Cyprus Named High-Risk for Sanctions Evasion: What the FIN-FSA Report Actually Says

Cyprus has been named as a country with a high risk of sanctions evasion in Europe.

The assessment comes from Finland's Financial Supervisory Authority, the FIN-FSA. Their Sanctions Risk Assessment 2025 was published on 12 February 2026 and is an update to a first assessment prepared in autumn 2024. It identifies Cyprus, Moldova and Serbia as the European countries presenting the highest risk of sanctions evasion.

This post sets out what the report actually contains, what it found specifically about investment services firms, and why the findings are relevant to compliance officers working in Cyprus.

What the FIN-FSA Assessment Is

The FIN-FSA is required by Finnish law to take a risk-based approach to supervising sanctions compliance. That means preparing a formal risk assessment identifying which sectors and counterparty countries pose the greatest risk of sanctions evasion, and directing supervisory resources accordingly.

The 2025 assessment is an update based on data reported by Finnish supervised entities for the year 2024, combined with supervisory observations gathered during 2024 and 2025. It covers the full range of Finnish financial sector participants: credit institutions, payment service providers, crypto asset service providers, investment firms, insurance companies and fund managers. For each, it assesses both sanctions risk exposure and the adequacy of internal controls.

The report also covers changes in the broader sanctions environment during 2025. Four new EU sanctions packages were published during the year, with a twentieth under preparation at the time of writing. EU sanctions against Iran were reimposed in September 2025 following a UN Security Council decision. The role of crypto assets in sanctions evasion grew, with several exchange services designated during the year.

The Cyprus reference sits in the section on sanctions evasion. The FIN-FSA notes that sanctions continue to be circumvented through a range of countries globally, including the UAE, Hong Kong, Kazakhstan, China, India and Turkey. In Europe specifically, Cyprus, Moldova and Serbia are identified as the countries with the highest risk of sanctions evasion.

It is worth being precise about what this means. The FIN-FSA is assessing the risk that sanctions are being evaded through Cyprus as a jurisdiction, not whether Cyprus-based firms are themselves violating sanctions. The distinction matters, but it does not reduce the practical consequences for firms operating here.

What the Report Found for Investment Services Firms

The section most directly relevant to Cyprus investment firms is section 3.4, covering the capital markets sector.

The findings are mixed. About half of investment service providers assessed received no risk points at all in the section covering risk assessment and organisational controls, including some that had recorded deficiencies in the previous year. That is a positive development.

Among those that did receive risk points, the most common deficiencies were in three areas: staff training, sanctions risk assessment documentation, and operating instructions for detecting sanctions evasion.

On screening, the findings are more concerning. Several investment service providers reported that they do not verify whether fund transfers violate current sanctions or freezing orders. Operating instructions for detecting sanctions evasion were missing from 15 firms. Six did not include UN economic sanctions in the lists they screen against.

Overall, the risk level for the investment services sector remains at the significant level.

The report also sets out what supervisory activity is planned for 2026. The FIN-FSA intends to follow up on deficiencies identified during its 2025 thematic review of sanctions screening. For sectors with very significant risk exposure, the possibility of ad hoc supervisory measures is reserved. Sector-specific supervisory letters will be sent to sectors where no positive development has occurred.

Why This Is Relevant to Cyprus Compliance Officers

The FIN-FSA report covers Finnish firms. But the pattern of deficiencies it identifies, gaps in staff training, missing detection procedures, incomplete screening coverage, is not unique to any one jurisdiction.

The more immediate consequence for Cyprus is practical. Finnish financial institutions are now expected to apply enhanced scrutiny to relationships and transactions involving Cyprus. Other EU regulators conduct similar assessments through their own processes. The FIN-FSA publication is one data point in a broader supervisory picture.

For compliance officers at Cyprus investment firms, the relevant question is whether your internal controls would hold up to that same level of scrutiny. Not just whether sanctions lists are being screened, but whether the procedures around that screening, the operating instructions, the staff training, the documentation, are in place, current and defensible.

The report closes with a point worth taking seriously: the sanctions situation changes constantly and methods of evasion evolve. Supervised entities are expected to remain vigilant and to continuously assess the risk affecting their own activities.

That is not a general observation. It is a supervisory expectation.

CPDs.Academy publishes regulatory analysis and CPD seminars for compliance professionals working in Cyprus financial services. Browse current seminars at cpds.academy.