- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Canada
- China
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- Uganda
- Ukraine
- UK
- USA
- Vietnam
CYPRUS KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Cyprus
Verify Cypriot customers and businesses through NFC, QES, identity documents, biometrics and AML screening in one platform, aligned to AML Law 188(I)/2007 and ready for AMLR.
Operational Performance for Cyprus KYC
Our Numbers Speak Volumes
98.67%
First-Pass
Verification Rate
< 10 sec
Median
Verification Time
6
Cyprus ID Methods
Supported
Cyprus IDV/KYC Challenges
Complex International Structures
Cyprus hosts a significant volume of cross-border holding companies and SPVs. Multi-layer ownership chains raise the UBO verification burden, and nominee arrangements demand enhanced documentation before onboarding can close.
Restricted UBO Register Access
Public access remains suspended. Obliged entities can search after Registrar approval of an e-request, a CDD solemn declaration and a €3.50 fee per legal entity, then independently verify and document beneficial ownership.
Greek and Latin Transliteration
Dual-language records create name inconsistencies in sanctions screening. Konstantinos becomes Constantinos across systems, so spelling variants inflate false positives and manual review volumes.
Risk-Based Monitoring Requirements
AML Law 188(I)/2007 and the CySEC AML Directive require ongoing monitoring proportionate to risk. High-risk third-country exposure triggers enhanced due diligence, and gaps can end in administrative sanctions.
Regulatory Update
What AMLR Changes for Identity Verification in Cyprus
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Cyprus from 10 July 2027, with no national transposition required. It reshapes how obliged entities verify customers, trace ownership and evidence their decisions.
Timeline
- End of 2026 Member State wallet issuance deadline
- 10 July 2027 AMLR applies, no transposition
- Late 2027 Art 5f acceptance duty, defined sectors
- 2028 AMLA direct supervision begins
eIDAS Expressly Recognised
Article 22(6) permits an identity document backed by reliable, independent sources, or eIDAS eID at substantial or high assurance with qualified trust services. Both routes are valid. Onboarding under the CySEC AML Directive and PS-01-2024 continues, and firms should document the route they use and why.
The Ownership Test Tightens
AMLR assesses beneficial ownership through 25% or more holdings and control, so UBO records and KYB checks should capture both limbs.
Existing Customers Get Re-Checked
AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.
Accountability Stays With You
Article 18 keeps customer due diligence accountable with the obliged entity even when verification is outsourced, so vendor evidence and clean audit trails matter more under AMLR.
FOR CYSEC-SUPERVISED BUSINESSES
Streamline CySEC-Supervised Onboarding in Cyprus
Connect identity verification, QES, Penny Drop and compliance evidence in one configurable workflow for businesses supervised by CySEC, from investment firms and fund managers to crypto-asset service providers. The CySEC AML Directive (282/2024) requires notifying CySEC of the electronic method before use. Unattended journeys need liveness checks.
Verify the Customer
Verify identity using the configured route, such as NFC chip reading of the Cyprus identity card, document and face biometric checks or docless eIDV, with the evidence captured for the file.
Complete Qualified Signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together in one case record.
Confirm the Payment Account
Use Penny Drop Verification as a supporting fraud and account-ownership control, with evidence kept in the case record.
Shufti's IDV/KYC Solutions for Cyprus
KYC Solutions
Clear onboarding for Cypriot customers aligned to AML Law 188(I)/2007, with age and address checked in the same flow as identity, each check completing in seconds.
Explore MoreFace Verification
Matches a live selfie to Cyprus ID card or passport imagery, supporting remote onboarding for CySEC CIFs, ASPs and CASPs under the CySEC AML Directive.
.Age Verification
Selfie-based age estimation combined with document verification fallback where required for regulated sectors such as online betting under the National Betting Authority.
.Bank Account Verification
Confirms a Cypriot bank account (CY IBAN) belongs to the customer, returning the registered account holder name for matching against the verified identity.
.Address Verification
Shufti verifies Cyprus address-bearing documents including utility bills, telecom invoices and bank statements from major Cypriot issuers. Proof of address commonly forms part of AML customer due diligence.
.Document Verification
Verification of Cyprus identity cards, biometric passports and residence permits, including Greek-language OCR and MRZ validation. Remains a permitted route for remote verification under AMLR.
.Identity Verification
Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ actively processed document types.
