--- title: "Cyprus (CY) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/cyprus/ source_html: /jurisdictions/cyprus/index.html description: "Financial integrity intelligence for Cyprus (CY): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: 7a249848c00d50dce126af3439db967005ec2950608d17279d1274df85f772d0 generator: "fe-fleet/md-twin@1.0" --- # Cyprus (CY) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # Cyprus CY Domains covered 8 of 8 Sources 149 Role actions 8 Horizon <90d 0 Jurisdiction profile FATF status: Compliant Tier: B Risk direction: Stable Enablement vs enforcement: Mixed Cyprus applies the EU AML/CFT acquis via its AML/CFT Law, with MOKAS as FIU, CySEC as securities/CASP supervisor, and CBC as banking supervisor. More Assessed by MONEYVAL under FATF standards, Cyprus remains in enhanced follow-up since its 2019 MER, rated partially compliant on non-profit organisations, correspondent banking, new technologies (crypto), and law-enforcement investigative powers. A national sanctions unit (NSIU/MEK), replacing a 2016 sanctions law, was legislated in 2025 after EU-deadline delays. Key deficiencies - Partially-compliant FATF rating on new technologies/virtual assets (R.15), downgraded from largely compliant - Delayed operationalisation of the National Sanctions Implementation Unit past the EU's May 2024 deadline - Non-public beneficial ownership and trust registers limiting third-party/journalistic verification - Professional-enabler resistance (Bar Association) to sanctions-enforcement reforms affecting lawyer participation - Historically weak prosecutorial follow-through on citizenship-by-investment corruption (2026 acquittals) Recent developments (18m) - ICIJ/OCCRP Cyprus Confidential fallout drove a three-pronged sanctions legislative package passed in 2025 criminalising sanctions evasion and creating a National Sanctions Implementation Unit - MONEYVAL/FATF published a further follow-up report on Cyprus's AML/CFT progress on 23 March 2026 - OFAC designated multiple Cyprus-registered companies and Cypriot nationals under Russia-related EO14024 in November and December 2025 - A Nicosia criminal court acquitted two former senior politicians in a golden-passport corruption case in February 2026, citing insufficient prosecution evidence - UK and Cyprus agreed cooperation (Dec 2024) on establishing the NSIU with OFSI/OTSI technical assistance and beneficial-ownership information sharing Law made at European Economic Area level that applies in Cyprus is covered once, on the [European Economic Area](/jurisdictions/eea/) page. This page covers Cyprus’s own layer: implementation, national authorities, national options and local enforcement. Brief ## Lead signal #### Lead Signal The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced. Read full brief #### Lead Signal The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced. Alongside the sanctions package, Cyprus moved on its domestic crypto-enforcement architecture. The Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026, following Cabinet approval on 10 September 2026. The bill would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal investigatory and enforcement powers, including inspections, compliance orders, and suspension or withdrawal of MiCA authorisation, with corporate fines of at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse. #### Other Developments CySEC public warnings on unauthorised websites. Cyprus main financial watchdog warned investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. The warning sits alongside the pending enforcement bill as evidence of continued supervisory activity in the crypto-adjacent space even ahead of the bill formal powers taking effect. UK divergent sanctions package. The United Kingdom issued a separate package on 8 October 2026 comprising 38 new designations, targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package is distinct in composition and timing from the EU 22nd package, illustrating the continued pattern of autonomous, non-synchronised EU and UK sanctions-listing activity that obliged entities operating across both jurisdictions must reconcile separately. MONEYVAL standing assessment. Cyprus remains under MONEYVAL enhanced follow-up procedure, per the 4th Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. None of the FATF recommendations are assessed as non-compliant for Cyprus, and the sixth-round mutual evaluation on-site visit is scheduled for October 2028. This is a baseline-descriptive record rather than fresh movement this cycle, but it frames the compliance backdrop against which the new sanctions and crypto-enforcement developments land. #### Cross-Monitor Connections The domestic crypto-enforcement bill intersects directly with the crypto monitor track: the same Markets in Crypto-Assets Bill of 2026 that strengthens CySEC and the Central Bank of Cyprus enforcement powers for market-integrity purposes also forms the backbone of the licensing-enforcement architecture tracked on the digital-assets side. The EU sanctions package similarly connects to payments-sector screening obligations, since the expanded designee population, including hundreds of newly named corporate officers, extends the counterparty-screening surface that correspondent banks and cross-sector payment firms operating in or through Cyprus must apply. #### Outlook The Markets in Crypto-Assets Bill of 2026 remains before Parliament, with no primary bill text yet retrieved; confidence in its final scope and effective date is capped at probable pending the official text and any committee amendments. Enactment is not confirmed for a specific date; the matter is best tracked as a bill at the parliamentary stage rather than an enacted instrument, with the gap in independently confirmed detail expected to narrow once the House of Representatives advances the text. The EU 22nd sanctions package applies immediately and without a transition period, so the near-term compliance task for obliged entities in Cyprus is incorporation of the expanded designee list into existing screening systems rather than awaiting any further domestic implementing step. Earlier periodic briefs (4) 25 Oct 2026 · fim-2026-10-25 #### Lead Signal The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, designating 1,569 individuals and entities, including 826 companies and 743 chief executives, tied to Russia military-industrial complex. The package is notable for its depth rather than its novelty of mechanism: rather than introducing a new evasion-architecture measure, it extends designations deep into supply chains, naming the corporate officers of already-sanctioned firms rather than headline entities alone. As a directly applicable Council Regulation, the package binds Cyprus immediately as an EU member state, with no national transposition step required; domestic enforcement runs through the National Sanctions Implementation Unit. For an EU financial centre with a historically significant Russia-linked corporate-services sector, a listings expansion of this scale widens the population of counterparties that obliged entities must screen against, even where no single new evasion typology is introduced. Alongside the sanctions package, Cyprus moved on its domestic crypto-enforcement architecture. The Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026, following Cabinet approval on 10 September 2026. The bill would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal investigatory and enforcement powers, including inspections, compliance orders, and suspension or withdrawal of MiCA authorisation, with corporate fines of at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse. #### Other Developments CySEC public warnings on unauthorised websites. Cyprus main financial watchdog warned investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. The warning sits alongside the pending enforcement bill as evidence of continued supervisory activity in the crypto-adjacent space even ahead of the bill formal powers taking effect. UK divergent sanctions package. The United Kingdom issued a separate package on 8 October 2026 comprising 38 new designations, targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package is distinct in composition and timing from the EU 22nd package, illustrating the continued pattern of autonomous, non-synchronised EU and UK sanctions-listing activity that obliged entities operating across both jurisdictions must reconcile separately. MONEYVAL standing assessment. Cyprus remains under MONEYVAL enhanced follow-up procedure, per the 4th Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. None of the FATF recommendations are assessed as non-compliant for Cyprus, and the sixth-round mutual evaluation on-site visit is scheduled for October 2028. This is a baseline-descriptive record rather than fresh movement, but it frames the compliance backdrop against which the new sanctions and crypto-enforcement developments land. #### Cross-Monitor Connections The domestic crypto-enforcement bill intersects directly with the crypto monitor track: the same Markets in Crypto-Assets Bill of 2026 that strengthens CySEC and the Central Bank of Cyprus enforcement powers for market-integrity purposes also forms the backbone of the licensing-enforcement architecture tracked on the digital-assets side. The EU sanctions package similarly connects to payments-sector screening obligations, since the expanded designee population, including hundreds of newly named corporate officers, extends the counterparty-screening surface that correspondent banks and cross-sector payment firms operating in or through Cyprus must apply. #### Outlook The Markets in Crypto-Assets Bill of 2026 remains before Parliament, with no primary bill text yet retrieved; confidence in its final scope and effective date is capped at probable pending the official text and any committee amendments. Enactment is not confirmed for a specific date; the matter is best tracked as a bill at the parliamentary stage rather than an enacted instrument, with the gap in independently confirmed detail expected to narrow once the House of Representatives advances the text. The EU 22nd sanctions package applies immediately and without a transition period, so the near-term compliance task for obliged entities in Cyprus is incorporation of the expanded designee list into existing screening systems rather than awaiting any further domestic implementing step. 12 Oct 2026 · fim-2026-10-11 #### Lead Signal Cyprus's financial-integrity posture this cycle is defined by two parallel tracks rather than a single headline event: a routine but consequential corporate-transparency compliance cycle, and a sanctions-architecture framework that continues to deepen under EU direction. The Department of the Registrar of Companies and Intellectual Property (DRCIP) opened the 2026 annual Beneficial Ownership Register confirmation window on 1 October 2026, running to 31 December 2026, and applicable to every Cyprus company, European company (SE) and partnership regardless of whether ownership has changed. Non-compliance carries an automatic penalty structure, beginning at EUR 100 on the first day of default and accruing EUR 50 per further day, capped at EUR 5,000 per