STR/SAR Quality Assessment: Understanding the Cyprus FIU's 25 Measures

On 1 May 2026 the Cyprus Financial Intelligence Unit (CyFIU, also known as MOKAS) adopted a new framework and feedback procedure for assessing the quality of the suspicious transaction and activity reports submitted by obliged entities. The framework rests on 25 quality measures covering the completeness, relevance, accuracy and overall quality of reports, and the FIU states that it has communicated those measures to obliged entities.

The measures are published in Appendix 7.4 of the CyFIU's Annual Sectorial Quantity and Quality Assessment of STRs/SARs submitted to the FIU of Cyprus by Obliged Entities for the year 2025. The document is specific to Cyprus, but in my view the checks it describes are useful to any MLRO reviewing their own reports, particularly now that AMLA's draft harmonised reporting format under Article 69(3) AMLR has been through consultation.

The sections below set out the 2025 figures, the 25 measures and the related feedback arrangements, followed by the AMLR context and a practitioner checklist.

1. The volume picture for 2025

The CyFIU received 24,092 reports from obliged entities in 2025, compared with 3,870 in 2024. Most of that increase comes from one group of reporters.

Of the 24,092 reports, 21,857 were submitted by obliged entities licensed in Cyprus and operating in other Member States under the freedom to provide services. Only 246 of those had a nexus with Cyprus and remained with the CyFIU for further analysis, while the rest were disseminated to the FIUs of the Member States concerned.

Crypto-asset service providers account for the bulk of this group, with 20,570 reports in 2025 compared with 760 in 2024. Of the 20,570 reports submitted in 2025, 172 had a nexus with Cyprus. The FIU links the rise to CASPs providing their services on a more extensive scale in 2025, having first begun submitting reports in 2024.

For the entities the report treats as "traditional" reporters, the sector figures moved as shown in the table below.

The report also notes that no reporting was observed from real estate agents (including when acting as intermediaries in lettings where monthly rent exceeds €10,000) or from persons trading in, or acting as intermediaries in, works of art.

2. Reports that fail submission

The FIU’s assessment also examines reports that failed submission. In 2025, 185 reports failed submission. Because a single report can fail for more than one reason, those 185 reports produced 256 recorded failure reasons, which break down as follows.

Percentages are as published by the CyFIU and are shares of the 256 failure reasons, not of the 185 reports. Because of rounding they sum to 102%.

The report explains the rules behind the main causes. The narrative in the reason for suspicion must contain more than 400 and fewer than 4,000 characters, and a report that does not meet this requirement fails submission. The FIU's stated aim is to prompt reporting entities to include background information, the rationale for suspicion, relevant transactional details and supporting context. A report submitted without attachments fails automatically, as does a report with missing or incomplete identification details for the subjects involved, or missing or incomplete information on legal entities such as legal name, registration number, jurisdiction, business activities, registered address and beneficial ownership.

These validation checks are only part of the requirements, and a report that clears them has not thereby shown that it is useful. Successful submission does not guarantee analytical quality, and the 25 measures are used to assess whether a report is actually useful.

3. The 25 quality measures

Appendix 7.4 lists each measure alongside the criterion it is assessed against. The measures fall under nine headings, summarised in the table below. The appendix does not set out any scoring method, weighting or pass mark.

Four measures fall under "Reason for suspicion". Their criteria call for a clear, structured and readable narrative that explains why the activity is suspicious and aligns with the transactions and indicators reported, supported by attachments that bear directly on the suspicion. The last of these concerns the evidence as much as the prose.

The report separately lists the most common deficiencies it found when assessing reports against its reporting guidelines. These were a weak reason for suspicion (insufficient narrative, lack of supporting documentation or unclear grounds),report indicators used without a clear explanation in the reason for suspicion, SARs submitted instead of STRs and, in rare cases, late submission that delayed dissemination and analysis.

4. The feedback arrangements

The measures are tied to a set of feedback arrangements, several of which involve supervisory authorities as well as obliged entities. As described in the report, they comprise the following.

Report quality assessment feedback every four months, which the report says is to be provided to supervisory authorities and obliged entities on the predefined measures in Appendix 7.4. Separately, the FIU states that it will provide statistical feedback on report quality and performance at regular intervals from 1 May 2026.

General yearly feedback for 2025, provided individually to each obliged entity that submitted more than four reports during 2025. The template in Appendix 7.3 covers technical standards quality (including reports that failed submission and the reasons given),use in operational and strategic analysis, report risk scores and outcomes with references to disseminated reports, the typology indicators used, suspension of transactions and freezing or confiscation orders.

