The derogation has a clock

Cyprus onboarding desks rarely argue about whether verification is required. They argue about when, and how long a client can sit on the books unverified. CySEC Circular C721 of 9 July 2025 replaces C367 and answers it.

The baseline is section 62(1) of L. 188(I)/2007: verification of the identity of the customer and the beneficial owner is performed before the establishment of a business relationship or the carrying out of the transaction. A proviso attaches: an obliged entity entering a new business relationship with a corporate or other legal entity, or a trust or a similar legal arrangement, subject to registration of beneficial ownership information under section 61A or 61B or 61C, shall collect proof of registration or an excerpt of that information from the register.

Section 62(2) permits verification to be completed during the establishment of the relationship — a two-condition derogation, not a grace period. It applies if this is necessary so as not to interrupt the normal conduct of business and where there is little risk of money laundering or terrorist financing occurring, with a proviso that the procedures shall be completed as soon as possible after the initial contact. CySEC restates that as three conditions that must all be met.

The circular separates identification from verification: section 61(1)(a) and (b) treat them as different steps. Identification is completed before entering into the relationship, with the economic profile created alongside it, and for CIFs a suitability test under section 26(2) of L. 87(I)/2017 and/or an appropriateness test under section 26(3) also come first, where applicable. Only verification travels under the derogation.

CySEC's view of when risk may be assessed as little carries four conditions, required among others and as a minimum — a floor, not a safe harbour. Total deposits not exceeding €2,000, regardless of the number of accounts held while verification is incomplete. Deposits only from a bank account in the customer's name, or an instrument linked to one such as a credit card. No more than 15 days from initial contact without completed verification. And no amount withheld and no account frozen except in cases of suspected money laundering, where the entity must immediately file a complaint with MOKAS. €2,000 does not automatically make the relationship low risk; each is still assessed under the Law and the CySEC Directive.

Expiry is not a warning letter. Initial contact runs from acceptance of the terms and conditions or the first deposit, whichever occurs first, and during it the entity shall take all reasonably necessary measures to keep the percentage of non-complying customers particularly low. If verification is not completed, the relationship shall be terminated on the day of expiry, all deposits shall be returned to the bank account they came from, the refund shall begin immediately whether or not requested, profits included and losses deducted. Hence the duty to warn clients appropriately, adequately and in good time about the procedure, including for example open positions and refunds, and take explicit consent regarding that procedure first.

ASPs sit outside that specification: the point (v) specification does not apply to the provision of administrative services, and an ASP verifying during conclusion must fully justify and record why doing it beforehand would interrupt the smooth conduct of its operations and why the risk is low. No monetary deposit is accepted unless the customer and beneficial owner provide the information needed for identification and the economic profile, and the AML manual must carry the measures, procedures and controls for implementing and monitoring section 62(2). CySEC encourages verification before the relationship begins; the alternative is described as exceptional.

Not legal advice. Verify against the primary source before acting.

Sources

• CySEC Circular C721, 9 July 2025 — Application of section 62(2) of L.188(I)/2007 (English, PDF; replaces C367)

Screen against the current lists in seconds

FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.