Third party, or part of you

The Cyprus Bar Association's new guidelines on third-party reliance turn on the arrangement you have with the person doing the client work. One kind makes them a third party you rely on, if they qualify and on conditions. The other, a contract citing section 67(5), makes them part of your own firm.

The guidelines were announced to members on 22 September 2026 (September 2026 edition, issued by the Bar's Supervision and Compliance Department). They explain members' obligations under section 67 of Law 188(I)/2007, the section on performance by third parties. They are in Greek; the translations here are ours.

Contract one is reliance. The guidelines define third persons as credit institutions, financial organisations, auditors, independent legal professionals and external accountants, among others, as well as other institutions or persons operating in the European Economic Area or in a third country (that is, the guidelines add, the obliged entities in paragraphs (a) to (d) of section 2A of the Law), where they both apply due diligence and record-keeping measures consistent with those laid down by Directive 2015/849 and are subject to supervision consistent with that Directive's requirements. Put plainly: firms of the listed kinds, wherever in the European Economic Area or beyond they operate, and only if both conditions are met.

Before relying on one, obliged entities are obliged to do five things. Assess the systems and procedures the third person applies to prevent money laundering and terrorist financing. Confirm, on that assessment, that its due diligence and client identification systems comply with the Law and the Bar's AML/CFT directive. Keep a separate file for each third person, holding the agreement, the assessment report and other relevant information. Take measures to ensure it will provide the original documents. And obtain the compliance officer's approval both for starting the cooperation and for accepting client identification data the third person has verified. Annex A lists what the assessment might gather, and calls itself a suggested, non-exhaustive list. In short: vet them, file it, and have the compliance officer sign off before anything is accepted.

The conditions for passing information and documents across are, the guidelines say with reference to section 67(3), set in writing between the two, for documentation purposes. Reliance is permitted only when the business relationship is established or an occasional transaction is carried out, exclusively for verifying the clients' identity, and not for ongoing monitoring. The same section also lists the purpose and intended nature of the relationship among the measures reliance is permitted for; the guidelines do not reconcile the two sentences. Whatever the reliance, the final responsibility rests exclusively with the obliged entity. The guidelines add, in one paragraph, that every obliged entity is to appoint a compliance officer, who must be a senior executive certified under the Bar's certification and appointment directive, with the authority, knowledge and expertise the role needs.

Contract two is not reliance at all. Section 67(5) of the Law, as the guidelines set it out, disapplies section 67 in outsourcing or agency relationships where, under a contractual arrangement, the outsourced service provider or the agent is considered part of the obliged entity. The guidelines add that the conditions are set in a written agreement between the obliged entity and the third person.

Example β shows it. An ΕΠΔΥ (our expansion: an administrative-services company) signs a services agreement with a natural person, for instance a lawyer employed by another office, so that the person provides administrative services, such as being appointed an officer of the ΕΠΔΥ's clients, for the ΕΠΔΥ's benefit. The ΕΠΔΥ invoices the clients. Under a contractual arrangement expressly referring to section 67(5), that person is considered part of the ΕΠΔΥ, and so has no self-standing obligation to apply due diligence to the ΕΠΔΥ's clients. The ΕΠΔΥ has that obligation for the clients the person serves on its behalf. In plain terms: the person is inside the firm, not a third party the firm relies on.

And the ΕΠΔΥ is to declare that person to the Bar as an employee who may provide such administrative services for its benefit, and point to Annex Γ of the Bar's «Οδηγία για τα Δικαιούχα Πρόσωπα που παρέχουν Διοικητικές Υπηρεσίες» (August 2026, 8th edition), in our translation the Directive on Persons Entitled to Provide Administrative Services. Annex Γ is an entitled person's confirmation about its employees: the persons listed are its employees and the only ones providing administrative services in the activities assigned to them. The guidelines state that declaration duty only for the ΕΠΔΥ.

The other examples mark the edges. In α, a lawyer provides director services to clients to whom another obliged entity, B, offers other services, and invoices the clients for them; the lawyer is obliged to carry out due diligence on them, but may rely on B through an agreement with B, only at the establishment of the relationship and not for ongoing monitoring. In γ, a lawyer provides administrative services, such as company formation, to an accounting firm that engaged him, and invoices the firm; its clients do not know of the arrangement. The lawyer is obliged to carry out due diligence on the clients, since he provides them with company formation services, and may rely on the accounting firm through an agreement with it. In δ, an ΕΠΔΥ engages a ΔΕΠΕ (our expansion: a lawyers' limited-liability company) for advisory services on an agreement between the ΕΠΔΥ's clients, and the ΔΕΠΕ will not provide formation, management or other section 2A services to them. Section 67 does not apply, because the ΕΠΔΥ is the ΔΕΠΕ's client; and no due diligence on the ΕΠΔΥ is required, because the service is considered of a judicial or legal nature where it does not concern a section 2A matter, and so falls outside the Law.

Across the four, the invoice is not what moves the due diligence: in γ the lawyer bills the accounting firm and still owes it to the clients he forms companies for.

Under both arrangements the due diligence ends up with the obliged entity. What the arrangement decides is whether the person doing the work is a third party you have vetted, or, by a contract citing section 67(5), part of your own firm.

Not legal advice. Verify against the primary source before acting.

Sources

• PRIMARY.
• CONTEXT.
• CROSS-REFERENCE ONLY.

Screen against the current lists in seconds

FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.