What this chapter covers
Customer due diligence (CDD) is how a regulated firm finds out who it is dealing with before it accepts a customer, and how it keeps that picture up to date afterwards. Know your customer (KYC) is the everyday name for the same work. In Cyprus the rules come mainly from Law 188(I)/2007 on the prevention and suppression of money laundering and terrorist financing, and from CySEC's AML Directive, which together implement the EU anti-money laundering directives.
Every obliged entity must run AML policies, controls and procedures in proportion to its nature and size. They cover, among other things, due diligence, record keeping, internal reporting, internal control and risk management, compliance management, ongoing staff training, and a closer look at complex or unusually large transactions and those with no apparent economic or lawful purpose. The notes below take the due diligence part one question at a time.
Read them in order the first time. The first three explain when CDD applies and what it involves; the rest cover identifying customers, scaling checks to risk and what happens after onboarding.
The 14 topics
Each note starts with a short answer and a table of the facts to remember.
When CDD applies
- When is customer due diligence (CDD) required?Always for a new business relationship; for one-off transactions it depends on the amount and the type of business.€15,000€1,000€2,000€10,000 cash cap5 min
- What does customer due diligence involve?The four CDD measures, and how the level of risk decides how far each one goes.4 measures5 min
- When must customer due diligence be completed?Before onboarding, with two narrow exceptions, and what to do when CDD cannot be completed.4 min
Knowing the customer
- How do you verify an individual's identity and address?An original photo ID from a reliable source, plus separate proof of address.6 months4 min
- How do you verify a company or other organisation?The entity, its directors, its beneficial owners and everyone who can operate the account.3 min
- What is a customer's economic profile?The expected pattern of activity that ongoing monitoring is measured against.3 min
- Who can see beneficial ownership registers in Cyprus?Full access for authorities, limited data for others, and fines for missing trust filings.25% + 1 share€5,000 cap7 min
Scaling checks to risk
- When can simplified due diligence be used?What SDD may reduce, what it never removes and when it is not allowed.5 min
- When is enhanced due diligence required?Extra measures for politically exposed persons, high-risk countries and other higher-risk cases.12 months7 min
- How does CDD differ by sector?Wealth management, investment firms, investment funds and the securities sector.Yearly review7 min
Monitoring, reliance and limits
- What is ongoing monitoring?Comparing real activity with the expected profile, and refreshing KYC after material changes.5 min
- Can a firm rely on a third party for CDD?Who can be relied on, what must be checked first and why responsibility never moves.5 min
- How do AML rules apply across a group?Group-wide policies, host-state rules inside the EU, and the Cyprus standard in third countries with weaker rules.4 min
- What does the AML/CFT Law prohibit outright?Anonymous accounts, shell-bank relationships and using AML data for other purposes.5 min
The numbers to know
Every figure in this chapter, with the note that explains it.
| Figure | What it is | Note |
|---|---|---|
| €15,000 or more | CDD threshold for occasional transactions, single or linked | Topic 1: When is customer due diligence (CDD) required? |
| More than €1,000 | CDD threshold for transfers of funds | Topic 1: When is customer due diligence (CDD) required? |
| €1,000 or more | CDD threshold for occasional transactions by crypto-asset service providers | Topic 1: When is customer due diligence (CDD) required? |
| €2,000 or more | CDD threshold for gambling: stakes, winnings or both | Topic 1: When is customer due diligence (CDD) required? |
| Up to €10,000 | Most that anyone trading in goods or services may pay or accept in cash, since 31 December 2024 | Topic 1: When is customer due diligence (CDD) required? |
| €150 | Most that can be stored on e-money covered by the CDD exemption | Topic 2: What does customer due diligence involve? |
| More than €50 | Cash redemption or remote payment that ends the e-money exemption | Topic 2: What does customer due diligence involve? |
| 6 months | Maximum age of a utility bill, tax bill or bank statement used as proof of address | Topic 4: How do you verify an individual's identity and address? |
| 25% plus one share | Shareholding that indicates beneficial ownership of a company | Topic 7: Who can see beneficial ownership registers in Cyprus? |
| €100 + €50 a day | Penalty for not filing trust information with the register, capped at €5,000 (since December 2024) | Topic 7: Who can see beneficial ownership registers in Cyprus? |
| 12 months | Minimum time the continuing risk of a former politically exposed person is taken into account | Topic 9: When is enhanced due diligence required? |
| At least yearly | Review of higher-risk customers in wealth management | Topic 10: How does CDD differ by sector? |