Cyprus law requires the compliance officer to be senior. It does not require a board seat. Senior, as the Law defines it, means knowing enough about the firm's money laundering and terrorist financing risk, and ranking high enough to take decisions that affect it. The board seat is a separate appointment.
Three sections of L.188(I)/2007 do the work: 69(α), 2 and 58Δ. ICPAC's AML Directive, issued under section 59(4) of the same Law, restates them for accountants and adds rules of its own. The Law is Greek, no official English version was in front of me, and every English rendering here is mine.
Section 69 has obliged entities apply internal reporting procedures, and its paragraph (α) begins: «Ορίζουν ανώτερο διοικητικό στέλεχος το οποίο διαθέτει ικανότητα, γνώσεις και εμπειρογνωμοσύνη, ως “λειτουργό συμμόρφωσης”». They designate a senior management official who possesses competence, knowledge and expertise, as compliance officer. The paragraph goes on to make that officer the person to whom information that proves or creates suspicion of money laundering or terrorist financing is reported.
The qualifying word is defined. Section 2: «"ανώτερο διοικητικό στέλεχος" σημαίνει στέλεχος ή υπάλληλο οντότητας με επαρκείς γνώσεις της έκθεσης της οντότητας στον κίνδυνο νομιμοποίησης εσόδων από παράνομες δραστηριότητες και χρηματοδότησης της τρομοκρατίας, το οποίο είναι σε ανώτερη βαθμίδα στην ιεραρχία για τη λήψη αποφάσεων που επηρεάζουν την έκθεση σε κίνδυνο, ανεξαρτήτως του εάν το εν λόγω πρόσωπο είναι μέλος του διοικητικού συμβουλίου της οντότητας». A senior management official means an officer or employee of an entity with sufficient knowledge of the entity's exposure to the risk of money laundering and terrorist financing, who is at a senior level of the hierarchy for taking decisions that affect that risk exposure, irrespective of whether that person is a member of the entity's board of directors.
Plainly: two tests and a clause about the board. The person knows enough about the firm's money laundering and terrorist financing risk, and stands high enough to take decisions that move it. Officer or employee, the definition says. And the last clause takes the board seat out of the test, either way.
Section 69(α) puts competence, knowledge and expertise on top, and stops there: no exam, no certificate, no count of years. «λειτουργό συμμόρφωσης» occurs five times in the whole Law, once in section 26(3) and four times in section 69, and none adds a qualification.
The board seat is section 58Δ, headed designation of a member of the board of directors: «Υπόχρεη οντότητα ορίζει μέλος του διοικητικού συμβουλίου, νοουμένου ότι υφίσταται διοικητικό συμβούλιο, το οποίο θα φέρει την ευθύνη για την εφαρμογή των διατάξεων του παρόντος Νόμου και των δυνάμει αυτού εκδιδόμενων οδηγιών ή/και εγκυκλίων ή/και κανονισμών περιλαμβανομένων των οποιωνδήποτε σχετικών πράξεων της Ευρωπαϊκής Ένωσης». An obliged entity designates a member of the board of directors, provided that a board of directors exists, who will bear responsibility for implementing the provisions of this Law and the directives and/or circulars and/or regulations issued under it, including any relevant acts of the European Union.
Plainly: where there is a board, one named member answers for the whole Law being applied, and for everything issued under it. A different job from receiving internal reports, with its own condition on the front. The Law files them apart itself: in section 59(6Ε), on what certain supervisors, ICPAC among them, publish each year about monitoring compliance, sections 69 and 70 sit under the reporting of suspicious transactions, and sections 68Α, 58 and 58Δ under internal controls.
Two seats, two sections. Can one person hold both? The Law does not say they must be different people, and it does not say they may be the same. Neither section mentions the other.
Nor does the Law write out the job. ICPAC's Directive says so at 3.2.1: the role of the Compliance Officer is not defined in the Law. Precisely, the Law says who is appointed, that internal reports go to them and are examined by them, and, at 69(γ), that the procedures allow them, for that examination, «άμεση και έγκαιρη πρόσβαση», direct and timely access, to other information, data and documents which may assist them and are available to the person carrying on the financial or other activities.
ICPAC keeps two terms where the Law has one. Senior Management means board members for companies, partners for partnerships, sole traders and other positions in other types of entity or legal arrangement, with top decision-making authority. A Senior Management Official is an officer or employee with sufficient knowledge of the obliged entity's money laundering and terrorist financing risk exposure and sufficient seniority to take decisions affecting its risk exposure, irrespective of whether the said person is a member of the Board of Directors. The second is the Law's section 2 definition in English, with sufficient seniority where the Law has a senior level of the hierarchy.
Paragraph 3.1.1 uses the second term. The person appointed as CO must be a senior management official, with sufficient skills, experience and knowledge in AML/CTF and Compliance areas as well as knowledge of the firm, its service lines and its clients, and must have the necessary authority to fulfil his duties, which may include taking decisions affecting the risk exposure of the firm and the handling of internal and external STRs and communication with MOKAS and the Institute. Then 3.1.2: in cases where the CO is not a member of the Board of Directors, a member of the Board of Directors should be designated to be responsible for the implementation of the Compliance policies and procedures in accordance with the Law. Plainly: senior by the definition, not by the seat, and where the officer is off the board, a board member is named beside them. Paragraph 2.1.5 asks for a member of the Board of Directors or senior partners, provided there is a Board.
ICPAC then adds what the Law does not say. All firms should appoint a Certified Compliance Officer according to its Regulation 6.700. Firms should communicate to MOKAS the name and position of the person appointed. Firms must ensure the CO has sufficient resources, and depending on size, complexity and structure may appoint Chief and assistants. The CO should be allowed direct and timely access to all documents, data and information possessed by the firm which may assist him in carrying out his duties. COs should undertake at least 10 specialised CPD units a year under paragraph 4(12) of Regulation 6.700. The access is wider than the Law's; the rest is not in the Law at all. Other supervisors issue their own directives, and a firm reads its own.
What neither text says: what a firm does when nobody inside it meets the definition, or how long the seat may stand empty.
So, and this is mine, not a requirement: write the appointment against the definition, not the org chart. Record what the officer knows of the firm's risk exposure and which decisions affecting it they can actually take. Record the 58Δ designation as its own line. If one person holds both, say so, knowing the Law does not address it.
The Law asks what your compliance officer knows and what they can decide, not whether they sit on the board. The board seat is a second appointment, in a different section.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 3 free full assessments, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