CySEC AML · Chapter 6 · Topic 3 of 14

When must customer due diligence be completed?

The rule that verification comes before onboarding, its two exceptions, and what a firm must do when CDD cannot be finished.

By the ExamPass CY editorial teamLast reviewed 25 September 20264 min read

Tested inAML · Ch 6 Advanced · Ch 7 Basic · Ch 8

Short answer

In Cyprus, the identity of the customer and the beneficial owner must be verified before a business relationship starts or a transaction is carried out. Two general exceptions exist: verification may be finished during onboarding when the risk is low and waiting would disrupt normal business, and an account with a bank or financial institution may be opened early if nothing can be transacted until verification is done. If CDD cannot be completed, the firm must not go ahead, must end any existing relationship and must consider reporting to MOKAS.

The timing rules at a glance

Situation	Rule
Default	Verify the customer and beneficial owner before the relationship starts or the transaction is carried out
Low risk, and waiting would disrupt normal business	Verification may be completed during onboarding, as soon as practicable after first contact
Opening a bank or other financial institution account	Allowed before verification if safeguards stop any transaction by or for the customer until the customer and beneficial owner are identified and verified
New company, trust or similar customer that must register its beneficial owners	Collect proof of registration or an extract from the register
Beneficiaries of life and other investment-related insurance	Verified at the latest when the policy pays out
CDD cannot be completed	Do not transact or onboard, end any existing relationship, consider a suspicious transaction report to MOKAS
Existing customers	Re-apply CDD at appropriate, risk-based moments, for example when their circumstances change

Source: Law 188(I)/2007, Articles 61 and 62.

What are the exceptions to verifying first?

The first covers onboarding itself. Verification may be completed while the relationship is being set up, but only if the money laundering and terrorist financing risk is low and waiting would interrupt the normal course of business. The firm must then finish as soon as practicable after the first contact.

The second covers accounts. A credit or financial institution may open an account, including one for dealing in transferable securities, before verification is complete, provided safeguards ensure that no transaction is carried out by or for the customer until the customer and beneficial owner have been identified and verified. Both exceptions only move the moment verification is completed; neither removes it.

A separate product rule applies to life and other investment-related insurance: the beneficiaries' identity may be verified at the latest when the policy pays out. If the policy is assigned, a firm that knows of the assignment identifies the beneficial owner of whoever receives it at the time of the assignment.

Terms used in this note

MOKAS: The Unit for Combating Money Laundering, Cyprus's financial intelligence unit, which receives suspicious transaction reports.
Business relationship: A professional or commercial relationship the firm expects, when contact begins, to last for some time.

What happens if CDD cannot be completed?

The firm must not carry out the transaction or open the relationship, must end any relationship already in place and must consider filing a suspicious transaction report with MOKAS. The rule applies to every obliged entity, crypto-asset service providers included.

There is one carve-out. The refuse-or-terminate rule does not bind independent lawyers, auditors, external accountants or tax advisers when they are assessing a client's legal position or defending or representing the client in legal proceedings.

Does CDD apply to existing customers?

Yes. CDD is repeated for existing customers whenever their risk calls for it: for example when their relevant circumstances change, or when the firm has a legal duty during the year to contact the customer to review beneficial ownership information, including under the rules on administrative cooperation in tax matters. Day-to-day checks between those moments are covered in What is ongoing monitoring?

How to think about it

Verification comes first; the exceptions only change when it finishes, never whether it happens. Is the risk low and would waiting break normal business? Finish during onboarding, quickly. Is it an account that can be frozen until checks are done? Open it, but let nothing move. If CDD still cannot be completed, walk away and consider reporting.

Common mistakes

Thinking higher risk justifies finishing verification later. Completing it during onboarding requires the risk to be low.
Letting a new account transact before verification is done. Every transaction must be blocked until the customer and beneficial owner are identified and verified.
Keeping an existing relationship open while CDD stays incomplete. It must be terminated.
Applying CDD only at onboarding. Existing customers are re-checked at risk-based moments.

Legal references

The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), as amended (opens in a new tab)
Article 62 (timing of verification) · Article 61 (CDD measures) · Articles 61A–61C (beneficial ownership registers)
CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing, as amended (opens in a new tab)

Practise this topic

Test what you just read

The Chapter 6 pack has 152 exam-style questions, 11 of them on this topic. Every question has a hint before you answer and a full explanation after.

Try the free demo

Or revise the numbers first with 18 free Chapter 6 flashcards →

Topic 1When is customer due diligence (CDD) required?Always for a new business relationship; for one-off transactions it depends on the amount and the type of business.Topic 2What does customer due diligence involve?The four CDD measures, and how the level of risk decides how far each one goes.Topic 11What is ongoing monitoring?Comparing real activity with the expected profile, and refreshing KYC after material changes.