Cyprus AML law asks for an independent internal audit service only when your size and the nature of what you do call for one. It attaches no such condition to finding out whether your controls actually work. Two duties, two sentences, and only one has a size on the front of it.
The conditional one is statutory. Section 58Β of L.188(I)/2007 is headed «Σύσταση ανεξάρτητης υπηρεσίας ελέγχου», establishment of an independent audit service. Everything I quote from the Law is Greek and every English rendering here is mine: the consolidated Greek text on CyLII is the only version I had, and no official English text exists in it.
«Όταν ενδείκνυται λόγω, του μεγέθους και της φύσης των δραστηριοτήτων της υπόχρεης οντότητας, συνίσταται ανεξάρτητη υπηρεσία εσωτερικού ελέγχου για την εξακρίβωση των εσωτερικών πολιτικών, ελέγχων και διαδικασιών που αναφέρονται στο άρθρο 58: Νοείται ότι η αρμόδια Εποπτική Αρχή διατηρεί το δικαίωμα να επιβάλει την υποχρέωση σύστασης ανεξάρτητης υπηρεσίας ελέγχου στην υπόχρεη οντότητα.»
Plainly: when it is indicated by reason of the size and the nature of the obliged entity's activities, an independent internal audit service is established to verify the internal policies, controls and procedures referred to in section 58, and the competent Supervisory Authority keeps the right to impose one on you anyway.
Two words carry that. The verb «συνίσταται» is the present indicative, is established, not a recommendation. The proviso's «διατηρεί το δικαίωμα να επιβάλει» is retains the right to impose, which is a power held, not a power exercised. And note the drafting: the heading and the proviso both say «ανεξάρτητης υπηρεσίας ελέγχου», an independent audit service, while only the operative sentence says «ανεξάρτητη υπηρεσία εσωτερικού ελέγχου», an independent internal audit service.
Now the object, which is «την εξακρίβωση των εσωτερικών πολιτικών, ελέγχων και διαδικασιών που αναφέρονται στο άρθρο 58» — the verification of the internal policies, controls and procedures referred to in section 58. Bare. The Law does not say what about them is to be verified.
The unconditional duty sits in the very next section. Section 58Γ: «Τα ανώτερα διοικητικά στελέχη υπόχρεης οντότητας εγκρίνουν τις πολιτικές, τις διαδικασίες και τους ελέγχους που εφαρμόζει η υπόχρεη οντότητα σε σχέση με τη νομιμοποίηση εσόδων από παράνομες δραστηριότητες και τη χρηματοδότηση της τρομοκρατίας, παρακολουθούν δε και, όπου ενδείκνυται, ενισχύουν τα μέτρα που έχουν ληφθεί.» In my English: senior management approve the policies, procedures and controls the entity applies against money laundering and terrorist financing, and they monitor and, where indicated, strengthen the measures taken. Read where the qualifier sits. It is between the two verbs. On my reading it conditions the strengthening, not the monitoring, and no size appears in the sentence at all. ICPAC's own English of the same sentence, in the closing paragraph of its 4.2.3, punctuates it that way: senior management officials must also approve the policies, procedures and controls applied by their firms, as well as monitor, and where appropriate, enhance the measures adopted.
Section 58 itself points the same way. Its policies, controls and procedures are «ανάλογες με τη φύση και το μέγεθός της», proportionate to the entity's nature and size, and one of the lettered areas they must cover is (δ) «τον εσωτερικό έλεγχο», internal control. Proportionate shapes a duty. It does not delete one.
Your supervisor supplies the detail, and only one supervisor's directive is in front of me. ICPAC's Directive puts both halves in a single paragraph, 2.1.4, and puts them in this order. First: firms should make arrangements to verify, on a regular basis, the compliance with and the effectiveness of policies, procedures and controls, and firms may consider obtaining assurance from independent professionals. Then, and only then: where appropriate and proportional to the size and nature of their activities, an independent internal audit service covering the firm's AML/CFT system should be established, for verification of the adequacy, effectiveness, appropriateness and proportionality of internal policies, controls and procedures.
So the sentence with the size condition is the second one. The first has none. Keep the modals apart too: verifying is a should, obtaining assurance from independent professionals is a may consider, and the Directive is binding and obligatory as to its adoption by the persons to whom it is addressed, which means ICPAC members. Section 58Β reaches every obliged entity whoever supervises it.
Notice also what ICPAC verifies against. The Law's object is the policies, controls and procedures themselves. ICPAC names four qualities: adequacy, effectiveness, appropriateness and proportionality. That is ICPAC's addition, and its first sentence adds a fifth thing, compliance with them.
Then the silences, which matter more than they look. Neither text says how often a regular basis is. Neither says who does the verifying, beyond the optional independent professionals. Neither defines independent. And ICPAC's own drafting allows for the firm with no audit function: at 3.2.1(i) the Compliance Officer works in consultation with the firm's senior management and its Internal Audit Department, and after that department alone come the bracketed words if applicable.
Closing the findings is where the two halves separate again. For the internal audit service, 2.1.4 says the work should take the form of a written report, and the board or equivalent managing body should be able to demonstrate proper consideration of it and then take appropriate action on any deficiencies highlighted. For the firm that merely makes arrangements to verify, neither text names an output at all.
Which is mine to say next, not the texts': write it down anyway. Decide the interval yourself and record why you chose it, name who did the checking and what made them independent of the thing checked, and finish each finding with a dated action and an owner. A verification nobody can see is indistinguishable from one nobody did.
You may be too small for an audit department. Nothing in either text makes you too small to find out whether your controls work.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