entity. This is a procedural obligation rather than a substantive rule change, but its universality across the Cyprus corporate registry base, and the automaticity of the penalty mechanism, make it a material event for any entity with Cyprus corporate structures in its ownership chain. Alongside this, the EU's 21st Russia sanctions package, adopted 23 July 2026, added 218 designations, comprising 48 individuals and 170 entities, and extended the shadow-fleet support-services regime while introducing the possibility of a blanket third-country crypto-services ban. Cypriot legal commentary followed closely on the package's scope and enforcement implications, reflecting the jurisdiction's continued sensitivity to Russia-linked sanctions exposure given its historical role as a financial centre for Russian and CIS-linked capital. #### Other Developments Beneficial ownership confirmation cycle reaches its annual checkpoint. The 2026 DRCIP window is not a new rule but a recurring procedural requirement under the Companies Law (Cap. 113) beneficial ownership regime, with the current penalty structure dating to Law L.141(I)/2024, effective February 2025. What makes this cycle notable is less the obligation itself than its blanket application: every registered entity must confirm, even where nothing has changed, and the automatic and escalating nature of the penalty removes most of the discretion that might otherwise soften enforcement against inadvertent late filers. AMLA technical standards consultation reaches Cypriot non-financial obliged entities. CySEC Circular C800, dated 8 September 2026, notified Administrative Service Providers and Crowdfunding Service Providers of a public hearing convened by the Anti-Money Laundering Authority (AMLA) on draft Regulatory Technical Standards under Article 40(2) of Directive (EU) 2024/1640, concerning risk-assessment methodology for non-financial sectors. This is a consultation notice, not a finalised obligation, but it signals that the EU-level harmonisation of AML risk methodology is actively reaching into sectors beyond banks and investment firms that Cyprus hosts in volume. Sanctions-criminalisation architecture remains the operative enforcement backdrop. Cyprus's Law No. 149(I)/2025, transposing EU Directive 2024/1226, criminalises intentional breach of EU sanctions, while the companion Law 150(I)/2025 established a National Sanctions Implementation Unit (EMEK) to coordinate enforcement with Europol, Eurojust and the European Public Prosecutor's Office. Neither law is new this cycle, but both form the legal environment into which the 21st sanctions package's expanded designations and shadow-fleet provisions land, and this standing architecture is the reason Cypriot firms have been receiving active compliance guidance following the July package. #### Cross-Monitor Connections The sanctions dimension of this cycle connects directly to crypto-asset and payments oversight: the 21st EU Russia sanctions package's introduction of a possible blanket third-country crypto-services ban sits alongside the separate expiry of Cyprus's MiCA Article 143(3) transitional regime on 1 July 2026, after which CySEC issued post-expiry warnings to crypto-asset service providers. Taken together, these developments narrow the population of entities that can lawfully provide crypto services from or into Cyprus without full authorisation, which bears on both financial-integrity screening obligations and payments-sector licensing scope. The beneficial ownership confirmation cycle is also structurally relevant to correspondent banking and enabler-jurisdiction due diligence conducted elsewhere in the EU and beyond: a jurisdiction's registry discipline, including whether filing obligations are enforced with automatic penalties, is itself an input into counterparty risk assessment of Cyprus-incorporated structures. #### Outlook The DRCIP confirmation window closes 31 December 2026, and the practical test of this cycle's development will be the scale of penalty accrual against non-filers once that deadline passes, which will not be visible until the following reporting period. On the sanctions side, Cypriot firms should expect continued compliance guidance to follow further EU Russia-sanctions escalation, given Cyprus's exposure through its historical position as a jurisdiction of choice for Russian and CIS corporate structuring. The AMLA RTS consultation under Article 40(2) remains at the draft stage, with no finalisation date yet identified; non-financial obliged entities in Cyprus, including Administrative Service Providers and Crowdfunding Service Providers, should anticipate that a harmonised EU risk-assessment methodology will eventually bind them, though the timeline for that is not yet fixed. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Cyprus enacted a three-law package effective 25 July 2025 — Law 150(I)/2025, Law 149(I)/2025 and Law 48(I)/2025 — establishing the National Sanctions Implementation Unit (NSIU/EMEK) within the Ministry of Finance. The new unit replaces a fragmented 2016 sanctions-enforcement regime with a centralised body responsible for coordinating EU and UN sanctions implementation, licensing and derogation decisions, and administrative enforcement. The reform is explicitly linked to prior ICIJ Cyprus Confidential findings that exposed weaknesses in Cyprus's sanctions-enforcement architecture, and Law 149(I)/2025 separately creates a new criminal offence for violating EU restrictive measures, implementing EU Directive 2024/1226 on harmonising criminal sanctions-violation offences across member states. This is a structural rather than episodic development: it consolidates what had been dispersed sanctions authority into a single body with defined licensing, derogation and enforcement powers, directly responsive to a documented prior gap. #### Other Developments MiCA CASP transition completed. The transitional period allowing crypto-asset service providers to operate in Cyprus under the pre-MiCA national registration regime closed entirely on 1 July 2026, with an application deadline of 27 February 2026 for firms seeking to carry over into full MiCA authorisation. Firms that did not file a complete application by the deadline were required to submit wind-down plans. From 1 July 2026, MiCA authorisation via CySEC is the sole lawful basis for providing crypto-asset services from Cyprus, and unauthorised-provider activity after that date is unlawful across the EU. CySEC accompanied the cutover with a circular, reported by a single legal-commentary source and not yet independently retrieved, directing regulated crypto and investment firms to strengthen anti-money-laundering controls as the transition concluded, citing new AMLA guidance. MONEYVAL follow-up upgrade. Cyprus is assessed via MONEYVAL rather than direct FATF mutual evaluation, and its most recent enhanced follow-up reporting shows an upgrade on FATF Recommendation 13, covering correspondent banking, to largely compliant. Recommendation 8, covering non-profit organisations, remains partially compliant. Cyprus is not on the FATF grey list. #### Cross-Monitor Connections The MiCA CASP cutover intersects directly with the crypto monitor's licensing and stablecoin-regime coverage: the same transitional-period expiry that closes the national CASP registration route is the structural fact underpinning that monitor's token-classification and stablecoin analysis for Cyprus this cycle. The NSIU establishment also has a payments-adjacent dimension worth noting for the world-payments monitor's AML/CFT coverage, since sanctions-list screening obligations sit alongside the payment-institution and e-money-institution authorisation regime the Central Bank of Cyprus separately administers, though that authorisation process is not itself a sanctions matter. #### Outlook Watch for independent retrieval and corroboration of the CySEC 9 July 2026 AML circular text, currently resting on a single T3 legal-commentary source. Watch also for confirmation of Cyprus's beneficial-ownership registry status, which was not independently re-verified this cycle, and for any enabler-jurisdiction or professional-facilitator findings that may emerge as a consequence of the NSIU's expanded coordination role. 25 Aug 2026 · fim-2026-08-05 #### Lead Signal The most structurally significant development for Cyprus this cycle is the formal close of the Markets in Crypto-Assets Regulation's national grandfathering window for crypto-asset service providers on 1 July 2026, following a 27 February 2026 application deadline. This retires Cyprus's AML-only national crypto registration regime in favour of full Markets in Crypto-Assets Regulation authorisation, with unauthorised providers required to wind down their operations. The finding carries a High confidence rating, anchored by a Tier 1 CySEC press release and corroborated across three independent secondary sources on both the application-deadline and expiry dates. This is treated as a structural regime transition rather than an incremental development, because it closes the last national-registration pathway available to crypto-asset firms operating in Cyprus and materially raises the compliance bar for CY-domiciled providers entering their first full MiCA supervisory cycle. Providers that have not secured full MiCA authorisation by the relevant deadline no longer have a national fallback registration to rely on, which sharpens the operational stakes of the transition considerably relative to prior cycles. The transition also converges with Cyprus's broader efforts to tighten its financial-crime architecture this cycle, discussed below, even as the crypto-specific compliance burden is assessed independently on its own evidentiary merits. #### Other Developments Sanctions enforcement build-out. CySEC's sanctions-breach criminalisation framework, implementing EU Directive 2024/1226, has been in force since 1 August 2025, and a National Sanctions Implementation Unit is now operational within the Ministry of Finance. This finding is assessed with moderate confidence, corroborated across two independent trade-press mirrors describing the same circular, though no Tier 1 CySEC circular text was located directly this cycle to confirm the precise scope of the new criminalisation framework. AMLA data-collection groundwork. CySEC Circular C748, as amended by Circular C749, set a 12 January 2026 submission deadline for obliged entities to provide AMLA-related data, forming part of the groundwork for the EU AML Regulation becoming directly applicable across the European Union. This is an assessed-confidence finding, drawn from two independent vendor sources; no Tier 1 or Tier 2 anchor was located this cycle for the underlying circular text itself, so the precise scope of the data-collection exercise remains a research gap. AMLR and 6AMLD direct applicability. The EU AML Regulation and the sixth Anti-Money Laundering Directive are moving toward, respectively, direct applicability and per-Member-State transposition, marking the first time EU anti-money-laundering law takes the form of a directly applicable Regulation rather than a directive requiring national transposition alone. This assessment rests on two independent Tier 4 sources