CySEC Forex KYC Compliance Handbook 2026

What happens when CySEC asks for evidence?

Since 1 December 2024, the question a CySEC audit asks is no longer whether remote onboarding works. It is whether the firm can produce the evidence on demand.

Liveness records, document verification logs, AML screening trails, EDD files, and annual rescreening records all have to be present, dated, retrievable, and customer-specific. For firms with Russian, MENA, Indian, or Nepali client exposure, those records also have to show that script-aware verification and name-matching controls were in place at the point of capture.

€740K

The fine CySEC imposed on Exelcius Prime Ltd in August 2024 cited failure to provide required records, among other findings. The inability to produce records on demand is an enforcement risk in itself.

What Changed Under PS-01-2024 and RAD 282/2024?

The 1 December 2024 application date did not end the compliance cycle. It started the audit cycle.

RAD 282/2024 replaced the old video-call derogation and removed the deposit ceiling that capped remote onboarding. PS-01-2024 set the evidentiary standard: for unattended journeys with no staff interaction, liveness detection is required, because a static selfie alone does not prove a live person was present at capture.

The notification is informational. CySEC does not approve RCOS methods in advance, so the regulatory risk sits with the firm’s choice of method and its ability to show that choice was properly risk-assessed.

Which Clients Drive Cyprus CIF Onboarding Risk?

Cyprus has one of the EU’s highest shares of foreign residents, which puts multi-script documents and sanctions screening at the centre of daily onboarding.

Foreign nationals made up roughly 24.8% of the resident population as of January 2025, and Russian nationals are about one in five of those foreign residents, the largest single non-EU group. That mix is why customer files routinely span Cyrillic, Arabic, Devanagari, and Latin-script documents in the same workflow.

Onboarding Risk Map, by Client Segment

Each segment maps to a verification tier, from standard EU CDD (Tier 1) through non-Latin script (Tier 2) and sanctions-adjacent EDD (Tier 3) to PEP and beneficial-owner identification (Tier 4).

Segment	Documents	Script complexity	Primary screening risk	Verification tier
Russian nationals / residents	Passport, residence permit	Cyrillic + Latin via ICAO transliteration	EU sanctions, PEPs, ownership links	Tier 2–3Elevated risk
MENA clients	Passport, national ID	Arabic: no universal standard	OFAC, EU, UN list name variants	Tier 2–3Elevated risk
Indian / Nepali clients	Passport, national ID	Devanagari: no ICAO standard	Standard AML, PEP screening	Tier 2Medium risk
EU clients	Passport, national ID	Latin script	Standard AML, PEP screening	Tier 1Low risk
Corporate / UBO structures	Corporate registration, director IDs	Varies by jurisdiction	Beneficial ownership, PEP, sanctions	Tier 4High risk

What Evidence Does a CySEC Audit Expect to See?

CySEC audits are evidence-driven: teams assess whether specific records are present, dated, organised, and retrievable.

The matrix maps each compliance area to the evidence to retain, the severity if it is missing, and the Shufti control that closes the gap. Severity is colour-keyed by audit-exposure risk.

Why Do Cyrillic, Arabic, and Devanagari Documents Break Generic KYC?

Multi-script verification is the most persistent KYC vulnerability for Cyprus CIFs, because a system that reads these documents without native script support turns one real person into several valid name variants.

Generic OCR reads the visible printed text instead of applying transliteration logic, so the name it extracts can differ from the one on a sanctions list. The figure below decodes a Russian passport to show where that divergence begins.

Three scripts, three different problems

Shufti’s Document Verification supports 10,000+ document types across 240+ countries, with proprietary OCR across 150+ languages, including native Cyrillic, Arabic, and Devanagari processing.

Why a Single Transliteration Misses Sanctions Hits

The same person can sit cleanly on one sanctions list and be missed on another, purely because each list romanises the name differently.

OFAC’s SDN list carries Latin-script entries only. The EU consolidated list holds Latin and original-script entries for many Russian and MENA entities. UN Security Council lists vary by language coverage. Only the overlap, where one normalised form matches all three, catches the entity everywhere it appears.

How Should CIFs Screen Sanctions and PEPs Across Name Variants?

A name has to be normalised before screening, and that pipeline is where most false positives and false negatives originate in multi-script environments.

Normalisation removes diacritics, standardises spacing, and converts Cyrillic, Arabic, or Devanagari into Latin. Fuzzy matching then measures the edits between two name strings. A single global threshold does not hold across scripts, so firms calibrate by script and list source and keep QA evidence for grey-zone overrides.

Illustrative thresholds: Latin 95%+, Cyrillic 85–90%, Arabic 80–85%. Firms document their own calibration.

Shufti’s AML Screening queries 3500+ watchlist sources across OFAC, EU consolidated lists, and UN Security Council designations, logs override decisions per customer, and schedules rescreening across the portfolio with per-customer records on each cycle.

What Must a CySEC-Ready Liveness Record Contain?

The post-implementation audit question is not whether liveness was deployed, but whether the record for each customer evidences it.

A static selfie compares a still image to a reference. It does not confirm a live person was present, and presentation attacks (printed photos, video replay, deepfakes, masks) can defeat it. A file holding only a static selfie evidences no liveness method, no timestamped outcome, and no presentation-attack detection, which is the gap a CySEC auditor looks for.

Shufti’s Face Verification uses 3D liveness detection with iBeta Level 3 conformance (ISO/IEC 30107-3), the highest presentation-attack-detection level, recording the timestamp, method, outcome, anti-spoofing result, and face-match score that a CySEC-ready liveness pack needs.

When Does a Cyprus CIF Client Trigger Enhanced Due Diligence?

As exposure rises, so does the evidence the file has to carry. A generic risk-rating label is not an EDD record.

EU Russia sanctions under Regulation 833/2014 restrict specific transactions, entities, and securities; they do not ban servicing all Russian-national clients. A CIF documents client-specific indicators (nationality, residence, beneficial ownership, source of funds, payment route, product exposure) rather than a nationality-only decision.

A 30-Day CySEC KYC Readiness Plan

A structured path from gap identification to documented controls, built around the four areas CySEC audits examine most closely.

How to Evaluate a KYC Vendor for CySEC Readiness

Before a CIF can build a CySEC-ready evidence layer, it has to confirm the vendor can support the standard. Score each area from 0 to 3 and total across vendors.

Scoring: 0 = not supported · 1 = partial or manual · 2 = supported, partial audit evidence · 3 = fully supported, exportable per-customer evidence.

Pre-Audit KYC Readiness Checklist

A self-assessment across four areas. Three or more gaps in any combination signal exposure a CySEC audit is likely to find.

Shufti for CySEC-Regulated Onboarding

For Cyprus CIFs, the goal is not only faster onboarding. It is a defensible KYC evidence layer that supports cross-border growth while cutting manual review and audit-preparation time.

Shufti combines document verification, face verification, AML screening, and workflow management in one platform. It processes Russian passports using ICAO Document 9303 transliteration, Arabic IDs with script-normalised matching, and Indian and Nepali passports in Devanagari without manual escalation. Zero-shot AI recognises new document variants without manual template configuration, and every verification record carries the OCR output, document type, country, confidence score, decision, and timestamp a customer file needs.