Bolt a new tool onto a service your firm has sold for ten years, and nothing about that service is new. Cyprus law still wants the money laundering risk assessed before you switch the tool on. Section 66(2A) of L.188(I)/2007 is not a new-products rule. The old product counts too.
The subsection sits in a section that looks like it is about something else, headed «Απαγόρευση συνεργασίας με εικονική τράπεζα, τήρησης ανώνυμων λογαριασμών και προώθηση νέων τεχνολογιών» — prohibition of cooperation with a shell bank, of keeping anonymous accounts, and promotion of new technologies. That rendering is mine, as is every English rendering below: the consolidated Greek text on CyLII is the only version of this Law I had. Subsection (1) speaks only to a credit institution and a financial organisation. Subsection (2A) opens with «Οι υπόχρεες οντότητες» — the obliged entities, all of them.
Here it is: «Οι υπόχρεες οντότητες εντοπίζουν και αξιολογούν τους κινδύνους νομιμοποίησης εσόδων από παράνομες δραστηριότητες και χρηματοδότησης της τρομοκρατίας σχετικά με την ανάπτυξη νέων προϊόντων και νέων επιχειρηματικών πρακτικών, συμπεριλαμβανομένων νέων μηχανισμών παράδοσης, καθώς και σχετικά με τη χρήση νέων ή αναπτυσσόμενων τεχνολογιών τόσο για νέα, όσο και για προϋπάρχοντα προϊόντα, πριν απο την προώθηση ή χρήση αυτών των προϊόντων, πρακτικών και τεχνολογιών και λαμβάνουν τα κατάλληλα μέτρα προκειμένου να διαχειρίζονται και να μετριάζουν τους κινδύνους αυτούς.» My translation: the obliged entities identify and assess the money laundering and terrorist financing risks relating to the development of new products and new business practices, including new delivery mechanisms, as well as relating to the use of new or developing technologies for both new and pre-existing products, before the promotion or use of those products, practices and technologies, and they take the appropriate measures in order to manage and mitigate those risks.
Plainly: before the new thing goes in front of anyone, work out what money laundering or terrorist financing risk it brings, then act on what you found. All three verbs, identify, assess and take, are present indicative, the voice this statute uses for a duty. Not may.
Now count what the sentence names, because there are four things in it and only one of them is a product. The development of new products. The development of new business practices. New delivery mechanisms, carried into that limb by «συμπεριλαμβανομένων», including, so they are examples inside the practices rather than a closed second list. And the use of new or developing technologies «τόσο για νέα, όσο και για προϋπάρχοντα προϊόντα», for both new and pre-existing products. That fourth one is the easiest to miss. The product can be the oldest thing you sell; if what you are pointing at it is new, the subsection is live.
The timing sits in the same sentence, at «πριν»: before the promotion or use of those products, practices and technologies. Promotion or use, not first client. On my reading, and the Law defines neither word, a pitch is promotion and a pilot is use.
What the subsection does not say matters too. I searched the Greek for νέων προϊόντων, νέες τεχνολογίες, αναπτυσσόμεν, μηχανισμών παράδοσης and δίαυλ. In that exact form, «νέων προϊόντων» occurs in the Law once: here. The nominative, «νέα προϊόντα», turns up in one other place, the Annex I come to below. And the trigger names no new client segment and no new country: on these words, opening a market does not start this clock. Clients and geographies belong to a different duty, the obliged entity's risk assessment under section 58A(1), whose factor list does take them in.
The trigger words appear once more, in Annex III item 2(ε), which lists the same four things again. Annex III is «Ενδεικτικός κατάλογος», an indicative list of factors pointing to potentially higher risk, and section 64(3) sends you there when enhanced due diligence is in play. Same words, different machine: there they raise the diligence you owe a client, here they start a duty that runs before anything is launched.
One supervisor's directive is in front of me, ICPAC's, issued to its members under sections 59(1)(δ) and 59(4). Its paragraph 4.8 is an addition, dated 3.8.2021 by the Directive's own Table of Amendments. 4.8.1 opens: Firms are obligated to perform risk assessment prior to the launch of any new technology, product or service, e.g., services related to cryptoassets, citizenship through investment programs, electronic money, crowdfunding etc. The e.g. and the etc. are the Directive's own, so those are examples, not the scope. It adds that special attention should be given to cases where vulnerabilities of abuse of technological advances or facilitation of anonymity exists — should there, obligated and must for the assessment itself.
Side by side, the supervisor's sentence is the narrower one. It names a new technology, product or service. It does not name business practices, delivery mechanisms, or technology used on a product a firm already offers; I searched the whole Directive, and those words appear in one place only, its Annex II, which reproduces the statute's higher-risk factor list in English. Paragraph 4.3.5 adds a filter the Law does not have: a firm starting a new service which is significantly different from its existing range of services should assess the corresponding risks. Significantly different, and should. The statute sets no materiality threshold and uses no should.
This paragraph is mine and none of it is a legal requirement: the trigger is rarely a launch meeting. It is a procurement decision, a new client portal, a change of outsourcing, a vendor update that lands on a Tuesday. So decide who in the firm is entitled to call something new, and put the assessment in front of go-live.
A new product announces itself. A new tool pointed at an old one does not. The Law counts both, and only one of them was ever going to appear on your calendar.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