.KYB Solutions
Shufti checks businesses as deeply as their people, backing your risk-based Law 188(I)/2007 approach. Shufti checks Registrar of Companies records, beneficial ownership and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.
Explore MoreBusiness Verification
Automated validation of Registrar of Companies data, directors, shareholders, TIC and VAT numbers. Reduces manual registry searches and onboarding delays.
.Enhanced Due Diligence (EDD)
Structured review of complex ownership chains, cross-border entities and high-risk jurisdictions, supporting the risk-based obligations of AML Law 188(I)/2007.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to risk flags anomalies against AML rules, supporting the controls expected by CySEC, the Central Bank of Cyprus and MOKAS.
.Supported Verification Methods for Cyprus
Every Verification Route Cyprus Uses, in One Platform
Shufti supports the full range of remote verification routes used in Cyprus, from the EUDI Wallet readiness track and the IDMe.cy eID to NFC, document and biometric checks and qualified electronic signatures.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22(6) expressly recognises the EUDI Wallet for verification. Cyprus is preparing its wallet under the eIDAS 2.0 rollout, building on the Digital Citizen app and the IDMe.cy identity infrastructure. Shufti is built to accept wallet-based verification as the Cyprus wallet goes live.
Notified eID
LiveIDMe.cy is Cyprus's notified eID at assurance level High (OJEU C/2024/1719, after the December 2023 Cooperation Network opinion). Shufti supports the Cyprus identity card via NFC chip reading and biometric verification, not the IDMe.cy scheme.
Docless Database (eIDV)
LiveDatabase-driven verification confirms identity in seconds for low-risk onboarding with no document upload, using permitted reference data sources. Shufti escalates to stronger checks as risk rises.
NFC Chip Verification
LiveShufti reads the secure chip in the biometric Cyprus identity card and the Cyprus ePassport. This is the high-assurance capture route where eID adoption is still growing.
Document and Face Biometric
LivePermitted by AMLR Article 22(6)(a). Document authentication of the Cyprus identity card, residence permit and ePassport, paired with iBeta Level 3-certified liveness under ISO/IEC 30107-3 to confirm a real, present person.
Qualified Electronic Signature
LiveQualified electronic signatures carry the legal effect of handwritten signatures under eIDAS Article 25. Shufti runs eIDAS-qualified signing powered by Evrotrust, an EU qualified trust service provider, producing PAdES-LTV signatures. For Cyprus the signing identity check runs through NFC and face biometrics.
Independent Validation
Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read MoreEvidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti verifies 13+ Cyprus documents.
View All Supported DocumentsCyprus National Identity Card (Δελτίο Ταυτότητας)
Biometric identity card issued under EU Regulation 2019/1157 with facial image and fingerprints on the chip. The primary domestic identity document for Cypriot nationals and the main route for AML-regulated onboarding.
Cyprus Biometric Passport
ICAO-compliant ePassport issued by the Civil Registry and Migration Department with MRZ and chip. Accepted for domestic and cross-border onboarding.
Residence Permit (MEU1, MEU2, third-country residence card)
Issued by the Civil Registry and Migration Department. MEU1 registration certificates cover EU nationals, MEU2 cards cover their third-country family members, and residence cards evidence lawful stay for other non-Cypriot residents.
EU/EEA National ID Cards & Passports
Accepted in line with the EU AML framework, subject to risk-based assessment.
Cyprus Driving Licence
May be used as supplementary identification where appropriate. Not typically sufficient alone for AML-regulated onboarding.
Entity Identity
Certificate of Incorporation
Issued by the Registrar of Companies. Confirms legal existence and anchors every KYB check that follows.
Certificate of Directors and Secretary
Identifies authorised officers so they can be screened and matched against onboarding declarations.
Certificate of Shareholders
Confirms the legal ownership structure and supports tracing toward beneficial owners.
Certificate of Registered Office
Confirms the official address recorded with the Registrar of Companies.
HE32 Annual Return Extract
The mandatory annual filing that provides updated shareholder, director and registered office information.
Tax Identity
Tax Identification Code (TIC)
Eight digits followed by one letter, issued by the Cyprus Tax Department. Used to validate Cypriot individuals and entities in KYB checks.
VAT Registration Number (CY + number)
Formed from the CY prefix and the TIC, issued under Cyprus VAT Law in line with the EU VAT Directive.
