation framework and the National Sanctions Implementation Unit represent counter-terrorist-financing-adjacent architecture insofar as sanctions-evasion typologies frequently overlap with the customer-typology categories flagged this cycle, including correspondent-banking relationships and trade-finance structures. The maritime-softening finding likewise touches trade-finance and correspondent-banking customer typologies, given the role those channels play in financing and settling shipping-sector transactions connected to sanctioned trade flows. Firms operating across the cross-sector and banking categories identified in this cycle's affected-firm-type tagging should treat both findings as relevant to their own sanctions-screening and correspondent-relationship risk assessments, even though neither finding rises to the level of a specific enforcement action against a named institution this cycle.

Outlook

The clearest gap to close next cycle is locating a primary CySEC circular text for the sanctions-breach criminalisation framework now in force; the current finding rests entirely on trade-press mirrors, and a primary source would materially firm up confidence in both the scope and the operational reality of the National Sanctions Implementation Unit. On the maritime-softening finding, watch for any follow-through enforcement action, or lack of it, against Cyprus-flagged or Cyprus-linked tanker activity connected to the sanctioned Russian trade, since continued non-enforcement in that specific channel would corroborate the enablement reading rather than leave it as a single-package negotiating episode. More broadly, the coexistence of enforcement build-out and enablement-adjacent lobbying is itself the trend to track across coming cycles: if the pattern persists, it would support treating Cyprus's sanctions posture as structurally bifurcated rather than as a simple trajectory in either direction. Watch also for whether the EU revisits the maritime carve-out in a subsequent package, which would test whether this cycle's softening was a one-off negotiating outcome or the start of a durable pattern.

D2 Beneficial Ownership

no_changeno_changestanding position

Beneficial Ownership and Corporate Transparency

Cyprus's beneficial-ownership transparency posture this cycle is defined by the persistence of a structural opacity that predates and outlasts its most visible remediation effort, the 2020 termination of the golden-passport citizenship-by-investment programme. Cyprus's 2021 UBO registry and CySEC's parallel register of beneficial owners of express trusts remain restricted to competent authorities and obliged entities rather than being publicly accessible, meaning that independent verification of corporate and trust ownership structures continues to depend on leaked datasets such as Cyprus Confidential rather than official transparency mechanisms. This is a standing feature, not a new development, but it is reinforced this cycle by a further failure of accountability at the enforcement end: a Nicosia court acquitted former Parliament President Demetris Syllouris and former MP Christakis Giovanis in a golden-passport corruption case in February 2026, after key prosecution witnesses failed to appear. This is the third first-instance prosecution connected to the scheme to founder, a pattern that raises the question of whether the legislative termination of the programme has been matched by any accountability mechanism for its historical abuse.

Continue reading

Set against this domestic picture, the European Commission twice amended the EU high-risk third-country AML/CFT list within a single month. Delegated Regulation (EU) 2026/46 added Russia, and Delegated Regulation (EU) 2026/83 subsequently added Bolivia and the British Virgin Islands while removing six other jurisdictions. The BVI addition carries particular relevance for Cyprus given the well-documented BVI-Cyprus layering chains identified in the Cyprus Confidential dataset; the addition raises enhanced-due-diligence obligations precisely on the kind of cross-jurisdictional structure that Cypriot enablers have historically used to shield Russian-linked beneficial ownership.

The durable structural backdrop against which all of this must be read is the EU AML Package, which comprises three distinct legal instruments rather than a single reform. The AML Regulation (AMLR, Regulation (EU) 2024/1624) is directly applicable across the EU, including Cyprus, from 2027, superseding fragmented national AML/CFT Law provisions without requiring national transposition. The sixth AML Directive (6AMLD) requires transposition by each Member State on its own timeline — and Cyprus's specific national transposition vehicle and status were not established this cycle, a gap the interpreter has flagged rather than assumed. The AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority, which will select approximately 40 high-risk cross-border obliged entities for direct supervision in 2027, with supervision beginning in 2028; this shifts the supervisory perimeter from purely national authorities such as Cyprus's MOKAS, CySEC and Central Bank of Cyprus toward a hybrid EU-level regime. Cyprus's internationally exposed banking and corporate-service-provider sector is assessed as a plausible candidate for this direct-supervision track, though no selection has yet occurred.

Outlook

The near-term trajectory for Cyprus's beneficial-ownership transparency depends on developments that are largely exogenous to Cyprus's own reform pace: the AMLR's 2027 direct application, and whether AMLA's 2027 entity-selection process draws in a Cyprus-headquartered institution. Domestically, the recurring pattern of failed golden-passport prosecutions suggests that legislative termination of the scheme has not yet been accompanied by a working accountability mechanism, and the non-public status of the UBO and trust registers means this gap is likely to remain difficult to independently verify absent a further leak-driven disclosure.

Judgment: No CY-specific beneficial-ownership register development located this cycle. Uncertain
Cumulative analysis

Beneficial Ownership and Corporate Transparency — Cumulative Analysis

The standing structural backdrop for this domain is the EU AML Package, comprising three distinct instruments: the AML Regulation (AMLR, Regulation (EU) 2024/1624), directly applicable across member states; the sixth Anti-Money Laundering Directive (6AMLD), transposed per member state; and the AMLA Regulation (Regulation (EU) 2024/1620), establishing the Anti-Money Laundering Authority and its direct- and indirect-supervision perimeter. This architecture shifts supervision of high-risk cross-border obliged entities from a purely national model toward a hybrid EU-level regime, and it is the durable backdrop against which the Cyprus-specific developments accumulated across recent cycles should be read.

Across the period leading into this cycle, Cyprus obliged entities moved through a series of preparatory milestones for this transition. The most concrete of these was CySEC Circular C748, as amended by Circular C749, which set a 12 January 2026 deadline for obliged entities to submit AMLA data-collection returns, groundwork for the AMLR transition to direct applicability. Sourcing across cycles has consistently described this transition as making anti-money-laundering law, for the first time in EU history, a directly applicable Regulation rather than a set of nationally transposed provisions, though this description continues to rest on Tier-4 sourcing without a located Tier-1 or Tier-2 anchor.

The most persistent open question across cycles has been the precise onset date for full AMLA direct supervision of the first cohort of high-risk cross-border obliged entities, with sources diverging between 2027 and 2028. This discrepancy has not resolved across the cycles tracked so far and remains flagged for reconciliation. Separately, the transposition vehicle and specific date for 6AMLD within Cyprus has also not been established across any cycle tracked to date, beyond the AMLA data-collection groundwork already documented.

Beneficial-ownership register effectiveness specifically for Cyprus has seen no update across recent cycles; the MOKAS beneficial-ownership disclosure powers under the AML Law remain the operative baseline, and the absence of new sourcing on register effectiveness should be read as a sourcing gap rather than a substantive assessment of adequacy.

Taken as an integrated picture, Cyprus obliged entities are in the middle of a multi-year transition from a manual, narrative-based national AML compliance approach toward a binding, structured-data risk-methodology standard imposed by AMLA, with the data-collection deadline now behind them and the AMLR direct-applicability date and AMLA direct-supervision onset still ahead. The unresolved 2027-versus-2028 discrepancy is the single most consequential open item for this domain going forward, and the AMLA work programme expected around 2026-Q4 should be the next concrete milestone against which the pace of this transition is measured.

domain_sub_briefs · D2 · Cumulative analysis
Standing baseline position

Cyprus BO-opacity legacy assessed as persistent: non-public UBO/trust registers combined with repeated prosecutorial failure (three first-instance golden-passport cases) on a scheme that injected roughly USD 8bn via citizenship-for-investment.

Periodic updates (2)
12 Oct 2026 · fim-2026-10-11

Beneficial Ownership

The durable structural backdrop against which this cycle's Cyprus beneficial-ownership signal should be read is the EU AML Package, which comprises three distinct instruments: the AML Regulation (AMLR, Regulation (EU) 2024/1624), which is directly applicable across all EU member states including Cyprus without national transposition; the sixth AML Directive (6AMLD), which requires transposition into national law by each member state; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and is progressively shifting the supervisory perimeter from purely national authorities toward a hybrid EU-level regime in which AMLA exercises direct supervision over certain higher-risk obliged entities and indirect supervisory coordination over the rest. This architecture is a structural fact of Cyprus's EU membership, not a single-cycle development, and it frames every national-level beneficial-ownership and corporate-transparency finding that follows.

Within that backdrop, this cycle's concrete Cyprus-specific signal is procedural rather than structural: the Department of the Registrar of Companies and Intellectual Property (DRCIP) opened the 2026 annual Beneficial Ownership Register confirmation window on 1 October 2026, closing 31 December 2026. The requirement applies to all Cyprus companies, European companies (SEs) and partnerships, and critically applies even where no change in beneficial ownership has occurred, meaning the obligation is one of affirmative annual confirmation rather than change-triggered update. The penalty regime attached to this confirmation cycle, under Law L.141(I)/2024, effective February 2025, is automatic rather than discretionary: a EUR 100 penalty is triggered on the first day of default, with a further EUR 50 accruing per additional day of non-compliance, capped at EUR 5,000 per entity. This automaticity removes most regulatory discretion from the enforcement process and means that corporate-structure holders with Cyprus entities in their ownership chains face a predictable, calculable financial exposure for late or omitted filings rather than a case-by-case enforcement judgment.

The significance of this routine confirmation cycle lies less in novelty, since it recurs annually, than in what it signals about the maturity of Cyprus's beneficial-ownership register enforcement architecture. An automatic, escalating, capped penalty structure of this kind is a more administratively robust enforcement mechanism than a discretionary fine regime, and its universal application, regardless of whether ownership has changed, indicates that Cyprus has institutionalised an affirmative-confirmation model rather than relying solely on event-triggered updates. For corporate-transparency due diligence purposes, this matters: a Cyprus entity's compliance history with this annual confirmation cycle becomes an observable, time-stamped data point about its administrative diligence, independent of the substance of its beneficial-ownership disclosures.

