Κείμενο
This study was prepared in the context of the Jean Monnet Center of Excellence AI-2-TRACE-CRIME and was funded by the European Union. Views and opinions expressed are however those of the author only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
1. Introduction
The global fight against money laundering and terrorist financing (AML/CFT) is anchored in the framework established by the Financial Action Task Force (FATF), particularly its 40 Recommendations. Although they constitute soft-law, FATF standards have been accepted internationally as a document of reference in AML/CFT, with a high level of compliance observed among FATF members. Within this context, the Council of Europe’s Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism (MONEYVAL) plays an important role in assessing AML/CFT compliance among its member states, including Cyprus, using the FATF standards as a benchmark in this exercise.
Cyprus underwent its Fifth Round Mutual Evaluation in December 2019, resulting in its placement under enhanced follow-up due to identified deficiencies in technical compliance and effectiveness across several FATF Recommendations. Subsequent follow-up reports tracked the progress of Cyprus in addressing these shortcomings. The most recent follow-up report, adopted by MONEYVAL in December 2023 and published in May 2024, which will be examined in more detail below, provides a critical assessment of Cyprus’s efforts to rectify these deficiencies, with a particular focus on FATF Recommendations 8 (Non-Profit Organisations) and 15 (New Technologies).
This article aims to critically evaluate Cyprus’s advancements as detailed in the MONEYVAL reports, analyzing the effectiveness of implemented measures and identifying areas that require further improvements. It is worth noting that there have been significant challenges related to the regulation of non-profit organisations and the oversight of virtual assets and service providers, which are not unique in the Cypriot case. In this context, the article seeks to provide a comprehensive understanding of Cyprus’s current AML/CFT landscape and its alignment with FATF standards.
2. The Context and Methodology of MONEYVAL Follow-Up
The evaluation of a country’s AML/CFT framework is a complex process that extends beyond the mere enactment of laws. It also encompasses the implementation of these measures, as well as their effectiveness in practice. To this end, the FATF uses the tools of ‘mutual evaluations’ and it has developed a detailed methodology to assess both technical compliance and effectiveness. This approach is also utilized by FATF-style bodies and regional bodies, including MONEYVAL.
MONEYVAL, as a monitoring body of the Council of Europe, conducts mutual evaluations of its member states to assess compliance with international AML/CFT standards. These evaluations are based on the FATF’s 40 Recommendations and focus on two key components: technical compliance and effectiveness. The first aspect evaluates whether a country has the necessary legal and institutional frameworks in place to meet the requirements of the FATF Recommendations. The second component assesses how well these frameworks are implemented in practice and the extent to which they achieve the desired outcomes in AML/CFT.
Following a mutual evaluation, countries are subject to a follow-up process to monitor their progress in addressing identified deficiencies. This process includes the submission of follow-up reports and, where appropriate, requests for re-rating of specific Recommendations.
According to MONEYVAL, there is an expectation that countries will have addressed most, if not all, technical compliance deficiencies by the end of the third year following the adoption of their Mutual Evaluation Report (MER). Specifically, a country should have at least 36 out of the 40 Recommendations rated as “Compliant” or “Largely Compliant,” with none of the six core Recommendations (3, 5, 6, 10, 11, and 20) rated as “Non-Compliant” or “Partially Compliant”.
The re-rating process involves a thorough analysis by MONEYVAL, which assesses the information provided by the country to determine whether sufficient progress has been made to warrant a change in rating. This analysis is then presented to the MONEYVAL Plenary for discussion and decision.
Cyprus underwent its Fifth Round Mutual Evaluation in December 2019, which identified several areas of non-compliance and led to its placement under enhanced follow-up. Subsequent follow-up reports were issued in December 2021 and November 2022. The Third Enhanced Follow-Up Report, adopted by MONEYVAL in December 2023 and published in May 2024, provides a critical assessment of Cyprus’s measures that aimed to address these deficiencies.
As of the 2023 report, Cyprus had achieved “Compliant” or “Largely Compliant” ratings on 37 out of the 40 Recommendations, including all six core Recommendations. Despite this progress, the country remains under enhanced follow-up, indicating that further improvements are necessary to fully align with international AML/CFT standards. Thus, the country is required to report back to MONEYVAL on progress to strengthen its implementation of AML/CFT measures by May 2025.
