Cyprus STR Reporting: The MONEYVAL Warning, Six Years On

Suspicious transaction reporting in Cyprus has drawn a blunt verdict. In its June 2026 study of 20 financial intelligence units, Transparency International concluded that, measured against the size of the financial sector, Cyprus files few suspicious transaction reports (STRs): "Cypriot reporting entities do appear to report STRs particularly rarely."

That sentence sent me back to MONEYVAL's mutual evaluation of Cyprus, adopted in December 2019 and published in February 2020. MONEYVAL found that administrative service providers were not reporting suspicious activity that the banks were identifying in the same client structures. Six years apart, two international bodies point to the same weak spot: suspicious transaction reporting outside the banking sector.

This article sets out what each report says, why I think the pattern has persisted, and what the sixth Anti-Money Laundering Directive (AMLD6) could change.

A note on sources: MONEYVAL's findings reflect its on-site visit in May 2019. Transparency International's report was published on 24 June 2026, with information correct to 30 September 2025. Its Cyprus STR comparison covers 2022 to 2024, and its explanation of the pattern relies partly on the same 2019 evaluation.

1. MONEYVAL on STR reporting by Cyprus service providers

MONEYVAL's key findings on suspicious transaction reporting to MOKAS, the Cyprus FIU, appear in the Executive Summary of the evaluation:

• Banks identify, service providers do not. Most cases reported by banks involved legal persons or arrangements generally administered by administrative service providers (ASPs). MONEYVAL found it surprising that ASP reporting was not higher, and was concerned that banks had identified suspicious activity through ongoing monitoring while ASPs had failed to do so for clients common to both (paragraph 7).
• Real estate. The low level of reporting by the real estate sector raised concern given the risks it faces (paragraph 7).
• Reporting concentrated in banks. Banks file STRs far more frequently than other financial institutions and designated non-financial businesses and professions (DNFBPs) (paragraph 25).
• Uneven understanding. Understanding of AML/CFT obligations among obliged entities was uneven. Among non-bank financial institutions and DNFBPs, awareness appeared to depend on size and international exposure. Real estate agents knew they had obligations but were not always clear what they were (paragraph 22).
• Reliance on banks. For some transactions, such as large real estate transactions, reliance on bank due diligence was explicit. MONEYVAL said this placed undue risk-mitigation expectations on the banking sector and weakened the overall effectiveness of the system. Only a few larger non-bank institutions appeared to have compliance practices designed to stand independently of banks (paragraph 23).

Cyprus received a rating of Moderate effectiveness for both preventive measures (Immediate Outcome 4) and financial intelligence (Immediate Outcome 6).

2. Transparency International on Cyprus STR volumes

Transparency International's report, Connecting the Dots, compares reporting volumes across the 20 countries it assessed. For Cyprus, it sets STR numbers against the size of the financial sector.

Exports of financial services amount to nearly 17 per cent of Cyprus's GDP, the highest share in the study. Singapore is second at 10 per cent. Against that exposure, Cypriot reporting entities send one STR for every US$2.2 million of financial services exported. That ratio is more than twice Singapore's, the next highest.

The report accepts that the right level of reporting cannot be determined without perfect knowledge of the underlying risk. It nevertheless concludes that, even compared with other financial centres, Cypriot reporting entities appear to report disproportionately fewer STRs for the value of financial services provided to clients abroad. It suggests this could leave the FIU with a significant information gap in a sector with well-documented cross-border money laundering risks.

The report also looks at the receiving end. The Cyprus FIU (MOKAS) had 36 staff in 2024. On TI's estimate, that works out at about 75 STRs per staff member per year, an outlier in the sample. According to the 2019 evaluation, all STRs were triaged manually at the time. TI notes that low reporting keeps this workload manageable, but suggests the FIU could be vulnerable if reporting volumes rose sharply.

3. Six years without a MONEYVAL reassessment

MONEYVAL has since adopted four follow-up reports on Cyprus, in 2021, 2022, 2023 and 2025. The most recent was published in June 2025. These are desk-based reviews of technical compliance. By design, they do not assess whether effectiveness has improved. The most recent report re-rated one recommendation, on correspondent banking.

