Cyprus law makes you end a client relationship on your own initiative for exactly one reason: you could not finish the customer due diligence. Not that the client scores high. Not that the file makes you uneasy. Walk away for those reasons and it was your firm's decision, not the Law's.
The trigger is statutory, not supervisory. Section 62(4) of L.188(I)/2007 carries it, and an accountant supervised by ICPAC and a lawyer supervised by the Bar Association take the identical duty from it. Their directives, each issued under section 59(4) of the same Law, reproduce it almost word for word, one in English and one in Greek. The operative text of the Law is Greek, no official English version of it exists, and the renderings here are ours.
Section 62(4) says that where an obliged entity cannot comply with the customer due diligence requirements as laid down in paragraphs (a), (b) and (c) of subsection (1) of section 61, it does not carry out a transaction through a bank account, does not establish a business relationship or does not carry out the transaction, as the case may be, terminates the business relationship in question, and considers the possibility of submitting a suspicious transaction report in relation to the customer to the Unit, in accordance with the provisions of section 69.
Plainly: whichever of those fits the position you are in. Nothing through the account, no relationship opened, no transaction done, and a relationship already running comes to an end. Then read the last limb slowly. The Greek says it examines the possibility of a report. It does not say report.
The trigger is narrower than the duty most people carry in their heads. Section 61(1) sets out four measures. Section 62(4) reaches three of them: identify and verify the customer; identify the beneficial owner and take reasonable measures to verify him, and for legal persons, trusts, companies, foundations and similar legal arrangements take reasonable measures to understand the ownership and control structure of the customer; and assess and, as appropriate, collect information on the purpose and intended nature of the business relationship. Ongoing monitoring, the fourth, is not in the trigger. What ends a relationship is a failure at the front of the file.
Then subsection (5), which is the sentence that matters most in a law firm or an audit practice. Independent legal professionals, auditors, tax advisers and external accountants are not covered by the provisions of subsection (4) when they are acting in the course of assessing the legal position of their clients, or defending or representing their clients in any judicial proceeding or in relation to it, including the provision of advice on instituting or avoiding such proceedings.
The conditions are doing the work there, not the job titles. It is switched on by what the professional is engaged to do at the time, so the same person can sit inside subsection (4) on one engagement and outside it on another. And it lifts the whole of subsection (4), the refusal limbs as well as the termination limb. Neither supervisor's termination paragraph carries it; both attach a similar carve-out to their reporting provisions instead.
Now the case that fills the diary: a client you can identify perfectly well, whose file is complete, and whose risk has moved. Section 64(1) is where the Law puts higher risk, and its opening words answer the question. An obliged entity applies enhanced customer due diligence measures, in addition to the measures referred to in sections 60, 61 and 62. More measures. Not the door.
Where the voice changes
ICPAC's AML Directive, at 6.1.4: where the substance of a business relationship changes significantly, firms should perform additional CDD procedures to identify and subsequently mitigate the money laundering and terrorist financing risks involved, and if the revised risk is not in line with the Client Acceptance Policy of the firm, then consideration should be made to terminate the business relationship. A list of changes follows, introduced as amongst others, and closing with the note that the list is not exhaustive.
The Bar Association says it in Greek, at the paragraph its August 2023 edition numbers ST.1.5: «Εάν ο αναθεωρημένος κίνδυνος δεν συνάδει με την Πολιτική Αποδοχής Πελατών της Εταιρείας, τότε θα πρέπει να εξεταστεί η διακοπή της επιχειρηματικής σχέσης.» Ours: if the revised risk is not in line with the Firm's Client Acceptance Policy, then the discontinuation of the business relationship is to be considered. Considered. Again.