3. Cyprus’s General Compliance Trajectory Since the 2019 Mutual Evaluation Report
MONEYVAL’s Fifth Round Mutual Evaluation Report on Cyprus identified several areas where Cyprus needed improvement, particularly in understanding and mitigating terrorist financing risks, applying a risk-based approach to the non-profit sector, and enhancing the effectiveness of its financial intelligence unit.
The MER rated Cyprus as “Partially Compliant” (PC) in some key Recommendations, including Recommendation 8 (Non-Profit Organisations) and Recommendation 15 (New Technologies). These ratings indicated deficiencies in the country’s legal and institutional frameworks, as well as in the practical implementation of AML/CFT measures.
By December 2023, Cyprus had made significant strides in addressing the deficiencies identified in the 2019 MER. Cyprus succeeded in achieving “Compliant” or “Largely Compliant” ratings in 37 out of the 40 FATF Recommendations, including the six core ones, mentioned earlier.
Notably, Cyprus’s rating for FATF Recommendation 15 (New Technologies) was upgraded from “Partially Compliant” to “Largely Compliant,” reflecting improvements in the regulation and supervision of virtual assets and service providers. However, FATF Recommendation 8 (Non-Profit Organisations) remained at “Partially Compliant,” indicating that further work was needed to fully align with FATF standards in this area. As a result, despite the progress made, Cyprus remains under MONEYVAL’s enhanced follow-up process. Clearly, Cyprus has demonstrated a strong commitment to improving its AML/CFT framework, achieving
substantial compliance with most FATF Recommendations. However, ongoing challenges in specific areas highlight the need for continued focus and resources to ensure full alignment with international standards.
4. Persistent Deficiencies in Recommendation 8: Regulation of Non-Profit Organisations
Despite notable strides in enhancing its AML/CFT framework, Cyprus continues to face significant challenges in fully aligning with Recommendation 8 of the FATF, which pertains to the regulation of non-profit organisations (NPOs). The 2023 MONEYVAL Third Enhanced Follow-Up Report maintained Cyprus’s rating as “Partially Compliant” in this area.
A key element of effective NPO regulation is a comprehensive risk assessment that identifies potential vulnerabilities to terrorist financing abuse. While Cyprus has initiated efforts to assess TF risks within the NPO sector, these assessments remain incomplete and lack depth. Notably, the risk assessment does not fully encompass non-profit companies, which are a component of the NPO landscape in Cyprus. This omission hampers the authorities’ ability to develop targeted and effective mitigation strategies.
Furthermore, the existing assessments have not been sufficiently disseminated among relevant stakeholders, limiting their practical utility. The absence of a consolidated and detailed risk profile for the NPO sector impedes the development of proportionate and risk-based regulatory measures.
Engagement with the NPO sector is also important for developing a collaborative approach to AML/CFT compliance. However, Cyprus’s outreach efforts have been limited in scope and effectiveness. While the Ministry of Interior has issued a best practices report aimed designed to be used as a self-diagnostic tool by NPOs compliance, the impact of this initiative has been constrained by insufficient follow-up and a lack of tailored guidance addressing the specific risks identified in the sector. MONEYVAL correctly points out that some requirements contained in the best practices paper seem to place excessive burden to NPOs that are lower risk and/or have limited capacity to implement the best practices (e.g., due to small size/scope of the activities). This is problematic, since it can potentially discourage legitimate NPO activities.
