Cyprus law says exactly what enhanced due diligence means in the cases it names, such as a high-risk third country or a politically exposed person. For every other client a firm rates high risk, it names the risk factors to weigh, then stops. Which measures follow is the firm's own choice.
That division of labour is statutory, not supervisory. Section 64 of L.188(I)/2007 is where enhanced due diligence lives, and a lawyer supervised by the Bar Association and an investment firm supervised by CySEC read the same section. ICPAC's AML Directive, issued under section 59(4) of that Law, tells its members how to do the work. The operative text is Greek, no official English version of the Law exists, and the renderings here are ours.
Start with the opening words of section 64(1), because they are easy to skip. An obliged entity applies enhanced customer due diligence measures in addition to the measures referred to in sections 60, 61 and 62. Enhanced diligence is not a harder version of ordinary diligence. It sits on top of it.
Where the Law names the case, it names the steps. For business relationships or transactions with high-risk third countries, section 64(1)(a) says the following enhanced measures are applied, and lists six. Collect additional information on the customer and the beneficial owner. Collect additional information on the intended nature of the business relationship. Collect information on the origin of the funds and the source of the wealth of the customer and of the beneficial owner. Collect information on the purpose of the transactions planned or carried out. Obtain senior-management approval for entering into or maintaining a business relationship with such a person. And carry out enhanced oversight of that relationship, by increasing the number and frequency of the controls applied and by selecting patterns of transactions that require further examination. A proviso follows: automatic application is not required for a branch or majority-owned subsidiary situated in a high-risk third country and owned by an obliged entity established in the European Union, where that branch or subsidiary fully complies with the group-level policies and procedures under section 68A, and in that case the obliged entity uses a risk-based approach.
Read the definition before deciding that list is somebody else's problem. Section 2 defines a high-risk third country in two limbs. One is a country the Commission identifies by delegated act under Article 9(2) of the EU Directive as presenting strategic deficiencies in its national anti-money-laundering and counter-terrorist-financing system that are considered significant threats to the financial system of the European Union. The other is a country classified as high risk by the obliged entities themselves, in accordance with the risk assessment provided for in section 58A. Your own business-wide assessment can put a country inside the six-measure regime.
Section 64(1)(c) does the same job for politically exposed persons. Appropriate risk-management systems, including risk-based procedures, to determine whether the customer or the customer's beneficial owner is one; then three measures for the relationship itself; then both the systems and the measures applied to close relatives and to persons known to be close associates. Section 64 names other cases and names measures for each of them: cross-border correspondent relationships and correspondent relationships in crypto-asset services, in limbs written for credit institutions, financial institutions and crypto-asset service providers; transfers to and from self-hosted crypto addresses, for crypto-asset service providers; and beneficiaries of life and investment-linked insurance policies, where subsection (2) attaches its own measures to the time of payout or assignment.
Then subsection (3), the residual case. An obliged entity applies enhanced measures, again in addition to sections 60, 61 and 62, also in other cases which by their nature present a high risk of money laundering or terrorist financing. The proviso attached says that in assessing those risks the obliged entity takes into account at least the factors of potentially higher-risk situations set out in Annex III. At least, so Annex III is a floor. Annex III calls itself an indicative list, and it groups its factors by customer, by product, service, transaction or delivery channel, and by geography. Every one of them tells you when to escalate. Not one tells you what to do next.
The geography head shows the seam. Annex III's first geographic factor is expressly without prejudice to section 64(1)(a): countries in which credible sources, such as mutual evaluations, detailed assessment reports or published follow-up reports, establish the lack of effective systems for combating money laundering and terrorist financing. So the Law keeps the two country routes apart, while the definition of a high-risk third country already reaches a country your own section 58A assessment rates high. Which route your judgement about a country lands on is a question the text leaves open. Settle it in your manual, not on the file.
One duty in section 64 waits for no classification at all. Under subsection (4) an obliged entity examines, to the extent reasonably possible, the background and purpose of all transactions meeting at least one of four conditions: they are complex, they are unusually large, they follow an unusual pattern, or they have no apparent economic or legal purpose. It then intensifies the degree and nature of its monitoring of the business relationship, in order to determine whether those transactions or activities appear suspicious.
Which is where ICPAC earns its place, because it fills the gap the Law leaves. Its Directive says EDD measures for business relationships and transactions must include eight items, among them looking for additional independent and reliable sources to verify information including identity, integrity and permanent address; a detailed examination of the background and purpose of the business relationship; systematic background checks for all high-risk clients; escalation of approval of the relationship; and establishing and corroborating the size and source of wealth. It says EDD procedures must be customised to respond to the areas that pose higher risk, and prints a table of worked examples. It says the PEP measures may also be adopted for various high-risk clients other than PEPs. And it says each firm should clearly outline, in its AML manual or client acceptance policy, the categories of clients for which it will be performing EDD.
On that residual case the international standard is no more prescriptive than the statute. FATF's assessment methodology, whose criteria are addressed to countries and assessors rather than to firms, puts the general rule in a single sentence: financial institutions should be required to perform enhanced due diligence where the money laundering and terrorist financing risks are higher.
So the trigger is written down and, for most files, the measures are not. For the client the Law did not name, nothing outside your own file records which measures you chose, or why you thought they were enough.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