Simplified due diligence in Cyprus law is a permission, and its condition comes first. A firm may lighten the measures provided it has already satisfied itself that the relationship or transaction is lower risk, and there is no suspicion. The finding comes before the lighter file.
The rule is section 63 of L.188(I)/2007. ICPAC's AML Directive, issued under section 59(4) of the same Law, fills in what the section leaves out. The Law is Greek, no official English text was in front of me, and every English rendering here is mine.
Section 63(1) in full: «Υπόχρεη οντότητα δύναται να εφαρμόζει απλουστευμένα μέτρα δέουσας επιμέλειας ως προς τον πελάτη, εφόσον προηγουμένως βεβαιωθεί ότι η επιχειρηματική σχέση ή η συναλλαγή παρουσιάζει χαμηλότερο βαθμό κινδύνου και νοουμένου ότι δεν υπάρχει υποψία για νομιμοποίηση εσόδων από παράνομες δραστηριότητες ή χρηματοδότηση της τρομοκρατίας: Νοείται ότι υπόχρεη οντότητα παρακολουθεί επαρκώς τη συναλλαγή και την επιχειρηματική σχέση, ώστε να είναι δυνατός ο εντοπισμός ασυνήθιστων ή ύποπτων συναλλαγών». An obliged entity may apply simplified customer due diligence measures, provided it has first satisfied itself that the business relationship or the transaction presents a lower degree of risk, and provided there is no suspicion of money laundering or terrorist financing: provided that the obliged entity monitors the transaction and the business relationship sufficiently to make it possible to detect unusual or suspicious transactions.
Plainly, four things. «δύναται» is may, not must: nothing obliges a firm to simplify. «προηγουμένως» is beforehand: the finding of lower risk comes before the lighter measures, and it is a finding about the business relationship or the transaction. The suspicion condition is in the present tense: there is no suspicion. And the proviso sets a floor that simplifying does not lower: monitoring sufficient to make unusual or suspicious transactions detectable.
Section 63(2) says what goes into the finding. In assessing the risks relating to categories of customers, geographic areas and particular products, services, transactions or delivery channels, the obliged entity takes into account at least the Annex II factors relating to situations of potentially lower risk. The Law heads Annex II «Ενδεικτικός κατάλογος των παραγόντων και των τύπων αποδεικτικών στοιχείων ως προς την ύπαρξη δυνητικά χαμηλότερου κινδύνου»: an indicative list of the factors and types of evidence as to the existence of potentially lower risk. Its examples include listed companies subject to disclosure requirements that ensure adequate transparency of beneficial ownership, public services or enterprises, and registration, seat or residence in a Member State of the European Union.
Plainly: an Annex II factor is evidence that goes into the finding. It is not the finding. The word is «δυνητικά», potentially, and section 63(2) asks for the factors to be taken into account «τουλάχιστον», at least. On the Law's words, a listed company points towards lower risk; being listed does not decide it.
What the Law does not say is what simplified measures are. The term appears only in section 63's heading and its first subsection. ICPAC supplies the content. At 5.8.3: "In applying SDD, CDD measures are still required but certain adjustments can be made to reflect the assessment of low risk." The adjustments "may cover" four things: the quality and source of information obtained for identification and verification purposes; the timing of application of CDD procedures; the frequency of scheduled or routine CDD updates; and the frequency and extent of transaction monitoring. The adjustments reflect an assessment already made. The order holds here too.
ICPAC also narrows the gate. 5.8.1 opens: "SDD measures may be applied in exceptional cases." Those cases "should be considered on a case by case basis, ensuring that the business relationship or transaction presents a lower risk for money laundering and terrorist financing, and given there is no suspicion", in line with its chapter 4 and "based on the content of Annex I (Low risk)". That is ICPAC's own Annex I, which it sources to the Law and whose items correspond to the Law's Annex II: different number, same list. The rationale "should be clearly documented in the AML manual or CAP". Section 63 does not say exceptional. I note the difference; neither text explains it.
Some things survive any simplification in ICPAC's text. Monitoring "to enable the detection of unusual or suspicious transactions is always required", and "the obligations to report to MOKAS any identified transactions still remain" (5.8.1). At 6.2.2, ongoing monitoring should take place for all client relationships, including clients for which SDD measures were adopted; what can be altered is its frequency and extent. At 5.8.2, where an STR or SAR is submitted for a client on SDD measures, the client "should be immediately re-classified to High risk", and consideration should also be given to EDD procedures, in coordination with MOKAS and without jeopardising an investigation or tipping off the suspect. The Law's own answer sits in section 60(γ): the identification procedures and due diligence measures apply when there is suspicion, «ανεξάρτητα από οποιαδήποτε παρέκκλιση, εξαίρεση ή κατώτατο όριο δυνάμει των διατάξεων του παρόντος Νόμου», regardless of any derogation, exception or minimum threshold under the Law. The Law does not say the words re-classify or high risk. ICPAC does.
My suggestion, not a requirement: write the finding down before the measures. Which factors, what evidence, that nothing was suspicious, who decided and when; then which of the four adjustments you made. Section 61(2) already expects firms to be able to demonstrate to the competent supervisory authorities that the extent of their measures is proportionate to their risks, and ICPAC's 4.9.2 asks for a documented risk assessment for each individual client.
Lower risk is a finding; the lighter file is what it permits. A file that shows the lighter measures without the finding shows the discount, not the permission.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 3 free full assessments, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