Until 14 September 2026 the Cyprus Bar Association's compliance officer directive was about the certificate: how to sit the exam, and who could be excused it. The third edition, issued that day, adds the chair: who may sit in it, how fast the Bar must be told when someone new does, and what happens while it stands empty.
Who may sit. The directive defines the compliance officer as an appointed natural person, a senior member of the obliged entity's own staff, full-time or part-time, who holds the necessary authority to carry out the role, has skills, knowledge and expertise in money laundering and terrorist financing, has obtained certification or equivalence, and keeps their annual training obligations in force. The definition ends with one flat sentence: outsourcing the compliance officer is expressly prohibited. The appointment section says the same thing about the duties, and adds that the post must be covered exclusively by an internal member of staff, full-time or part-time depending on the size, nature and complexity of the firm's activities, its type of client base and the risk-based approach it applies. Part-time is allowed, and the appointment form has the entity declare that a part-time arrangement is sufficient and proportionate to the size, nature, complexity and volume of its services. The second edition, which this one replaces, contains no such sentence anywhere, so within this directive the prohibition is new.
An officer who was certified at an earlier sitting does not qualify on the certificate alone. In the twelve months before the appointment they are to have completed the required ten annual training units in money laundering and terrorist financing, so that their certification is validated. A certificate from an earlier sitting, with no training in the twelve months before the appointment, is not validated.
Telling the Bar. On an appointment, a change, or a sudden vacancy, obliged entities have an obligation within ten working days to notify the change, by email, on the new appointment or vacancy annexes. Separately, the vacancy section says the entity is to notify the Bar immediately of the vacancy and of any temporary replacement. Two different timing words over events that overlap, and the directive does not reconcile them.
What happens while the chair is empty. Where the post becomes vacant or the appointed officer is temporarily unable to perform their duties, including cases of resignation, termination of employment, prolonged absence or any other circumstance affecting the exercise of those duties, responsibility for monitoring and managing anti-money-laundering compliance is taken over by the Designated Board Member. In plain terms: the board member already named as the person responsible for money laundering and terrorist financing matters carries the function until the seat is filled, and during that transitional period the entity is to take all necessary measures to keep its policies, procedures and controls running continuously and without interruption.
Where the vacancy is the result of termination of employment, that board member may take over temporarily, for up to four months from the date the post fell vacant. Note the limit of that sentence. It is written for the termination case; the general paragraph, the one covering resignation, prolonged absence and any other circumstance, sets no outer date at all. The vacancy notification form, which the entity signs, reads it the other way: whatever reason is ticked, the entity declares that it will fill the post within the four-month deadline provided by the directive. The section and the form do not say the same thing.
Two ways back into compliance are offered: appointing a person who holds the required certification, or temporarily appointing a suitable member of the entity's own staff, on condition that that person registers for the very next available certification exam.
Firms are to comply within four months of publication, which is a different four months from the vacancy one. And on 17 September 2026 the Bar reminded certified compliance officers to complete their ten hours of training by the end of the year.
A firm can pass the exam and still fail this directive, by leaving the chair empty and telling nobody.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