Central Bank of Cyprus €750,000 AML/CFT fine on a credit institution (September 2026)

In an announcement of 30 September 2026, published under section 59(6A)(a) of the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007), the CBC said that on 29 September 2026 it decided to impose a fine of €750,000 on a credit institution that the CBC names as Banque SBA Cyprus.

According to the CBC, the decision rests on findings from an examination conducted during 2023. The institution failed to comply with certain provisions of the Law and of the CBC Directive to Credit Institutions for the Prevention of Money Laundering and Terrorist Financing, 5th edition of February 2019. The CBC explains that it may take measures under section 59(6) of the Law when a supervised entity does not comply with Part VIII of the Law or the relevant directives, and that the entity is given the opportunity to be heard before a final decision. The announcement does not identify the specific provisions breached.

Three points stand out. First, about three years passed between the examination and the fine, so findings from an inspection remain live until they are resolved and the evidence is on file. Second, the decision was measured against the directive that applied at the time; according to law-firm summaries, the CBC has since issued a new AML/CFT Directive (R.A.A. 120/2025), in force since 2 June 2025, which covers credit, payment and electronic money institutions among others. Third, the CBC's AML/CFT page lists the measures available under section 59(6), which include fines and the amendment, suspension or revocation of a licence.

For the wider system of AML supervisors in Cyprus, see our study note on AML supervisory authorities.

Because the CBC does not say what went wrong, the checks below are general good practice, not a description of this case. Confirm that your AML/CFT policy, procedures and customer risk assessment refer to the version of the supervisor's directive now in force, and record when each was last reviewed.

Keep a register of every finding from supervisory examinations, internal audit and external reviews, with an owner, a deadline and evidence of closure. Test a sample of customer files for customer due diligence, ongoing monitoring and record-keeping, and make sure the results reach senior management and the board through the AML compliance officer's reporting.

Firms supervised by CySEC rather than the CBC can run the same exercise against CySEC's own AML directive. Remediation plans should also look ahead: from 10 July 2027 the EU Anti-Money Laundering Regulation applies directly, so a fix designed today should still work under the new rulebook.