Cyprus CY

Cyprus's sanctions architecture underwent a structural overhaul effective 25 July 2025 with the enactment of a three-law package — Law 150(I)/2025, Law 149(I)/2025 and Law 48(I)/2025 — establishing the National Sanctions Implementation Unit (NSIU/EMEK) within the Ministry of Finance. Before this reform, sanctions enforcement in Cyprus sat under a fragmented 2016 regime; the new unit centralises coordination of EU and UN sanctions implementation, licensing and derogation decisions, and administrative enforcement under a single body. The reform is directly and explicitly linked to prior ICIJ Cyprus Confidential findings, which had exposed gaps in Cyprus's sanctions-enforcement capacity, giving this development the architecture-over-incident character that FIM's analytical register prioritises: a durable institutional change responsive to a documented structural weakness, rather than a one-off enforcement episode.

Alongside the institutional consolidation, Law 149(I)/2025 creates a new domestic criminal offence for violating EU restrictive measures, transposing EU Directive 2024/1226, the EU's harmonising directive on criminal sanctions-violation offences. This pairs administrative centralisation (via NSIU/EMEK) with a criminal-law backstop, giving Cyprus both a coordinating body and a prosecutable offence where sanctions violations occur — a combination that was previously absent or, at minimum, fragmented across different authorities.

CySEC's own 2026 sanctions-outlook commentary treats the July 2025 NSIU stand-up as the domestic mechanism reconciling EU autonomous sanctions listings with UN Security Council designations, underscoring that the reform's significance extends beyond enforcement capacity to reconciling two potentially divergent listing regimes under one coordinating unit.

Cyprus is not FATF grey-listed and continues to be assessed through MONEYVAL rather than direct FATF mutual evaluation. This places the D1 development in context: it is not a response to an international listing pressure but appears to be a domestically and EU-driven structural reform, reinforcing the enablement-versus-enforcement distinction FIM applies across jurisdictions — Cyprus is tightening its own architecture proactively rather than reactively.

Outlook

Watch for the NSIU's first substantive licensing or derogation decisions under its new powers, which would test whether the centralised structure translates into materially different enforcement outcomes than the prior fragmented regime. Also watch for any enabler-jurisdiction or professional-facilitator findings that may emerge from the unit's expanded coordination role, an area where no Cyprus-specific finding surfaced this cycle beyond the institutional reform itself.

Cyprus's crypto-asset sector reached a structural cutover point on 1 July 2026, when the transitional period permitting crypto-asset service providers (CASPs) to operate under the pre-MiCA national registration regime closed entirely. Firms seeking to carry over into full MiCA authorisation were required to file a complete application by 27 February 2026; those that did not were required to submit wind-down plans. From 1 July 2026 onward, MiCA authorisation via CySEC is the sole lawful basis for providing crypto-asset services from Cyprus, and any unauthorised-provider activity after that date is unlawful on an EU-wide basis, not merely a domestic one. This closes what had previously been flagged as a structural gap: a national CASP regime running in parallel with, rather than fully subsumed into, the harmonised EU framework.

CySEC accompanied the cutover with a circular, dated 9 July 2026, directing regulated crypto and investment firms to strengthen their anti-money-laundering controls as the MiCA transition concluded, citing new AMLA guidance. This claim currently rests on a single T3 legal-commentary source describing the circular; the circular's own text has not yet been independently retrieved or corroborated, and this gap is logged rather than papered over. If corroborated, the circular would indicate that CySEC is treating the end of the transitional period not merely as an administrative registration event but as an occasion to reinforce AML expectations across its regulated crypto population — consistent with the three-pillar balance FIM applies, since a licensing-transition event of this scale carries AML/CTF implications that deserve equal weight to the authorisation mechanics themselves.

The completion of this transition is a genuine structural improvement in Cyprus's crypto-sector oversight: it removes ambiguity about which regime governs CASP activity and brings Cyprus-based providers fully within the EU's harmonised MiCA perimeter, with the attendant AML obligations that accompany MiCA authorisation.

Outlook

The near-term watch item is independent corroboration of the CySEC circular text itself, given the current single-source basis for that claim. Beyond that, expect the population of Cyprus-authorised CASPs to stabilise now that the transitional pathway has closed; any residual national-regime holdouts operating without MiCA authorisation after 1 July 2026 would represent a live enforcement exposure worth monitoring in a future cycle.