Operating a holding firm in Cyprus brings considerable tax and structural advantages. Yet these benefits come with a parallel set of regulatory demands that investors cannot afford to overlook. The country’s anti-money laundering (AML) framework imposes specific duties on all registered entities, including holding vehicles.
This article examines the AML requirements in Cyprus that apply to holding structures, covering due diligence procedures, beneficial ownership registration, audit obligations, transaction monitoring, and the penalties for non-compliance. If you are considering establishing or already managing a Cyprus holding company, understanding these rules is essential for maintaining good standing.
The Legal Foundation Behind Cyprus AML Rules
The cornerstone of the AML framework in Cyprus is the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), as amended. This legislation transposes relevant EU directives into local law while incorporating recommendations from the Financial Action Task Force (FATF), the global standard-setter for preventing illicit financial flows.
The Central Bank of Cyprus is primarily responsible for overseeing financial institutions and enforcing these regulations. Meanwhile, the Cyprus Securities and Exchange Commission (CySEC) issues directives that affect investment firms and other regulated entities. In August 2024, CySEC published Directive R.A.D 282/2024, which updated requirements for customer identification, electronic verification protocols, and adverse media monitoring.
More recently, in May 2025, the Central Bank issued a new AML/CFT Directive (Κ.Δ.Π. 120/2025) that came into force on 2 June 2025. This directive strengthens governance mandates for boards and compliance officers, prohibits the complete outsourcing of compliance functions, and enables risk-based, proportional reviews rather than rigid schedules.
For holding structures, these laws impose obligations to identify the ultimately controller of the entity, monitor transactions, and report suspicious activity. The AML law extends its reach to all legal entities, not merely those engaged in day-to-day trading.
Who Must Comply With These Regulations
A common misconception is that AML obligations apply only to banks and financial institutions. This is not the case. Under Cyprus law, compliance requirements extend to:
- Credit and financial institutions
- Investment firms and fund managers
- Legal practitioners and accountants
- Auditors and tax advisors
- Real estate agents
- Trust and company service providers
- Crypto-asset service providers
A Cyprus holding company typically engages one or more of these professional service providers during formation and ongoing management. Those professionals bear direct AML responsibilities when providing services to the holding vehicle.
The holding entity itself may not be classified as an “obliged entity” under the strict legal definition. However, it remains subject to beneficial ownership reporting, annual audit requirements, and record-keeping standards. More importantly, banks and corporate service providers conducting due diligence on the holding firm will require extensive documentation before establishing any business relationship.
Key Regulatory Bodies in Cyprus
| Authority | Primary Role |
| Central Bank of Cyprus | Supervises banks, payment institutions, EMIs; issues AML directives |
| CySEC | Regulates investment services; enforces AML rules for the securities sector |
| MOKAS (Financial Intelligence Unit) | Receives suspicious transaction reports; conducts investigations |
| Registrar of Companies | Maintains beneficial ownership registry; enforces UBO reporting |
| ICPAC | Oversees accountants and auditors for AML compliance |
| Cyprus Bar Association | Ensures lawyers meet AML duties |
Understanding which body oversees which function helps when structuring a holding arrangement and selecting professional advisors.
Customer Due Diligence: What Service Providers Must Collect
When a Cyprus holding company opens a bank account, engages a corporate service provider, or seeks audit services, the professional firm must perform customer due diligence (CDD). This involves verifying who owns and controls the holding structure.
The Cyprus AML law under Section 61 specifies the procedures, which include:
For Natural Persons (Shareholders and Directors)
- Valid passport or national identity card
- Proof of residential address (utility bill, bank statement, or government-issued document dated within three months)
- Professional reference or curriculum vitae
- Source of wealth and source of funds documentation
For Corporate Shareholders
- Certificate of incorporation or equivalent extract (issued within six months)
- Constitutional documents (memorandum and articles of association)
- Register of directors and shareholders
- Beneficial ownership chart showing ultimate owners
- Board resolution authorising the relationship
- KYC documentation for all natural persons behind the corporate shareholder
The KYC form completed during onboarding requires disclosure of the purpose and intended nature of the business relationship. For a holding arrangement, this typically means managing investments, receiving dividends from subsidiaries, or consolidating group assets.
Banks in Cyprus have become particularly stringent since 2014, when the sector undertook substantial de-risking. Opening a corporate bank account for a holding structure can take anywhere from two to six weeks, depending on the complexity of the ownership chain and the jurisdictions involved.
Beneficial Ownership Registration Obligations
Every Cyprus company, partnership, and European Public Limited Company must register its beneficial owners with the Department of the Registrar of Companies and Intellectual Property. This requirement flows from the Prevention and Suppression of Money Laundering Directive (Κ.Δ.Π. 112/2021), as amended.
