Cyprus AML Compliance 2026: Law 188(I)/2007, MOKAS, Supervisors & the New EU AML Package

What law governs anti-money laundering in Cyprus?

Cyprus's anti-money-laundering (AML) and counter-terrorist-financing (CFT) regime is built on the Prevention and Suppression of Money Laundering Activities Law of 2007 — Law 188(I)/2007, as amended. The law has been updated repeatedly to transpose successive EU directives: the 4th AML Directive (Directive (EU) 2015/849, transposed via Law 13(I)/2018) and the subsequent 5th and 6th Directives.

The law criminalises money laundering and terrorist financing, defines the entities that must comply ('obliged entities'), sets out their preventive obligations, and empowers MOKAS and the sector supervisors to enforce them. It sits alongside EU instruments that apply directly in Cyprus, including the Transfer of Funds Regulation and — from 2027 — the single EU Anti-Money Laundering Regulation.

General information, not legal advice. AML obligations are fact-specific and the supervisor for your sector issues binding directives; confirm your firm's exact duties with a Cyprus-qualified compliance adviser.

Who must comply (obliged entities)?

The AML obligations fall on 'obliged entities' — the businesses most exposed to laundering risk. In Cyprus these include:

• Banks and electronic money / payment institutions (supervised by the Central Bank of Cyprus)
• Cyprus Investment Firms (CIFs) and Administrative Service Providers (ASPs/fiduciaries) (supervised by CySEC)
• Crypto-Asset Service Providers (CASPs) registered with CySEC
• Auditors, external accountants and tax advisers (supervised by ICPAC)
• Lawyers and law firms when carrying out relevant financial/corporate transactions (supervised by the Cyprus Bar Association)
• Real-estate agents, dealers in high-value goods, and trust and company service providers

An ordinary trading company is not itself an obliged entity, but it is the customer of several (its bank, its accountant, its corporate-services provider) — so it must be ready to evidence its ownership, source of funds and business rationale during their due diligence.

Who supervises and enforces AML in Cyprus?

Cyprus uses a multi-supervisor model. MOKAS — the Unit for Combating Money Laundering — is the national Financial Intelligence Unit: it receives suspicious-transaction reports, analyses them, and can freeze assets and pass cases to prosecutors. Day-to-day supervision of obliged entities is split by sector:

What are the core AML obligations?

Every obliged entity must operate a risk-based AML programme. The pillars are:

1. 1Business-wide risk assessment — identify and document the entity's exposure to laundering/terrorist-financing risk across customers, products, geographies and channels.
2. 2Customer Due Diligence (CDD/KYC) — identify and verify each customer and its beneficial owner before onboarding, and understand the purpose and nature of the relationship.
3. 3Ongoing monitoring — scrutinise transactions through the life of the relationship and keep CDD information up to date.
4. 4Record-keeping — retain CDD documents and transaction records for the period required by law (generally five years after the relationship ends).
5. 5Compliance officer — appoint a Money Laundering Compliance Officer (and, where required, an internal AML/compliance function) with sufficient seniority and independence.
6. 6Suspicious-transaction reporting — file a Suspicious Transaction Report (STR) with MOKAS where there are reasonable grounds to suspect laundering or terrorist financing; do not 'tip off' the customer.
7. 7Staff training and independent review — train relevant staff and periodically test the programme's effectiveness.

Customer Due Diligence: the three levels

CDD is risk-based, so the depth of checks scales with the risk of the customer or transaction:

'Source of funds' (where the money for a specific transaction came from) and 'source of wealth' (how the customer's overall wealth was accumulated) are distinct — enhanced due diligence typically requires evidence of both.

Beneficial-ownership (UBO) obligations

Cyprus companies and other legal entities must identify their ultimate beneficial owners (UBOs) and file them in the UBO register maintained by the Registrar of Companies. The beneficial-ownership threshold is a holding or control of more than 25%. Obliged entities must also identify and verify the UBO as part of CDD — and discrepancies between what a customer declares and the register must be reported.

For a deeper treatment of the register itself — who must file, deadlines and penalties — see the dedicated UBO guide linked below.

How does the new EU AML package change things?

The EU has replaced its directive-by-directive approach with a single 'AML package' that harmonises the rules across all member states. Cyprus firms should track three moving parts, each labelled here by status:

• AMLA — the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (seated in Frankfurt) — is operational from 1 January 2026 (in force). It took over the AML/CFT mandate previously held by the European Banking Authority and will directly supervise certain high-risk cross-border financial entities.
• The single EU Anti-Money Laundering Regulation (AMLR) applies from 10 July 2027 (adopted; not yet applicable). Because it is a Regulation it will apply directly, replacing much of the member-state-by-member-state detail with one EU rulebook.
• The 6th AML Directive and the Transfer of Funds (crypto) Regulation complete the package, tightening rules on beneficial ownership, supervision and crypto-asset transfers.

Until the AMLR applies in July 2027, Law 188(I)/2007 and the Cyprus supervisors' directives remain the operative rulebook. Treat the AMLR as forthcoming, not current, law.

What are the penalties for non-compliance?

Money laundering is a criminal offence under Law 188(I)/2007 carrying, on conviction, imprisonment of up to 14 years. Separately, supervisors can impose administrative sanctions on obliged entities for failures in their preventive programme — ranging from directions and conditions to monetary fines, restriction or withdrawal of authorisation, and personal sanctions on responsible officers.

The reputational and banking consequences are often as material as the legal ones: AML findings can trigger loss of correspondent banking, account closures and reputational damage that outlasts any fine. A documented, risk-based programme is the practical defence.

Practical AML readiness for a Cyprus company

1. 1Map who holds AML duties over you — your bank, accountant/auditor (ICPAC-supervised) and corporate-services provider (CySEC-supervised) will each run CDD on you.
2. 2Keep a clean UBO record at the Registrar of Companies and ensure it matches what you tell your service providers.
3. 3Prepare a source-of-funds / source-of-wealth file for material transactions before you are asked.
4. 4Maintain genuine substance and a clear commercial rationale for the structure — opaque or purely tax-driven arrangements draw enhanced due diligence.
5. 5If you are yourself an obliged entity (e.g. an ASP, CIF or CASP), appoint a compliance officer, adopt a board-approved risk assessment and AML manual, and train staff to your supervisor's directive.

Key terms

• MOKAS — the Cyprus Unit for Combating Money Laundering; the national Financial Intelligence Unit.
• Obliged entity — a business legally required to apply AML preventive measures (banks, CIFs, ASPs, CASPs, accountants, lawyers, etc.).
• CDD / KYC — Customer Due Diligence / Know Your Customer: identifying and verifying customers and their beneficial owners.
• UBO — Ultimate Beneficial Owner: the natural person who ultimately owns or controls more than 25% of a legal entity.
• STR — Suspicious Transaction Report filed with MOKAS.
• AMLA — the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (operational 1 January 2026).
• AMLR — the single EU Anti-Money Laundering Regulation (applies from 10 July 2027).

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.