AML/CFT Compliance for Payment Service Providers
Payment institutions and electronic money institutions sit at the frontline of the EU’s anti-money laundering framework, given the speed and volume of transactions they process. Cyprus applies its AML/CFT legislation, itself derived from EU directives, to all licensed payment firms.
Customer Due Diligence
Payment firms must identify and verify the identity of their customers before establishing a business relationship, applying enhanced due diligence for higher-risk customers, such as those linked to politically exposed persons, high-risk jurisdictions, or unusual transaction patterns.
Ongoing Monitoring
Beyond initial onboarding, firms must continuously monitor customer transactions to detect activity inconsistent with the customer’s profile or expected behaviour, using a combination of automated transaction monitoring systems and manual review by trained compliance staff.
Risk-Based Approach
Cyprus AML law, like the broader EU framework, requires a risk-based approach, meaning firms must conduct a business-wide risk assessment covering their products, customer base, delivery channels and geographic exposure, and calibrate their controls accordingly rather than applying a one-size-fits-all approach.
Suspicious Transaction Reporting
Where a firm identifies activity it suspects may be linked to money laundering or terrorist financing, it must file a report with Cyprus’s Financial Intelligence Unit (MOKAS), and must not disclose to the customer that such a report has been made.
Governance and Staffing
Regulated payment firms are expected to appoint a suitably experienced Money Laundering Compliance Officer, provide regular AML training to staff, and maintain robust record-keeping to demonstrate compliance to both the Central Bank of Cyprus and MOKAS during inspections.
Building AML Into the Licence Application
A well-developed AML framework, tailored to the firm’s actual products and customer base rather than adapted from a generic template, is one of the most scrutinised elements of any payment institution application in Cyprus.
Enalian advises payment institutions, e-money institutions and fintech businesses on licensing, authorisation and ongoing regulatory compliance in Cyprus. If you are exploring a PSP or EMI licence, or need support with an existing authorisation, our team can help. Get in touch with our team to discuss your specific circumstances.
This article is provided for general informational purposes only and does not constitute legal, tax or regulatory advice. Regulatory requirements are subject to change; readers should seek specific advice on their circumstances before taking action.