only; no Tier 1 or Tier 2 anchor was located this cycle, and it is flagged accordingly as thinner-sourced than the MiCA finding above. #### Cross-Monitor Connections The MiCA transition intersects directly with the World Payments Monitor's own tracking of Cyprus's crypto-asset-service-provider licensing lifecycle, since the same 1 July 2026 grandfathering expiry that closes the AML-only national registration pathway also determines which providers may continue to offer payment-adjacent digital-asset services in Cyprus going forward. Separately, the sanctions-enforcement build-out and the AMLA data-collection groundwork under Circular C748/C749 both feed the same underlying supervisory infrastructure that Cyprus obliged entities will depend on as the EU AML Regulation and the Anti-Money Laundering Authority's direct and indirect supervision architecture come into force across the European Union. Both threads reflect Cyprus obliged entities preparing simultaneously for a new sanctions-enforcement architecture and a new EU-level AML supervisory architecture, on parallel but related timelines. #### Outlook The immediate item to watch is how CySEC applies its new sanctions-enforcement powers in practice now that the National Sanctions Implementation Unit is operational, since the current finding rests on secondary trade-press coverage rather than a located primary circular; a primary-source confirmation next cycle would materially firm up this finding's confidence. On the AMLA side, sources diverge on whether full AMLA direct supervision of high-risk cross-border obliged entities begins in 2027 or 2028; this date discrepancy is flagged for reconciliation and would sharpen the compliance-timeline picture for Cyprus obliged entities once resolved. On crypto, the practical test of the MiCA transition will be how many previously AML-registered Cyprus crypto-asset firms successfully convert to full MiCA authorisation versus wind down their Cyprus operations, a question this cycle's research could not yet answer and which next cycle should target directly. Taken together, these three threads point to a Cyprus financial-integrity posture that is genuinely building out formal architecture across sanctions, AML supervision, and crypto authorisation in parallel, even though the primary-source evidentiary base for two of the three threads remains thinner than ideal this cycle. Domain intelligence (D1–D8) #### Sanctions The Council of the European Union adopted its 22nd sanctions package against Russia on 12 October 2026, the largest-ever single round of listings against the architecture of Russia's military-industrial complex. The package designates 1,569 individuals and entities, comprising 826 companies and 743 chief executives. Analytically, the structural significance lies less in novel evasion-architecture mechanisms than in the depth of the designee population: by naming the chief executives of already-sanctioned firms rather than confining itself to headline corporate entities, the package pushes the screening burden into the management layer of the sanctioned supply chain. As a Council Regulation, this is directly applicable across the European Union, binding Cyprus immediately without a national transposition step. Domestic implementation and enforcement in Cyprus runs through the National Sanctions Implementation Unit, which becomes the practical point of contact for Cyprus-based obliged entities seeking guidance on the expanded list. Continue reading For Cyprus specifically, the architecture point is that a directly applicable EU instrument removes any domestic discretion over scope or timing; the obligation is immediate and self-executing. This stands in explicit contrast to the United Kingdom's approach: on 8 October 2026 the UK issued its own, separate package of 38 new designations targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges. The UK package differs in composition and in timing from the EU's, reflecting the continuing pattern of autonomous UK and EU sanctions-listing activity post-Brexit. For firms with cross-border exposure between EU member states and the UK, including many Cyprus-domiciled financial and corporate-services firms given the jurisdiction's historical role as a conduit for cross-border structuring, this divergence means two independently maintained designee lists must be reconciled rather than one harmonised list applied. The enablement-versus-enforcement lens is also relevant here. Cyprus's standing compliance record, assessed under MONEYVAL's enhanced follow-up procedure, shows no FATF recommendation currently rated non-compliant, with the most recent Enhanced Follow-up Report adopted 12 May 2025 and published 23 March 2026. This is a favourable baseline against which the sanctions package lands: the expanded designee population tests the practical screening capacity of a jurisdiction that has, on paper, a sound technical-compliance record, rather than testing a jurisdiction with known technical gaps. The absence of any Cyprus-specific enforcement action connected to the new package this cycle is itself a data point, not an omission: it indicates the screening and implementation burden is still being absorbed rather than having already generated an enforcement response. #### Outlook The EU 22nd package took effect on adoption, with no transition period, so Cyprus-based obliged entities face an immediate task of incorporating the expanded designee list, including the newly listed corporate officers, into transaction-screening and customer due-diligence systems. No further national implementing measure is required or expected, since the regulation is self-executing. The divergence between EU and UK listings is a structural feature of the post-Brexit sanctions landscape that is likely to persist and recur with each new package on either side, rather than a one-off feature of this cycle; firms with dual EU-UK exposure should expect continued reconciliation work between the two designee lists going forward. Cyprus's next MONEYVAL assessment point, a fifth-round follow-up report, is anticipated in the first quarter of 2027, though the precise submission date has not been independently confirmed this cycle. Judgment: NSIU/EMEK remains the standing sanctions-enforcement architecture; no new designation or evasion-architecture finding this cycle. Uncertain #### Beneficial Ownership and Corporate Transparency Cyprus's beneficial-ownership transparency posture this cycle is defined by the persistence of a structural opacity that predates and outlasts its most visible remediation effort, the 2020 termination of the golden-passport citizenship-by-investment programme. Cyprus's 2021 UBO registry and CySEC's parallel register of beneficial owners of express trusts remain restricted to competent authorities and obliged entities rather than being publicly accessible, meaning that independent verification of corporate and trust ownership structures continues to depend on leaked datasets such as Cyprus Confidential rather than official transparency mechanisms. This is a standing feature, not a new development, but it is reinforced this cycle by a further failure of accountability at the enforcement end: a Nicosia court acquitted former Parliament President Demetris Syllouris and former MP Christakis Giovanis in a golden-passport corruption case in February 2026, after key prosecution witnesses failed to appear. This is the third first-instance prosecution connected to the scheme to founder, a pattern that raises the question of whether the legislative termination of the programme has been matched by any accountability mechanism for its historical abuse. Continue reading Set against this domestic picture, the European Commission twice amended the EU high-risk third-country AML/CFT list within a single month. Delegated Regulation (EU) 2026/46 added Russia, and Delegated Regulation (EU) 2026/83 subsequently added Bolivia and the British Virgin Islands while removing six other jurisdictions. The BVI addition carries particular relevance for Cyprus given the well-documented BVI-Cyprus layering chains identified in the Cyprus Confidential dataset; the addition raises enhanced-due-diligence obligations precisely on the kind of cross-jurisdictional structure that Cypriot enablers have historically used to shield Russian-linked beneficial ownership. The durable structural backdrop against which all of this must be read is the EU AML Package, which comprises three distinct legal instruments rather than a single reform. The AML Regulation (AMLR, Regulation (EU) 2024/1624) is directly applicable across the EU, including Cyprus, from 2027, superseding fragmented national AML/CFT Law provisions without requiring national transposition. The sixth AML Directive (6AMLD) requires transposition by each Member State on its own timeline — and Cyprus's specific national transposition vehicle and status were not established this cycle, a gap the interpreter has flagged rather than assumed. The AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority, which will select approximately 40 high-risk cross-border obliged entities for direct supervision in 2027, with supervision beginning in 2028; this shifts the supervisory perimeter from purely national authorities such as Cyprus's MOKAS, CySEC and Central Bank of Cyprus toward a hybrid EU-level regime. Cyprus's internationally exposed banking and corporate-service-provider sector is assessed as a plausible candidate for this direct-supervision track, though no selection has yet occurred. #### Outlook The near-term trajectory for Cyprus's beneficial-ownership transparency depends on developments that are largely exogenous to Cyprus's own reform pace: the AMLR's 2027 direct application, and whether AMLA's 2027 entity-selection process draws in a Cyprus-headquartered institution. Domestically, the recurring pattern of failed golden-passport prosecutions suggests that legislative termination of the scheme has not yet been accompanied by a working accountability mechanism, and the non-public status of the UBO and trust registers means this gap is likely to remain difficult to independently verify absent a further leak-driven disclosure. Judgment: No CY-specific beneficial-ownership register development located this cycle. Uncertain #### Enabler Jurisdictions and Professional Facilitators Cyprus's professional-services sector remains the documented architecture through which Russian oligarch asset-shielding has been executed, and this cycle's evidence base reinforces rather than revises that assessment. The Cyprus Confidential investigation established that Cypriot accounting, legal, and corporate/trust-service firms — with PwC Cyprus specifically named — administered rapid share transfers and inter-company restructurings, including a $1.4bn Mordashov holding and roughly $100m in Evraz-linked transfers, executed as EU sanctions loomed. The gap between this Tier-2 investigative finding and confirmed Tier-1 enforcement action against the enabling professionals themselves — as distinct from the underlying designated individuals — is itself a signal under FIM's enablement-as-signal methodology: professional facilitation architecture frequently escapes direct sanction even where