Separately, but within the same domain, CySEC Circular C800 of 8 September 2026 notified Administrative Service Providers and Crowdfunding Service Providers, obliged entities whose ownership and control structures are themselves subject to beneficial-ownership and corporate-transparency expectations, of an AMLA public hearing on draft Regulatory Technical Standards under Article 40(2) of Directive (EU) 2024/1640 concerning risk-assessment methodology for non-financial sectors. While this consultation notice sits more squarely in the AML/CTF regime domain, it is relevant here because non-financial-sector obliged entities, including corporate and trust service providers who are themselves central to beneficial-ownership transparency chains, will eventually be bound by a harmonised EU risk-assessment methodology once AMLA's RTS process concludes.

Outlook

The 2026 DRCIP confirmation window closes 31 December 2026, and the practical consequence of this cycle's development, the scale of penalty accrual against non-filers, will only become visible in the subsequent reporting period once the window has closed and enforcement data is available. No AMLA direct-supervision perimeter confirmation was located this cycle regarding whether any Cyprus-domiciled obliged entity is a selected directly-supervised entity under the AMLA Regulation, which remains an open question for Cyprus's position within the hybrid EU-level supervisory architecture. As the AMLA RTS consultation under Article 40(2) progresses, Cyprus's non-financial obliged entities, including those whose corporate structures intersect with the beneficial-ownership register regime, should anticipate eventual alignment with a harmonised EU risk-assessment methodology, though no finalisation date has yet been identified.

25 Aug 2026 · fim-2026-08-05

Beneficial Ownership

Cyprus's most concrete beneficial-ownership and corporate-transparency development this cycle is procedural rather than substantive in the beneficial-ownership-register sense: CySEC Circular C748, as amended by Circular C749, set a 12 January 2026 deadline for obliged entities to submit data as part of the groundwork for the EU AML Regulation's single rulebook. This is an assessed-confidence finding drawn from two independent vendor sources; no Tier 1 or Tier 2 anchor was located this cycle for the underlying circular text, so the precise scope of what obliged entities were required to submit remains a research gap rather than a settled fact. Separately, the EU AML Regulation and the sixth Anti-Money Laundering Directive are moving toward, respectively, direct applicability and per-member-state transposition, a milestone described in the available sourcing as the first time EU anti-money-laundering law takes the form of a directly applicable Regulation rather than a directive alone. This finding rests on two independent Tier 4 sources only, thinner sourcing than the CySEC circular finding, and is flagged accordingly.

The obligation itself is tagged to a cross-sector firm-type lens and a corporate customer-typology, indicating that CySEC's data-collection exercise was not confined to a single supervised-entity category such as investment firms alone, but reached across the broader population of CySEC-supervised obliged entities. This breadth is itself informative: a cross-sector data call ahead of a supranational supervisory transition is consistent with a regulator preparing its full obliged-entity population for a harmonised reporting baseline, rather than targeting a narrow subset for a specific enforcement purpose.

Standing context for reading both findings is the durable architecture of the EU AML Package itself, which comprises three distinct instruments rather than one: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), which is directly applicable across member states without national transposition; the sixth AML Directive, or 6AMLD, which is transposed individually per member state; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority itself. Together these three instruments shift the EU's AML supervisory perimeter from a purely national-authority model toward a hybrid regime in which the Anti-Money Laundering Authority exercises direct supervision over a first cohort of high-risk, cross-border obliged entities while national authorities continue to supervise the broader population. This is a structural, durable backdrop against which this cycle's Cyprus-specific signal should be read, not a single-cycle development in itself: Cyprus's CySEC Circular C748/C749 data-collection exercise is best understood as one jurisdiction's piece of groundwork for a supervisory architecture being built at EU level over multiple years.

That said, the precise timeline for AMLA's direct-supervision function remains genuinely unresolved in the sourcing available this cycle. One source places the AMLR/6AMLD application date in 2027, while another places the onset of AMLA's direct supervision of selected high-risk obliged entities in 2028; this date discrepancy has not been reconciled against a primary EU or CySEC source this cycle and is carried forward as an open item. Both dates share the same underlying direction, an EU AML supervisory perimeter shifting from purely national to hybrid EU-level oversight, but the exact sequencing and the specific cohort of Cyprus obliged entities that will fall under direct AMLA supervision, versus continued CySEC national supervision, is not yet settled in the evidence base.

For corporate-services providers, fund structures, and high-net-worth-linked corporate vehicles domiciled in Cyprus, the practical significance of this cycle's findings is anticipatory rather than immediate: no new beneficial-ownership disclosure obligation, register-access rule, or verification duty was identified as taking effect this cycle specifically for Cyprus. The signal is instead that the underlying EU-level architecture within which any future Cyprus-specific beneficial-ownership rule will sit is now firming up, with the AMLR's single rulebook and the AMLA Regulation both already adopted instruments moving toward application, rather than proposals still subject to negotiation.

Outlook

The immediate research priority for next cycle is resolving the 2027-versus-2028 date discrepancy for AMLA's direct-supervision onset, since this materially affects the compliance-planning timeline for Cyprus obliged entities that may fall within AMLA's initial cohort. A second priority is locating primary CySEC circular text for C748/C749 to establish precisely what data obliged entities were required to submit and to which authority, since the current finding rests on vendor commentary rather than the regulator's own published text. Watch also for AMLA's first published work programme and supervisory methodology, expected around the fourth quarter of 2026, which should begin to clarify both the direct-supervision cohort and the practical shape of the hybrid EU-national supervisory model described above. Firms that anticipate falling within AMLA's initial direct-supervision cohort should treat the 2027/2028 date uncertainty as a planning risk rather than a settled compliance deadline, and should not assume the later date without independent confirmation. Taken as a whole, this cycle's Cyprus-specific AMLA-adjacent signal is thin in primary-source terms but directionally consistent with the durable EU-level architecture described above, and it should be tracked rather than treated as concluded.

D3 Enabler Jurisdictions

no_changeno_changestanding position

Enabler Jurisdictions and Professional Facilitators

Cyprus's professional-services sector remains the documented architecture through which Russian oligarch asset-shielding has been executed, and this cycle's evidence base reinforces rather than revises that assessment. The Cyprus Confidential investigation established that Cypriot accounting, legal, and corporate/trust-service firms — with PwC Cyprus specifically named — administered rapid share transfers and inter-company restructurings, including a $1.4bn Mordashov holding and roughly $100m in Evraz-linked transfers, executed as EU sanctions loomed. The gap between this Tier-2 investigative finding and confirmed Tier-1 enforcement action against the enabling professionals themselves — as distinct from the underlying designated individuals — is itself a signal under FIM's enablement-as-signal methodology: professional facilitation architecture frequently escapes direct sanction even where the assets it shields are eventually designated.

Continue reading

Applying the Enabler Jurisdiction Filter's four-dimension assessment — legal framework, enforcement, capacity versus choice, and systemic significance — Cyprus presents a mixed but coherent profile. On capacity, the National Sanctions Implementation Unit's delayed stand-up reflects a genuine resourcing question. On choice, however, the Cyprus Bar Association's constitutional and role-exclusion objections to the NSIU's design actively delayed the enabling legislation past the EU's 20 May 2024 deadline — a professional-body-driven political constraint distinct from simple incapacity, and one that illustrates how enabler-jurisdiction status can be actively defended by domestic professional interests rather than merely tolerated through under-resourcing.

Cyprus's standing FATF-compliance trajectory corroborates this mixed picture at the institutional level. The March 2026 MONEYVAL enhanced Follow-Up Report keeps Cyprus in enhanced follow-up since its 2019 Mutual Evaluation Report, with partial-compliance ratings persisting on four of forty Recommendations: non-profit organisations, correspondent banking, new technologies and virtual assets under R.15, and law-enforcement investigative powers. These are not new deficiencies; their persistence across multiple follow-up cycles is itself the analytically relevant finding, distinguishing a structural enforcement gap from an episodic lapse.

Outlook

The defining question for Cyprus's enabler-jurisdiction status going forward is whether the professional-body resistance that delayed the NSIU's legislative design will similarly shape or constrain its operational stand-up, expected around Q4 2026. If the Bar Association's influence extends into the unit's investigative practice once operational, the capacity-versus-choice distinction identified this cycle will harden into a durable feature of Cyprus's enabler profile rather than a one-off legislative delay. The next MONEYVAL follow-up report, expected around 2027-Q2, will be a useful marker of whether the persistent partial-compliance ratings — particularly on investigative powers and virtual assets — show any movement.

Judgment: No new enabler-jurisdiction finding this cycle. Uncertain
Cumulative analysis

Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis

The enabler-jurisdiction posture of Cyprus has shown a consistent structural pattern across recent cycles: measurable and continuing improvement in bank- and investment-firm-centric supervision, running in parallel with an unmoved accountability gap for professional facilitators outside CySEC direct authority. CySEC's 2025 enforcement record, totalling approximately EUR 2.3 million in fines and settlements including a full licence suspension of Triangleview Investments for AML-controls failures and a fine against Conotoxia Ltd for AML/CFT Directive non-compliance, demonstrates that the traditional supervisory perimeter continues to see active enforcement.

That activity has not extended, across any cycle tracked so far, into the lawyer, accountant, corporate-service-provider and real-estate-agent sectors that sit structurally outside CySEC direct authority. Professional facilitators in Cyprus remain largely unaccountable for having helped facilitate Russia-linked sanctions evasion and money laundering, a finding that traces back to ICIJ Cyprus Confidential investigative reporting and has been corroborated rather than superseded by subsequent sourcing. The 2024 UK-Cyprus National Sanctions Implementation Unit cooperation memorandum was intended in part to address this gap, but no cycle to date has produced sourcing establishing a measurable enforcement outcome against professional facilitators attributable to that cooperation channel.

