CySEC Circular C806: adopt AMLA's final rules on CDD and group-wide AML
Cyprus Securities and Exchange Commission (CySEC)Circular C806Issued
By the ExamPass CY editorial teamPublished
- AML/CFT
- Governance
Short answer
On 13 October 2026 CySEC issued Circular C806 to its regulated entities, including CIFs, ASPs, fund managers and CASPs. It points them to AMLA's three final draft RTS under the AMLR: customer due diligence, business relationships and linked transactions, and group-wide AML/CFT requirements. The standards still need Commission adoption and are proposed to apply six months after entry into force. CySEC urges firms to study the material and change their policies, checks, systems and procedures to adopt the new RTS.
At a glance
- What changes
- CySEC tells regulated entities that AMLA has finalised three sets of draft RTS under the AMLR and urges them to adapt their policies, checks, systems and procedures. The RTS are not yet law.
- Who is affected
- CIFs, ASPs, UCITS management companies, AIFMs, internally managed funds, CASPs, small AIFMs and crowdfunding service providers, and in particular their AML, onboarding and group compliance teams.
- Cyprus investment firms (CIFs) and administrative service providers (ASPs)
- UCITS management companies, AIFMs, small AIFMs, companies whose sole purpose is managing AIFLNPs, and internally managed UCITS, AIFs and AIFLNPs
- Crypto-asset service providers (CASPs)
- Crowdfunding service providers
- What to do
- Study AMLA's final reports and factsheets, map the gaps against current CDD, transaction-monitoring and group-wide procedures, and plan the changes CySEC asks for.
- By when
- Six months after the RTS enter into force (date not yet set; the Commission must adopt them first)
What does Circular C806 say?
With Circular C806, dated 13 October 2026 and following its earlier circulars C755 and C774, CySEC informs its regulated entities that AMLA, the EU's Anti-Money Laundering Authority, has finalised three sets of regulatory technical standards (RTS) under the EU Anti-Money Laundering Regulation (AMLR). AMLA has published the final reports on its website, together with factsheets.
The final draft standards have been submitted to the European Commission. Once adopted and published in the Official Journal of the EU, they are proposed to apply six months after their entry into force. CySEC urges regulated entities to study the published material and to adopt the content of the new RTS by making the necessary changes to their policies, checks, systems and procedures.
What do the three RTS cover?
The RTS under Article 28(1) AMLR cover customer due diligence: the customer information firms must collect and verify, proportionate measures for lower-risk cases, non-face-to-face verification, electronic identification, and screening of politically exposed persons, their family members and close associates.
The RTS under Article 19(9) AMLR set criteria for telling business relationships from occasional transactions, for identifying linked transactions and for lower thresholds, so that CDD thresholds are applied consistently. The RTS under Articles 16(4) and 17(3) AMLR set minimum requirements for group-wide AML/CFT arrangements, including governance, risk management, internal controls and secure information sharing, and additional measures for subsidiaries and branches in third countries.
When will the new rules apply?
Not yet. The Commission must first adopt the standards and publish them in the Official Journal. AMLA proposes that they apply six months after entry into force; for football agents and professional football clubs, from 10 July 2029.
CySEC's message is to use the time now. Compare onboarding, verification and screening procedures with the CDD standards, check how your systems separate business relationships from occasional and linked transactions, and, for firms in a group, review group-wide policies and any branches or subsidiaries outside the EU. See our study note on what CDD involves and our note on group-wide AML policies.
In the official wording
“adopt the content of the new RTS by proceeding with the necessary changes to their policies, checks, systems and procedures”
When does it apply?
Applies now
- Circular C806 asks no report or submission; CySEC urges regulated entities to study AMLA's material and adapt their policies, checks, systems and procedures to the new RTS.
Applies later
- The RTS are proposed to apply to football agents and professional football clubs (for other obliged entities: six months after entry into force, date not yet set).
What to do
- Read AMLA's final reports and factsheets on the RTS under Articles 28(1), 19(9), 16(4) and 17(3) AMLR.No fixed deadline
- Map gaps between current CDD, PEP screening and remote onboarding procedures and the CDD standards.No fixed deadline
- Check how systems distinguish business relationships, occasional transactions and linked transactions.No fixed deadline
- Groups: review group-wide AML/CFT policies, information sharing and measures for branches and subsidiaries in third countries.No fixed deadline
- Plan the changes to policies, checks, systems and procedures that CySEC asks for, and track Commission adoption to fix the application date.No fixed deadline
In the exam
Customer due diligence, politically exposed persons and group-wide AML policies are core topics of the CySEC AML Compliance Officer exam and of the AML material in the Advanced and Basic exams.
Related study notes
Preparing for an exam?
Practise the topics behind this update
Exam-style questions with a hint before you answer and a full explanation after, chapter by chapter.
Sources
- Circular C806: AMLA's Final Reports regarding the RTS under articles 28(1), 19(9), 16(4) and 17(3) of the AMLR (opens in a new tab)
CySECOfficial text
- Press Release: AMLA finalises key standards for the private sector (opens in a new tab)
AMLAOfficial text
Summary prepared by the ExamPass CY editorial team; it is not the official text. Quotations are reproduced from the source for the purpose of reporting and review.