Three lists bind a firm in Cyprus, and a statute names them: EU restrictive measures, UN Security Council sanctions, and the Republic's own national sanctions. OFAC is not one of the three. ICPAC and the Bar Association both say so, and both then tell you to watch it anyway.
Your screening tool also has a list. Nothing guarantees it is that one.
Where the duty comes from
Not from your supervisor's directive. Section 25(1) of L.150(I)/2025, the Law that created the National Sanctions Implementation Unit, says every obliged entity «θεσπίζει και εφαρμόζει» adequate and appropriate policies, controls, systems and procedures so as to identify, assess, mitigate and effectively manage the risks of breaching Sanctions, and to identify acts or omissions connected with its professional activities which breach or may breach Sanctions. Under section 25(2) those are proportionate to its characteristics and activity.
In plain terms: you must build controls that find the risk and catch the breach, screening among them, and you must build them to fit your firm. The verb is present indicative. The Greek states the duty as a fact, not as an ambition.
The Law borrows the term obliged entity from L.188(I)/2007, so a lawyer supervised by the Bar Association and an accountant supervised by ICPAC carry the identical duty. The Law is in Greek; no official English text exists, and CySEC's Circular C724 of 1 August 2025 said one would be added when available. Every rendering here is ours.
Which Sanctions
Section 2 defines the word: «Κυρώσεις» σημαίνει τα Περιοριστικά Μέτρα της Ένωσης, τις Εθνικές Κυρώσεις και τις Κυρώσεις του Συμβουλίου Ασφαλείας. Sanctions means the Union Restrictive Measures, the National Sanctions and the Security Council Sanctions. Three items, and no among others: the same section's definition of funds does say its own list is indicative, and this one does not. Section 25 hangs the duty on that defined word, so the perimeter is set by the definition and not by your risk appetite.
Union Restrictive Measures are those adopted by the EU under Article 29 of the Treaty on European Union or Article 215 of the Treaty on the Functioning of the European Union. Security Council Sanctions are those adopted, imposed and applied in the Republic under Security Council resolutions or decisions. National Sanctions are the measures adopted under Part VI of the same Law.
The one most people cannot name
Part VI is two sections long. The Council of Ministers may, on the recommendation of the Minister of Foreign Affairs, issue Regulations, which may regulate financial sanctions, travel restrictions and restrictions on the movement of goods of strategic importance and of other goods; and by Order it may, among other things, enter a person, entity or body on a national sanctions list. The grounds include, among others, threatening or disturbing international peace and security, violating human rights within the Republic, involvement in international terrorism offences or in weapons of mass destruction, and violating the sovereign right of the Republic over its underground waters, mines and antiquities.
That is a Cyprus list, made in Cyprus, on grounds a Cyprus government chose, the last of them local enough to name the Republic's own mines. Section 36(3) says the list is re-examined at regular intervals and at least every year. If you cannot say where in your screening that third source arrives, you have found the gap.
What the supervisors add
Neither supervisor drew the perimeter; ICPAC's Sanctions Directive repeats the statute's three in its own definitions. What they add is the gloss on the list that is not in it.
ICPAC's AML Directive, at 4.6.2: US sanctions imposed by the Office of Foreign Assets Control do not need to be adhered to, according to the relevant legislation, by obliged entities established in the Republic. Despite that, firms are encouraged to pay close attention to these sanctions and to assess the risks emanating from any business relationships they may have with a sanctioned person. It then flags secondary sanctions: economic restrictions on non-US citizens and companies for doing business with a US sanctioned person.
The Bar Association's operative Directive, the August 2023 Greek edition, says the same at Γ.6.3 about two countries rather than one: «οι Εταιρείες δεν είναι αναγκασμένες να ακολουθούν κυρώσεις του Ηνωμένου Βασιλείου και των ΗΠΑ που επιβλήθηκαν από το Γραφείο Ελέγχου Ξένων Περιουσιακών Στοιχείων (Office of Foreign Assets Control - OFAC), σύμφωνα με τη σχετική νομοθεσία». Firms are not obliged to follow United Kingdom sanctions, or US sanctions imposed by OFAC, in accordance with the relevant legislation. And in the next breath, «ενθαρρύνονται», they are encouraged to pay particular attention.