the assets it shields are eventually designated. Continue reading Applying the Enabler Jurisdiction Filter's four-dimension assessment — legal framework, enforcement, capacity versus choice, and systemic significance — Cyprus presents a mixed but coherent profile. On capacity, the National Sanctions Implementation Unit's delayed stand-up reflects a genuine resourcing question. On choice, however, the Cyprus Bar Association's constitutional and role-exclusion objections to the NSIU's design actively delayed the enabling legislation past the EU's 20 May 2024 deadline — a professional-body-driven political constraint distinct from simple incapacity, and one that illustrates how enabler-jurisdiction status can be actively defended by domestic professional interests rather than merely tolerated through under-resourcing. Cyprus's standing FATF-compliance trajectory corroborates this mixed picture at the institutional level. The March 2026 MONEYVAL enhanced Follow-Up Report keeps Cyprus in enhanced follow-up since its 2019 Mutual Evaluation Report, with partial-compliance ratings persisting on four of forty Recommendations: non-profit organisations, correspondent banking, new technologies and virtual assets under R.15, and law-enforcement investigative powers. These are not new deficiencies; their persistence across multiple follow-up cycles is itself the analytically relevant finding, distinguishing a structural enforcement gap from an episodic lapse. #### Outlook The defining question for Cyprus's enabler-jurisdiction status going forward is whether the professional-body resistance that delayed the NSIU's legislative design will similarly shape or constrain its operational stand-up, expected around Q4 2026. If the Bar Association's influence extends into the unit's investigative practice once operational, the capacity-versus-choice distinction identified this cycle will harden into a durable feature of Cyprus's enabler profile rather than a one-off legislative delay. The next MONEYVAL follow-up report, expected around 2027-Q2, will be a useful marker of whether the persistent partial-compliance ratings — particularly on investigative powers and virtual assets — show any movement. Judgment: No new enabler-jurisdiction finding this cycle. Uncertain #### Conflict Finance and Extractive-Industry Integrity Cyprus's conflict-finance exposure this cycle is concentrated in a single, well-evidenced channel: its shipping sector's role in sustaining Russian oil-export revenue through the shadow-fleet layering architecture already documented under D1. The distinguishing analytical contribution to the conflict-finance domain specifically is the identification of a domestic political-economy incentive that moderates Cyprus's enforcement appetite toward this channel. Cyprus's government has historically linked its support for stricter shadow-fleet sanctions to compensation for lost shipping-industry revenue, a sector that represents approximately 8% of Cypriot GDP. This is a state-capture-adjacent dynamic distinct from a simple capacity constraint: it describes an economic dependency that structurally incentivises enforcement moderation rather than a resourcing gap that prevents enforcement altogether. Continue reading This dynamic is corroborated by a specific behavioural finding: Cypriot law firms continued servicing sanctioned Russian oligarchs for more than a year after the initial 2022 sanctions wave, evidence that the economic-dependency incentive translated into observable continuity of service to sanctioned clients rather than remaining a purely structural or theoretical concern. Read against the F1 state-capture filter and F4 conflict-finance filter jointly, this represents a case where enforcement moderation is plausibly driven by an identifiable domestic economic interest rather than by institutional incapacity alone — a distinction with direct relevance to how the severity of Cyprus's conflict-finance exposure should be assessed relative to jurisdictions where the same shadow-fleet architecture operates without an equivalent domestic economic stake. #### Outlook The key forward question for this domain is whether the EU's expanding shadow-fleet designation regime — which reached nearly 600 vessel listings by December 2025 — will progressively erode the economic rationale for Cyprus's historical enforcement moderation, or whether the shipping sector's GDP weight continues to shape enforcement intensity independently of the external designation tempo. No compensation mechanism or structural resolution of this tension has been evidenced in the research record this cycle; it remains an open and unresolved dynamic. Judgment: No conflict-finance finding specific to Cyprus this cycle. Uncertain #### Crypto / Digital Assets / Financial Innovation Cyprus moved to strengthen its domestic crypto-enforcement architecture this cycle. Following Cabinet approval on 10 September 2026, the Markets in Crypto-Assets Bill of 2026 was submitted to the House of Representatives on 8 October 2026. The bill, if enacted, would grant the Central Bank of Cyprus and the Cyprus Securities and Exchange Commission formal domestic powers under the EU's Markets in Crypto-Assets Regulation framework: the authority to investigate, inspect, issue compliance orders, and suspend or withdraw MiCA authorisation from a crypto-asset service provider. Corporate fines would run to at least five million euro for specified infringements and fifteen million euro or more, turnover-linked, for serious market abuse, with individual penalties layered on top. This formalises an enforcement architecture for a sector where Cyprus carries a comparatively high concentration of crypto-asset service provider registrations relative to its size, meaning the practical reach of the bill, once enacted, would extend across a meaningfully sized population of regulated firms. Continue reading No primary parliamentary bill text has been retrieved this cycle; the development is sourced from press coverage rather than the bill text itself, which caps confidence in the precise scope and final fine thresholds at the probable tier pending the official text and any committee-stage amendments. This is a material qualification: the headline fine figures and powers described should be read as the bill as tabled, not as settled law, and the final enacted version may differ in scope or threshold. Alongside the legislative development, the Cyprus Securities and Exchange Commission continued its supervisory activity in the sector, warning investors about six websites offering or appearing to offer investment or crypto-asset services without the required authorisation. This supervisory activity, which precedes and is independent of the pending enforcement bill, indicates that Cyprus's crypto-market oversight is not waiting on the new legislation to begin functioning; existing powers are already being exercised against unauthorised activity, and the new bill would primarily extend and formalise the toolkit available for firms that are already authorised but found to be non-compliant, rather than create oversight capacity where none currently exists. #### Outlook The Markets in Crypto-Assets Bill of 2026 remains at the parliamentary stage, with enactment not yet confirmed for a specific date; the matter should be tracked as a bill before the House of Representatives rather than as an enacted instrument. Confidence in the bill's final scope, including the precise fine thresholds and the scope of covered infringements, will firm up once the official parliamentary text and any committee amendments become available. In the interim, Cyprus's existing crypto-market supervisory activity, including continued public warnings against unauthorised websites, is expected to continue independently of the bill's progress through Parliament. Judgment: MiCA national transitional period for CASPs ended 1 July 2026 with CySEC confirming full enforcement; this is standing context, not a new development this cycle. Probable #### Compliance Technology and Active Defence Cyprus's compliance-technology signal this cycle is modest in evidentiary weight but directionally consistent with the broader EU supervisory build-out. CySEC's reported use of blockchain-analytics tooling for CASP authorisation and supervision, alongside the expansion of MiFID-authorised brokers into crypto services via MiCA's Article 60 notification route, points toward incremental institutional capacity-building at the national supervisory level. This finding, however, rests on a single Tier-3 vendor-sourced citation, and the research record itself flags the absence of a corroborating Tier-1 or Tier-2 source as a gap warranting a stronger evidentiary basis before being treated as confirmed regulatory practice. Continue reading The more structurally consequential development in this domain is not Cyprus-specific but EU-level: AMLA's ongoing supervisory-methodology development and EuReCA database build-out ahead of its 2027-2028 direct-supervision mandate. AMLA will select approximately 40 high-risk cross-border obliged entities for direct supervision beginning 2027, with supervision starting in 2028, and Cyprus's internationally exposed banking and corporate-service-provider sector is assessed as a plausible candidate jurisdiction for this selection, though no selection has yet occurred. This represents a genuine shift in the compliance-technology and active-defence landscape, moving supervisory methodology development from a purely national exercise toward a centralised EU-level function that will eventually set standards Cyprus's own supervisors must align with. #### Outlook The key forward marker for this domain is whether CySEC's incremental RegTech signals receive stronger corroboration in subsequent cycles, and whether AMLA's supervisory-methodology publications, expected around Q4 2026, begin to shape national-level compliance-technology requirements ahead of the 2027 entity-selection process. Given the current evidentiary thinness of the Cyprus-specific signal, this domain warrants continued monitoring rather than a confident structural assessment at this stage. Judgment: No RegTech/compliance-technology development specific to Cyprus found this cycle. Uncertain Cyprus is assessed by MONEYVAL rather than directly by FATF; its most recent enhanced follow-up report upgrades Recommendation 13 (correspondent banking) to largely compliant, while Recommendation 8 (non-profit organisations) remains partially compliant. Judgment: MONEYVAL 5th-round follow-up process for Cyprus formally closed (CM(2026)144, 23 Sept 2026); Cyprus rated Compliant/Largely Compliant on 38 of 40 FATF Recommendations, with R.8 and R.31 remaining Partially Compliant. Supervisory architecture (CBC/CySEC/ICPAC/Bar Association, MOKAS as FIU) unchanged. Probable Judgment: No commercial activity among financial-integrity infrastructure firms specific to Cyprus found this cycle. Uncertain Regulatory horizon Proposed 2027-Q1 · ±half_year ### Markets in Crypto-Assets Bill of 2026 (domestic MiCA enforcement framework) Once enacted, CBC and CySEC gain formal domestic powers to investigate, inspect, restrict, suspend or withdraw MiCA authorisations and impose fines of 5 million to 15 