If your sanctions procedure still cites the 2016 implementation law, it cites a law that has been repealed.
CySEC issued Circular C724 on 1 August 2025 to tell Regulated Entities that on Friday 25 July 2025 three new pieces of legislation, one of them an amending law, were published in the Official Gazette. Together, CySEC says, they constitute the new legal framework for Restrictive Measures/Sanctions in the Republic, and they are in force from publication.
The addressee list is wide: CIFs, ASPs, UCITS management companies, self-managed UCITS, AIFMs, self-managed AIFs, self-managed AIFLNPs, the companies whose sole purpose is managing AIFLNPs, small AIFMs, and crypto-asset service providers.
The first law is L.149(I)/2025, on the criminalisation of the violation of European Union restrictive measures. It harmonises Directive (EU) 2024/1226 of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures, the directive that itself amends Directive (EU) 2018/1673. It also repeals the Implementation of the Provisions of the Resolutions or Decisions of the United Nations Security Council (Sanctions) and the Decisions and Regulations of the Council of the European Union (Restrictive Measures) Law of 2016. That repeal is the practical one. Any policy, manual or client-facing summary that names the 2016 law is now pointing at nothing.
The second law is the one that changes who you deal with. L.150(I)/2025 establishes, within the Ministry of Finance, a Directorate called the National Sanctions Implementation Unit. Its responsibilities, as the circular lists them, include the implementation and supervision of EU restrictive measures and UN Security Council sanctions in relation to economic sanctions, the coordination of all authorities and state services for implementation in the Republic, the collection of information, cooperation with other authorities in the Republic, with competent authorities abroad and with other organisations, the examination of requests for licences or derogations under the acts establishing the measures, the evaluation of cases of potential violation, the issuance of directives, circulars, guidelines, clarifications and guidance, and training, from seminars and conferences to published material. The list is prefaced with "among others", so treat it as indicative rather than closed.
Two consequences follow from the same law. Licence and derogation requests now have a named destination, which matters the first time a frozen-asset question lands on a Friday afternoon. And the law establishes the framework for authorisation applications, for the obligations of regulated entities, and for the imposition of administrative fines by the NSIU, expressly without affecting the powers and responsibilities of the Supervisory Authorities. Read that clause slowly. CySEC's powers over you are not displaced by the new unit.
The third law, L.148(I)/2025, amends the law protecting persons who report breaches of Union and national law. It brings the violations of Union restrictive measures listed in article 5 of the criminalisation law, including incitement, aiding and abetting and attempting to commit them, within that law's application. An internal report about a sanctions breach now sits inside the protected-disclosure regime.
CySEC closes with one call: harmonise the existing measures and procedures designed and implemented for the detection of actions that are in breach, or may potentially be in breach, of restrictive measures and sanctions, in accordance with the new framework. Note "may potentially be in breach". The detection duty CySEC is describing does not stop at confirmed hits.
One more line worth flagging. CySEC says the legislation will be added to the Sanctions/Restrictive Measures section of its website when available in English. Until then there is no English text to work from.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