When is enhanced due diligence required?

EDD is always added to the standard CDD measures and never replaces them. Beyond the cases the law names, a firm must apply it in any situation its risk assessment shows to be high risk, choosing measures that fit the specific risk.

Common measures fall into four groups. More information: about the identity, ownership structure, reputation and business of the customer and beneficial owner, including adverse media searches, and about the purpose of the relationship, the expected size and frequency of transactions and where funds will go. Better-quality information: for example requiring the first payment to come from an account held in the customer's own name at a bank whose CDD standards are at least as strict as the EU's, and verifying source of wealth and funds. More frequent reviews, with senior management approval to start or continue the relationship. And deeper transaction monitoring.

Source of wealth and funds can be verified from evidence such as pay slips, tax returns, public deeds, audited accounts or independent media reports. Where the risk is particularly high, that verification may be the only adequate way to manage it.

Under Cyprus law, a PEP is someone who holds, or has held, a prominent public function in Cyprus or any other country, together with their close family members and known close associates. The functions include heads of state and government, ministers, deputy ministers and assistant ministers; members of parliament or similar legislative bodies; members of political parties' governing bodies; judges of supreme and constitutional courts and other high-level courts whose decisions can be appealed only in exceptional circumstances; members of courts of auditors and central bank boards; ambassadors, chargés d'affaires and high-ranking officers of the armed and security forces; members of the administrative, management or supervisory bodies of state-owned enterprises; directors, deputy directors and board members of international organisations; and mayors. Middle-ranking and junior officials are not PEPs.

Close family members are the spouse or equivalent partner, the children and their spouses or partners, and the parents. Known close associates are people who jointly own a legal entity or arrangement with the PEP or have other close business ties, and people who are the sole owners of an entity set up for the PEP's benefit. The PEP measures apply to all of them.

First, it needs risk-based systems to find out whether a customer, or a customer's beneficial owner, is a PEP. When one is, the firm obtains senior management approval before starting or continuing the relationship, takes adequate steps to establish both the source of wealth and the source of funds involved, and conducts enhanced ongoing monitoring of the relationship.

Being a PEP is not a reason to refuse business; it is a reason for extra scrutiny. When a person leaves office, the firm keeps taking the continuing risk into account for at least 12 months, and longer if the PEP-specific risk has not gone.

For life and investment-related insurance, the firm checks whether a beneficiary, or the beneficiary's beneficial owner, is a PEP no later than the payout or the assignment of the policy. If so, or if the risk is higher, senior management is informed before the payout and the whole relationship with the policyholder is examined more closely.

The law gives a non-exhaustive list of factors a firm must at least consider. Customer factors: a relationship conducted in unusual circumstances; residence in a higher-risk area; personal asset-holding vehicles; companies with nominee shareholders or bearer shares; cash-intensive businesses; ownership that looks unusual or excessively complex for the business; and customers, or their beneficial owners, applying for residence or citizenship in Cyprus in exchange for investment.

Product and channel factors: private banking; products or transactions that could favour anonymity; business done without meeting the customer, unless safeguards such as electronic identification or recognised trust services are in place; payments from unknown or unrelated third parties; new products, practices or technologies; and transactions involving oil, arms, precious metals, tobacco, cultural artefacts, ivory or protected species. Geographic factors: countries without effective AML/CFT systems, with significant corruption or crime, under sanctions or embargoes such as those of the EU or UN, or that fund or support terrorism.

A high-risk third country is one the European Commission has designated for strategic weaknesses in its AML/CFT regime, or one the firm's own risk assessment rates as high risk. Business involving such a country triggers the EDD measures in the table. Branches and majority-owned subsidiaries of EU firms located there are the exception: if they fully follow group-wide policies, EDD is applied on a risk basis rather than automatically.

For correspondent relationships, the EDD package applies when a bank or financial institution enters into any cross-border correspondent relationship involving payments. Until October 2023 Cyprus law limited it to respondents outside the EEA, and older study material may still describe that version. Since June 2025, crypto-asset service providers apply similar checks to cross-border correspondent relationships with other crypto-asset businesses.