million euro or more (turnover-linked) for serious breaches. [Source](https://cyprus-mail.com/2026/10/15/cyprus-moves-to-tighten-crypto-rules-with-fines-of-up-to-e15-million) In Force Pending 2027-Q1 · ±year ### MONEYVAL 5th-round follow-up report on Cyprus Expected next follow-up assessment reviewing Cyprus's technical-compliance re-ratings. [Source](https://www.coe.int/en/web/moneyval/-/cyprus-framework-against-money-laundering-and-terrorist-financing-with-respect-to-correspondent-banking-has-been-enhanced) Adopted 2028-Q1 · ±year ### AMLA direct supervision of selected obliged entities A small number of high-risk cross-border financial groups will move from national supervision (CBC/CySEC) to direct AMLA supervision; all other Cyprus obliged entities remain under national supervisors applying the common AMLR rulebook. [AMLA / European Commission Source](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=cca832d1-dae4-4fe1-a6e9-9d31d176ff98) 3 dated · 4 pending date · baseline financial-integrity-2026-07-05 Role action cards MLRO ### EU adopted its largest-ever Russia sanctions package, expanding the screening population to include corporate officers of already-sanctioned firms. The 22nd package is directly applicable and binds Cyprus immediately; screening systems need the expanded designee list incorporated without a domestic transposition step. 2 evidence refs Compliance ### Cyprus tabled a domestic MiCA enforcement bill granting CBC/CySEC investigatory and penalty powers of up to 15 million euro. The bill is still before Parliament and sourced from press coverage only; policy and control frameworks for crypto-asset exposure should track the bill rather than treat it as settled law. 2 evidence refs Legal ### EU and UK Russia sanctions packages diverged again, with the UK issuing a separate 38-designation package on 8 October 2026. Firms with cross-border EU-UK exposure face two independently maintained designee lists requiring separate reconciliation; the divergence pattern is structural rather than one-off. 2 evidence refs Board ### Cyprus's domestic crypto-enforcement architecture is being formalised while the jurisdiction's AML/CTF baseline remains favourably assessed. The combination of a strengthening crypto-enforcement bill and a stable, favourable MONEYVAL assessment signals continued regulatory tightening without an underlying compliance deficiency being corrected. 2 evidence refs CTO ### The pending Markets in Crypto-Assets Bill of 2026 would give CySEC and CBC expanded investigatory powers over crypto-asset platforms operating in Cyprus. Technical and platform teams supporting crypto-asset operations in Cyprus should anticipate possible on-site and desk-based regulatory review powers once the bill is enacted, alongside CySEC's continuing public warnings against unauthorised platforms. 2 evidence refs Risk ### The EU's 22nd sanctions package deepens designee coverage into the executive layer of sanctioned entities' supply chains. Risk exposure concentration analysis should account for the newly listed corporate officers, not just headline sanctioned entities, when assessing counterparty risk in Russia-linked corporate structures. 1 evidence refs Operations ### CySEC issued fresh public warnings against six unauthorised crypto/investment websites. Operational screening and customer-facing warning processes may need to reflect regulator-published unauthorised-entity lists as they are updated. 1 evidence refs Audit ### No primary parliamentary text for the Markets in Crypto-Assets Bill of 2026 has yet been retrieved, capping confidence in its documented scope. Audit trails referencing the bill's powers and fine thresholds should flag this as sourced from press coverage pending the official legislative text. 1 evidence refs Scenario sketches ### Illustrative AMLA direct-supervision transition for cross-border obliged entities Illustrative orientation only: as the AMLA Regulation (Reg (EU) 2024/1620) moves the EU from purely national AML supervision toward a hybrid model, a cross-border obliged entity group with a Cyprus-based subsidiary could, in a possible future scenario, find itself under AMLA direct supervision at group level while remaining under national supervision for its Cyprus-only book, alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition. This is an illustrative structural mechanism, not an observed fact about any specific entity. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture no_change No material change found this cycle; NSIU reports ~EUR 1.9bn in frozen Russian-held assets since 2022 (T3 sourced). T2 · EU AML Package / AMLA watch AMLR applies from 10 July 2027; AMLA operational since 1 July 2025 and absorbed EBA AML mandates 1 January 2026; CySEC Circulars C748/C749 guide CY entities through provisional-eligibility data collection ahead of 2028 direct supervision. T3 · FATF Grey List no_change Cyprus is not on the FATF grey list; MONEYVAL 5th-round follow-up formally closed in 2026; 6th-round onsite scheduled October 2028. T4 · Beneficial-Ownership Register Status no_change No CY-specific beneficial-ownership register development located this cycle. T5 · Crypto & Digital-Asset Integrity no_change MiCA national transitional period for CY CASPs ended 1 July 2026; CySEC confirmed full MiCA enforcement from that date. No new AML-specific crypto development this cycle. T6 · Sanctions Regime Divergence no_change No new EU/US/UK divergence specific to Cyprus found this cycle; NSIU's EU-aligned unified architecture is the standing structural point. Registers ### Enforcement actions - 24 Nov 2025 - 18 Dec 2025 - 23 Mar 2026 - 17 Feb 2026 - 10 Jul 2025 - 17 Mar 2025 - 21 Jul 2025 - 21 Jan 2026 - OFAC designated Cypriot businessman Demetrios Serghides and Cyprus-registered Hightrail Ltd, alongside linked individuals (Attikouris, Giannakou/Yiannakou, Georgiou, Vakanas) and entities (Windfel Properties, Savoler Development, Miramonte Investments, Almenor Holdings), under Russia-related Executive Order 14024, citing links to sanctioned oligarch Alisher Usmanov. 24 Nov 2025 - OFAC designated two Nicosia-registered companies, Veles International Limited and Hadlerco Limited, under Russia-related EO14024 for links to Dmitry Bugayenko, as part of a broader package including Iran-related shipping designations. 18 Dec 2025 - MONEYVAL published a further follow-up report (3rd enhanced FUR successor) on Cyprus's progress addressing technical-compliance deficiencies since its 2020 mutual evaluation, continuing Cyprus's enhanced follow-up status. 23 Mar 2026 - Criminal prosecution of two senior former politicians for alleged improper intervention in golden-passport citizenship applications, stemming from a 2020 Al Jazeera undercover investigation, concluded with acquittal after key prosecution witnesses failed to appear. 17 Feb 2026 - Parliament passed a three-pronged legislative package establishing a National Sanctions Implementation Unit with fining powers, criminalising sanctions evasion, and replacing the 2016 sanctions law, after missing the EU's May 2024 transposition deadline amid Bar Association objections. 10 Jul 2025 ### Sanctions changes - 23 Oct 2025 - 3 Dec 2025 - 4 Dec 2025 - 18 Dec 2025 - 23 Apr 2026 - 23 Jul 2026 - 12 Oct 2026 - The EU's 19th sanctions package added 117 further shadow-fleet vessel listings (total 557), imposed the first-ever EU sanctions on crypto-asset infrastructure supporting Russia, banned LNG imports from 2027, and eliminated remaining Rosneft/Gazprom Neft oil-import exemptions. 23 Oct 2025 - Commission Delegated Regulation (EU) 2026/46 added Russia to the EU list of high-risk third countries with AML/CFT strategic deficiencies, amending Delegated Regulation (EU) 2016/1675. 3 Dec 2025 - Commission Delegated Regulation (EU) 2026/83 added Bolivia and the British Virgin Islands to the EU high-risk third-country list while removing Burkina Faso, Mali, Mozambique, Nigeria, South Africa and Tanzania, reflecting FATF grey-list alignment. 4 Dec 2025 - The EU Council designated nine shadow-fleet enablers (shipping companies based in the UAE, Vietnam and Russia) on 15 December 2025 and a further 41 shadow-fleet vessels on 18 December 2025, bringing total vessel designations to nearly 600. 18 Dec 2025 ### Regulatory horizon (register) - AMLA direct supervision of selected obliged entities - MiCA CASP transitional-period expiry / national CASP regime wind-down - AMLA draft RTS — risk-assessment methodology for non-financial sectors - Annual UBO Register confirmation cycle 2026 closes - Markets in Crypto-Assets Bill of 2026 (domestic MiCA enforcement framework) - MONEYVAL 5th-round follow-up report on Cyprus - AMLA direct supervision of selected obliged entities - AML Regulation (AMLR) becomes directly applicable across the EU - AMLA selects ~40 directly-supervised high-risk cross-border entities - National Sanctions Implementation Unit reaches full operational capacity - Next MONEYVAL follow-up report on Cyprus AML/CFT progress ### Active schemes - [CRITICAL] Cypriot professional-enabler network shielding Russian oligarch assets - [HIGH] Shadow-fleet oil tanker layering via Cyprus corporate structures - EEA VASP-passporting gap in Cyprus crypto supervision - [HIGH] Legacy golden-passport beneficial-ownership opacity Sources - [Annex C: Package of NRA Tools (World Bank, International Monetary Fund, Council of Europe)](https://www.fatf-gafi.org/en/publications/Methodsandtrends/combined-package-of-NRA-tools.html) - [Greek Reporter](https://greekreporter.com/2026/05/02/greece-cyprus-malta-block-eu-sanctions-russia/) - [eflow](https://www.eflowglobal.com/insights/blogs/cysecs-new-sanctions-regime) - [Cyprus Mail](https://cyprus-mail.com/2026/01/21/cysec-imposes-e2-3-million-in-fines-tightens-aml-and-sanctions-enforcement) - [CX Financia](https://cxfinancia.com/amla-regulation-cyprus-readiness/) - [CySEC](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3c2571bc-1e2f-4537-b139-bc6bdc375719) - [Transparency International US / Compliance Week](https://us.transparency.org/app/uploads/2025/01/Inside-Cyprus-efforts-to-stem-money-laundering-and-sanctions-evasion-_-Premium-_-Compliance-Week.pdf) - [Greek Reporter](https://greekreporter.com/2026/05/02/greece-cyprus-malta-block-eu-sanctions-russia/) - [eflow](https://www.eflowglobal.com/insights/blogs/cysecs-new-sanctions-regime) - [Cyprus Mail](https://cyprus-mail.com/2026/01/21/cysec-imposes-e2-3-million-in-fines-tightens-aml-and-sanctions-enforcement) - [Zitadelle AG](https://www.zitadelleag.com/news/cysec-cif-license-2026-guide) - [FX News Group](https://fxnewsgroup.com/forex-news/regulatory/cysec-fines-conotoxia-for-non-compliance-with-aml-directive/) - [CX Financia](https://cxfinancia.com/amla-regulation-cyprus-readiness/) - [Euromanagement](https://euromanagement.biz/brief-amla-2026.html) - [LCK Financial Services](https://www.lckfs.com/post/the-grace-period-is-over-crypto-services-in-cyprus-after-mica) - [CySEC](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=3c2571bc-1e2f-4537-b139-bc6bdc375719) - [FXTrustScore](https://www.fxtrustscore.com/cysec-mica-transition-unauthorised-crypto-platforms/) - [Jamestown