How are suspicious transactions reported internally and to MOKAS?
The two internal documents, who writes each one, when and how the AML compliance officer reports to MOKAS through goAML, and what happens after a report is filed.
By the ExamPass CY editorial teamLast reviewed 5 min read
Topic 2 of 4 · all topics in this chapter
Short answer
Staff with knowledge or even a slight suspicion of money laundering or terrorist financing send a written Internal Suspicion Report, without delay, to the AML compliance officer, a senior manager with the right skills. The compliance officer evaluates it against all available information and records the result in an Internal Evaluation Report, giving full reasons if deciding not to report. When the firm knows or reasonably suspects that funds, whatever the amount, are criminal proceeds or linked to terrorist financing, the compliance officer reports to MOKAS immediately through goAML. Attempted transactions are reported too.
Reporting at a glance
| Step | Rule |
|---|---|
| Internal Suspicion Report | Written by the employee who has knowledge or even a slight suspicion, sent without delay to the AML compliance officer |
| Internal Evaluation Report | Written by the AML compliance officer; full reasons if deciding not to report |
| AML compliance officer | A member of senior management with the ability, knowledge and expertise, and direct access to the firm's information |
| When to report to MOKAS | Immediately, on the firm's own initiative, on knowledge or reasonable suspicion, whatever the amount; attempts included |
| How | Through goAML, MOKAS's online reporting system; the firm must be able to print the report at any time |
| After the report | Close monitoring of the accounts involved and connected accounts; MOKAS's instructions followed; the compliance officer is MOKAS's first point of contact |
| Not required | Proof of a crime, board approval, or a minimum amount |
Source: Law 188(I)/2007, Article 69, as amended up to 2026; CySEC AML Directive, paragraphs 9(1)(e) to (i), 27, 29, 30 and 34.
How does the internal reporting route work?
Every obliged entity must appoint an AML compliance officer: a member of senior management with the ability, knowledge and expertise to receive reports from staff about anything that, in their opinion, shows or raises a suspicion that someone is involved in money laundering or terrorist financing. The compliance officer must have direct and timely access to the firm's other information, data and documents.
An employee who has knowledge or even a slight suspicion writes it up in an Internal Suspicion Report and sends it to the compliance officer without delay. The compliance officer weighs it against everything else the firm knows, discusses the case with the employee and, where appropriate, with the employee's superiors, and records the evaluation in an Internal Evaluation Report. So the employee writes the first document and the compliance officer writes the second.
If the compliance officer decides not to report to MOKAS, the Internal Evaluation Report must explain the reasons in full. That record matters if the decision is questioned later by CySEC or MOKAS.
Terms used in this note
- Internal Suspicion Report
- The written report an employee sends to the AML compliance officer describing their knowledge or suspicion of money laundering or terrorist financing.
- Internal Evaluation Report
- The compliance officer's written evaluation of an internal report, including the decision on whether to report to MOKAS and the reasons.
- goAML
- The online system through which obliged entities in Cyprus submit suspicious transaction reports to MOKAS.
When and how is a report made to MOKAS?
When the firm knows or has reasonable grounds to suspect that funds, whatever the amount, are the proceeds of crime or are related to terrorist financing, it must make sure that MOKAS is informed immediately and on its own initiative, through the compliance officer, and must give MOKAS, without delay, all the information it asks for. The duty covers attempted suspicious transactions as well as completed ones. No proof of a crime is needed, and no approval from the board or senior management.
The compliance officer submits the report, formally the Compliance Officer's Report to the Unit for Combating Money Laundering, as soon as possible through goAML, MOKAS's online reporting platform, and the firm must be able to produce a printed copy at any time. CDD thresholds such as €15,000 have nothing to do with the reporting duty.
What happens after a report is filed?
After filing, the compliance officer closely monitors the accounts involved and any connected accounts and, following MOKAS's directions, examines their transactions thoroughly. The firm follows MOKAS's instructions, in particular on whether to continue or suspend a transaction or keep an account active, and must be able to provide promptly information such as the account holders, beneficial owners and authorised persons, volumes of funds, connected accounts, and the origin, form and destination of specific funds.
The compliance officer is MOKAS's first point of contact once an investigation starts and throughout it. If the firm later wants to end the relationship, it must take particular care not to alert the customer that a report was made, and it keeps in close touch with MOKAS so as not to frustrate the investigation. The board or senior management are told about filings periodically, as part of the compliance officer's reporting.
How to think about it
Two documents, two authors: the employee writes the Internal Suspicion Report, the compliance officer writes the Internal Evaluation Report. Then one decision, taken by the compliance officer: report to MOKAS immediately through goAML, or record full reasons for not reporting. Amount, proof and board approval never enter into it, and an attempted transaction counts as much as a completed one.
Common mistakes
Having the compliance officer write the Internal Suspicion Report. The employee writes it; the compliance officer writes the Internal Evaluation Report.
Seeking board approval before reporting. The compliance officer reports on the firm's behalf; no board approval or proof of a crime is required.
Ignoring transactions that were only attempted. The duty to report includes attempts to carry out suspicious transactions.
Deciding not to report without a record. The reasons must be set out in full in the Internal Evaluation Report.
Closing the account abruptly after a report. Any exit must avoid alerting the customer, in liaison with MOKAS.
Legal references
- The Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007), consolidated Greek text on CyLaw (amendments up to Law 25(I)/2026) (opens in a new tab)
Article 69: internal reporting, reporting to MOKAS and giving MOKAS requested information without delay · Article 48: tipping off
- CySEC Directive for the Prevention and Suppression of Money Laundering and Terrorist Financing, as amended (opens in a new tab)
Paragraph 9(1)(e) to (i): internal reports, evaluation and reporting · Paragraph 27: attempted transactions · Paragraph 29: report through goAML and after filing · Paragraph 30: information for MOKAS · Paragraph 34: employees report without delay
- MOKAS goAML reporting platform (opens in a new tab)
Practise this topic
Test what you just read
The Chapter 7 pack has 53 exam-style questions, 15 of them on this topic. Every question has a hint before you answer and a full explanation after.
Or revise the numbers first with 15 free Chapter 7 flashcards →