The persistence of this gap across cycles, even as the sanctions-enforcement architecture of Cyprus has visibly strengthened through a criminalisation framework and an operational National Sanctions Implementation Unit, is the central analytical finding for this domain: institutional strengthening in one enforcement channel (banking and sanctions-specific criminal enforcement) has not generalised to the professional-services enforcement channel, indicating the gap likely reflects an absence of equivalent supervisory architecture reaching that sector rather than a general capacity constraint affecting Cyprus enforcement institutions as a whole.

No FATF mutual-evaluation or grey-list status change for Cyprus has been identified across recent cycles, meaning this structural gap continues to be tracked, if at all, through investigative journalism and cross-monitor flagging to WDM rather than through the standard multilateral evaluation architecture. Going forward, the key test for this domain is whether any enforcement action, investigation, or supervisory measure specifically targeting lawyers, accountants, or corporate-service providers is sourced in a future cycle, which would represent the first material movement in a domain that has otherwise remained structurally static.

domain_sub_briefs · D3 · Cumulative analysis
Standing baseline position

Cyprus assessed as an enabler jurisdiction combining capacity deficit (partial FATF-compliance ratings, delayed NSIU) and professional-body-driven political constraint (Bar Association resistance); PwC Cyprus/CSP network remains the documented asset-shielding architecture.

Periodic updates (1)
6 Aug 2026 · fim-2026-08-05

Enabler Jurisdictions and Professional Facilitators

The 2025 enforcement record of CySEC demonstrates continued activity within its traditional supervisory perimeter without extending into the professional-enabler sector that has been repeatedly identified as the structural gap in the financial-integrity posture of Cyprus. Approximately EUR 2.3 million in fines and settlements were imposed during 2025, at assessed confidence, including a full licence suspension of Triangleview Investments for AML-controls failures and a EUR 3,650 fine against Conotoxia Ltd for non-compliance with the AML/CFT Directive 157/2019. These are meaningful supervisory actions, but they fall within the bank- and investment-firm-centric enforcement model that has characterised CySEC oversight for some time, rather than extending into the lawyer, accountant, corporate-service-provider and real-estate-agent sectors that sit outside direct CySEC authority.

That gap is the persistent structural finding for this domain. Professional facilitators in Cyprus, including lawyers, accountants and corporate-service providers, remain largely unaccountable for having helped facilitate Russia-linked sanctions evasion and money laundering, notwithstanding the bank-sector reform demonstrated by the enforcement sweep above and notwithstanding a 2024 UK-Cyprus National Sanctions Implementation Unit cooperation memorandum intended in part to address exactly this gap. This finding, sourced to a single Tier-2 investigative account, corroborates earlier ICIJ Cyprus Confidential reporting rather than introducing a new pattern, and its persistence across multiple sourcing cycles is itself the analytically significant signal: this is a structural feature of the enabler-jurisdiction posture of Cyprus rather than an episodic enforcement lag.

Read against F3 enabler-jurisdiction methodology, which requires assessing legal framework, enforcement capacity, and the distinction between structural incapacity and deliberate policy choice, the persistence of this gap after both a criminalised sanctions-breach regime and a dedicated National Sanctions Implementation Unit have been stood up suggests the gap is not primarily a capacity constraint on the banking-supervision side, since that side has demonstrably improved, but rather reflects the absence of an equivalent supervisory or enforcement architecture reaching the professional-services sector specifically.

This structural gap is also the basis for a cross-monitor flag to WDM this cycle, since persistent professional-enabler impunity functions as an institutional-integrity theme relevant to broader tracking of structural capture dynamics beyond the financial-integrity domain narrowly defined. The absence of a corresponding Cyprus-specific FATF grey-list or mutual-evaluation change this cycle, confirmed at low confidence, means that this structural gap is not currently being registered through the FATF standing-tracker mechanism either, reinforcing the case that professional-enabler accountability is tracked, if at all, through investigative journalism and cross-monitor flagging rather than through the standard multilateral evaluation architecture that captures banking-sector deficiencies more readily.

The three-pillar balance requirement under the FIM analytical register is worth noting explicitly here: this domain finding sits entirely within the AML pillar, and no CTF- or CPF-specific professional-enabler finding was sourced for Cyprus this cycle, a gap that should be read as an absence of sourcing rather than as evidence that professional facilitators play no role in sanctions-evasion or proliferation-finance schemes touching the jurisdiction.

Outlook

Continued absence of enforcement action against professional facilitators, even as bank-sector and sanctions-specific enforcement architecture visibly strengthens, is itself an analytically significant non-enforcement signal under the enablement-as-signal principle. The next cycle should specifically test whether the 2024 UK-Cyprus cooperation memorandum has produced any measurable enforcement outcome against lawyers, accountants, or corporate-service providers, since its stated purpose was to address exactly the gap this cycle finding continues to document.

D4 Conflict Finance

no_changeno_changestanding position

Conflict Finance and Extractive-Industry Integrity

Cyprus's conflict-finance exposure this cycle is concentrated in a single, well-evidenced channel: its shipping sector's role in sustaining Russian oil-export revenue through the shadow-fleet layering architecture already documented under D1. The distinguishing analytical contribution to the conflict-finance domain specifically is the identification of a domestic political-economy incentive that moderates Cyprus's enforcement appetite toward this channel. Cyprus's government has historically linked its support for stricter shadow-fleet sanctions to compensation for lost shipping-industry revenue, a sector that represents approximately 8% of Cypriot GDP. This is a state-capture-adjacent dynamic distinct from a simple capacity constraint: it describes an economic dependency that structurally incentivises enforcement moderation rather than a resourcing gap that prevents enforcement altogether.

Continue reading

This dynamic is corroborated by a specific behavioural finding: Cypriot law firms continued servicing sanctioned Russian oligarchs for more than a year after the initial 2022 sanctions wave, evidence that the economic-dependency incentive translated into observable continuity of service to sanctioned clients rather than remaining a purely structural or theoretical concern. Read against the F1 state-capture filter and F4 conflict-finance filter jointly, this represents a case where enforcement moderation is plausibly driven by an identifiable domestic economic interest rather than by institutional incapacity alone — a distinction with direct relevance to how the severity of Cyprus's conflict-finance exposure should be assessed relative to jurisdictions where the same shadow-fleet architecture operates without an equivalent domestic economic stake.

Outlook

The key forward question for this domain is whether the EU's expanding shadow-fleet designation regime — which reached nearly 600 vessel listings by December 2025 — will progressively erode the economic rationale for Cyprus's historical enforcement moderation, or whether the shipping sector's GDP weight continues to shape enforcement intensity independently of the external designation tempo. No compensation mechanism or structural resolution of this tension has been evidenced in the research record this cycle; it remains an open and unresolved dynamic.

Judgment: No conflict-finance finding specific to Cyprus this cycle. Uncertain
Cumulative analysis

Conflict Finance and Extractive-Industry Integrity — Cumulative Analysis

Across the tracked period, Cyprus's conflict-finance exposure has been anchored in a single well-evidenced channel: the shipping sector's role in sustaining Russian oil-export revenue through shadow-fleet corporate layering across Cyprus, the UAE and Liberia, an architecture documented cumulatively under Cyprus's D1 sanctions profile. The distinct contribution to this domain, however, is not the mechanics of the layering itself but the identification of a domestic political-economy incentive that has consistently shaped Cyprus's enforcement posture toward it. Cyprus's government has historically linked its support for stricter shadow-fleet sanctions to compensation for lost shipping-industry revenue, a sector representing approximately 8% of Cypriot GDP — a state-capture-adjacent dynamic, read jointly under the F1 and F4 filters, that is structurally distinct from a simple capacity constraint.

This dynamic has been corroborated across the tracked period by a specific behavioural finding: Cypriot law firms continued servicing sanctioned Russian oligarchs for more than a year after the initial 2022 sanctions wave. This is significant cumulatively because it demonstrates that the economic-dependency incentive has translated into sustained, observable continuity of professional service to sanctioned clients, rather than remaining a purely structural or theoretical concern confined to a single episode.

This cumulative domain remains comparatively thin in evidentiary terms relative to Cyprus's D1 and D3 profiles — a single Tier-2 sourced finding underpins the core assessment, with no additional conflict-finance-specific development surfaced this cycle beyond the continuation of the shadow-fleet architecture already tracked elsewhere. This is noted honestly rather than padded with adjacent material.

Outlook

The key forward question remains whether the EU's expanding shadow-fleet designation regime, which reached nearly 600 vessel listings by December 2025, will progressively erode the economic rationale underlying Cyprus's historical enforcement moderation, or whether the shipping sector's GDP weight continues to shape enforcement intensity independently of the external designation tempo. No compensation mechanism or structural resolution has been evidenced across the tracked period; this remains an open and unresolved dynamic warranting continued monitoring rather than a settled conclusion.

domain_sub_briefs · D4 · Cumulative analysis
Periodic updates (1)
6 Aug 2026 · fim-2026-08-05

Conflict Finance and Extractive-Industry Integrity

Coverage of conflict finance specific to Cyprus was thin this cycle, and the domain finding here is derivative rather than independently sourced: it rests on a cross-reference from the sanctions-architecture finding rather than a dedicated Cyprus-specific conflict-finance assessment. The commercial shipping registry of Cyprus is structurally significant as a node for Russian oil and LNG revenue and for dark-fleet tanker maintenance, a reading drawn from the softened maritime and tanker restrictions that Cyprus, alongside Greece and Malta, secured within the EU 20th Russia-sanctions package adopted 23 April 2026. At low confidence, this finding flags the shipping registry as a channel worth continued attention rather than establishing a discrete new conflict-finance scheme this cycle.

No independent Cyprus-specific assessment of extractive-industry integrity, war-economy financing volumes, or dark-fleet vessel counts attributable specifically to Cyprus-flagged or Cyprus-managed vessels was sourced this cycle. This is an honest gap rather than an assessed null finding: the absence of sourcing means the domain cannot currently support a standing baseline judgment beyond the cross-reference already noted, and thin coverage for Cyprus specifically has been explicitly flagged this cycle.

