How are reporters protected, and should a suspicious transaction be carried out?

Customers are entitled to confidentiality, and staff might worry that reporting them breaches it. The law removes that worry. A disclosure made in good faith by an obliged entity, or by one of its employees or directors, under the reporting rules does not breach any contractual, legal, regulatory or administrative restriction on disclosing information, and does not make the firm, its directors or its staff liable in any way.

The protection holds even if the reporter did not know precisely what the underlying criminal activity was, and even if it turns out that no crime was committed. The test is good faith, not whether the suspicion proved right.

Employees who have reported suspicions have sometimes faced threats or hostility. The law therefore protects anyone, including employees and representatives of an obliged entity, who makes an internal report or a report to MOKAS from exposure to threats, retaliation or hostile action, and in particular from adverse treatment or discrimination at work. A person who suffers such treatment can complain securely to the relevant supervisory authority (CySEC for the firms it supervises) and has a right to an effective remedy.

This protection applies to internal reports to the AML compliance officer as well as to reports made to MOKAS.

As a rule, no. Obliged entities must refrain from carrying out transactions they know or suspect are linked to money laundering or terrorist financing until they have reported the suspicion to MOKAS. The report comes first; after that, the firm follows MOKAS's instructions on whether to go ahead, suspend the transaction or keep the account active.

There is a practical exception. If holding back is impossible, or could frustrate the prosecution of the people behind the suspected laundering or terrorist financing, the firm may carry out the transaction but must inform MOKAS immediately afterwards. Refusing abruptly in a way that alerts the customer can itself damage an investigation, and tipping off is an offence, so the decision should involve the compliance officer, who keeps in close contact with MOKAS.

No, in two situations. A firm that does not carry out, or delays, a transaction for a customer is not in breach of any contractual or other obligation to that customer if the reason is that the customer has not provided enough information about the nature and economic or commercial purpose of the transaction, or about the parties involved where the EU rules on transfers of funds and crypto-assets (Regulation (EU) 2023/1113) require it; or that the firm knows the money in the account or the transaction is likely to be linked to money laundering, terrorist financing or another criminal offence.

Article 71 sets no fixed number of days for such a delay and does not require the firm to compensate the customer. Delays on MOKAS's written instructions are covered separately: they are not a breach of contract either, and a MOKAS order to postpone or not carry out a transaction lasts up to 7 working days, renewable up to 30 working days in total.