Direct letters to underperforming obliged entities, highlighting identified deficiencies and the corrective actions expected within a defined timeframe, and direct letters to supervisory authorities on reporting deficiencies and on low or non-reporting in the sectors they supervise.

Targeted in-person meetings with obliged entities and with supervisory authorities on quality findings, together with dissemination feedback informing reporting entities when case intelligence from their reports has been disseminated to law enforcement authorities.

5. Risk prioritisation and use of financial intelligence

Submitted reports are categorised as Low, Medium, Medium Serious or High under predefined risk criteria, which the FIU uses to prioritise their assignment to analysts. These are risk-priority categories and not quality grades. The 2025 risk table covers six sectors (banking institutions, payment institutions, gambling service providers, lawyers, company service providers and accountants and auditors) with 1,166 reports in total, of which 184 were categorised Medium Serious and 73 High. The broader sector chart in section 1 also includes 17 reports under "Others", which brings the total for traditional reporters to 1,183.

The FIU carried out 572 disseminations of financial intelligence in 2025, compared with 205 in 2024. These emerged from reports received and from other sources. Most went to the Police (469),followed by the Tax Department (58),with smaller numbers to Customs, the Ministry of Interior, supervisory authorities and other departments.

The report also records domestic freezing orders with assets exceeding €10 million, frozen assets of approximately €17.1 million from the registration of foreign freezing orders and confiscated assets exceeding €6.5 million in 2025.

These are 2025 results and they predate the quality framework adopted on 1 May 2026, so they should not be read as an outcome of it. In its executive summary the FIU attributes the improvement it observed in reporting quality to targeted actions including enhanced guidance, outreach sessions and engagement through the AML/CFT public private partnership, while stating that further improvement remains necessary.

6. The AMLR connection

Article 69(3) of the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) requires AMLA to develop draft implementing technical standards on the format for reporting suspicions and providing transaction records to FIUs. AMLA's draft ITS proposes reporting templates adapted to different types of obliged entity and templates for the provision of transaction records by credit and financial institutions.

The consultation on the draft closed on 20 September 2026, and AMLA listed a public hearing for 9 September 2026. AMLA has said that feedback will be considered when preparing the draft ITS for submission to the Commission, so the standards remain a draft and are neither adopted nor binding.

Two timelines should be kept apart. The AMLR generally applies from 10 July 2027, with a later date of 10 July 2029 for football agents and professional football clubs. The draft ITS has its own timetable: its application dates are left open in the consultation text, and it proposes a phased adaptation in which FIUs first assess the changes needed and then implement them within periods that are also still to be set.

Practitioner interpretation: a harmonised format can standardise which data points a report contains, but a common format does not by itself guarantee a well-explained suspicion. Completing the fields and explaining the suspicion are both part of the reporting obligation. My view is that as formats converge across the EU, the analytical content of the narrative, the relevance of the indicators and the support provided by the attachments are where measures like the CyFIU's will carry most weight. This is my interpretation and not a statement made in either the CyFIU assessment or the AMLA consultation.

7. A practitioner checklist drawn from the measures

The questions below are my own checklist, drawn from the criteria in Appendix 7.4 and the common deficiencies the CyFIU identified. They are not an FIU document and they do not add to any legal obligation.

Timing and type. Was the report submitted without delay once the suspicion was formed? The appendix treats late submission in two bands, over one year and between six months and one year, but these are assessment categories and not a period within which reporting can wait. Is the report correctly classified as an STR or a SAR?

Persons and entities. Is every core person and entity included with full identification details, and is each person's role stated? Are beneficial ownership, the nature of the business and its expected behaviour described?

Accounts and transactions. Are all core accounts included with accurate account number, type, currency and status? Are all relevant suspicious transactions included, with correct amounts, dates and currencies, and is the link between accounts, persons and entities clear?

Indicators. Does every selected indicator apply to this suspicion and these transactions, is any core indicator missing, and is each one explained in the reason for suspicion?

Reason for suspicion. Does the narrative explain why the activity is suspicious rather than only what happened, does it align with the transactions and indicators reported, and would an analyst unfamiliar with the client be able to follow it?

Attachments. Are the CDD and supporting documents attached, is each one referenced in the narrative, and does each one support the suspicion?

Sources

Know what the FIU is looking for. CPDs.Academy runs practical AML seminars for compliance professionals at EU and UK regulated firms, built on primary regulatory sources and real supervisory findings.

Explore seminars at cpds.academy

This article summarises a publicly available FIU document for professional development purposes. It does not constitute legal advice. Figures are taken from the CyFIU assessment as published.