Outlook

The next cycle should prioritise sourcing a dedicated Cyprus-specific conflict-finance assessment, particularly given the direct cross-reference to shadow-fleet and Russian energy-revenue channels already established through the sanctions-architecture finding above. Until that sourcing gap is closed, this domain should be read as a watch item drawing entirely on adjacent evidence rather than as an independently substantiated finding.

D5 Crypto / Digital Assets / Financial Innovation

no_changeno_change

Crypto / Digital Assets / Financial Innovation

Cyprus moved to strengthen its domestic crypto-enforcement architecture this cycle. Following Cabinet approval on 10 September 2026, the Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026. The bill, if enacted, would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal domestic powers under the EU's Markets in Crypto-Assets Regulation framework: the authority to investigate, inspect, issue compliance orders, and suspend or withdraw MiCA authorisation from a crypto-asset service provider. Corporate fines would run to at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse, with individual penalties layered on top. This formalises an enforcement architecture for a sector where Cyprus carries a comparatively high concentration of crypto-asset service provider registrations relative to its size, meaning the practical reach of the bill, once enacted, would extend across a meaningfully sized population of regulated firms.

Continue reading

No primary parliamentary bill text has been retrieved this cycle; the development is sourced from press coverage rather than the bill text itself, which caps confidence in the precise scope and final fine thresholds at the probable tier pending the official text and any committee-stage amendments. This is a material qualification: the headline fine figures and powers described should be read as the bill as tabled, not as settled law, and the final enacted version may differ in scope or threshold.

Alongside the legislative development, the Cyprus Securities and Exchange Commission continued its supervisory activity in the sector, warning investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. This supervisory activity, which precedes and is independent of the pending enforcement bill, indicates that Cyprus's crypto-market oversight is not waiting on the new legislation to begin functioning; existing powers are already being exercised against unauthorised activity, and the new bill would primarily extend and formalise the toolkit available for firms that are already authorised but found to be non-compliant, rather than create oversight capacity where none currently exists.

Outlook

The Markets in Crypto-Assets Bill of 2026 remains at the parliamentary stage, with enactment not yet confirmed for a specific date; the matter should be tracked as a bill before the House of Representatives rather than as an enacted instrument. Confidence in the bill's final scope, including the precise fine thresholds and the scope of covered infringements, will firm up once the official parliamentary text and any committee amendments become available. In the interim, Cyprus's existing crypto-market supervisory activity, including continued public warnings against unauthorised websites, is expected to continue independently of the bill's progress through Parliament.

Judgment: MiCA national transitional period for CASPs ended 1 July 2026 with CySEC confirming full enforcement; this is standing context, not a new development this cycle. Probable
Cumulative analysis

Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis

The crypto-asset regulatory posture of Cyprus has moved, across the cycles tracked, from a national AML-only registration model toward full alignment with the EU-wide MiCA authorisation regime, culminating this cycle in the formal expiry of the last remaining national grandfathering pathway. Prior to this cycle, Cyprus-domiciled crypto-asset service providers could continue operating under a comparatively lighter national standard grounded in AML legislation rather than the harmonised MiCA framework, with an application deadline of 27 February 2026 set as the trigger point for the transition.

This cycle confirms that transition reached its structural endpoint: the national grandfathering window under Article 143(3) of the MiCA Regulation formally expired 1 July 2026, at High confidence, anchored by a Tier-1 CySEC press release corroborated by three independent secondary sources. Providers that did not secure full MiCA authorisation, or at minimum submit a documented wind-down plan, are now required to cease operating the relevant services under the legacy regime. This retires the last national AML-only crypto-registration pathway operating anywhere inside the EU, a structural milestone rather than an incremental regulatory update.

CySEC has flagged heightened AML risk specifically during this restructuring period, a risk that should be read as intrinsic to any regulatory-transition window of this kind, in which firms are simultaneously completing authorisation, winding down, or in some cases continuing to operate in the gap between expired national status and confirmed EU-wide authorisation. This dynamic mirrors the parallel AMLA and AMLR transition tracked in the beneficial-ownership domain, both reflecting the same broader EU pattern of consolidating fragmented national regimes into harmonised, directly applicable EU-wide standards.

The crypto and digital-asset integrity standing tracker for Cyprus recorded a material-change trajectory specifically on the basis of this grandfathering expiry, in contrast to the no-change trajectories recorded over the same period for the FATF grey-list and beneficial-ownership-register standing trackers, underscoring that the most significant Cyprus development across the recent cycle window has been concentrated in the digital-asset domain specifically. Going forward, the key open question is how many Cyprus-domiciled providers actually completed full MiCA authorisation versus wound down or continued operating outside the new requirement, and whether any enforcement action follows the 1 July 2026 cut-off against providers that did neither.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

Cyprus submitted the Markets in Crypto-Assets Bill of 2026 to the House of Representatives on 8 October 2026, granting CBC/CySEC investigation, inspection, suspension/withdrawal and fining powers (€5m-€15m+) for MiCA breaches.

Cyprus crypto-supervision gap assessed as partially addressed: a 66-point national VASP action plan has been adopted, but the EEA-VASP remote-passporting exemption and R.15 partial-compliance rating remain unresolved.

Periodic updates (3)
25 Oct 2026 · fim-2026-10-25

Crypto / Digital Assets / Financial Innovation

Cyprus moved to strengthen its domestic crypto-enforcement architecture. Following Cabinet approval on 10 September 2026, the Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026. The bill, if enacted, would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal domestic powers under the EU's Markets in Crypto-Assets Regulation framework: the authority to investigate, inspect, issue compliance orders, and suspend or withdraw MiCA authorisation from a crypto-asset service provider. Corporate fines would run to at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse, with individual penalties layered on top. This formalises an enforcement architecture for a sector where Cyprus carries a comparatively high concentration of crypto-asset service provider registrations relative to its size, meaning the practical reach of the bill, once enacted, would extend across a meaningfully sized population of regulated firms.

No primary parliamentary bill text has been retrieved; the development is sourced from press coverage rather than the bill text itself, which caps confidence in the precise scope and final fine thresholds at the probable tier pending the official text and any committee-stage amendments. This is a material qualification: the headline fine figures and powers described should be read as the bill as tabled, not as settled law, and the final enacted version may differ in scope or threshold.

Alongside the legislative development, the Cyprus Securities and Exchange Commission continued its supervisory activity in the sector, warning investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. This supervisory activity, which precedes and is independent of the pending enforcement bill, indicates that Cyprus's crypto-market oversight is not waiting on the new legislation to begin functioning; existing powers are already being exercised against unauthorised activity, and the new bill would primarily extend and formalise the toolkit available for firms that are already authorised but found to be non-compliant, rather than create oversight capacity where none currently exists.

Outlook

The Markets in Crypto-Assets Bill of 2026 remains at the parliamentary stage, with enactment not yet confirmed for a specific date; the matter should be tracked as a bill before the House of Representatives rather than as an enacted instrument. Confidence in the bill's final scope, including the precise fine thresholds and the scope of covered infringements, will firm up once the official parliamentary text and any committee amendments become available. In the interim, Cyprus's existing crypto-market supervisory activity, including continued public warnings against unauthorised websites, is expected to continue independently of the bill's progress through Parliament.

28 Sep 2026 · fim-2026-09-28

Crypto, Digital Assets, and Financial Innovation

Cyprus's crypto-asset sector reached a structural cutover point on 1 July 2026, when the transitional period permitting crypto-asset service providers (CASPs) to operate under the pre-MiCA national registration regime closed entirely. Firms seeking to carry over into full MiCA authorisation were required to file a complete application by 27 February 2026; those that did not were required to submit wind-down plans. From 1 July 2026 onward, MiCA authorisation via CySEC is the sole lawful basis for providing crypto-asset services from Cyprus, and any unauthorised-provider activity after that date is unlawful on an EU-wide basis, not merely a domestic one. This closes what had previously been flagged as a structural gap: a national CASP regime running in parallel with, rather than fully subsumed into, the harmonised EU framework.

CySEC accompanied the cutover with a circular, dated 9 July 2026, directing regulated crypto and investment firms to strengthen their anti-money-laundering controls as the MiCA transition concluded, citing new AMLA guidance. This claim currently rests on a single T3 legal-commentary source describing the circular; the circular's own text has not yet been independently retrieved or corroborated, and this gap is logged rather than papered over. If corroborated, the circular would indicate that CySEC is treating the end of the transitional period not merely as an administrative registration event but as an occasion to reinforce AML expectations across its regulated crypto population — consistent with the three-pillar balance FIM applies, since a licensing-transition event of this scale carries AML/CTF implications that deserve equal weight to the authorisation mechanics themselves.

The completion of this transition is a genuine structural improvement in Cyprus's crypto-sector oversight: it removes ambiguity about which regime governs CASP activity and brings Cyprus-based providers fully within the EU's harmonised MiCA perimeter, with the attendant AML obligations that accompany MiCA authorisation.

Outlook

The near-term watch item is independent corroboration of the CySEC circular text itself, given the current single-source basis for that claim. Beyond that, expect the population of Cyprus-authorised CASPs to stabilise now that the transitional pathway has closed; any residual national-regime holdouts operating without MiCA authorisation after 1 July 2026 would represent a live enforcement exposure worth monitoring in a future cycle.

25 Aug 2026 · fim-2026-08-05

Crypto / Digital Assets / Financial Innovation

The defining Cyprus finding this cycle is the formal close, on 1 July 2026, of the Markets in Crypto-Assets Regulation's national grandfathering window for crypto-asset service providers, following a 27 February 2026 application deadline. This is a High-confidence finding, anchored by a Tier 1 CySEC press release and corroborated across three independent secondary sources on both the application-deadline and expiry dates, making it the best-sourced single finding for Cyprus this cycle across any domain. Framed through a digital-asset-architecture lens rather than an incident lens, the significance of this finding is structural: it retires Cyprus's prior AML-only national crypto-registration regime entirely, closing what had functioned as a lighter-touch national pathway into crypto-asset activity, and replaces it with full MiCA authorisation as the only route to lawful operation. Providers that did not secure authorisation by the relevant deadline are required to wind down their Cyprus operations rather than continue under any residual national registration.