Foundation](https://jamestown.org/cyprus-hub-for-russian-influence-money-laundering-and-sanctions-evasion/) - [ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-to-launch-new-unit-targeting-sanctions-evaders/) - [UK Government](https://www.globalsecurity.org/wmd/library/news/russia/2024/12/russia-241210-ukgov01.htm) - [Transparency International US / Compliance Week](https://us.transparency.org/app/uploads/2025/01/Inside-Cyprus-efforts-to-stem-money-laundering-and-sanctions-evasion-_-Premium-_-Compliance-Week.pdf) - [Government of Cyprus](https://www.gov.cy/nsiu/en/documents/material-related-to-the-nsiu/nsiu-legislative-framework/) - [ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-greenlights-sanctions-unit-following-icij-investigation-into-the-countrys-financial-services-sector/) - [STEP](https://www.step.org/industry-news/cyprus-launches-sanctions-implementation-unit) - [CySEC](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=ce7a7e74-51f8-42fd-b538-ef657d359792) - [Cyprus Gaming and Casino Supervision Commission](https://www.cgc.org.cy/en/moneyval-follow-up-on-cyprus-june-2025/) - [Global Sanctions](https://globalsanctions.com/2026/01/cyprus-sec-provides-2026-sanctions-enforcement-outlook/) - [https://www.harneys.com/our-blogs/regulatory/cyprus-annual-beneficial-ownership-confirmation-window-opens-1-october-2026/](https://www.harneys.com/our-blogs/regulatory/cyprus-annual-beneficial-ownership-confirmation-window-opens-1-october-2026/) - [https://rm.coe.int/cm-2026-144-en/48802e01cb](https://rm.coe.int/cm-2026-144-en/48802e01cb) - [https://www.harriskyriakides.law/insights/news/eu-21st-russia-sanctions-package-measures-implications/](https://www.harriskyriakides.law/insights/news/eu-21st-russia-sanctions-package-measures-implications/) - [https://www.legal500.com/developments/thought-leadership/cyprus-steps-up-sanctions-enforcement-from-compliance-obligations-to-criminal-consequences/](https://www.legal500.com/developments/thought-leadership/cyprus-steps-up-sanctions-enforcement-from-compliance-obligations-to-criminal-consequences/) - [https://cxfinancia.com/cysec-circular-c800/](https://cxfinancia.com/cysec-circular-c800/) - [https://www.harneys.com/our-blogs/regulatory/cysec-casps-must-apply-for-mica-licence-by-27-february-2026/](https://www.harneys.com/our-blogs/regulatory/cysec-casps-must-apply-for-mica-licence-by-27-february-2026/) - [https://www.eeas.europa.eu/delegations/chile/eu-adopts-its-largest-ever-package-sanctions-listings-targeting-industry-behind-russias-war_en](https://www.eeas.europa.eu/delegations/chile/eu-adopts-its-largest-ever-package-sanctions-listings-targeting-industry-behind-russias-war_en) - [https://www.coe.int/en/web/moneyval/-/cyprus-framework-against-money-laundering-and-terrorist-financing-with-respect-to-correspondent-banking-has-been-enhanced](https://www.coe.int/en/web/moneyval/-/cyprus-framework-against-money-laundering-and-terrorist-financing-with-respect-to-correspondent-banking-has-been-enhanced) - [https://cyprus-mail.com/2026/10/15/cyprus-moves-to-tighten-crypto-rules-with-fines-of-up-to-e15-million](https://cyprus-mail.com/2026/10/15/cyprus-moves-to-tighten-crypto-rules-with-fines-of-up-to-e15-million) - [https://en.sigmalive.com/cyprus-proposes-crypto-rules-with-fines-of-up-to-e15-million/](https://en.sigmalive.com/cyprus-proposes-crypto-rules-with-fines-of-up-to-e15-million/) - [https://cyprus-mail.com/2026/10/06/cyprus-regulator-warns-investors-over-six-unauthorised-financial-websites](https://cyprus-mail.com/2026/10/06/cyprus-regulator-warns-investors-over-six-unauthorised-financial-websites) - [https://www.penningtonslaw.com/insights/eu-and-uk-sanctions-developments-eus-22nd-sanctions-package-and-latest-uk-measures-targeting-russias-military-industrial-energy-and-shipping-sectors/](https://www.penningtonslaw.com/insights/eu-and-uk-sanctions-developments-eus-22nd-sanctions-package-and-latest-uk-measures-targeting-russias-military-industrial-energy-and-shipping-sectors/) - [https://www.fatf-gafi.org/en/countries/global-network/committee-of-experts-on-the-evaluation-of-anti-money-laundering-.html](https://www.fatf-gafi.org/en/countries/global-network/committee-of-experts-on-the-evaluation-of-anti-money-laundering-.html) - [https://rm.coe.int/moneyval-2025-2-cy-5th-round-4th-enhanced-fur/1680b667de](https://rm.coe.int/moneyval-2025-2-cy-5th-round-4th-enhanced-fur/1680b667de) - [https://www.legal500.com/intelligence/cyprus/technology/cyprus-launches-national-sanctions-implementation-unit](https://www.legal500.com/intelligence/cyprus/technology/cyprus-launches-national-sanctions-implementation-unit) - [https://www.harneys.com/our-blogs/regulatory/cyprus-strengthens-sanctions-obligations-for-obliged-entities/](https://www.harneys.com/our-blogs/regulatory/cyprus-strengthens-sanctions-obligations-for-obliged-entities/) - [https://cyprus-mail.com/2026/05/22/cysec-sounds-alarm-to-cyprus-firms-after-sharp-spike-in-mokas-alerts](https://cyprus-mail.com/2026/05/22/cysec-sounds-alarm-to-cyprus-firms-after-sharp-spike-in-mokas-alerts) - [https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=cca832d1-dae4-4fe1-a6e9-9d31d176ff98](https://www.cysec.gov.cy/CMSPages/GetFile.aspx?guid=cca832d1-dae4-4fe1-a6e9-9d31d176ff98) - [https://www.kourtellos.com/post/anti-money-laundering-in-cyprus-the-current-rules-and-the-eu-single-rulebook-from-july-2027](https://www.kourtellos.com/post/anti-money-laundering-in-cyprus-the-current-rules-and-the-eu-single-rulebook-from-july-2027) - [https://www.coe.int/en/web/moneyval/-/cyprus-improved-aml/cft-measures-with-respect-to-virtual-asset-service-providers-and-virtual-asset-related-activities](https://www.coe.int/en/web/moneyval/-/cyprus-improved-aml/cft-measures-with-respect-to-virtual-asset-service-providers-and-virtual-asset-related-activities) - [Mutual Evaluation Report of Cyprus](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationreportofcyprus.html) - [Cyprus](https://www.fatf-gafi.org/en/countries/detail/Cyprus.html) - [Cyprus' progress in strengthening measures to tackle money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fur-cyprus-2022.html) - [Committee of Experts on the Evaluation of Anti-Money Laundering Measures (MONEYVAL)](https://www.fatf-gafi.org/en/countries/global-network/committee-of-experts-on-the-evaluation-of-anti-money-laundering-.html) - [0 Anti-money laundering and counter-terrorist financing measures Cyprus](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Moneyval-Mutual-Evaluation-Report-Cyprus.pdf) - [Cyprus's measures to combat money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mer-cyprus-2019.html) - [Consolidated assessment ratings](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Assessment-ratings.html) - [1 Anti-money laundering and counter-terrorist financing measures Cyprus](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Cyprus_MONEYVAL_5thRound_3rdEnhFUR.pdf.coredownload.inline.pdf) - [Assessments](https://www.fatf-gafi.org/en/calendars/assessments.html) - [Mutual Evaluations](https://www.fatf-gafi.org/en/topics/mutual-evaluations.html?hf=10&=&b=0&=&s=desc(fatf_releasedate)) - [Cyprus and US to form partnership to combat financial crime - ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-and-u-s-to-form-partnership-to-combat-financial-crime/) - [Cyprus misses EU deadline as long-awaited sanctions unit stalls - ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-misses-eu-deadline-as-long-awaited-sanctions-unit-stalls/) - [Cyprus greenlights sanctions unit following ICIJ investigation into financial services sector - ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-greenlights-sanctions-unit-following-icij-investigation-into-the-countrys-financial-services-sector/) - [Sanctions Programs and Country Information | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information) - [National competent authorities for the implementation of eu ...](https://finance.ec.europa.eu/document/download/803d74d5-84a0-4bf4-a735-30f1fe5ae6dd_en?filename=national-competent-authorities-sanctions-implementation_en.pdf) - [Counter Terrorism Designation Update; Counter Narcotics Designation Update; Russia-related Designations Removals | Office of Foreign Assets Control](https://ofac.treasury.gov/recent-actions/20251124) - [Cyprus to launch new unit targeting sanctions evaders - ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-to-launch-new-unit-targeting-sanctions-evaders/) - [Philippines Could Pursue 2M Euros Alleged Crime Boss Stashed in Cyprus | OCCRP](https://www.occrp.org/en/scoop/philippines-could-pursue-2m-euros-alleged-crime-boss-stashed-in-cyprus) - [MOKAS | OCCRP](https://www.occrp.org/en/organizations/mokas) - [FBI called in to help Cyprus investigate Russian sanctions dodging - ICIJ](https://www.icij.org/investigations/cyprus-confidential/fbi-called-in-to-help-cyprus-investigate-russian-sanctions-dodging/) - ["Black and grey" lists](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [Jurisdictions under Increased Monitoring - 13 February 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [Countries / Jurisdictions](https://www.fatf-gafi.org/countries/) - [Fatf-gafi](https://www.fatf-gafi.org/content/dam/fatf-gafi/Global-Network/4th-Round-Ratings.pdf.coredownload.inline.pdf) - [Jurisdictions under Increased Monitoring - 19 June 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2026.html) - [Jurisdictions under Increased Monitoring - 24 October 2025](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-october-2025.html) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions.html) - [Cyprus Launches New Registry that Identifies Company Owners | OCCRP](https://www.occrp.org/en/daily/14212-cyprus-launches-new-registry-that-identifies-company-owners) - [Cyprus, Ghana and Kenya join growing list of countries to create beneficial ownership registries - ICIJ](https://www.icij.org/investigations/panama-papers/cyprus-ghana-and-kenya-join-growing-list-of-countries-to-create-beneficial-ownership-registries/) - [AVAILABILITY OF COMPANY BENEFICIAL OWNERSHIP ...](https://www.globalwitness.org/documents/19879/EU_BO_registers_Annex.pdf) - [Corporate - ICIJ](https://www.icij.org/about/corporate/) - [Treasury Department won’t enforce beneficial ownership rule under the Corporate Transparency Act - ICIJ](https://www.icij.org/inside-icij/2025/03/treasury-department-wont-enforce-beneficial-ownership-rule-under-the-corporate-transparency-act/) - [1 Questionnaire on Beneficial Ownership information 1.](https://www.unodc.org/documents/treaties/UNCAC/WorkingGroups/workinggroup2/2022-November-7-11/contributions_to_CAC-COSP-WG.2-2022-CRP.1/CYPRUS_EN.pdf) - [Inside Cyprus Confidential: The data-driven journalism that helped expose an island under Russian influence - ICIJ](https://www.icij.org/investigations/cyprus-confidential/leaked-data-journalism-methodology/) - [Beneficial Ownership](https://www.fatf-gafi.org/en/topics/beneficial-ownership.html) - [European Commission - Have your say](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12476-Implementing-Act-on-the-technical-specifications-of-the-Beneficial-Ownership-Registers-Interconnection-System-BORIS-) - [Beneficial Ownership Data is Critical in the Fight Against Corruption | OCCRP](https://www.occrp.org/en/project/beneficial-ownership-data-is-critical-in-the-fight-against-corruption) - [Cyprus to Abolish its