A beneficial owner is defined as any natural person who ultimately owns or controls the legal entity. The threshold is:
- Holding more than 25% of shares directly or indirectly
- Holding more than 25% of voting rights
- Exercising control through other means (shareholder agreements, significant influence)
Where no individual meets these criteria, the senior management officials must be registered instead.
What Information Must Be Submitted
The beneficial ownership register is electronic, and submissions are made through the government portal. No paper documents are filed. Required data includes:
- Full name, date of birth, and nationality of each beneficial owner
- Residential address and country of residence
- Nature of beneficial interest (direct, indirect, or both)
- Extent of ownership (percentage of shares, voting rights, or other control)
- Dates when ownership commenced or ceased
For holding structures where ownership passes through trusts or foundations, additional details about trustees, settlors, and beneficiaries must be disclosed.
Annual Confirmation Deadlines
Between 1 October 2025 and 31 December 2025, all Cyprus-registered companies must access the Beneficial Ownership Register system and confirm that their registered details remain accurate. Even if nothing has changed, the confirmation is mandatory.
Failure to complete this annual confirmation triggers penalties: €100 on the first day of non-compliance, plus €50 for each subsequent day, capped at €5,000. The Registrar can also initiate strike-off proceedings against entities that are persistently non-compliant.
Enhanced Due Diligence for Higher-Risk Scenarios
Standard CDD suffices for most straightforward holding arrangements. However, certain factors trigger enhanced due diligence (EDD), which requires service providers to gather additional information.
EDD applies when:
- Shareholders or directors are politically exposed persons (PEPs)
- The client is based in a high-risk third country identified by the EU or FATF
- The ownership structure involves complex, multi-layered entities
- Transactions appear unusually large or lack a clear economic purpose
- Adverse media links the client to corruption, fraud, or financial crime
Under EDD, service providers must:
- Obtain detailed source of funds and source of wealth evidence
- Secure senior management approval before establishing the relationship
- Conduct ongoing monitoring with increased frequency
- Document the rationale for accepting the client despite elevated risk
For a Cyprus holding company with shareholders from certain jurisdictions or with complicated ownership chains, expect banks and auditors to apply EDD procedures. This extends the onboarding timeline and increases documentation demands.
Transaction Monitoring and Suspicious Activity Reporting
Obliged entities must maintain systems to monitor transactions and identify patterns that may indicate money laundering or terrorist financing. When suspicious activities are detected, they have a legal duty to report these to MOKAS, the Cyprus Financial Intelligence Unit.
Suspicious transaction reporting applies whenever a service provider has knowledge or reasonable suspicion that:
- Funds derive from criminal activity
- A transaction is being attempted to launder the proceeds of crime
- The client is connected to terrorist financing
The AML law under Articles 64a and 70 mandates these reports. Failure to comply can result in substantial penalties and potential imprisonment for responsible individuals.
For a Cyprus holding company, transaction monitoring is typically performed by the bank where accounts are held. However, corporate service providers managing the entity may also flag unusual instructions, such as requests to transfer large sums to unrelated parties or jurisdictions with no apparent business rationale.
Record-Keeping and Documentation Standards
Effective record-keeping is fundamental to AML compliance in Cyprus. Obliged entities must retain comprehensive records for specified periods:
- Customer identification and verification documents: minimum five years after the business relationship ends
- Transaction records: minimum five years
- Due diligence documentation: minimum five years (seven years for higher-risk cases)
For a holding structure, this means maintaining:
- Certified copies of shareholder and director identification
- Beneficial ownership charts and supporting evidence
- Board minutes and resolutions
- Bank statements and transaction records
- Correspondence with service providers
- Audit files and financial statements
All supporting documents should be readily accessible for audit requests or regulatory inspections. Implementing a calendar with reminders for statutory deadlines helps avoid lapses.
Audit and Financial Reporting Requirements
Annual audited financial statements are required for all Cyprus companies, including holding vehicles. There is no exemption based on size or turnover. The audit must be conducted by a registered auditor approved by the Institute of Certified Public Accountants of Cyprus (ICPAC).
The financial statements must comply with International Financial Reporting Standards (IFRS). They should be filed with the Registrar of Companies, alongside the annual return, within the statutory deadlines.
Beyond the statutory audit, there is no requirement for an internal audit unless the holding operates in a regulated sector (such as financial services). However, best practice suggests conducting internal reviews of compliance controls, particularly for complex group structures.
