Most firms go back to a client's due diligence when something new happens: a new deal, a new owner, a bigger sum. Cyprus law also sends them back when nothing new has happened, except that the firm now doubts a document it already holds. That doubt is a trigger by itself.
The rule is in section 60 of L.188(I)/2007, the Law's list of cases in which obliged entities apply customer due diligence. ICPAC's AML Directive, issued under section 59(4), restates it and adds procedure. The Law is Greek, no official English text was in front of me, and every English rendering here is mine.
Section 60 opens: «Υπόχρεες οντότητες εφαρμόζουν τις διαδικασίες προσδιορισμού ταυτότητας και τα μέτρα δέουσας επιμέλειας ως προς τον πελάτη στις εξής περιπτώσεις». Obliged entities apply the identification procedures and the customer due diligence measures in the following cases. Case (δ): «όταν υπάρχουν αμφιβολίες για την ακρίβεια ή την επάρκεια των εγγράφων, στοιχείων ή πληροφοριών που συγκεντρώθηκαν προηγουμένως για την εξακρίβωση της ταυτότητας υφιστάμενου πελάτη». When there are doubts about the accuracy or the adequacy of the documents, data or information gathered previously to ascertain the identity of an existing client.
Plainly: the client does not have to do anything. Case (δ) asks for no new transaction, no amount and no change in the client's circumstances. Its only condition is a doubt about what is already in the file. It shares those opening words with a new business relationship, the amount-based cases and suspicion.
«ακρίβεια ή την επάρκεια» is two limbs: accuracy or adequacy. A document need not look false to be in scope; one that may be genuine but is not enough to establish who the client is falls under the second limb. And the doubt attaches to material gathered «για την εξακρίβωση της ταυτότητας», to ascertain identity. On its words, the Law's case is about the identity file.
ICPAC words it more widely. At 5.3.1, under "According to the legislation CDD should be completed when", its fourth case is "There are doubts about the veracity or adequacy of previously obtained CDD". In the Directive, CDD reaches beyond identity: 5.2.1 also lists the beneficial owner, ownership and control, the purpose of the relationship and ongoing monitoring. The Law says identity material and accuracy; ICPAC says CDD and veracity. Neither text addresses the difference, and I do not resolve it.
Keep case (δ) apart from its neighbours. Section 61(1)(δ) makes ongoing monitoring one of the measures, and part of it is «τη διασφάλιση της τήρησης ενημερωμένων εγγράφων, στοιχείων ή πληροφοριών», ensuring that up-to-date documents, data or information are kept. Section 62(6) applies the measures to existing clients at the appropriate time according to risk, when their relevant circumstances change, or when the firm has a statutory duty to contact the client in the calendar year to review beneficial-ownership information. One is upkeep, the other a timetable set by risk and events. Case (δ) waits for neither. ICPAC's 5.3.2 list of change-driven updates, from "Suspicions" to "Any other changes", does not name doubts either.
What follows a doubt is the Law's ordinary sequence. Section 61(1) says the measures include identifying and verifying the client on documents, data or information from a reliable and independent source; identifying the beneficial owner and taking reasonable measures to verify; assessing the purpose and intended nature of the relationship; and ongoing monitoring. Section 61(2) lets firms set the extent by degree of risk, taking into account at least the Annex I variables, but they must be able to demonstrate to the competent supervisory authorities that the extent is proportionate to their risks. Risk sets the depth; the firm carries the burden of showing it was enough.
If the measures a doubt brings in cannot be completed, section 62(4) says where it ends. When an obliged entity cannot comply with the due diligence requirements in section 61(1)(α), (β) and (γ), it does not carry out a transaction through a bank account, does not enter into a business relationship or does not carry out the transaction, as the case may be, «τερματίζει την εν λόγω επιχειρηματική σχέση και εξετάζει το ενδεχόμενο υποβολής αναφοράς για ύποπτη συναλλαγή»: terminates the business relationship in question and examines the possibility of submitting a suspicious transaction report in relation to the client to the Unit, under section 69. Section 62(5) takes independent legal professionals, auditors, tax advisers and external accountants outside 62(4) when assessing a client's legal position, or defending or representing the client in or concerning judicial proceedings, including advice on starting or avoiding them. Plainly: for an existing client, the road ends at termination and a decision on whether to report, unless 62(5) applies.
ICPAC adds steps before that point which the Law does not spell out. At 5.3.3, a firm that finds, at any stage of the relationship with an existing client, that valid or sufficient documentation or information on identity and economic profile is not available must collect it "as quickly as possible". At 5.3.4, further enquiries come first, and the exit follows where the firm "still has doubts or the client did not provide the information requested within a reasonable time". Section 62(4) contains neither step.
One limit applies throughout. Section 61(7): an obliged entity «δύναται να μην ολοκληρώσει τα μέτρα δέουσας επιμέλειας», may refrain from completing the measures, where completing them may constitute an offence under section 48, and then informs the Unit immediately. ICPAC's 5.3.4 ends on the same point, naming tipping off.
What neither text tells you is how strong a doubt must be, or how long you have to resolve it. The Law gives no period; ICPAC's words are "as quickly as possible" and "within a reasonable time". The nearest thing to a finish line is section 61(3), on the same root as the adequacy limb: proof of identity is «επαρκής», adequate, if it is reasonably possible to establish that the client is in fact who he claims to be, and the person examining the evidence is satisfied, under the Law's procedures, that he is.
My suggestion, not a requirement: give doubt its own line in the procedure, apart from the refresh calendar. Who raised it, what was asked for, by when, what was decided.
Nothing new has to happen for the file to reopen. A doubt about what is already in it is enough.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 3 free full assessments, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