Golden Passport Program | OCCRP](https://www.occrp.org/en/news/cyprus-to-abolish-its-golden-passport-program) - [Cyprus to Revoke 45 Golden Visas Issued Illegally | OCCRP](https://www.occrp.org/en/news/cyprus-to-revoke-45-golden-visas-issued-illegally) - [Cyprus to Rescind 10 More Golden Passports Over Alleged Abuse | OCCRP](https://www.occrp.org/en/news/cyprus-to-rescind-10-more-golden-passports-over-alleged-abuse) - [Cyprus Court Acquits Ex-Parliament President, MP in Golden Passport Case | OCCRP](https://www.occrp.org/en/news/cyprus-court-acquits-ex-parliament-president-mp-in-golden-passport-case) - [Cyprus to Revoke Seven Golden Passports | OCCRP](https://www.occrp.org/en/news/cyprus-to-revoke-seven-golden-passports) - [Cyprus Retracts “Golden Passports” from Sanctioned Russian Oligarchs | OCCRP](https://www.occrp.org/en/daily/16208-cyprus-retracts-golden-passports-from-sanctioned-russian-oligarchs) - [Report: Cyprus Failed to Act Even When Warned of Shady Passport Buyers | OCCRP](https://www.occrp.org/en/news/report-cyprus-failed-to-act-even-when-warned-of-shady-passport-buyers) - [Cyprus to Revoke 45 Golden Visas Issued Illegally](https://www.occrp.org/en/daily/15352-cyprus-to-revoke-45-golden-visas-issued-illegally) - [Cypriot Auditor Scrutinizes Political Donations From ‘Golden Passport’ Program | OCCRP](https://www.occrp.org/en/news/cypriot-auditor-scrutinizes-political-donations-from-golden-passport-program) - [Investor citizenship schemes: European Commission opens infringements against Cyprus and Malta for “selling” EU citizenship](https://ec.europa.eu/commission/presscorner/detail/en/ip_20_1925) - [Anti-money laundering and countering the financing of terrorism at international level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level_en) - [Anti-Money Laundering and Terrorist Financing Directive 4 - Finance](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/anti-money-laundering-and-terrorist-financing-directive-4_en) - [European Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance](https://finance.ec.europa.eu/news/european-commission-updates-list-high-risk-countries-strengthen-international-fight-against-2025-12-04_en) - [High risk third countries and the international context content of anti-money laundering and countering the financing of terrorism - European Commission](https://finance.ec.europa.eu/financial-crime/high-risk-third-countries-and-international-context-content-anti-money-laundering-and-countering_en) - [Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance](https://finance.ec.europa.eu/news/commission-updates-list-high-risk-countries-strengthen-international-fight-against-financial-crime-2025-06-10_en) - [EU methodology for the identification of high-risk third countries - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level/eu-methodology-identification-high-risk-third-countries_en) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/topics/high-risk-and-other-monitored-jurisdictions.html) - [Money Laundering Advisory Notice: June 2026 - GOV.UK](https://www.gov.uk/government/publications/money-laundering-advisory-notice-high-risk-third-countries--2/money-laundering-advisory-notice-high-risk-third-countries--2) - [Anti-money laundering and countering the financing of terrorism at EU level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en) - [EU adopts 17th sanctions package against Russia - European Commission](https://cyprus.representation.ec.europa.eu/news/eu-adopts-17th-sanctions-package-against-russia-2025-05-20_en) - [European Ships Keep Russia’s Shadow Fleet Afloat | OCCRP](https://www.occrp.org/en/investigation/european-ships-keep-russias-shadow-fleet-afloat) - [Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [Russia's war of aggression against Ukraine: Council sanctions 9 shadow fleet enablers - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/15/russia-s-war-of-aggression-against-ukraine-council-sanctions-9-shadow-fleet-enablers/) - [Iran-related Designations; International Criminal Court-related Designations; Russia-related Designations Removals; Foreign Sanctions Evaders Determination Removal; Issuance of Iran-related and International Criminal Court-related General Licenses | Office of Foreign Assets Control](https://ofac.treasury.gov/recent-actions/20251218) - [EU adopts 14th package of sanctions against Russia for its continued illegal war against Ukraine, strengthening enforcement and anti-circumvention measures - European Commission Representation in Cyprus](https://cyprus.representation.ec.europa.eu/news/eu-adopts-14th-package-sanctions-against-russia-its-continued-illegal-war-against-ukraine-2024-06-24_en) - [19th package of sanctions against Russia: EU targets Russian energy, third-country banks and crypto providers - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/10/23/19th-package-of-sanctions-against-russia-eu-targets-russian-energy-third-country-banks-and-crypto-providers/) - [EU adopts 19th package of sanctions against Russia - Finance](https://finance.ec.europa.eu/news/eu-adopts-19th-package-sanctions-against-russia-2025-10-23_en) - [Russian Tankers Delivering Oil to EU Ports Despite Sanctions | OCCRP](https://www.occrp.org/en/blog/16474-russian-tankers-delivering-oil-to-eu-ports-despite-sanctions) - [How Cyprus Brokers Can Seize the Crypto Market Opportunity](https://www.chainalysis.com/blog/cyprus-brokers-crypto-market-opportunities-webinar-recap/) - [Virtual Asset Service Provider (VASP): Definition, Compliance & Examples](https://www.trmlabs.com/glossary/virtual-asset-service-provider-vasp) - [Cyprus Securities and Exchange Commission | EU Digital Finance Platform](https://digital-finance-platform.ec.europa.eu/cross-border-services/cross-border-testing/participants/cyprus-securities-and-exchange-commission) - [VASP Data Flat File - Chainalysis](https://www.chainalysis.com/product/vasp-data-flat-file/) - [Virtual Asset Service Provider (VASP) Risking - Chainalysis](https://www.chainalysis.com/product/vasp-risking/) - [What Is a VASP? Virtual Asset Service Provider - Chainalysis](https://www.chainalysis.com/glossary/virtual-asset-service-provider/) - [Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/global-crypto-policy-review-outlook-2025-26) - [MONEYVAL-Follow-Up-Report-Cyprus-2022](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/MONEYVAL-Follow-Up-Report-Cyprus-2022.pdf.coredownload.inline.pdf) - [Follow-up report Anti-money laundering and counter-terrorist](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/MONEYVAL-Follow-Up-Report-Cyprus-2022.pdf) - [Questions and Answers: The new EU Anti-Money Laundering Authority (AMLA)](https://finance.ec.europa.eu/document/download/61cf5a0d-0e5d-43e2-876a-8e68e45c7f1f_en?filename=240424-anti-money-laundering-faqs_en_0.pdf) - [About AMLA - Authority for Anti-Money Laundering and Countering the Financing of Terrorism](https://finance.ec.europa.eu/financial-crime/amla/about-amla_en) - [Timeline: EU action against money laundering and terrorist financing - Consilium](https://www.consilium.europa.eu/en/policies/fight-against-terrorist-financing/timeline/) - [FAQs - Authority for Anti-Money Laundering and Countering the Financing of Terrorism](https://finance.ec.europa.eu/financial-crime/amla/frequently-asked-questions_en) - [List of competent authorities under Article 48(1a) of AMLD](https://finance.ec.europa.eu/system/files/2024-03/amld-article-48-competent-authorities-cyprus_en.pdf) - [Anti-money laundering and countering the financing of terrorism overview - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-overview_en) - [Anti-money laundering: Council and Parliament agree to create new authority - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2023/12/13/anti-money-laundering-council-and-parliament-agree-to-create-new-authority/) - [Frankfurt to host the EU’s new anti-money laundering authority (AMLA) - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2024/02/22/frankfurt-to-host-the-eus-new-anti-money-laundering-authority-amla/) - [Cyprus Wing of Auditing Giant PwC May Have Breached Sanctions in Work for Oligarch | OCCRP](https://www.occrp.org/en/project/cyprus-confidential/cyprus-wing-of-auditing-giant-pwc-may-have-breached-sanctions-in-work-for-oligarch) - [As sanctions loomed, accounting giant PwC scrambled to keep powerful Russians a step ahead - ICIJ](https://www.icij.org/investigations/cyprus-confidential/pwc-cyprus-russia-oligarchs-ukraine-sanctions/) - [About the Cyprus Confidential investigation - ICIJ](https://www.icij.org/investigations/cyprus-confidential/about-cyprus-confidential-investigation/) - [Beyond Cyprus, PwC has weathered a decade of global probes and scandals - ICIJ](https://www.icij.org/investigations/cyprus-confidential/pwc-scandals-leaks-papers/) - [Cyprus ignores Russian atrocities, Western sanctions to shield vast wealth of Putin allies - ICIJ](https://www.icij.org/investigations/cyprus-confidential/cyprus-russia-eu-secrecy-tax-haven/) - [ISF Cyprus: National Sanctions Implementation Unit - Find a Tender](https://www.find-tender.service.gov.uk/Notice/004593-2025) - [National competent authorities for the implementation of eu ...](https://finance.ec.europa.eu/document/download/803d74d5-84a0-4bf4-a735-30f1fe5ae6dd_en) - [UK and Cyprus to tackle serious organised crime and Russian illicit finance in closer cooperation - GOV.UK](https://www.gov.uk/government/news/uk-and-cyprus-to-tackle-serious-organised-crime-and-russian-illicit-finance-in-closer-cooperation) - [Cyprus Bracing for More Sanctions in Response to Enforcement Failures | OCCRP](https://www.occrp.org/en/news/cyprus-bracing-for-more-sanctions-in-response-to-enforcement-failures) - [Cyprus' progress in strengthening measures to tackle money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Cyprus-MONEYVAL-FUR-2024.html) - [FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks](https://www.fatf-gafi.org/en/publications/Fatfgeneral/FATF-launches-National-Risk-Assessment-toolkit-to-help-countries-identify-greatest-money-laundering-risks.html) - [Annex C: Package of NRA Tools (World Bank, International Monetary Fund, Council of Europe)](https://www.fatf-gafi.org/en/publications/Methodsandtrends/combined-package-of-NRA-tools.html) - [FATF / MONEYVAL](https://www.fatf-gafi.org/en/countries/detail/Cyprus.html) - [Cyprus Securities and Exchange Commission (CySEC)](https://www.cysec.gov.cy/en-GB/home/) - [US Office of Foreign Assets Control (OFAC)](https://ofac.treasury.gov/recent-actions/20251124) - [European Commission (DG FISMA)](https://finance.ec.europa.eu/financial-crime/amla/about-amla_en) - [International Consortium of Investigative Journalists (ICIJ)](https://www.icij.org/investigations/cyprus-confidential/about-cyprus-confidential-investigation/) - [Organized Crime and Corruption Reporting Project (OCCRP)](https://www.occrp.org/en/news/cyprus-court-acquits-ex-parliament-president-mp-in-golden-passport-case) - [Council of the European Union](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [HM Treasury (UK)](https://www.gov.uk/government/publications/money-laundering-advisory-notice-high-risk-third-countries--2/money-laundering-advisory-notice-high-risk-third-countries--2) Coverage gaps fim-int-2026-07-07-G001: The authoritative Cyprus national