Most firms treat an ICPAC inspection as something they will get time to prepare for. Regulation 4.602 is drafted on the opposite assumption.
ICPAC adopted the Regulation — short title, the Quality Assurance Regulation of 2024 — as the supervisory authority for its members under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (L. 188(I)/2007) and the law establishing the National Sanctions Implementation Unit (L. 150(I)/2025). It repeals and replaces the earlier regulations to the extent they relate to AML/CFT and sanctions compliance, and absorbs Regulation 6.400 on off-site supervision, which is repealed. It binds every member and firm holding any ICPAC practising certificate — accounting, audit, administrative services, insolvency — for as long as the certificate is held.
ICPAC supervises with three tools and four scopes. The tools are off-site monitoring, which assesses firms on a risk-based approach and classifies them into risk categories; on-site monitoring visits; and remote visits. The scopes are full scope, covering every policy, procedure and measure under the AML and sanctions laws; thematic, where the Regulation's own example is sanctions; targeted, aimed at particular members, firms or transactions; and follow-up on the action plan left by a full-scope visit.
Your risk category comes out of a questionnaire. ICPAC runs the risk-based assessment annually through a designated consolidated questionnaire and may issue further questionnaires at its sole discretion. Completion is mandatory for all firms. Miss the deadline, or give false or misleading information, or conceal information, and a predetermined penalty is imposed ex officio — and the obligation to submit survives the penalty. Continued failure sends the firm to Admissions and Licensing, to reassess whether it should hold a practising certificate at all.
Then the visit. It may be carried out with notice or without prior notice, and ICPAC may conduct as many visits, of any type, on the same firm in the same calendar year as it deems necessary. Both the management of the firm, or its representatives, and the Compliance Officer must attend an on-site visit. The Monitoring Officer may enter the business premises, sample client files in whatever form they are kept, inspect records, books, accounts and data held on computers or other electronic means, take copies or extracts, and take notes and photographs. If a file sits with a filing service provider, off the premises, or in a branch outside Cyprus, it must still be produced within the deadline set. The activity runs in English unless ICPAC decides otherwise.
The annual full-scope on-site round carries a Monitoring Fee, initially determined by Council through Circular GC 5/2024. Extraordinary, targeted and specialised visits carry no additional charge.
The provision that should change how you keep the file is quieter. Anything submitted after the supervisory activity has finished is accepted only at ICPAC's absolute discretion. There is no repair window by right.
The consequences are stated. Unjustified refusal of entry brings the firm before the Administrative Committee outright. Failing to respond to a notification, withholding the client list, concealing or misstating the number of clients, or breaching the AML/CFT Directive, the Sanctions Directive or this Regulation may start an administrative procedure. Decisions withdrawing or suspending a practising certificate are published, so far as data-protection legislation permits, indicating at least the substance of the decision and the type and amount of the sanction. What you hand over is confidential, usable only for ICPAC's responsibilities under those laws.
Sanctions is a named thematic scope, and a sample check tests the file, not the intention. If your screening evidence lives in memory rather than in the file, a thematic visit is where that shows.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