Two supervisors, two professions, one statutory perimeter, and the same word: encouraged. Encouraged is not required. It is also not ignore. ICPAC's separate Sanctions Directive, issued under sections 6(2) and 25(3) of the same Law, says at 1.4 that only sanctions imposed by the United Nations, the European Union and the Republic of Cyprus are legally binding, that individual country sanctions lists are strongly suggested to be taken into consideration, and that special attention should be given to countries whose sanctions carry an extra-territorial impact, for example OFAC.
Which list you breached decides which Law answers
Section 33 of L.150(I)/2025 makes it an offence to breach any National Sanction or any provision of a Security Council resolution or decision: on conviction, up to two years' imprisonment or a fine up to 100,000 euro, or both, for a natural person, and a fine up to 300,000 euro for a legal person, subject to any other law providing a greater penalty. EU restrictive measures are not in that section. They sit in the companion Law, L.149(I)/2025, whose section 5 offence requires intent, except that gross negligence suffices for one category, dealings in military-list and dual-use goods, and whose penalties for a legal person can reach five per cent of total worldwide turnover.
Both AML directives print the two years, 100,000 and 300,000 figures against non-compliance with the EU restrictive measures and the UN sanction programmes. Those are the figures section 33 attaches to national and UN sanctions. We flag the gap rather than resolve it, and suggest reading both Laws. Your supervisor needs no court in any event: under section 27 it may, after a hearing, fine an obliged entity up to 500,000 euro for failing to comply with section 25 and the directives it issues under it, plus up to 500 euro for each day a breach continues.
Then how often
Once the three are fixed, the timing attaches to them, and ICPAC's Sanctions Directive is the most specific text on the desk. Screening should be conducted during the establishment of a business relationship and before providing any service or executing any transaction. The entire client base should be screened without delay whenever a new UNSCR, EU Decision or Regulation, or national sanction of the Republic is issued, or a list changes. The frequency of re-screening should be commensurate with the sanctions risk profile of the firm and should accommodate change-driven updates, for example changes in beneficial owners or directors. Screening should also follow a specific request by the supervisory authority.
Then the line that turns cadence into evidence, at 4.4: firms must be able to demonstrate to the supervisory authority the frequency of screening. Not that they screen. How often.
Both AML directives say the same from the due diligence side. Background screening against sanctions lists should form part of the initial CDD process, and should also happen during change-driven updates and during scheduled or routine CDD updates. The Bar Association's 2023 edition goes further than its 2019 English predecessor: it covers the prospective and the existing client, and it has the firm record the screening exercise, the findings or the absence of any match, the date on which the check and any follow-up took place, and the person who ran it and in what capacity.
FATF's assessment methodology is addressed to countries and to assessors, not to firms. Read in that register, criterion 6.5(a) asks countries to require all natural and legal persons within the country to freeze, without delay and without prior notice, the assets of designated persons, and its glossary reads without delay as, ideally, within a matter of hours of a designation. That is about freezing rather than screening frequency, but it is the speed the system assumes.
Count what your tool carries
ICPAC's Sanctions Directive at 4.6.2 makes the firm responsible for ensuring that the information its screening solution provides, manual or automated, is up to date and reflects current developments in the sanctions regime; 4.7 adds that outsourcing moves none of the liability. Its AML Directive says firms using specialist databases should comprehend how they are populated. The Bar Association is blunter at Ε.4.11: «πρέπει να κατανοήσουν πώς δημιουργούνται, λειτουργούν, αναβαθμίζονται και ενημερώνονται αυτές οι βάσεις δεδομένων». They must understand how those databases are created, how they operate, how they are upgraded and how they are updated.
So the question for Monday is not whether you screen. Open the coverage page of whatever you screen against, and count. Which of the three does it actually carry, and if a fourth is switched on, can you say who chose it, and why.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