How do financial sanctions work for firms in Cyprus?

Sanctions are a foreign-policy tool of the UN and the EU, used to prevent conflict and to respond to crises that are emerging or already under way. Their aims are keeping the peace and strengthening international security, promoting international co-operation and protecting shared values and security, and upholding human rights, democracy and the rule of law.

They can be aimed at the governments of countries outside the EU for their policies, at companies that supply the means for those policies, at groups such as terrorist organisations, and at individuals who back the targeted policies or take part in terrorism. As a member of both organisations, Cyprus enforces UN Security Council sanctions adopted under Chapter VII of the UN Charter and the EU Council's restrictive measures. Since July 2025 the law also allows the Council of Ministers to impose national sanctions.

Asset-freeze sanctions are list-based. No funds or economic resources may be made available, directly or indirectly, to a listed person or entity or for their benefit, and everything they own, hold or control must be frozen. The rules apply inside the EU, to every EU national and every entity incorporated in a member state wherever they operate, and to any business done wholly or partly in the EU.

The UN and EU lists are public, so obliged entities screen customers, beneficial owners and payments against them during CDD and ongoing monitoring. A confirmed match is not a risk to be managed: the funds are frozen at once, information about them goes to the National Sanctions Implementation Unit within two weeks, and any suspicion of laundering or terrorist financing is reported to MOKAS. Information about possible sanctions breaches is also passed to the unit.

Every obliged entity needs proportionate policies, controls and procedures to manage the risk of sanctions breaches and to detect acts that breach or may breach them. CySEC-supervised firms record these measures in their risk management and procedures manual.

Sanctions regimes allow some activity under licence, such as paying basic living costs out of frozen funds, but approval must come first. Since July 2025 requests concerning financial sanctions go to the National Sanctions Implementation Unit, created within the Ministry of Finance by Law 150(I)/2025. It approves or rejects them, may set conditions, and its decisions can be challenged before the Minister of Finance within 20 days.

Before July 2025 there were two routes. A CySEC-supervised firm applied, through its AML compliance officer, to the sanctions implementation unit for the financial sector, whose recommendations went to three ministers for decision. Requests to release frozen money held in bank accounts went through the firm's bank to an advisory committee (SEOK), and the Minister of Finance decided. The new unit replaced both bodies and took over their pending requests and existing licences. Paragraph 36 of the CySEC Directive, as consolidated up to 2024, still describes the old route; the law now prevails.

Law 149(I)/2025 makes deliberate breaches of EU restrictive measures criminal offences. For the main breaches, such as making funds available to a listed person, failing to freeze or hiding who really owns frozen assets, an individual faces up to 5 years in prison and/or a €100,000 fine where €100,000 or more is involved, and up to 3 years and/or €50,000 below that. A company faces a fine of up to 5% of its total worldwide turnover, or up to €40 million where turnover cannot be established. Failures to report frozen assets carry lower penalties.

Breaching UN Security Council sanctions or national sanctions carries up to 2 years in prison and/or €100,000 for an individual and up to €300,000 for a company, unless another law sets a higher penalty; breaches of counter-terrorism measures carry up to 8 years under the terrorism law. The 2-year, €100,000 and €300,000 figures were the general penalties for sanctions breaches under Law 58(I)/2016, repealed in July 2025.