This is best understood as a jurisdiction-wide regime transition rather than a single enforcement event, and it should be weighted accordingly against episodic findings elsewhere in this cycle's Cyprus coverage. Where a single enforcement action against a named crypto firm would be an incident, a formal close of an entire national registration category, applicable uniformly across the whole population of Cyprus-domiciled crypto-asset service providers, is architecture: it changes the rules that determine market access for an entire category of financial-innovation firm, not the compliance posture of one firm within an unchanged rule set. The compliance-cost implications flow directly from this architectural framing: firms previously operating under the lighter AML-only national registration must now satisfy the full MiCA authorisation bar, a materially higher compliance threshold spanning governance, prudential, custody, and market-conduct requirements that the prior national regime did not impose in the same form.

The obligation itself traces to Regulation (EU) 2023/1114, Article 143(3), the MiCA provision establishing the national transitional-period mechanism that member states could apply to crypto-asset service providers already operating under national law before MiCA's own authorisation regime took full effect. Cyprus's use of the full transitional window, running through the 27 February 2026 application deadline to the 1 July 2026 hard expiry, places it within the standard MiCA transition timeline rather than an accelerated or Cyprus-specific variant; the significance lies not in Cyprus doing anything unusual, but in the transition milestone itself now being crossed for a jurisdiction with an economically meaningful crypto-services sector.

The transition also has second-order relevance for how Cyprus's crypto sector is perceived from a financial-integrity standpoint specifically: a jurisdiction that has fully retired its national AML-only crypto pathway in favour of the harmonised EU MiCA standard removes one channel that a jurisdiction shopping for lighter-touch crypto registration might previously have used Cyprus for. Firms with a customer-typology profile linked to virtual-asset-service-provider counterparties should treat the transition as closing a specific Cyprus-based regulatory-arbitrage channel, rather than as a routine licensing update. For firms weighing Cyprus as a crypto-asset-service-provider base going forward, the practical entry calculus has now fully converged with the MiCA-wide standard: there is no longer a Cyprus-specific lighter registration tier to weigh against full MiCA authorisation, since that tier has been formally retired.

Outlook

The practical question for next cycle is how many previously AML-registered Cyprus crypto-asset firms have successfully converted to full MiCA authorisation versus wound down their Cyprus operations; this cycle's research established the regulatory deadline and its legal basis but could not yet establish the population-level compliance outcome. Watch also for any enforcement action against providers that continued operating in Cyprus without securing MiCA authorisation past the 1 July 2026 deadline, which would be the first test of how the new architecture is actually enforced in practice, as distinct from simply being formally in place. A further open question is whether any Cyprus-specific transitional guidance was issued by CySEC to firms mid-conversion, which this cycle's sourcing did not surface; locating any such guidance would help distinguish firms that wound down voluntarily from those still pursuing authorisation past the formal deadline. Both threads should be prioritised directly with CySEC primary-source material next cycle, given the current finding's strength rests substantially on the Tier 1 press release rather than granular population-level detail.

D6 Compliance Technology & Active Defence

no_changeno_changestanding position

Compliance Technology and Active Defence

Cyprus's compliance-technology signal this cycle is modest in evidentiary weight but directionally consistent with the broader EU supervisory build-out. CySEC's reported use of blockchain-analytics tooling for CASP authorisation and supervision, alongside the expansion of MiFID-authorised brokers into crypto services via MiCA's Article 60 notification route, points toward incremental institutional capacity-building at the national supervisory level. This finding, however, rests on a single Tier-3 vendor-sourced citation, and the research record itself flags the absence of a corroborating Tier-1 or Tier-2 source as a gap warranting a stronger evidentiary basis before being treated as confirmed regulatory practice.

Continue reading

The more structurally consequential development in this domain is not Cyprus-specific but EU-level: AMLA's ongoing supervisory-methodology development and EuReCA database build-out ahead of its 2027-2028 direct-supervision mandate. AMLA will select approximately 40 high-risk cross-border obliged entities for direct supervision beginning 2027, with supervision starting in 2028, and Cyprus's internationally exposed banking and corporate-service-provider sector is assessed as a plausible candidate jurisdiction for this selection, though no selection has yet occurred. This represents a genuine shift in the compliance-technology and active-defence landscape, moving supervisory methodology development from a purely national exercise toward a centralised EU-level function that will eventually set standards Cyprus's own supervisors must align with.

Outlook

The key forward marker for this domain is whether CySEC's incremental RegTech signals receive stronger corroboration in subsequent cycles, and whether AMLA's supervisory-methodology publications, expected around Q4 2026, begin to shape national-level compliance-technology requirements ahead of the 2027 entity-selection process. Given the current evidentiary thinness of the Cyprus-specific signal, this domain warrants continued monitoring rather than a confident structural assessment at this stage.

Judgment: No RegTech/compliance-technology development specific to Cyprus found this cycle. Uncertain
Cumulative analysis

Compliance Technology and Active Defence — Cumulative Analysis

Cyprus's compliance-technology posture across the tracked period has remained a thin but directionally consistent signal. CySEC's reported use of blockchain-analytics tooling for CASP authorisation and supervision, alongside the expansion of MiFID-authorised brokers into crypto services via MiCA's Article 60 notification route, has been the primary Cyprus-specific finding throughout, and it continues to rest on a single Tier-3 vendor-sourced citation without Tier-1 or Tier-2 corroboration across the tracked period. This evidentiary limitation is carried forward honestly rather than treated as resolved.

The structurally more consequential development in this domain remains EU-level rather than Cyprus-specific: AMLA's ongoing supervisory-methodology development and EuReCA database build-out ahead of its 2027-2028 direct-supervision mandate. AMLA will select approximately 40 high-risk cross-border obliged entities for direct supervision beginning 2027, with supervision starting in 2028, shifting supervisory-methodology development from a purely national exercise toward a centralised EU-level function. Cyprus's internationally exposed banking and corporate-service-provider sector remains a plausible candidate jurisdiction for this selection, though no selection has occurred across the tracked period.

Outlook

The key forward marker for this domain remains whether CySEC's incremental RegTech signals receive stronger corroboration in subsequent cycles, and whether AMLA's supervisory-methodology publications, expected around Q4 2026, begin to shape national-level compliance-technology requirements ahead of the 2027 entity-selection process. Given the persistent evidentiary thinness of the Cyprus-specific signal across the tracked period, this domain continues to warrant monitoring rather than a confident structural assessment.

domain_sub_briefs · D6 · Cumulative analysis
Periodic updates (1)
6 Aug 2026 · fim-2026-08-05

Compliance Technology and Active Defence

Coverage of compliance technology specific to Cyprus was thin this cycle, and the finding available rests on a single low-confidence source. CySEC has stated that its 2026 priorities include investment in AI, data-analytics and cybersecurity capability, alongside a multi-year project to automate licensing procedures and examination management. Reporting also suggests, though without independent corroboration this cycle, that CASP applicants demonstrating AI-driven AML compliance frameworks are prioritised in the authorisation process.

No discrete enforcement-gap finding regarding the adequacy of AI or machine-learning transaction-monitoring tools specifically for Cyprus-domiciled obliged entities was independently sourced this cycle. This is an honest sourcing gap rather than a substantive null finding, and it means this domain cannot currently support a standing baseline judgment beyond the stated CySEC priorities already noted. This domain also connects to the multi-year licensing and examination automation project referenced above, which if implemented as described would represent a structural investment in supervisory capacity distinct from the enforcement actions catalogued in the enabler-jurisdiction domain, though this connection has been flagged as thin and unconfirmed rather than established this cycle.

Outlook

The next cycle should prioritise sourcing a discrete, independently corroborated assessment of compliance-technology adoption or enforcement-gap findings specific to Cyprus, since the current low-confidence, single-source finding does not yet establish whether stated CySEC technology priorities have translated into measurable supervisory capability improvements.

D7 AML/CTF Regime

no_changeno_change

Cyprus is assessed by MONEYVAL rather than directly by FATF; its most recent enhanced follow-up report upgrades Recommendation 13 (correspondent banking) to largely compliant, while Recommendation 8 (non-profit organisations) remains partially compliant.

Judgment: MONEYVAL 5th-round follow-up process for Cyprus formally closed (CM(2026)144, 23 Sept 2026); Cyprus rated Compliant/Largely Compliant on 38 of 40 FATF Recommendations, with R.8 and R.31 remaining Partially Compliant. Supervisory architecture (CBC/CySEC/ICPAC/Bar Association, MOKAS as FIU) unchanged. Probable

D8 Commercial Activity

no_changeno_change
Judgment: No commercial activity among financial-integrity infrastructure firms specific to Cyprus found this cycle. Uncertain
Regulatory horizon
Proposed2027-Q1 · ±half_year

Markets in Crypto-Assets Bill of 2026 (domestic MiCA enforcement framework)

Once enacted, CBC and CySEC gain formal domestic powers to investigate, inspect, restrict, suspend or withdraw MiCA authorisations and impose fines of 5 million to 15 million euro or more (turnover-linked) for serious breaches.
Source
In Force Pending2027-Q1 · ±year

MONEYVAL 5th-round follow-up report on Cyprus

Expected next follow-up assessment reviewing Cyprus's technical-compliance re-ratings.
Source
Adopted2028-Q1 · ±year

AMLA direct supervision of selected obliged entities

A small number of high-risk cross-border financial groups will move from national supervision (CBC/CySEC) to direct AMLA supervision; all other Cyprus obliged entities remain under national supervisors applying the common AMLR rulebook.
AMLA / European Commission Source
3 dated · 4 pending date · baseline financial-integrity-2026-07-05
Role action cards
MLRO

EU adopted its largest-ever Russia sanctions package, expanding the screening population to include corporate officers of already-sanctioned firms.

