What does the AML/CFT Law prohibit outright?

A shell bank is a credit or financial institution, or an institution doing equivalent business, incorporated in a jurisdiction where it has no physical presence involving real management, and which is not part of a regulated financial group. With no one on the ground to supervise, it can move money for anyone with little scrutiny.

Banks and other financial institutions may therefore not enter into, or continue, a correspondent relationship with a shell bank. They must also assess, and take the necessary measures to ensure, that they do not enter into or continue correspondent relationships with an institution that lets a shell bank use its accounts, since that would give the shell bank access through the back door. Other correspondent relationships are covered in When is enhanced due diligence required?

No firm may open or maintain an anonymous or numbered account, an account in a name that differs from the one in the customer's official identity documents, or an anonymous safe-deposit box. Every account must be traceable to a verified person.

Beyond the outright bans, firms must pay particular attention to products and transactions that could favour anonymity, take measures where needed to stop them being misused, and apply reasonable measures against the risks that new technology and new financial products bring. Before launching new products, business practices or delivery channels, or using new or developing technologies for new or existing products, they identify and assess the money laundering and terrorist financing risks and take measures to manage and reduce them.

Processing personal data under the AML/CFT Law is subject to the GDPR and Cyprus's data protection law, and it counts as a matter of public interest. Firms may process the data only for the purposes the AML/CFT Law sets. Using it for anything else, such as marketing or other commercial purposes, is prohibited.

Before a relationship starts or an occasional transaction is carried out, the firm gives new customers the information the GDPR requires and a notice explaining that it must process their personal data to prevent money laundering and terrorist financing.

A customer's right to see the data held about them can be restricted in two situations: so the firm or the supervisory authorities can carry out their AML/CFT duties properly, and so official inquiries and investigations are not obstructed and the detection of money laundering and terrorist financing is not put at risk. Convenience or cost is not a ground.