What do Cyprus's terrorism and sanctions laws provide, and what are the penalties?

The Combating of Terrorism and Victims' Protection Law of 2019 lists serious intentional acts, such as attacks on life, kidnapping, causing extensive destruction or interfering with essential supplies, which by their nature or context may seriously harm a country or an international organisation. They become terrorist offences when committed with one of three aims: seriously intimidating the public, unduly compelling public authorities or an international organisation to act or refrain from acting, or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or international organisation. A person convicted of a terrorist offence faces life imprisonment.

Many related acts are offences in their own right, whether or not an attack ever happens: threatening to commit a terrorist offence, taking part in a terrorist group, directing or organising one, supporting a terrorist group or listed persons, including by financing, giving or receiving training for terrorism, public provocation, recruitment, travelling for terrorism and organising such travel, aggravated theft, extortion or forgery linked to terrorism, and refusing to disclose information that could help prevent an offence. Directing a terrorist group carries life imprisonment; threats carry up to 10 years; most of the others carry imprisonment and/or a fine, such as up to 8 years and/or €150,000 for participation and support.

A legal person can be prosecuted for any offence under the law committed for its benefit by someone acting alone or as a member of one of its bodies who holds a leading position based on a power of representation, authority to take decisions, or authority to exercise control within it. It is also liable where a lack of supervision or control by such a person made the offence possible. The company's liability does not replace the individuals' liability.

A convicted company faces a fine of up to €850,000 and, depending on the offence, a ban on business activity, exclusion from public benefits, closure of premises, judicial supervision or winding up.

Until July 2025, Law 58(I)/2016 made any breach of UN Security Council sanctions or EU restrictive measures an offence, punishable by up to 2 years in prison and/or €100,000 for an individual, including a company director, and up to €300,000 for a company, with prosecution only with the Attorney General's approval. That law was repealed on 25 July 2025.

Law 150(I)/2025 now sets up the National Sanctions Implementation Unit and carries the 2-year, €100,000 and €300,000 penalties over to breaches of UN Security Council sanctions and national sanctions, unless another law sets a higher penalty; breaches of counter-terrorism measures, for example, carry up to 8 years under the terrorism law. Law 149(I)/2025 makes intentional breaches of EU restrictive measures criminal offences, together with grossly negligent breaches involving military or dual-use goods, with penalties graded by type and amount. For the main breaches, an individual faces up to 5 years and/or €100,000 where €100,000 or more is involved, and a company up to 5% of its total worldwide turnover in the previous year, or up to €40 million where turnover cannot be established. The detail of what firms must do is in the note on financial sanctions.

Each supervisory authority, CySEC included, ensures that sanctions are applied in the areas it supervises and can issue directives to its firms and take measures when they fail to comply. Obliged entities must have policies and controls to identify and manage the risk of sanctions breaches.