The 22nd package is directly applicable and binds Cyprus immediately; screening systems need the expanded designee list incorporated without a domestic transposition step.

2 evidence refs
Compliance

Cyprus tabled a domestic MiCA enforcement bill granting CBC/CySEC investigatory and penalty powers of up to 15 million euro.

The bill is still before Parliament and sourced from press coverage only; policy and control frameworks for crypto-asset exposure should track the bill rather than treat it as settled law.

2 evidence refs
Legal

EU and UK Russia sanctions packages diverged again, with the UK issuing a separate 38-designation package on 8 October 2026.

Firms with cross-border EU-UK exposure face two independently maintained designee lists requiring separate reconciliation; the divergence pattern is structural rather than one-off.

2 evidence refs
Board

Cyprus's domestic crypto-enforcement architecture is being formalised while the jurisdiction's AML/CTF baseline remains favourably assessed.

The combination of a strengthening crypto-enforcement bill and a stable, favourable MONEYVAL assessment signals continued regulatory tightening without an underlying compliance deficiency being corrected.

2 evidence refs
CTO

The pending Markets in Crypto-Assets Bill of 2026 would give CySEC and CBC expanded investigatory powers over crypto-asset platforms operating in Cyprus.

Technical and platform teams supporting crypto-asset operations in Cyprus should anticipate possible on-site and desk-based regulatory review powers once the bill is enacted, alongside CySEC's continuing public warnings against unauthorised platforms.

2 evidence refs
Risk

The EU's 22nd sanctions package deepens designee coverage into the executive layer of sanctioned entities' supply chains.

Risk exposure concentration analysis should account for the newly listed corporate officers, not just headline sanctioned entities, when assessing counterparty risk in Russia-linked corporate structures.

1 evidence refs
Operations

CySEC issued fresh public warnings against six unauthorised crypto/investment websites.

Operational screening and customer-facing warning processes may need to reflect regulator-published unauthorised-entity lists as they are updated.

1 evidence refs
Audit

No primary parliamentary text for the Markets in Crypto-Assets Bill of 2026 has yet been retrieved, capping confidence in its documented scope.

Audit trails referencing the bill's powers and fine thresholds should flag this as sourced from press coverage pending the official legislative text.

1 evidence refs
Scenario sketches

Illustrative AMLA direct-supervision transition for cross-border obliged entities

Illustrative orientation only: as the AMLA Regulation (Reg (EU) 2024/1620) moves the EU from purely national AML supervision toward a hybrid model, a cross-border obliged entity group with a Cyprus-based subsidiary could, in a possible future scenario, find itself under AMLA direct supervision at group level while remaining under national supervision for its Cyprus-only book, alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition. This is an illustrative structural mechanism, not an observed fact about any specific entity.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo material change found this cycle; NSIU reports ~EUR 1.9bn in frozen Russian-held assets since 2022 (T3 sourced).
T2 · EU AML Package / AMLAwatchAMLR applies from 10 July 2027; AMLA operational since 1 July 2025 and absorbed EBA AML mandates 1 January 2026; CySEC Circulars C748/C749 guide CY entities through provisional-eligibility data collection ahead of 2028 direct supervision.
T3 · FATF Grey Listno_changeCyprus is not on the FATF grey list; MONEYVAL 5th-round follow-up formally closed in 2026; 6th-round onsite scheduled October 2028.
T4 · Beneficial-Ownership Register Statusno_changeNo CY-specific beneficial-ownership register development located this cycle.
T5 · Crypto & Digital-Asset Integrityno_changeMiCA national transitional period for CY CASPs ended 1 July 2026; CySEC confirmed full MiCA enforcement from that date. No new AML-specific crypto development this cycle.
T6 · Sanctions Regime Divergenceno_changeNo new EU/US/UK divergence specific to Cyprus found this cycle; NSIU's EU-aligned unified architecture is the standing structural point.
Registers

Enforcement actions

  • 24 Nov 2025
  • 18 Dec 2025
  • 23 Mar 2026
  • 17 Feb 2026
  • 10 Jul 2025
  • 17 Mar 2025
  • 21 Jul 2025
  • 21 Jan 2026
  • OFAC designated Cypriot businessman Demetrios Serghides and Cyprus-registered Hightrail Ltd, alongside linked individuals (Attikouris, Giannakou/Yiannakou, Georgiou, Vakanas) and entities (Windfel Properties, Savoler Development, Miramonte Investments, Almenor Holdings), under Russia-related Executive Order 14024, citing links to sanctioned oligarch Alisher Usmanov. 24 Nov 2025
  • OFAC designated two Nicosia-registered companies, Veles International Limited and Hadlerco Limited, under Russia-related EO14024 for links to Dmitry Bugayenko, as part of a broader package including Iran-related shipping designations. 18 Dec 2025
  • MONEYVAL published a further follow-up report (3rd enhanced FUR successor) on Cyprus's progress addressing technical-compliance deficiencies since its 2020 mutual evaluation, continuing Cyprus's enhanced follow-up status. 23 Mar 2026
  • Criminal prosecution of two senior former politicians for alleged improper intervention in golden-passport citizenship applications, stemming from a 2020 Al Jazeera undercover investigation, concluded with acquittal after key prosecution witnesses failed to appear. 17 Feb 2026
  • Parliament passed a three-pronged legislative package establishing a National Sanctions Implementation Unit with fining powers, criminalising sanctions evasion, and replacing the 2016 sanctions law, after missing the EU's May 2024 transposition deadline amid Bar Association objections. 10 Jul 2025

Sanctions changes

  • 23 Oct 2025
  • 3 Dec 2025
  • 4 Dec 2025
  • 18 Dec 2025
  • 23 Apr 2026
  • 23 Jul 2026
  • 12 Oct 2026
  • The EU's 19th sanctions package added 117 further shadow-fleet vessel listings (total 557), imposed the first-ever EU sanctions on crypto-asset infrastructure supporting Russia, banned LNG imports from 2027, and eliminated remaining Rosneft/Gazprom Neft oil-import exemptions. 23 Oct 2025
  • Commission Delegated Regulation (EU) 2026/46 added Russia to the EU list of high-risk third countries with AML/CFT strategic deficiencies, amending Delegated Regulation (EU) 2016/1675. 3 Dec 2025
  • Commission Delegated Regulation (EU) 2026/83 added Bolivia and the British Virgin Islands to the EU high-risk third-country list while removing Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania, reflecting FATF grey-list alignment. 4 Dec 2025
  • The EU Council designated nine shadow-fleet enablers (shipping companies based in the UAE, Vietnam and Russia) on 15 December 2025 and a further 41 shadow-fleet vessels on 18 December 2025, bringing total vessel designations to nearly 600. 18 Dec 2025

Regulatory horizon (register)

  • AMLA direct supervision of selected obliged entities
  • MiCA CASP transitional-period expiry / national CASP regime wind-down
  • AMLA draft RTS — risk-assessment methodology for non-financial sectors
  • Annual UBO Register confirmation cycle 2026 closes
  • Markets in Crypto-Assets Bill of 2026 (domestic MiCA enforcement framework)
  • MONEYVAL 5th-round follow-up report on Cyprus
  • AMLA direct supervision of selected obliged entities
  • AML Regulation (AMLR) becomes directly applicable across the EU
  • AMLA selects ~40 directly-supervised high-risk cross-border entities
  • National Sanctions Implementation Unit reaches full operational capacity
  • Next MONEYVAL follow-up report on Cyprus AML/CFT progress

