Cyprus

Section 2B(1) allows persons who trade in goods or provide services, including in real estate, to accept or make cash payments only up to €10,000, in one payment or several apparently linked ones. Payments between private individuals acting non-professionally, certain payments at credit institutions, e-money issuers and payment service providers, and payments by casino customers are excluded (s. 2B(2)). Breach is an offence punishable by a fine of up to 10% of the cash received, imprisonment of up to five years, or both (s. 2B(3)).

Section 8(2) requires private-sector legal persons with 50 or more employees, and all public-sector legal persons, to set up internal reporting channels, with exemptions for small local authorities and for entities covered by listed EU acts regardless of size. Section 9(1) requires confidentiality, acknowledgement of a report within seven days, an impartial person or department to follow up, and feedback within a reasonable period of no more than three months from the acknowledgement.

Section 68(1) requires records of due diligence, transactions and correspondence to be kept for five years after the end of the business relationship or the date of an occasional transaction. Under section 68(1A) the entity may keep them for up to five further years where this is reasonably justified to prevent, detect or investigate money laundering or terrorist financing. Section 68(2) requires records to be given promptly to MOKAS and the supervisory authority.

Section 69 requires every obliged entity to designate a compliance officer who receives internal reports and decides whether they show suspicion. Where an entity knows or reasonably suspects that funds of any amount are proceeds of illegal activity or linked to terrorist financing, MOKAS must be informed promptly (άμεσα), attempted transactions included, and further information requested by the Unit must be supplied without delay (αμελλητί). Independent legal professionals, auditors, external accountants and tax advisers are exempt for information obtained while assessing a client's legal position or in legal proceedings.

Article 5(1) allows a payment institution with Cyprus as home Member State to provide payment services only after prior authorisation from the Central Bank, and limits authorisation to legal persons established in Cyprus with registered and head office there. Article 5(3) sets out the application, including a programme of operations, a three-year business plan, evidence of initial capital under Article 7, and descriptions of governance, internal controls, security policies and business continuity.

Article 64(5) requires crypto-asset service providers to keep policies, procedures and controls that identify and assess the money laundering and terrorist financing risks of transfers to or from self-hosted addresses, and to apply risk-based measures such as identifying and verifying the originator or beneficiary, asking for information on the source and destination of the assets, and enhanced monitoring. Article 64(1)(β1) adds checks on counterpart providers in cross-border relationships. Section 60(β)(ii) refers fund transfers above €1,000 to Regulation (EU) 2023/1113; the Cypriot text read contains no separate travel-rule provision.