Cyprus law sets no timetable for a firm's own money laundering risk assessment. It says the assessment is kept up to date. "Annually" is ICPAC's word, and ICPAC also expects a review when things change. On the Law's words, what makes the document stale is a change in the firm, not a date.
The duty is section 58A of L.188(I)/2007. Two ICPAC texts sit on top of it: the AML Directive, issued under section 59(4), and the guidance paper on the firm-wide risk based approach which, the Directive says, was published with circular CC_13/2022 on 6 June 2022. Both are written for ICPAC's members; if another supervisor licenses you, its own directive is the one to read. The Law is Greek, no official English text was in front of me, and every English rendering here is mine.
Section 58A(1) serves limb (δ) of section 58: internal control, risk assessment and risk management. An obliged entity «λαμβάνει κατάλληλα μέτρα προκειμένου να εντοπίζει και να εκτιμά» the money laundering and terrorist financing risks «που διατρέχουν»: takes appropriate measures to identify and assess the risks they run, taking into account risk factors, «συμπεριλαμβανομένων», including, those relating to its customers, countries or geographic areas, products, services, transactions or delivery channels. Then the proviso: «Νοείται ότι, τα μέτρα αυτά είναι ανάλογα με τη φύση και το μέγεθος της υπόχρεης οντότητας». Provided that those measures are proportionate to the nature and size of the obliged entity.
Plainly: the risks to assess are the ones your firm runs, read through who your clients are, where you and they deal, what you sell, the transactions you handle and how you deliver it. The list is open, and the effort scales with the firm. ICPAC's guidance paper says firms that do not offer complex services and have limited or no international exposure "may not need an overly complex or sophisticated assessment". Simple is allowed.
Section 58A(2) is one sentence: «Οι αναφερόμενες στο εδάφιο (1) εκτιμήσεις κινδύνων τεκμηριώνονται, επικαιροποιούνται και τίθενται στη διάθεση της αρμόδιας Εποπτικής Αρχής». The risk assessments referred to in subsection (1) are documented, updated and made available to the competent Supervisory Authority. Three verbs in the plain present tense. No period, no form, no date.
I searched the whole consolidated Greek text for ετησίως, κάθε έτος and every form of ετήσι-. The annual words are there: the Unit's annual report, some supervisors' annual reports, annual statistics, annual turnover for fines. None touches section 58A. The Law's only use of the phrase calendar year is in section 62(6), about contacting clients to review beneficial-ownership information.
"Annually" comes from ICPAC. Directive 4.9.3: "All firms must document the firm-wide risk assessment performed annually taking into account the overall risks undertaken by the firm." The must sits on documenting; the annual performance rides along with it. The guidance paper says the firm-wide assessment is carried out "annually" and speaks of "the overall annual assessment process which must be undertaken by firms". For an ICPAC firm the yearly cycle is real, and the Directive binds its members under section 59(4). It is just not the Law's own wording.
And ICPAC does not stop at the year. The same paper says the firm-wide assessment is "performed initially once the RBA is adopted" and "reviewed periodically and if material changes take place internally or externally". At Step 4: "Firms must regularly review the risk assessment to ensure that it always remains relevant and up to date." That review should take in internal information such as internal suspicious reports, new trends, emerging risks and new technologies, legal updates, law enforcement alerts, and the findings of the national and supranational assessments; where it finds deficiencies, firms "must make all necessary changes accordingly". The Directive calls the risk based approach "a dynamic process" that "must be maintained".
Plainly: inside ICPAC's own annual cycle, the test is "always remains relevant and up to date". A date on the cover does not pass it.
ICPAC's clearest example is countries. The guidance paper asks you to list every country you deal with, meaning any country you have clients in, including the countries of your clients' ultimate beneficial owners. Then: "the list should be kept updated with any additional countries that you deal with or establish business relationships and should be reflected in your firm’s risk assessment." A new country arrives with a client, not with January.
The Law gives that an edge. Its definition of a high-risk third country includes «τρίτη χώρα, η οποία κατατάσσεται από τις υπόχρεες οντότητες ως υψηλού κινδύνου, σύμφωνα με την προβλεπόμενη στο άρθρο 58Α εκτίμηση κινδύνου»: a third country which obliged entities categorise as high risk in accordance with the section 58A risk assessment. Section 64(1)(α) applies enhanced due diligence to business relationships or transactions with high-risk third countries, with a proviso for certain branches and subsidiaries of EU obliged entities. On my reading, a country that arrived after the last review has not been categorised by that assessment at all.
The national risk assessment, as ICPAC calls it, does not stand in for yours either. The Law does not use that phrase. Section 57(1)(β1) has the Advisory Authority coordinate public services and private-sector bodies in identifying, assessing, understanding and mitigating these risks and in updating that assessment, and one of the uses it lists, limb (v), is «την παροχή στις υπόχρεες οντότητες κατάλληλων πληροφοριών, ώστε να τις διευκολύνει να πραγματοποιήσουν τις δικές τους εκτιμήσεις κινδύνου». Providing obliged entities with appropriate information so as to facilitate them in carrying out their own risk assessments. Their own.
My suggestion, not a requirement: list the changes that would move your assessment, such as a new service line, a new country among clients or their owners, a new delivery channel, an internal suspicious report, and treat each one as a review date. Keep ICPAC's annual date as well. ICPAC's own worked examples end with three lines: prepared by and date, approved by and date, on-going review date.
Section 58A(2) does not say when the supervisor will ask. It says the assessment is made available. On whatever day it is asked for, the question worth asking of it is not whether it is dated this year. It is whether it still describes your firm.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 3 free full assessments, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