Active schemes

  • [CRITICAL] Cypriot professional-enabler network shielding Russian oligarch assets
  • [HIGH] Shadow-fleet oil tanker layering via Cyprus corporate structures
  • EEA VASP-passporting gap in Cyprus crypto supervision
  • [HIGH] Legacy golden-passport beneficial-ownership opacity
Sources
  1. Annex C: Package of NRA Tools (World Bank, International Monetary Fund, Council of Europe)
  2. Greek Reporter
  3. eflow
  4. Cyprus Mail
  5. CX Financia
  6. CySEC
  7. Transparency International US / Compliance Week
  8. Greek Reporter
  9. eflow
  10. Cyprus Mail
  11. Zitadelle AG
  12. FX News Group
  13. CX Financia
  14. Euromanagement
  15. LCK Financial Services
  16. CySEC
  17. FXTrustScore
  18. Jamestown Foundation
  19. ICIJ
  20. UK Government
  21. Transparency International US / Compliance Week
  22. Government of Cyprus
  23. ICIJ
  24. STEP
  25. CySEC
  26. Cyprus Gaming and Casino Supervision Commission
  27. Global Sanctions
  28. https://www.harneys.com/our-blogs/regulatory/cyprus-annual-beneficial-ownership-confirmation-window-opens-1-october-2026/
  29. https://rm.coe.int/cm-2026-144-en/48802e01cb
  30. https://www.harriskyriakides.law/insights/news/eu-21st-russia-sanctions-package-measures-implications/
  31. https://www.legal500.com/developments/thought-leadership/cyprus-steps-up-sanctions-enforcement-from-compliance-obligations-to-criminal-consequences/
  32. https://cxfinancia.com/cysec-circular-c800/
  33. https://www.harneys.com/our-blogs/regulatory/cysec-casps-must-apply-for-mica-licence-by-27-february-2026/
  34. https://www.eeas.europa.eu/delegations/chile/eu-adopts-its-largest-ever-package-sanctions-listings-targeting-industry-behind-russias-war_en
  35. https://www.coe.int/en/web/moneyval/-/cyprus-framework-against-money-laundering-and-terrorist-financing-with-respect-to-correspondent-banking-has-been-enhanced
  36. https://cyprus-mail.com/2026/10/15/cyprus-moves-to-tighten-crypto-rules-with-fines-of-up-to-e15-million
  37. https://en.sigmalive.com/cyprus-proposes-crypto-rules-with-fines-of-up-to-e15-million/
  38. https://cyprus-mail.com/2026/10/06/cyprus-regulator-warns-investors-over-six-unauthorised-financial-websites
  39. https://www.penningtonslaw.com/insights/eu-and-uk-sanctions-developments-eus-22nd-sanctions-package-and-latest-uk-measures-targeting-russias-military-industrial-energy-and-shipping-sectors/
  40. https://www.fatf-gafi.org/en/countries/global-network/committee-of-experts-on-the-evaluation-of-anti-money-laundering-.html
  41. https://rm.coe.int/moneyval-2025-2-cy-5th-round-4th-enhanced-fur/1680b667de
  42. https://www.legal500.com/intelligence/cyprus/technology/cyprus-launches-national-sanctions-implementation-unit
  43. https://www.harneys.com/our-blogs/regulatory/cyprus-strengthens-sanctions-obligations-for-obliged-entities/
  44. https://cyprus-mail.com/2026/05/22/cysec-sounds-alarm-to-cyprus-firms-after-sharp-spike-in-mokas-alerts
  45. https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=cca832d1-dae4-4fe1-a6e9-9d31d176ff98
  46. https://www.kourtellos.com/post/anti-money-laundering-in-cyprus-the-current-rules-and-the-eu-single-rulebook-from-july-2027
  47. https://www.coe.int/en/web/moneyval/-/cyprus-improved-aml/cft-measures-with-respect-to-virtual-asset-service-providers-and-virtual-asset-related-activities
  48. Mutual Evaluation Report of Cyprus
  49. Cyprus
  50. Cyprus' progress in strengthening measures to tackle money laundering and terrorist financing
  51. Committee of Experts on the Evaluation of Anti-Money Laundering Measures (MONEYVAL)
  52. 0 Anti-money laundering and counter-terrorist financing measures Cyprus
  53. Cyprus's measures to combat money laundering and terrorist financing
  54. Consolidated assessment ratings
  55. 1 Anti-money laundering and counter-terrorist financing measures Cyprus
  56. Assessments
  57. Mutual Evaluations
  58. Cyprus and US to form partnership to combat financial crime - ICIJ
  59. Cyprus misses EU deadline as long-awaited sanctions unit stalls - ICIJ
  60. Cyprus greenlights sanctions unit following ICIJ investigation into financial services sector - ICIJ
  61. Sanctions Programs and Country Information | Office of Foreign Assets Control
  62. National competent authorities for the implementation of eu ...
  63. Counter Terrorism Designation Update; Counter Narcotics Designation Update; Russia-related Designations Removals | Office of Foreign Assets Control
  64. Cyprus to launch new unit targeting sanctions evaders - ICIJ
  65. Philippines Could Pursue 2M Euros Alleged Crime Boss Stashed in Cyprus | OCCRP
  66. MOKAS | OCCRP
  67. FBI called in to help Cyprus investigate Russian sanctions dodging - ICIJ
  68. "Black and grey" lists
  69. Jurisdictions under Increased Monitoring - 13 February 2026
  70. Countries / Jurisdictions
  71. Fatf-gafi
  72. Jurisdictions under Increased Monitoring - 19 June 2026
  73. Jurisdictions under Increased Monitoring - 24 October 2025
  74. High-risk and other monitored jurisdictions
  75. Cyprus Launches New Registry that Identifies Company Owners | OCCRP
  76. Cyprus, Ghana and Kenya join growing list of countries to create beneficial ownership registries - ICIJ
  77. AVAILABILITY OF COMPANY BENEFICIAL OWNERSHIP ...
  78. Corporate - ICIJ
  79. Treasury Department won’t enforce beneficial ownership rule under the Corporate Transparency Act - ICIJ
  80. 1 Questionnaire on Beneficial Ownership information 1.
  81. Inside Cyprus Confidential: The data-driven journalism that helped expose an island under Russian influence - ICIJ
  82. Beneficial Ownership
  83. European Commission - Have your say
  84. Beneficial Ownership Data is Critical in the Fight Against Corruption | OCCRP
  85. Cyprus to Abolish its Golden Passport Program | OCCRP
  86. Cyprus to Revoke 45 Golden Visas Issued Illegally | OCCRP
  87. Cyprus to Rescind 10 More Golden Passports Over Alleged Abuse | OCCRP
  88. Cyprus Court Acquits Ex-Parliament President, MP in Golden Passport Case | OCCRP
  89. Cyprus to Revoke Seven Golden Passports | OCCRP
  90. Cyprus Retracts “Golden Passports” from Sanctioned Russian Oligarchs | OCCRP
  91. Report: Cyprus Failed to Act Even When Warned of Shady Passport Buyers | OCCRP
  92. Cyprus to Revoke 45 Golden Visas Issued Illegally
  93. Cypriot Auditor Scrutinizes Political Donations From ‘Golden Passport’ Program | OCCRP
  94. Investor citizenship schemes: European Commission opens infringements against Cyprus and Malta for “selling” EU citizenship
  95. Anti-money laundering and countering the financing of terrorism at international level - Finance
  96. Anti-Money Laundering and Terrorist Financing Directive 4 - Finance
  97. European Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance
  98. High risk third countries and the international context content of anti-money laundering and countering the financing of terrorism - European Commission
  99. Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance
  100. EU methodology for the identification of high-risk third countries - Finance
  101. High-risk and other monitored jurisdictions
  102. Money Laundering Advisory Notice: June 2026 - GOV.UK
  103. Anti-money laundering and countering the financing of terrorism at EU level - Finance
  104. EU adopts 17th sanctions package against Russia - European Commission
  105. European Ships Keep Russia’s Shadow Fleet Afloat | OCCRP
  106. Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet - Consilium
  107. Russia's war of aggression against Ukraine: Council sanctions 9 shadow fleet enablers - Consilium
  108. Iran-related Designations; International Criminal Court-related Designations; Russia-related Designations Removals; Foreign Sanctions Evaders Determination Removal; Issuance of Iran-related and International Criminal Court-related General Licenses | Office of Foreign Assets Control
  109. EU adopts 14th package of sanctions against Russia for its continued illegal war against Ukraine, strengthening enforcement and anti-circumvention measures - European Commission Representation in Cyprus
  110. 19th package of sanctions against Russia: EU targets Russian energy, third-country banks and crypto providers - Consilium
  111. EU adopts 19th package of sanctions against Russia - Finance
  112. Russian Tankers Delivering Oil to EU Ports Despite Sanctions | OCCRP
  113. How Cyprus Brokers Can Seize the Crypto Market Opportunity
  114. Virtual Asset Service Provider (VASP): Definition, Compliance & Examples
  115. Cyprus Securities and Exchange Commission | EU Digital Finance Platform
  116. VASP Data Flat File - Chainalysis
  117. Virtual Asset Service Provider (VASP) Risking - Chainalysis
  118. What Is a VASP? Virtual Asset Service Provider - Chainalysis
  119. Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs
  120. MONEYVAL-Follow-Up-Report-Cyprus-2022
  121. Follow-up report Anti-money laundering and counter-terrorist
  122. Questions and Answers: The new EU Anti-Money Laundering Authority (AMLA)
  123. About AMLA - Authority for Anti-Money Laundering and Countering the Financing of Terrorism
  124. Timeline: EU action against money laundering and terrorist financing - Consilium
  125. FAQs - Authority for Anti-Money Laundering and Countering the Financing of Terrorism
  126. List of competent authorities under Article 48(1a) of AMLD
  127. Anti-money laundering and countering the financing of terrorism overview - Finance
  128. Anti-money laundering: Council and Parliament agree to create new authority - Consilium
  129. Frankfurt to host the EU’s new anti-money laundering authority (AMLA) - Consilium
  130. Cyprus Wing of Auditing Giant PwC May Have Breached Sanctions in Work for Oligarch | OCCRP
  131. As sanctions loomed, accounting giant PwC scrambled to keep powerful Russians a step ahead - ICIJ
  132. About the Cyprus Confidential investigation - ICIJ
  133. Beyond Cyprus, PwC has weathered a decade of global probes and scandals - ICIJ
  134. Cyprus ignores Russian atrocities, Western sanctions to shield vast wealth of Putin allies - ICIJ
  135. ISF Cyprus: National Sanctions Implementation Unit - Find a Tender
  136. National competent authorities for the implementation of eu ...
  137. UK and Cyprus to tackle serious organised crime and Russian illicit finance in closer cooperation - GOV.UK
  138. Cyprus Bracing for More Sanctions in Response to Enforcement Failures | OCCRP
  139. Cyprus' progress in strengthening measures to tackle money laundering and terrorist financing
  140. FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks
  141. Annex C: Package of NRA Tools (World Bank, International Monetary Fund, Council of Europe)
  142. FATF / MONEYVAL
  143. Cyprus Securities and Exchange Commission (CySEC)
  144. US Office of Foreign Assets Control (OFAC)
  145. European Commission (DG FISMA)
  146. International Consortium of Investigative Journalists (ICIJ)
  147. Organized Crime and Corruption Reporting Project (OCCRP)
  148. Council of the European Union
  149. HM Treasury (UK)
Coverage gaps
fim-int-2026-07-07-G001: The authoritative Cyprus national N…
fim-int-2026-07-07-G001: The authoritative Cyprus national NRA document (Ministry of Finance Concise NRA) returned a 404 error and could not be directly cited, forcing reliance on MONEYVAL/FATF characterisations instead of Cyprus's own risk self-assessment. [resolved]
fim-int-2026-07-07-G002: Cyprus's specific 6AMLD national tr…
fim-int-2026-07-07-G002: Cyprus's specific 6AMLD national transposition vehicle and status were not established this cycle; a dedicated transposition-tracking source is needed to confirm whether Cyprus has transposed in part, in full, or not yet. [resolved]
fim-int-2026-07-07-G003: No direct confirmation of the Natio…
fim-int-2026-07-07-G003: No direct confirmation of the National Sanctions Implementation Unit's current staffing or operational-capacity status was available beyond the 2025 legislative milestone and February 2025 tender record. [resolved]
fim-int-2026-07-07-G004: Independent, non-leaked verificatio…
fim-int-2026-07-07-G004: Independent, non-leaked verification of Cyprus corporate/trust beneficial-ownership data remains unavailable given the non-public UBO and trust registers. [resolved]
fim-int-2026-07-07-G005: No EU-level or UK-level designation…
fim-int-2026-07-07-G005: No EU-level or UK-level designation record was found contemporaneously mirroring the November/December 2025 OFAC designations of Cyprus-registered entities, leaving the extent of cross-regime listing convergence unconfirmed. [resolved]
fim-int-2026-07-07-G006: Evidence on CySEC's blockchain-anal…
fim-int-2026-07-07-G006: Evidence on CySEC's blockchain-analytics tooling and MiCA Article 60 broker expansion was limited to a single T3 vendor source; a T1/T2 corroborating source would strengthen the D6 RegTech-adoption assessment. [resolved]
fim-int-2026-08-05-G001: Tier-D jurisdictions (Cambodia, Lao…
fim-int-2026-08-05-G001: Tier-D jurisdictions (Cambodia, Laos, Mexico, Colombia) were not searched this cycle given the CY-bound dispatch scope. [resolved]
fim-int-2026-08-05-G002: AMLA full direct-supervision onset …
fim-int-2026-08-05-G002: AMLA full direct-supervision onset date is unresolved between 2027 and 2028 across vendor sources. [resolved]
fim-int-2026-08-05-G003: No primary CySEC circular text was …
fim-int-2026-08-05-G003: No primary CySEC circular text was located for the new sanctions-enforcement framework (in force since 1 August 2025); only trade-press mirrors. [resolved]
fim-int-2026-08-05-G004: D4 (Conflict Finance) and D6 (Compl…
fim-int-2026-08-05-G004: D4 (Conflict Finance) and D6 (Compliance Technology) domains carry thin coverage for Cyprus specifically this cycle. [resolved]
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No CY-specific beneficial-ownership registry update was independently re-verified against the Cyprus UBO Registry portal this cycle. [resolved]
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): The CySEC 9 July 2026 AML circular text itself was not independently retrieved; only single T3 legal commentary describing it. [resolved]
fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D3'}): No enabler-jurisdiction professional-facilitator specific finding for Cyprus surfaced this cycle beyond the NSIU institutional reform. [resolved]
fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', 'value': 'D4'}): No conflict-finance signal intersecting Cyprus surfaced this cycle; coverage remains thin for D4. [resolved]
fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No primary DRCIP notice page was retrieved confirming the 2026 UBO annual confirmation window; relied on secondary law-firm reporting. [resolved]
fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): No AMLA direct-supervision perimeter confirmation was located for whether any Cyprus-domiciled obliged entity is a selected directly-supervised entity. [resolved]
fim-int-2026-10-11-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-11-G003 ({'scheme': 'financial_integrity', 'value': 'D4'}): No D4 (conflict finance) substantive Cyprus-specific finding was located this cycle. [resolved]
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No primary parliamentary bill text for the Markets in Crypto-Assets Bill of 2026 was retrieved this cycle; current confidence capped at Probable pending the official bill text. [open]
fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, C…
fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle due to pooled search budget prioritisation to CY; recorded as awaiting_primary_source rather than a confirmed no-change. [open]
fim-int-2026-10-25-G001: No T1 primary legislative text of t…
fim-int-2026-10-25-G001: No T1 primary legislative text of the NSIU Law 2025 located; sanctions-architecture claim capped at Probable. [open]
fim-int-2026-10-25-G002: D2/D3/D4/D6/D8 domains have thin or…
fim-int-2026-10-25-G002: D2/D3/D4/D6/D8 domains have thin or no coverage for Cyprus this cycle. [open]
FIM-GAP-001 (D2): The seed-referenced authoritative national…
FIM-GAP-001 (D2): The seed-referenced authoritative national NRA document (Ministry of Finance Cyprus Concise NRA, mof.gov.cy/assets/modules/wnp/articles/201811/448/docs/cy_concise_nra.pdf) returned a 404 error at execution and could not be directly read or cited verbatim as instructed.
FIM-GAP-002 (D3): The Cyprus Bar Association's objections (c…
FIM-GAP-002 (D3): The Cyprus Bar Association's objections (constitutional/language grounds, exclusion from the AML advisory role) delayed the National Sanctions Implementation Unit legislation past the EU's 20 May 2024 deadline, illustrating professional-body capture of reform timelines.
FIM-GAP-003 (D2): Criminal prosecutions arising from the gol…
FIM-GAP-003 (D2): Criminal prosecutions arising from the golden-passport scandal have largely failed at first instance, with the February 2026 acquittal of two senior former politicians the latest of three first-instance cases to founder, in one instance due to witnesses simply not being summoned.
FIM-GAP-004 (D2): Cyprus's UBO registry (established 2021) a…
FIM-GAP-004 (D2): Cyprus's UBO registry (established 2021) and trust registers remain non-public, limiting third-party and journalistic verification of beneficial ownership; investigators have repeatedly had to rely on leaked corporate-registry data (Cyprus Confidential) rather than official transparency mechanisms.
FIM-GAP-005 (D5): Cyprus's virtual-asset supervisory framewo…
FIM-GAP-005 (D5): Cyprus's virtual-asset supervisory framework remains rated partially compliant on FATF Recommendation 15, with MONEYVAL noting the unresolved question of host-country obligations for foreign-registered VASPs operating remotely into Cyprus, and an initially absent national VASP risk-mitigation action plan.
FIM-GAP-006 (D1): Cyprus's government has historically linke…
FIM-GAP-006 (D1): Cyprus's government has historically linked support for stricter shadow-fleet and shipping-sector sanctions to compensation for lost shipping-industry revenue (a sector worth ~8% of GDP), and its law firms continued servicing dozens of sanctioned oligarchs more than a year after the 2022 sanctions wave.