Ownership & Control (UBO)
Beneficial Owner Register Filing
Maintained by the Registrar of Companies under Law 188(I)/2007 and the UBO Directive, as amended. Cypriot companies must identify the natural persons exercising ultimate control.
Shareholder Register / Trust Documentation (where applicable)
Used to verify indirect control where ownership runs through holding layers, nominees or trusts.
Languages We Cover
Greek and English Parsing
Shufti parses Greek and English document fields reflecting Cyprus's administrative practice, so both languages used on Cypriot documents and records are read accurately.
Transliteration-Aware Matching
Matching bridges Greek and Latin scripts, so name variants across documents and databases resolve to the same person.
Cross-Verification with Registrar Filings
Cross-references names, addresses and dates between identity documents and Registrar of Companies filings and catches inconsistencies common in cross-border files.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Optimised capture for the Cyprus identity card and bilingual Greek and English formats cuts avoidable re-submissions during onboarding.
Cleaner Audit Trails
Structured logs aligned to AML Law 188(I)/2007 recordkeeping and MOKAS reporting duties keep every decision retrievable for audit and supervisory review.
Better Name Matching Outcomes
Matching handles Greek and Latin transliteration variants, so Konstantinos and Constantinos resolve to the same person instead of triggering false positives.
One Workflow, One Back Office
KYC, KYB and AML screening are consolidated in one operational case view across the Registrar of Companies, the UBO register and sanctions lists.
National ID-First Flow Design
Identity card-first onboarding reflects the way Cypriot customers actually verify, with the biometric passport as the natural alternative.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to AML Law 188(I)/2007 record-keeping standards, so the file is organised and retrievable for internal audit and supervisory review.
Perpetual KYC
pKYCKeeps customer risk current with behavioural biometrics, fraud signals and ongoing AML screening. Behavioural biometrics adds re-authentication for CySEC-regulated CIFs and CASPs. The controller sets the lawful basis, Article 9 GDPR applies, and human review is available.
Perpetual KYB
pKYBMonitors the Registrar of Companies and the UBO register for shareholding and control changes, so an ownership or control shift prompts re-verification instead of surfacing at the annual review.
Built To Fit Cyprus's Compliance Landscape
Cyprus Securities and Exchange Commission (CySEC)
Supervises Cyprus Investment Firms (CIFs), Administrative Service Providers (ASPs) and crypto-asset service providers under AML Law 188(I)/2007. Shufti supports customer due diligence, enhanced due diligence and ongoing monitoring documentation supporting CySEC AML Directive requirements.
Central Bank of Cyprus (CBC)
Supervises banks, payment institutions and electronic money institutions. Structured identity evidence and screening logs support CBC AML expectations.
Institute of Certified Public Accountants of Cyprus (ICPAC)
AML/CFT supervisor for accountants and many corporate-service providers under AML Law 188(I)/2007. Structured KYC and KYB evidence supports ICPAC-supervised firms and their client files.
MOKAS (Unit for Combating Money Laundering)
The Cyprus Financial Intelligence Unit receives suspicious transaction reports under the AML Law through the goAML portal. Decision audit logs support report documentation.
Registrar of Companies and Intellectual Property
Maintains the corporate registry and UBO filings. KYB workflows validate legal status, directors and beneficial ownership against Registrar records.
Cyprus Tax Department
Issues TIC and VAT numbers. Business verification supports fiscal registration checks during KYB.
Office of the Commissioner for Personal Data Protection
Enforces GDPR in Cyprus. Shufti maintains encryption-based storage and controlled retention so personal data processing stays aligned with EU GDPR obligations.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. It begins direct supervision of selected high-risk entities in 2028 and shapes supervisory expectations across the EU, including Cyprus.
Deployment Choice
EU-region and on-premise deployments are available. Personal data may also be transferred or accessed internationally under applicable transfer safeguards.
Regulatory Alignment
Aligned to Cyprus AML Law 188(I)/2007 recordkeeping and MOKAS reporting duties, with EU GDPR principles of lawfulness, purpose limitation, and integrity.
Retention Controls
Configurable retention and purge settings support the five-year period in Section 68(1) of Law 188(I)/2007 and EU GDPR storage-limitation principles.
Encryption Posture
Strong encryption applied to personal and financial data in transit and at rest, supporting Article 32 EU GDPR obligations on the security of processing.
