Cyprus law lets you rely on another firm for three of the four due diligence measures: identify the customer, identify the beneficial owner and who controls the customer, work out what the relationship is for. The fourth, ongoing monitoring, is not on that list. The final responsibility for all of it stays with you.
The provision is section 67 of L.188(I)/2007. Its first subsection says obliged entities may rely on third persons for carrying out the identification procedures and customer due diligence measures as those are laid down in paragraphs (a), (b) and (c) of subsection (1) of section 61. Section 61(1) has four paragraphs. Section 67(1) names three. The operative text is Greek and no official English version exists; the renderings here are ours.
Then the proviso, in the same sentence as the permission: the final responsibility for carrying out the above measures and procedures rests with the obliged entity that relies on the third person. The Greek verb there is the one you would use for a weight bearing down on something.
Not everyone can be your third person. Section 67(2)(a) defines them as the obliged entities in paragraphs (a), (b), (c) and (d) of section 2A — credit institutions, financial organisations, auditors, external accountants, tax advisers and independent legal professionals, and trust and company service providers — or as other institutions or persons operating in the European Economic Area or in a third country which both apply due diligence and record-keeping measures consistent with those laid down by the EU Directive and are subject to supervision consistent with its relevant requirements. Put plainly: a Cyprus firm of those kinds, or a foreign one both regulated and supervised to EU standard. Section 2A itself runs on well past (d), through estate agents, gambling service providers, casinos, art dealers, free-port art storage, persons supervised by CySEC and persons supervised by the Central Bank of Cyprus, several of those subject to qualifying thresholds the section sets out. The first branch reaches them only if they also sit inside (a) to (d); anyone else comes in through the second branch, and only by meeting both of its conditions.
An obliged entity does not rely on third persons established in high-risk third countries. A supervisory authority may exempt a branch or a majority-owned subsidiary of an obliged entity established in the European Union from that prohibition, but only where the branch or subsidiary fully complies with the group-wide policies and procedures applied under section 68A. And section 2 defines a high-risk third country as both a country flagged by the European Commission by delegated act and a country classified as high risk by the obliged entity itself, in the risk assessment section 58A requires it to make. Your own risk assessment can shut this door on you.
Section 67(3) says what you take, and when. Immediately from the third person you rely on, the necessary information about the paragraph (a), (b) and (c) measures. And appropriate measures to make sure the third person forwards immediately appropriate copies of the identification and verification data and documents, including, where they are available, data obtained through electronic identification means and relevant trust services. The word immediately is in there twice.
Section 67(4) lets the home supervisory authority and, for branches and subsidiaries, the host supervisory authority treat an entity as applying the subsection (2) and (3) measures through its group programme, on three conditions, all of which must be met: the information comes from a third person belonging to the same group; the group applies due diligence measures, record-keeping rules and AML/CFT programmes in accordance with the requirements of the EU Directive or equivalent rules; and effective implementation of those requirements is supervised at group level by the competent supervisory authority of the home Member State or of the third country. Put plainly: inside a properly supervised group, the group's own programme can stand in for the checks in subsections (2) and (3).
Section 67(5) takes a whole category back out. The section does not apply to outsourcing or agency relationships where, under a contractual arrangement, the outsourced service provider or the agent is considered part of the obliged entity. If your provider is contractually part of you, this is not reliance and section 67 is not your provision.
ICPAC's AML Directive, issued under section 59(4) of that Law, supplies the procedure. Reliance goes through an agreement with the third party, and the agreement should explicitly state that the third party should make copies of the requested CDD documentation available immediately for the establishment of the business relationship. Before accepting anything, the firm should assess the third party's systems and procedures, satisfy itself they are in line with the Law and the Directive, maintain a separate file for every such third party, take steps to ensure copies of the original documentation will be provided immediately, and obtain the Compliance Officer's approval both for starting the cooperation and for accepting client identification data verified by the third party. In short: assess them, file the assessment, and have the Compliance Officer sign off before anything is taken in. Read the other way round: before an ICPAC member consents to be relied upon, it must ensure its client, and any other party whose information may be disclosed, is aware that a disclosure may be made and has no objection to it. And where a firm merges with another or acquires a practice in whole or in part, ICPAC says it may not be necessary for the identity of the acquired clients to be re-verified, provided satisfactory identification records are available.
On the fourth measure the two texts do different work. The Law simply does not extend section 67(1) to paragraph (d). ICPAC says it outright: reliance should only be placed on third parties at the outset, and no reliance can be placed on any third party when conducting ongoing monitoring.
FATF Recommendation 17 sits behind the section, and its criteria are addressed to countries and assessors rather than to you. Criterion 17.1 has the same shape: where financial institutions are permitted to rely on third-party financial institutions and DNFBPs to perform elements (a) to (c) of the Recommendation 10 CDD measures, the ultimate responsibility for CDD measures should remain with the institution relying on the third party. Its footnote 99 also takes outsourcing and agency relationships out, by reference to an Interpretive Note we have not read; section 67(5) does so only where the provider is contractually part of the obliged entity.
Section 68C makes it an offence for a third person relied on under section 67(2)(a) to knowingly provide false or misleading data and information about the identity of the customer or the ultimate beneficial owner, or to present false or forged identity documents: up to two years, up to €100,000, or both. That is their offence. The proviso to section 67(1) is still your responsibility.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