Which payment businesses and professions are vulnerable to money laundering?

A money transfer business takes cash from a customer and, through the banking system, has it paid out by an agent in another country. It usually works through a network of agents, which in Cyprus can be individuals or companies acting for payment institutions licensed in Cyprus or another EU state. Its customers include migrant workers sending money home and people who prefer it to a bank because fees are lower; abroad, it reaches remote areas with no formal banking.

Worldwide, the biggest threat to these services is misuse for terrorist financing. What makes them vulnerable to laundering is the mix of customers, reliance on agents, cross-border transfers and the amount of cash handled.

Card issuing and acquiring is more exposed to fraud, such as false or stolen identities, than to laundering. When cards are used to launder, it is at the layering or integration stage: criminal money already paid into an account is reached through a linked card, for example by withdrawing it at cash machines abroad.

A Cypriot electronic money institution needs authorisation from the Central Bank of Cyprus under the Electronic Money Law of 2012; institutions authorised in other EU states can also operate in Cyprus, and banks may issue e-money too. Prepaid cards and online wallets are fast, cheap and easy to use across borders, and customers are rarely met in person, which is the main challenge for these firms. Where products are kept to low limits, they are hard to use for storing large amounts of criminal wealth. Some e-money products can be exempted from certain CDD measures, but only where the risk is low and strict conditions are met, including a small stored value, use only for buying goods or services and no anonymous funding.

Virtual currencies, now covered in Cyprus law under the wider term crypto-assets, have no physical form: they are recorded digitally, kept in software wallets and transferred over the internet or private networks. They are a different thing from e-money, which is a claim on an issuer. Anyone can usually see the transactions, but not the people behind them, which gives users a high degree of anonymity. Crypto-asset service providers are now obliged entities in their own right, supervised by CySEC.

Trust and company service providers, called administrative service providers in Cyprus law, act as trustees and nominees, run company secretarial and administration work, keep accounts and manage trusts, and add services such as payroll and providing a registered address. They can create and run the company structures that launderers use to hide ownership. Under Law 196(I)/2012 three bodies supervise them: the Cyprus Bar Association for lawyers and law firms, the Institute of Certified Public Accountants of Cyprus (ICPAC) for accountants and audit firms, and CySEC for other administrative service providers, which it licenses. Each supervisor has issued its own AML directive.

Non-profit organisations are not obliged entities, but the national assessment discussed them alongside the non-financial professions because they have been abused internationally to raise and move money for terrorism, often behind a genuine charitable purpose. Cyprus has five main types: non-profit companies, charities, foundations or institutions, societies or associations, and clubs.