Scope of Our Role
Shufti is a data processor providing verification technology, not legal or regulatory advice. Customer due diligence and the verification method remain with the obliged entity, recorded in its risk assessment.
AI Act Position
Biometric checks follow EU AI Act Article 50 transparency duties, applicable from 2 August 2026.
Data and Privacy Controls in Cyprus
Cyprus AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Cyprus and globally. A few of them are:
MOKAS (Unit for Combating Money Laundering)
Central Bank of Cyprus (CBC)
Cyprus Securities and Exchange Commission (CySEC)
Insurance Companies Control Service (ICCS)
Registrar of Companies and Intellectual Property
Tax Department (Cyprus)
Institute of Certified Public Accountants of Cyprus (ICPAC)
Cyprus Bar Association
National Betting Authority
EU Consolidated Financial Sanctions List
UN Security Council Consolidated List
Financial Action Task Force (FATF)
Council of Europe MONEYVAL
Egmont Group of Financial Intelligence Units
European Banking Authority (EBA)
AMLA (EU Anti-Money Laundering Authority)
SEE SHUFTI IN YOUR CYPRUS WORKFLOW
Turn Cyprus Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to configure verification for your Cyprus operations, from remote onboarding to continuous monitoring.
Frequently Asked Questions
Which identity documents can be used for onboarding in Cyprus?
Customers can use the Cyprus national identity card, the biometric passport and residence permits issued by the Civil Registry and Migration Department. EU and EEA national ID cards and passports are accepted subject to risk-based assessment, and the driving licence can serve as supplementary identification.
Can onboarding proceed with a Cyprus residence permit?
Yes. Residence permits issued by the Civil Registry and Migration Department, including MEU1 and MEU2 registration certificates for EU nationals and third-country residence cards, are accepted as identity evidence under Cyprus AML Law 188(I)/2007.
How does Shufti support CySEC-supervised businesses in Cyprus?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one platform, so CySEC-supervised firms can evidence remote onboarding decisions and keep files retrievable for review.
How do QES and account verification work together for Cyprus onboarding?
Cyprus’s identity card is not among the notified eIDs usable for the QES signing identity check, so Shufti runs the signing identity check through NFC chip reading and face biometrics. Where a workflow also needs proof of account ownership, Penny Drop Verification confirms payment-account ownership and keeps the signed document, verification result and supporting evidence together in one workflow.
What documents are required for KYB in Cyprus?
Typically a Certificate of Incorporation, the certificates of directors and secretary, shareholders and registered office, the HE32 annual return extract, plus TIC and VAT details. Beneficial owners are identified through the UBO register filing and verified independently.
How are Greek and Latin name variants handled in screening?
Matching accounts for Greek and Latin transliteration, so variants such as Konstantinos and Constantinos resolve to the same person and false positives fall instead of piling into manual review.
How long must AML records be retained in Cyprus?
Section 68(1) of Law 188(I)/2007 sets five years. Section 68(1A) permits up to five more where justified for AML/CFT purposes, taking account of ongoing investigations or legal proceedings. From 10 July 2027, AMLR Article 77 keeps the five-year baseline.
Is EU-region data hosting available for Cyprus data?
Yes. EU-region hosting and on-premise deployment are available. Shufti's Services Privacy Notice says personal data may also be transferred or accessed internationally under applicable safeguards.
What changes for Cyprus under AMLR from July 2027?
AMLR applies directly from 10 July 2027, so no Cyprus transposition law is needed. It permits two verification routes, document-based and eIDAS-based, recognising notified eIDs and the EUDI Wallet. Ownership is assessed at 25%+ holdings or control, and accountability stays with the obliged entity when verification is outsourced.
When will the EUDI Wallet be usable for onboarding in Cyprus?
Under eIDAS 2.0, member states must issue wallets by end-2026. From late 2027, Article 5f requires acceptance by relying parties using strong user authentication, defined sectors and very large platforms. Cyprus is building on the Digital Citizen app and IDMe.cy. Shufti is built to accept wallet verification when it goes live.
Can we keep using our current remote onboarding process after July 2027?
Yes. Article 22(6) permits both routes, eIDAS-based and document and biometric verification. Firms should document why the chosen method fits the risk, and Shufti evidence packages support that justification.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
10 July, 2026
Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
Product Guide