N… fim-int-2026-07-07-G001: The authoritative Cyprus national NRA document (Ministry of Finance Concise NRA) returned a 404 error and could not be directly cited, forcing reliance on MONEYVAL/FATF characterisations instead of Cyprus's own risk self-assessment. [resolved] fim-int-2026-07-07-G002: Cyprus's specific 6AMLD national tr… fim-int-2026-07-07-G002: Cyprus's specific 6AMLD national transposition vehicle and status were not established this cycle; a dedicated transposition-tracking source is needed to confirm whether Cyprus has transposed in part, in full, or not yet. [resolved] fim-int-2026-07-07-G003: No direct confirmation of the Natio… fim-int-2026-07-07-G003: No direct confirmation of the National Sanctions Implementation Unit's current staffing or operational-capacity status was available beyond the 2025 legislative milestone and February 2025 tender record. [resolved] fim-int-2026-07-07-G004: Independent, non-leaked verificatio… fim-int-2026-07-07-G004: Independent, non-leaked verification of Cyprus corporate/trust beneficial-ownership data remains unavailable given the non-public UBO and trust registers. [resolved] fim-int-2026-07-07-G005: No EU-level or UK-level designation… fim-int-2026-07-07-G005: No EU-level or UK-level designation record was found contemporaneously mirroring the November/December 2025 OFAC designations of Cyprus-registered entities, leaving the extent of cross-regime listing convergence unconfirmed. [resolved] fim-int-2026-07-07-G006: Evidence on CySEC's blockchain-anal… fim-int-2026-07-07-G006: Evidence on CySEC's blockchain-analytics tooling and MiCA Article 60 broker expansion was limited to a single T3 vendor source; a T1/T2 corroborating source would strengthen the D6 RegTech-adoption assessment. [resolved] fim-int-2026-08-05-G001: Tier-D jurisdictions (Cambodia, Lao… fim-int-2026-08-05-G001: Tier-D jurisdictions (Cambodia, Laos, Mexico, Colombia) were not searched this cycle given the CY-bound dispatch scope. [resolved] fim-int-2026-08-05-G002: AMLA full direct-supervision onset … fim-int-2026-08-05-G002: AMLA full direct-supervision onset date is unresolved between 2027 and 2028 across vendor sources. [resolved] fim-int-2026-08-05-G003: No primary CySEC circular text was … fim-int-2026-08-05-G003: No primary CySEC circular text was located for the new sanctions-enforcement framework (in force since 1 August 2025); only trade-press mirrors. [resolved] fim-int-2026-08-05-G004: D4 (Conflict Finance) and D6 (Compl… fim-int-2026-08-05-G004: D4 (Conflict Finance) and D6 (Compliance Technology) domains carry thin coverage for Cyprus specifically this cycle. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No CY-specific beneficial-ownership registry update was independently re-verified against the Cyprus UBO Registry portal this cycle. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): The CySEC 9 July 2026 AML circular text itself was not independently retrieved; only single T3 legal commentary describing it. [resolved] fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D3'}): No enabler-jurisdiction professional-facilitator specific finding for Cyprus surfaced this cycle beyond the NSIU institutional reform. [resolved] fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', 'value': 'D4'}): No conflict-finance signal intersecting Cyprus surfaced this cycle; coverage remains thin for D4. [resolved] fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No primary DRCIP notice page was retrieved confirming the 2026 UBO annual confirmation window; relied on secondary law-firm reporting. [resolved] fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): No AMLA direct-supervision perimeter confirmation was located for whether any Cyprus-domiciled obliged entity is a selected directly-supervised entity. [resolved] fim-int-2026-10-11-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-10-11-G003 ({'scheme': 'financial_integrity', 'value': 'D4'}): No D4 (conflict finance) substantive Cyprus-specific finding was located this cycle. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No primary parliamentary bill text for the Markets in Crypto-Assets Bill of 2026 was retrieved this cycle; current confidence capped at Probable pending the official bill text. [open] fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, C… fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle due to pooled search budget prioritisation to CY; recorded as awaiting_primary_source rather than a confirmed no-change. [open] fim-int-2026-10-25-G001: No T1 primary legislative text of t… fim-int-2026-10-25-G001: No T1 primary legislative text of the NSIU Law 2025 located; sanctions-architecture claim capped at Probable. [open] fim-int-2026-10-25-G002: D2/D3/D4/D6/D8 domains have thin or… fim-int-2026-10-25-G002: D2/D3/D4/D6/D8 domains have thin or no coverage for Cyprus this cycle. [open] FIM-GAP-001 (D2): The seed-referenced authoritative national… FIM-GAP-001 (D2): The seed-referenced authoritative national NRA document (Ministry of Finance Cyprus Concise NRA, mof.gov.cy/assets/modules/wnp/articles/201811/448/docs/cy_concise_nra.pdf) returned a 404 error at execution and could not be directly read or cited verbatim as instructed. FIM-GAP-002 (D3): The Cyprus Bar Association's objections (c… FIM-GAP-002 (D3): The Cyprus Bar Association's objections (constitutional/language grounds, exclusion from the AML advisory role) delayed the National Sanctions Implementation Unit legislation past the EU's 20 May 2024 deadline, illustrating professional-body capture of reform timelines. FIM-GAP-003 (D2): Criminal prosecutions arising from the gol… FIM-GAP-003 (D2): Criminal prosecutions arising from the golden-passport scandal have largely failed at first instance, with the February 2026 acquittal of two senior former politicians the latest of three first-instance cases to founder, in one instance due to witnesses simply not being summoned. FIM-GAP-004 (D2): Cyprus's UBO registry (established 2021) a… FIM-GAP-004 (D2): Cyprus's UBO registry (established 2021) and trust registers remain non-public, limiting third-party and journalistic verification of beneficial ownership; investigators have repeatedly had to rely on leaked corporate-registry data (Cyprus Confidential) rather than official transparency mechanisms. FIM-GAP-005 (D5): Cyprus's virtual-asset supervisory framewo… FIM-GAP-005 (D5): Cyprus's virtual-asset supervisory framework remains rated partially compliant on FATF Recommendation 15, with MONEYVAL noting the unresolved question of host-country obligations for foreign-registered VASPs operating remotely into Cyprus, and an initially absent national VASP risk-mitigation action plan. FIM-GAP-006 (D1): Cyprus's government has historically linke… FIM-GAP-006 (D1): Cyprus's government has historically linked support for stricter shadow-fleet and shipping-sector sanctions to compensation for lost shipping-industry revenue (a sector worth ~8% of GDP), and its law firms continued servicing dozens of sanctioned oligarchs more than a year after the 2022 sanctions wave. ## Evidence #### Confidence-tiered claims 2026 annual Beneficial Ownership Register confirmation window opened 1 October 2026, closing 31 December 2026, applicable to all Cyprus companies, SEs and partnerships, required even absent any ownership change; automatic penalty of EUR 100 on day one plus EUR 50 per further day, capped at EUR 5,000 per entity. [[Source 1]](#sec-sources) Probable · 1 source CySEC Circular C800 (8 September 2026) informed Administrative Service Providers and Crowdfunding Service Providers of an AMLA public hearing on draft RTS under Article 40(2) of Directive (EU) 2024/1640 concerning risk-assessment methodology for non-financial sectors. [[Source 1]](#sec-sources) Probable · 1 source 21st EU Russia sanctions package adopted 23 July 2026, 218 designations (48 individuals, 170 entities), extending shadow-fleet support-services regime and introducing possible blanket third-country crypto-services ban; Cypriot compliance guidance followed. [[Source 1]](#sec-sources) Probable · 1 source Law No. 149(I)/2025 (25 July 2025) transposes EU Directive 2024/1226, criminalising intentional breach of EU sanctions; Law 150(I)/2025 establishes a National Sanctions Implementation Unit (EMEK) for enforcement cooperation with Europol, Eurojust and the EPPO. Standing-regime context, pre-dating this cycle's anchor. [[Source 1]](#sec-sources) Probable · 1 source Cyprus not FATF grey-listed; 4th Enhanced Follow-Up Report referenced in CoE Committee of Ministers papers of 23 September 2026 notes continued progress; Cyprus found compliant on 16 and partially compliant on 2 of remaining recommendations per the 2024 follow-up report; 6th-round onsite visit scheduled October 2028. [[Source 1]](#sec-sources) Probable · 1 source MiCA Article 143(3) transitional regime for Cyprus-registered CASPs expired 1 July 2026; CySEC issued post-expiry warnings within days. Standing-regime milestone reached before this cycle's anchor, carried for its effect on AML-obliged-entity scope. [[Source 1]](#sec-sources) Probable · 1 source 22nd EU Russia sanctions package adopted 12 October 2026, designating 1,569 individuals/entities (826 companies, 743 CEOs) in Russia's military-industrial complex. [[Source 1]](#sec-sources) Probable · 1 source Markets in Crypto-Assets Bill of 2026 submitted to Parliament on 8 October 2026, granting CBC/CySEC investigatory and enforcement powers and fines of €5m-€15m+ for serious breaches. [[Source 1]](#sec-sources) Probable · 1 source Cyprus remains under MONEYVAL's enhanced follow-up procedure (4th Enhanced FUR, adopted 12 May 2025, published 23 March 2026); no FATF Recommendation rated non-compliant; 6th-round mutual evaluation on-site visit scheduled October 2028. [[Source 1]](#sec-sources) Probable · 1 source CySEC warned investors about six websites offering or appearing to offer investment or crypto-asset services without required authorisation. [[Source 1]](#sec-sources) Probable · 1 source UK issued a separate package on 8 October 2026 (38 new designations) targeting oil, shadow-fleet shipping, payment platforms and crypto-exchanges, distinct from the EU's 22nd package. [[Source 1]](#sec-sources) Probable · 1 source Formally closed; Compliant/Largely Compliant on 38 of 40 FATF Recommendations, R.8 and R.31 remain Partially Compliant [[Source 1]](#sec-sources) Probable · 1 source AMLA operational since 1 July 2025, absorbed EBA AML mandates 1 January 2026; direct supervision of selected cross-border entities begins 2028; CySEC Circulars C748/C749 guide provisional-eligibility data collection [[Source 1]](#sec-sources) Probable · 1 source Operational since 10 July 2025 under NSIU Law 2025; administrative fines up to EUR 500,000 (plus EUR 500/day continuing violation); aligned with EU Directive 2024/1226; reported ~EUR 1.9bn in frozen Russian-held assets since 2022 [[Source 1]](#sec-sources) Probable · 1 source 572 disseminations in 2025, up ~70% year-on-year; 631 cases of information exchange with foreign counterparts [[Source 1]](#sec-sources) Probable · 1 source MiCA national transitional period for CASPs ended 1 July 2026; CySEC confirmed full MiCA enforcement from that date [[Source 1]](#sec-sources) Probable · 1 source