To address the deficiency identified in the MER, Cyprus has amended “Associations and Foundations and other related matters Law”, however, sanctions foreseen in this law do not apply to charities (regulated by Charities Law) and Non-profit companies. The second Follow-up-Report correctly pointed out that a large number (2,446) of NPOs registered under the previous Societies and Institutions Law of 1972 have been deleted from the register for non-compliance reasons, such as anomalies with funding and in the preparation of financial statements. Therefore, these NPOs have lost their legal ability to operate, while their property has been alienated. The scope of sanctions for breaching the Societies and Institutions Law is limited to striking from the register and dissolution, but this is still an important sanction. Moreover, extensive de-registration raises concerns about proportionality and potential unintended consequences. The ability to investigate and respond to TF threats within the NPO sector is a fundamental aspect of AML/CFT compliance. According to MONEYVAL, Cyprus has not demonstrated that law enforcement authorities and other competent authorities possess specific investigative expertise and capability to examine NPOs exploited for terrorist activities or by terrorist organisations. Additionally, MONEYVAL points out that there is no specific mechanism to ensure that information related to suspicion of terrorism financing involving an NPO is shared promptly with the competent authorities. The absence of a designated point of contact for inquiries related to terrorism financing further exacerbates this issue, potentially hindering timely and effective responses to cross-border threats.
Addressing these legal and structural deficiencies is imperative for enhancing the effectiveness of Cyprus’s AML/CFT regime concerning NPOs.
5. Progress on Recommendation 15: Addressing New Technologies
The rapid evolution of financial technologies, especially the emergence of virtual assets and virtual asset service
providers (VASPs), has posed significant challenges to global AML/CFT frameworks. Recognizing these challenges, the FATF updated Recommendation 15 to specifically address the risks associated with new technologies. Cyprus, in its efforts to align with these international standards, has undertaken substantial measures to enhance its regulatory and supervisory framework concerning virtual assets and VASPs.
A key element of Cyprus’s approach to mitigating the risks in this context has been the conduct of a comprehensive National Risk Assessment (NRA) on virtual assets and VASPs in 2021. This assessment evaluated the money laundering and terrorist financing risks associated with virtual assets, identifying weaknesses and areas to be improved. Regrettably, the Cypriot NRA of virtual assets and VASPs does not fully enumerate the size of the sector (number and volume of transactions conducted by financial institutions that conduct activities in virtual assets) and the nature of trading in virtual assets by investment firms. However, the NRA indicates that virtual assets form a negligible part of the overall volume of the activities of investment firms.
In response to the evolving landscape of virtual assets, Cyprus has made clear progress towards improving the key deficiencies in R15. The country has adopted a National Action Plan which demonstrates a commitment to improving the situation relating to virtual assets and VASPs. Furthermore, the Cyprus Securities and Exchange Commission (CySEC) has published a Guidance document for terrorism financing in crypto assets, which covers crypto assets’ vulnerabilities and risks, transactions monitoring and customer due diligence, detecting and reporting suspicious transactions, red flag indicators and employee education and training
Importantly, Cyprus has amended its AML/CFT legislation to incorporate provisions specific to VASPs. These legislative changes mandate the registration of VASPs with CySEC and subject them to “fit-and-proper” assessments. The regulatory framework requires VASPs to implement customer due diligence measures, maintain comprehensive records, and report suspicious transactions.
The following minor shortcomings remain: (i) the lack of requirement to identify and assess risk that may arise in relation to new business practices or developing technologies; (ii) it remains not clear that every legal person created in Cyprus will be required to register as a VASP in Cyprus; (iii) some gaps remain in relation to the application of fit and proper measures; (iv) insufficient sanctions and preventive measures for failure to register as required. Despite these shortcomings, considered as minor by MONEYVAL, Cyprus was re-rated as largely compliant in respect of FATF Recommendation 15.
6. Assessing the Implications of the Re-Ratings
The latest MONEYVAL Enhanced Follow-Up Report presents a nuanced picture of Cyprus’s progress in aligning with the FATF Recommendations. While the re-rating of Recommendation 15 (New Technologies) from “Partially Compliant” to “Largely Compliant” recognizes substantial advancements by Cyprus in regulating virtual assets and VASPs, the persistent “Partially Compliant” status of Recommendation 8 (Non-Profit Organisations) shows that challenges remain in that sector. The MONEYVAL report highlights that while Cyprus has initiated measures to assess terrorism financing risks within the NPO sector, these assessments are not yet comprehensive or fully implemented. Notably, the risk assessment does not adequately cover non-profit companies, and there is a lack of detailed analysis to inform targeted mitigation strategies. Furthermore, outreach and guidance to the NPO sector remain limited. These deficiencies hinder the effective implementation of a risk-based approach to NPO regulation, which is a prerequisite for a proportionate response to the problem. On the other hand, the upgrade of Recommendation 15 to “Largely Compliant” reflects Cyprus’s significant progress in addressing the AML/CFT risks associated with new technologies. Key developments include the completion of the NRA focusing on virtual assets and VASPs, the establishment of a comprehensive regulatory framework for VASPs, and the implementation of supervisory mechanisms by the CySEC. However, the report notes that certain challenges persist. For instance, Cyprus does not apply supervisory or regulatory requirements to VASPs providing services remotely from European Economic Area (EEA) member states, relying instead on the assumption of equivalent regulation in those jurisdictions. While this approach aligns with FATF standards, it may pose risks if not accompanied by robust information-sharing and cooperation mechanisms.
