A compliance officer schedules a periodic review. The Law schedules a measure; the review performs half of it.
Section 61(1) of L.188(I)/2007 says the identification procedures and customer due diligence measures include four things; the fourth, paragraph (d), is ongoing monitoring. The operative text is Greek and no official English version exists; the renderings here are ours. Paragraph (d) has two halves. The obliged entity exercises continuous oversight of the relationship, closely examining the transactions carried out during it so as to ensure they are consistent with the data and information it holds on the customer, the business and the customer's risk profile and, where required, on the origin of the monies. And it ensures documents, data or information are kept up to date. The first half runs continuously; the second is the file refresh most firms call the periodic review. Doing that on time does not discharge the first.
The duty is statutory, so it does not change with the supervisor: a Bar Association member and a CySEC-supervised investment firm read the same section. ICPAC's AML Directive, issued under section 59(4) of that Law, adds practice detail, not the obligation.
Section 61(2) sets how far. Obliged entities apply the measures but may determine their extent according to the degree of risk, taking into account at least the variables in Annex I, expressly an indicative list: the purpose of an account or relationship, the level of assets to be deposited or the size of transactions, and the regularity or duration of the relationship. And obliged entities must be able to demonstrate to the Supervisory Authorities that the extent of the measures is proportionate to the money laundering and terrorist financing risks they face. Risk sets frequency and extent, not whether.
Low risk is not an exemption. Section 63(1) permits simplified measures where the entity has first satisfied itself of a lower degree of risk and no suspicion exists, and the proviso attached requires it to monitor the transaction and the relationship sufficiently to detect unusual or suspicious transactions. ICPAC agrees: monitoring should take place for all client relationships including low risk clients and those under simplified due diligence; what can be altered is the frequency and extent. It also says no reliance can be placed on any third party when conducting ongoing monitoring.
Triggers are written down. Section 62(6) applies the measures to existing customers at the appropriate time by degree of risk, or when the customer's relevant circumstances change, or where the Law or the Administrative Cooperation in the Field of Taxation Law requires it to contact the customer during the relevant calendar year to review substantive beneficial-ownership information. Section 64(4) adds transactions meeting at least one of four conditions, complex, unusually large, following an unusual pattern, or without apparent economic or legal purpose: the entity examines their background and purpose as far as reasonably possible and intensifies the degree and nature of its monitoring, to determine whether the transactions or activities appear suspicious. ICPAC would have firms consider reclassifying the client and, where the revised risk falls outside the acceptance policy, termination.
FATF Recommendation 10 stands behind all of it; its criteria address countries and assessors, not you. Criterion 10.7 pairs the same two halves and spells out a mechanism the Cyprus wording does not: undertaking reviews of existing records, particularly for higher risk categories of customers. AMLA has draft guidelines on ongoing monitoring out for consultation; a draft binds nobody.
Section 68 holds the due diligence file, transaction records and client correspondence five years past the relationship, or past an occasional transaction. A review with nothing recorded is indistinguishable from one that never happened.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