Put those beside the paragraph each supervisor writes for the due diligence failure. ICPAC 5.3.6: the firm must terminate or refuse to enter into a business relationship, depending on the case, if it cannot comply with the identification, verification and evaluation of the nature of the business relationship requirements, and the firm has also a legal obligation to examine the possibility of filing a suspicious report to MOKAS. The Bar Association, in the paragraph its 2023 edition numbers E.4.11: «Η Εταιρεία, αναλόγως περίπτωσης, πρέπει να τερματίσει ή να αρνηθεί να συνάψει επιχειρηματική σχέση εάν δεν μπορεί να συμμορφωθεί με τις υποχρεώσεις της για προσδιορισμό, επαλήθευση και αξιολόγηση της φύσης της επιχειρηματικής σχέσης.» Ours: the Firm, as the case may be, must terminate or refuse to enter into a business relationship if it cannot comply with its obligations of identification, verification and evaluation of the nature of the business relationship.
Both paragraphs continue past what is quoted here, each adding the duty to consider a report and a prohibition on telling the client anything about it.
Two supervisors, two languages, one sentence. Must, where the due diligence cannot be completed. Consider, where the risk moved. And neither of them is the source. ICPAC's own amendment log describes what it added at 5.3.6 as the obligation to terminate business if unable to comply with article 61(1)(a)-(c). The supervisor is pointing at the statute.
One case sits just short of the statutory trigger, and there the two part company. ICPAC 5.3.4: if the firm, following further enquiries still has doubts or the client did not provide the information requested within a reasonable time, the business relationship must be declined or terminated. The Bar Association's E.4.9 sets out the same facts in the same order and ends «η επιχειρηματική σχέση μπορεί να απορριφθεί ή να τερματιστεί» — the business relationship may be declined or terminated. Its superseded December 2019 English edition, which is not the current text, said may in English at E.3.4, so the difference is not ours in translation. Doubt is not inability to comply. The Law does not reach that case, and the two supervisors fill the gap differently.
Whose decision it is
Both directives answer it, and neither answer is the Law. ICPAC 4.2.1: each firm's senior management officials should establish the acceptable risk profiles of its clients, and these should be documented in a Client Acceptance Policy, which will also outline the characteristics of a potential client that the firm should potentially decline; the example given is business relationships with PEPs from high risk countries, depending on the risk appetite of the firm. The Bar Association's G.2.1 is the same architecture with a harder verb: the policy also describes the characteristics of a potential client with whom the Firm prohibits the establishment of a business relationship, for example PEPs from high-risk countries, determined according to the Firm's Risk Appetite. That prohibition belongs to the firm. Both say for example.
Because exactly one is a strong thing to say
The Greek verb for terminating appears four times in the whole Law. Section 62(4) is one. Section 59(10)(a) is a second, where terminating business relationships is something a Supervisory Authority may require of a group that keeps a branch or subsidiary in a third country. Section 59(13)(b)(v) is a third, one of the measures the Supervisory Authorities may apply in relation to high-risk third countries: requiring credit institutions and financial institutions to review and amend or, if necessary, terminate cross-border correspondent relationships with a client institution from the country concerned. The fourth is section 64(1)(b1)(ii): where crypto-asset service providers decide to terminate correspondent relationships for reasons connected with the policy of preventing money laundering and combating terrorist financing, they document and record their decision. Section 66 adds two flat prohibitions that end things without using the verb at all. No credit institution or financial institution may enter into or continue a correspondent relationship with a shell bank. No obliged entity may open or maintain anonymous or numbered accounts, accounts in names other than those stated in official identity documents, or anonymous safe deposit boxes.
That is the inventory. Exactly one of them lands on your own client, on your own initiative, because of something in the file. And the only one that speaks to a firm making its own choice, narrow as it is, tells the firm to write the choice down.
So there are two exits and only one of them is the Law's. You take the first because you could not finish the work, and section 62(4) names it, sequences it and tells you what to consider next. You take the second because you decided this is not a client for you, and that one has no section number and no statutory trigger. What it has is a policy, a date and a signature, or it has nothing at all.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