Who supervises firms for AML in Cyprus, and what fines can CySEC impose?

Each type of obliged entity has an AML supervisor. The Central Bank of Cyprus covers credit institutions, e-money institutions and payment institutions. CySEC covers Cyprus investment firms, investment funds that market their own units and the firms that manage them, the administrative service providers it licenses, crypto-asset service providers, and the Cyprus branches of these, as well as other persons assigned to it by law. Other authorities cover insurance, accountants (ICPAC), lawyers (the Cyprus Bar Association), estate agents, betting, casinos and dealers in works of art.

So a question about a bank's AML failings points to the Central Bank, not CySEC, and casinos or charities fall outside CySEC's remit. MOKAS, the financial intelligence unit, is not a supervisor at all.

A supervisor issues directives to the firms it supervises, which are binding on them; CySEC's AML Directive is the main example. It monitors, evaluates and supervises compliance with the law and its directives, on site and off site.

When it supervises on a risk basis, it must have a clear understanding of the money laundering and terrorist financing risks in Cyprus, have access on site and off site to the information it needs about firms' customers, products and services, and set the frequency and intensity of its inspections according to each firm's risk profile and the national risks. Supervisors must also stop people convicted of relevant crimes, or their associates, from holding management functions in or owning obliged entities.

If a supervised person fails to comply with the law or the supervisor's directives, the supervisor can require it to put things right within a set time. It can impose an administrative fine of up to €1,000,000 after giving the person a chance to be heard; up to twice the benefit gained where that benefit exceeds the €1,000,000 fine; and up to €1,000 for every day a breach continues. It can amend, suspend or withdraw a licence, temporarily ban people with management duties who are responsible, fine individuals whose fault, deliberate omission or negligence caused the breach, publish a statement naming the person and the breach, and order the conduct to stop. The same measures apply to repeated failures to send the required payer and payee information with transfers of funds or crypto-assets.

For credit institutions and financial institutions the ceilings are higher: a legal person can be fined up to €5,000,000 or 10% of its total annual turnover, or consolidated turnover for a group, and a natural person up to €5,000,000. Financial institutions in the law include Cyprus investment firms, investment funds that market their own units, crypto-asset service providers and life insurers, so this higher tier covers most CySEC-supervised firms, not only banks.

A company can be held liable for breaches committed for its benefit by a person in a leading position with powers of representation, decision-making or control, and also where poor supervision by such a person made the breach possible. In setting a fine, the supervisor considers the gravity and duration of the breach, the degree of responsibility, the person's financial strength, the profit gained, harm to third parties, cooperation and past breaches. Decisions are published on the supervisor's website once notified, but publication can be postponed, made anonymous or, in some cases, dropped where naming the person would be disproportionate or would threaten market stability or an investigation.