In general, the progress of Cyprus meets the general expectation set by MONEYVAL for countries to address most technical compliance deficiencies within three years of their MER. The latest MONEYVAL report demonstrate Cyprus’s commitment to strengthening its AML/CFT framework, as required by the FATF standards and the relevant legislative instruments under EU law. Nonetheless, some persistent deficiencies, such as in NPO sector, highlight the need for continued efforts to develop and implement comprehensive risk assessments, enhance outreach and guidance, and establish effective monitoring and enforcement mechanisms. Addressing these challenges is very important for achieving full compliance with international standards and ensuring the integrity and the reputation of Cyprus’s financial system.
References
Basel Committee on Banking Supervision, “Designing a prudential treatment for crypto-assets” (2019) Basel Committee Consultative Paper.
CySEC, Guidance on identifying, assessing and understanding Terrorist Financing risks in the context of Crypto assets activities (June 1, 2023).
Demetriades, G., ““Is the person who he claims to be?” old fashion due diligence may give the correct answer!” (2016) Journal of Money Laundering Control, Vol. 19 No 1, pp. 79-91.
Härdle, W., Harvey, C., Reule, R., “Understanding Cryptocurrencies” (2020) Journal of Financial Econometrics, Vol. 18, No 2, pp. 181–208.
Lastra, R., Allen, J., “Virtual Currencies in the Eurosystem: Challenges Ahead” (2018) European Parliament Study
MONEYVAL, Cyprus: 1st Enhanced Follow-up Report & Technical Compliance Re-Rating, December 2021
MONEYVAL, Cyprus: 2nd Enhanced Follow-up Report& Technical Compliance Re-Rating, November 2022
MONEYVAL, Cyprus: 3rd Enhanced Follow-up Report & Technical Compliance Re-Rating Follow-up report, December 2023
MONEYVAL, Cyprus: Fifth Round Mutual Evaluation Report, December 2019
Murrar, F., “Adopting a risk-based approach for non-profit organisations”(2022) Journal of Money Laundering Control, Vol. 25 No 1, pp. 19-26.
Pavlidis, G., “Asset recovery in the European Union: implementing a “no safe haven” strategy for illicit proceeds” (2022) Journal of Money Laundering Control Vol. 25 No 1, pp. 109-117.
Pavlidis, G., “The dark side of anti-money laundering: Mitigating the unintended consequences of FATF standards” (2023) Journal of Economic Criminology 2: 100040.
Romaniuk, P., Keatinge, T,, “Protecting charities from terrorists… and counterterrorists: FATF and the global effort to prevent terrorist financing through the non-profit sector” (2018) Crime, Law and Social Change, Vol. 69, pp. 265-282.
Sansonetti, R., “The mutual evaluation process: a methodology of increasing Importance at international level” (2000) Journal of Financial Crime, Vol. 7 No 3, pp. 218-226.
van Broekhoven, L., Goswami, S., “Can stakeholder dialogues help solve financial access restrictions faced by non-profit organizations that stem from countering terrorism financing standards and international sanctions?” (2021) International Review of the Red Cross, pp. 717-746.
van der Does de Willebois, E., “Nonprofit organizations and the combatting of terrorism financing: a proportionate response” (2010) World Bank Working Paper No. 208.
Wang, S., Chen, Y., “Information-led policing: non-profit organization’s terrorist financing” (2024) International journal of offender therapy and comparative criminology Vol. 68 No 8, pp. 735-748.