Tax and Substance Considerations
Cyprus does not impose any debt-to-equity ratio requirements. A holding company can be funded entirely through shareholder loans, and arm’s-length interest paid to related parties remains deductible against taxable income. This flexibility distinguishes the jurisdiction from others that impose thin capitalisation rules.
However, to benefit from Cyprus’s double tax treaty network and avoid challenges under OECD BEPS initiatives, the holding must demonstrate genuine economic substance:
- Local directors who actively participate in management
- Board meetings held in Cyprus
- Physical office or serviced workspace on the island
- Local professional advisors (accountants, lawyers, auditors)
Without adequate substance, tax authorities in other countries may challenge the holding’s entitlement to treaty benefits.
Penalties for Non-Compliance
The consequences of ignoring AML obligations can be severe. Penalties vary depending on the nature and gravity of the breach:
Financial Penalties
- UBO registration failures: €100 first day, €50 per additional day, capped at €5,000
- AML compliance breaches: fines can reach €350,000 for serious lapses
- Late filing of accounts: escalating penalties based on the length of the delay length
Operational Sanctions
- Strike-off from the company register for persistent non-compliance
- Licence revocation for regulated entities
- Seizure and confiscation of assets connected to money laundering
Criminal Liability
- Imprisonment for individuals found guilty of money laundering offences
- Disqualification from holding directorships
- Prohibition orders preventing work in financial services
The establishment of the National Sanctions Implementation Unit (NSIU) in 2025 has further strengthened enforcement. This body investigates violations of EU and UN sanctions, processes exemption applications, and imposes administrative fines up to €100,000 plus €100 per day for ongoing non-compliance.
Practical Steps for Maintaining Compliance
Managing AML obligations need not be overwhelming if approached systematically. Consider the following:
- Engage Qualified Service Providers: Select corporate service providers, auditors, and legal counsel with proven AML expertise. They should understand the specific holding structure.
- Prepare Documentation Early: Gather all KYC materials before approaching banks or service providers. Delays in producing source-of-funds evidence or certified documents significantly slow down onboarding.
- Establish Internal Controls: Even for a passive holding with minimal transactions, maintain written policies covering beneficial ownership updates, transaction monitoring, and reporting procedures.
- Monitor Regulatory Changes: Cyprus AML rules evolve frequently. The CySEC directive was updated in 2024, and the Central Bank directive in 2025 demonstrates this. Subscribe to regulatory newsletters or rely on advisors who track developments.
- Calendar Statutory Deadlines: Mark the annual UBO confirmation period (October to December), annual return filing deadline, and tax return due dates. Missing these triggers results in automatic penalties.
- Review Substance Arrangements: Ensure the holding demonstrates genuine management from Cyprus. Schedule board meetings on the island, document local decisions, and use resident directors where possible.
Frequently Asked Questions
What are the main AML laws applicable in Cyprus?
The primary legislation is the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), as amended. This transposes EU directives, particularly AMLD4 and AMLD5, into Cypriot law. Additional regulations include CySEC Directive R.A.D 282/2024 for securities firms and the Central Bank’s AML/CFT Directive Κ.Δ.Π. 120/2025 for financial institutions. Together, these establish customer due diligence standards, suspicious activity reporting duties, and beneficial ownership registration requirements.
Is an independent audit mandatory for all Cyprus companies?
Yes. Every Cyprus-registered company, regardless of size, must prepare annual audited financial statements under IFRS. A registered auditor approved by ICPAC must perform the audit. There are no small company exemptions. The audited accounts must be filed with the Registrar of Companies within the statutory deadline, typically alongside the annual return. Failure to file on time triggers escalating penalties.
Do holding companies need their own AML policies?
Holding companies are not typically classified as “obliged entities” under the AML law unless they provide financial or professional services to third parties. However, their service providers, including banks, auditors, and corporate secretaries, must comply with AML regulations when dealing with the holding. The holding itself must register beneficial owners, maintain accurate records, and produce documentation for KYC purposes when requested by banks or regulators.
How often must beneficial ownership details be confirmed?
Cyprus-registered entities must access the Beneficial Ownership Register system annually, between 1 October and 31 December, to confirm that their recorded details remain accurate. Even if no changes occurred, explicit confirmation is required. Updates following changes in ownership must be submitted within 14 days of the change occurring. Failure to confirm or update triggers daily fines starting at €100.
Speak With Our Specialists
Navigating AML obligations alongside tax planning and corporate structuring demands requires experienced guidance. C. Savva & Associates LTD provides advisory services for Cyprus holding arrangements, covering regulatory compliance, beneficial ownership registration, and coordination with banks and auditors.
Contact our team in Nicosia to discuss your specific situation and ensure your holding structure meets all applicable requirements.