As at 30 September 2026, the effectiveness findings on reporting outside the banking sector therefore remain MONEYVAL's latest published assessment.

Why would the pattern persist? My explanation is one most compliance officers will recognise. A client already holds a Cyprus bank account, so it is assumed the bank has done the work. The file becomes lighter, the questions fewer, and suspicion quietly becomes the bank's responsibility. That is exactly the reliance MONEYVAL described.

4. What AMLD6 could change for self-regulatory supervision

Administrative service providers in Cyprus answer to three supervisors: CySEC, the Institute of Certified Public Accountants of Cyprus (ICPAC) and the Cyprus Bar Association. Two of them are professional bodies, and that model is directly addressed by AMLD6, Directive (EU) 2024/1640.

Recital 100 of AMLD6 states:

"Directive (EU) 2015/849 allows Member States to entrust the supervision of some obliged entities to self-regulatory bodies. However, the quality and intensity of supervision performed by such self-regulatory bodies has been insufficient, and under no, or close to no, public scrutiny. Where a Member State decides to entrust supervision to a self-regulatory body, it should also designate a public authority to oversee the activities of the self-regulatory body to ensure that the performance of those activities is in line with this Directive."

The operative requirement is in Article 52(1): where supervision is entrusted to a self-regulatory body, a public authority must oversee its activities. The recital is clear about the nature of that role. Oversight of the professional body does not in itself require the public authority to supervise obliged entities directly or to take decisions in individual cases handled by that body. Member States may assign it additional tasks, provided these respect fundamental rights, including the rights of defence and the confidentiality of lawyer-client communication.

Under Article 78(1),Member States must transpose the Directive, including Article 52, by 10 July 2027.

Neither MONEYVAL nor Transparency International makes this connection. It is mine. But I think it matters. If the professional bodies supervising part of the service provider sector are themselves subject to public oversight, stricter expectations of the firms they supervise should follow. My hope is that this is where the pattern identified in 2019, and echoed in the figures reported in 2026, finally changes.

5. What the Cyprus FIU (MOKAS) does well

Transparency International's report is not one-sided. It identifies several areas where MOKAS compares well with other FIUs in the study:

• Preventive powers. Cyprus is one of nine FIUs in the sample that can both suspend suspicious transactions and freeze accounts (TI, Table 2, page 16).
• International cooperation. Relative to GDP, the Cyprus FIU receives and sends more information requests than any other FIU among those with available data. TI notes that the small GDP denominator partly explains this, and that the volume also reflects the international exposure of the financial sector.
• Sharing without an MoU. TI identifies Cyprus and the UK as able to share intelligence with foreign counterparts without a relevant memorandum of understanding.
• Transparency on cooperation. Cyprus publishes not only request volumes but also the regions and countries it exchanges information with.

MONEYVAL, for its part, noted that a few larger service providers appeared to have compliance practices designed to stand independently of banks.

6. STR reporting questions for AMLCOs outside banking

For compliance officers at service providers, accounting firms and real estate businesses, both reports point to the same questions:

• Does the firm's reporting record reflect its actual risk exposure, or its reliance on the bank?
• Is the firm's own monitoring designed to identify suspicious activity in a structure it administers, or does it assume the bank already has?
• For an established firm with a substantial client base, when was the last STR filed? The longer a firm operates and the more clients it serves, the more likely it is to have encountered something suspicious. Supervisors will look at the same figures as part of their quantitative review of the firm's framework.

Reporting volumes are one of the data points a firm should test in its own business-wide risk assessment, and supervisors are moving towards a more data-driven approach to monitoring it.

Know how the outside world reads your numbers. Supervisors read your STR record as a statistic. A business-wide risk assessment should do the same with your own data: client base, exposure and reporting, measured and explained. Our CPD-certified seminar on the Business-Wide Risk Assessment under AMLR Article 10 shows how to build one step by step.

Explore the Business-Wide Risk Assessment seminar

This article summarises third-party publications and EU legislation for professional education purposes and does not constitute legal advice. MONEYVAL findings reflect the position at the time of the 2019 evaluation. Transparency International figures are as reported in its June 2026 study, with information correct to 30 September 2025.

Sources