Evidence

Confidence-tiered claims

2026 annual Beneficial Ownership Register confirmation window opened 1 October 2026, closing 31 December 2026, applicable to all Cyprus companies, SEs and partnerships, required even absent any ownership change; automatic penalty of EUR 100 on day one plus EUR 50 per further day, capped at EUR 5,000 per entity. [Source 1]
Probable · 1 source
CySEC Circular C800 (8 September 2026) informed Administrative Service Providers and Crowdfunding Service Providers of an AMLA public hearing on draft RTS under Article 40(2) of Directive (EU) 2024/1640 concerning risk-assessment methodology for non-financial sectors. [Source 1]
Probable · 1 source
21st EU Russia sanctions package adopted 23 July 2026, 218 designations (48 individuals, 170 entities), extending shadow-fleet support-services regime and introducing possible blanket third-country crypto-services ban; Cypriot compliance guidance followed. [Source 1]
Probable · 1 source
Law No. 149(I)/2025 (25 July 2025) transposes EU Directive 2024/1226, criminalising intentional breach of EU sanctions; Law 150(I)/2025 establishes a National Sanctions Implementation Unit (EMEK) for enforcement cooperation with Europol, Eurojust and the EPPO. Standing-regime context, pre-dating this cycle's anchor. [Source 1]
Probable · 1 source
Cyprus not FATF grey-listed; 4th Enhanced Follow-Up Report referenced in CoE Committee of Ministers papers of 23 September 2026 notes continued progress; Cyprus found compliant on 16 and partially compliant on 2 of remaining recommendations per the 2024 follow-up report; 6th-round onsite visit scheduled October 2028. [Source 1]
Probable · 1 source
MiCA Article 143(3) transitional regime for Cyprus-registered CASPs expired 1 July 2026; CySEC issued post-expiry warnings within days. Standing-regime milestone reached before this cycle's anchor, carried for its effect on AML-obliged-entity scope. [Source 1]
Probable · 1 source
22nd EU Russia sanctions package adopted 12 October 2026, designating 1,569 individuals/entities (826 companies, 743 CEOs) in Russia's military-industrial complex. [Source 1]
Probable · 1 source
Markets in Crypto-Assets Bill of 2026 submitted to Parliament on 8 October 2026, granting CBC/CySEC investigatory and enforcement powers and fines of €5m-€15m+ for serious breaches. [Source 1]
Probable · 1 source
Cyprus remains under MONEYVAL's enhanced follow-up procedure (4th Enhanced FUR, adopted 12 May 2025, published 23 March 2026); no FATF Recommendation rated non-compliant; 6th-round mutual evaluation on-site visit scheduled October 2028. [Source 1]
Probable · 1 source
CySEC warned investors about six websites offering or appearing to offer investment or crypto-asset services without required authorisation. [Source 1]
Probable · 1 source
UK issued a separate package on 8 October 2026 (38 new designations) targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges, distinct from the EU's 22nd package. [Source 1]
Probable · 1 source
Formally closed; Compliant/Largely Compliant on 38 of 40 FATF Recommendations, R.8 and R.31 remain Partially Compliant [Source 1]
Probable · 1 source
AMLA operational since 1 July 2025, absorbed EBA AML mandates 1 January 2026; direct supervision of selected cross-border entities begins 2028; CySEC Circulars C748/C749 guide provisional-eligibility data collection [Source 1]
Probable · 1 source
Operational since 10 July 2025 under NSIU Law 2025; administrative fines up to EUR 500,000 (plus EUR 500/day continuing violation); aligned with EU Directive 2024/1226; reported ~EUR 1.9bn in frozen Russian-held assets since 2022 [Source 1]
Probable · 1 source
572 disseminations in 2025, up ~70% year-on-year; 631 cases of information exchange with foreign counterparts [Source 1]
Probable · 1 source
MiCA national transitional period for CASPs ended 1 July 2026; CySEC confirmed full MiCA enforcement from that date [Source 1]
Probable · 1 source