+357 25 800 000
·
info@demetriades.com
·
Mon - Fri 08:00-17:00
Get In Touch

By

Demetriades Office

Cyprus Central Bank introduces new Licensing Process for Electronic Money and Payment Institutions

The Central Bank of Cyprus (CBC) has introduced a revised licensing process for Electronic Money Institutions (EMIs) and Payment Institutions (PIs), effective from 3 August 2026. The principal change is the introduction of a mandatory pre-application exploratory stage before a formal licensing application can be submitted.

The CBC says the new stage is intended to improve applicants’ understanding of its licensing expectations and to identify potential concerns at an early stage, particularly in relation to the good repute of the ultimate beneficial owners and the wider group, where applicable.

A new step before the licensing application

Under the revised process, an entity intending to seek an EMI or PI licence must first complete a Pre-Application Document and submit specified information to the CBC. A non-refundable fee of €5,000 applies to this stage.

The CBC will conduct a preliminary assessment of the information provided. It may also require an Enhanced Due Diligence Report concerning the ultimate beneficial owners and connected entities, depending on the circumstances and its risk-based assessment.

The preliminary assessment is generally expected to be completed within 30 working days. Where enhanced due diligence is required, the period may extend to 50 working days.

The process concludes with an initial meeting involving the CBC and the relevant representatives and ultimate beneficial owners. The CBC will provide feedback on its preliminary conclusions and identify matters that should be addressed before a formal application is submitted.

Importantly, completion of this stage does not amount to approval or pre-approval of a future licence application. The CBC expressly notes that not all licensing criteria are examined during the exploratory stage.

Higher formal application fee

The fee payable when submitting the formal licensing application has increased from €5,000 to €10,000.

Accordingly, an applicant following the new process will face at least €15,000 in CBC fees across the pre-application and formal application stages, excluding any additional costs associated with enhanced due diligence or professional advisers.

The increased cost therefore accompanies a more structured engagement with the regulator before the formal application is filed.

Greater focus on due diligence and responsiveness

The CBC may require an enhanced due diligence report either during the pre-application exploratory stage or while assessing the formal licensing application. The report may be prepared by an appropriately experienced independent third party. In certain circumstances, the CBC may obtain the report itself through a third-party provider, with the cost borne by the interested entity.

The revised process also addresses applications that become inactive. Where an applicant does not respond to CBC comments or requests within the applicable period, the application may be deemed withdrawn.

These changes place greater importance on maintaining an organised application process and responding promptly to regulatory requests.

What this means for prospective applicants

For businesses considering establishing an EMI or PI in Cyprus, the revised process means that regulatory preparation begins before the formal application stage.

Applicants should expect the CBC to examine the proposed business model and relevant ownership structure at an early stage. The new process also provides an opportunity to identify potential concerns before significant resources are committed to a full licensing application.

The practical focus should therefore be on preparing the business model, ownership and governance information, and supporting documentation carefully from the outset. Particular attention should be given to matters capable of affecting the good-repute assessment.

The changes form part of the CBC’s wider licensing and supervisory strategy for the EMI and PI sector, which the CBC announced in December 2024.

Conclusion

The revised CBC framework represents a more structured front-end to the Cyprus EMI and PI licensing process. From 3 August 2026, prospective applicants must complete a pre-application exploratory stage and pay a non-refundable €5,000 fee before submitting the formal application, while the formal application fee has increased to €10,000.

For prospective applicants, the key practical message is that regulatory readiness and ownership due diligence need to be addressed at an earlier stage of the licensing process.

For more information, please contact Chrysses Demetriades at chrysses.demetriades@demetriades.com

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Cyprus online Residence Permit Renewal Service for Third-Country Nationals

Cyprus introduced a new online service for renewing certain residence permits of third-country nationals. The initiative forms part of the Government’s broader digitalisation of immigration and public administration services.

The platform allows eligible applicants, employers and authorised representatives to handle significant parts of the renewal process electronically, including submitting applications and documents, following application progress and paying applicable fees.

Which permits are covered?

The online procedure currently applies to renewals involving:

  • Remunerated Employment;
  • Domestic Employment;
  • employees of Companies of Foreign Interests;
  • Family Reunification in the relevant qualifying cases; and
  • Long-Term Residents.

The service is currently intended for renewals of existing permits, rather than first-time residence applications.

For certain employment categories, eligibility for online renewal may also depend on the employee continuing to work for the same employer or company.

Who can apply?

A renewal application may be submitted by the permit holder, the relevant employer, or an authorised representative, such as a law or accounting firm.

This provides employers and professional advisers with a practical option for managing renewal applications on behalf of clients or employees.

What can be done online?

Depending on the permit category, the platform can be used to:

  • submit a renewal application;
  • upload supporting documents;
  • manage representative authorisations;
  • receive application updates;
  • pay the relevant government fees; and
  • arrange the service point for subsequent steps and permit collection.

Biometrics and personal attendance

Online submission does not remove all requirements for attending in person.

Where applicable, applicants must still attend the relevant service point for procedures such as the collection of biometric data and signature. The exact requirements may vary according to the residence permit category.

Applicants should therefore treat electronic filing and the subsequent in-person stages as separate parts of the renewal process.

CY Login requirement

A verified CY Login account is required to access the online service. Applicants and representatives should complete the necessary registration and verification process before submitting a renewal application.

Key considerations

The digital platform changes the method of submitting an application but does not remove the substantive immigration requirements applicable to the relevant residence category.

Applicants and employers should ensure that:

  • the permit is eligible for online renewal;
  • all supporting documents are complete and current;
  • any required authorisation has been properly arranged; and
  • biometric and other in-person requirements are addressed.

Renewal preparations should also begin sufficiently early to avoid issues associated with the expiry of the existing permit.

Conclusion

The new online renewal service is an important development in the digitalisation of Cyprus immigration procedures. While it allows much of the renewal process to be handled electronically, applicants must continue to comply with the applicable eligibility, documentary and in-person requirements.

For more information, please contact us at info@demetriades.com

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Important Administrative Court judgment regarding the tax treatment of impaired bank deposits

A recent Administrative Court judgment concerning the tax treatment of losses arising from the impairment of bank deposits following the 2013 banking crisis represents an important development in Cyprus tax law.

Having successfully acted for our client in the proceedings, our partner Katia Kakouli examines the judgment in her latest article for the e-newspaper of the Great Britain-Cyprus Business Association and considers its broader implications for taxpayers, tax advisers and the Tax Department.

Read the full analysis here:
https://gbcy.business/wp-content/uploads/2026/01/CD-Administrative-Court-judgment-reshapes-the-debate-on-the-tax-treatment-of-impaired-bank-deposits.pdf

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Cyprus Shipping Companies and NIS 2: A Legal Framework Overview

Cyprus is among the most significant ship-owning and ship-management centres in Europe and consistently ranks as one of the largest flag administrations globally. The entry into force of Directive (EU) 2022/2555 (the “NIS 2 Directive”) and its transposition into Cypriot law through the Security of Networks and Information Systems Law of 2020, as amended by Law 60(I)/2025 (the “Cyprus NIS 2 Law”), has raised important and complex questions for the Cypriot maritime industry. Whether, and to what extent, a Cyprus-based shipping company falls within scope depends on a multi-factorial analysis that goes well beyond a simple activity test. This article sets out the relevant legal framework and the key considerations for Cyprus shipping companies owning or operating Cyprus-flagged vessels.

1. What Is NIS 2?

The NIS 2 Directive was adopted on 14 December 2022, entered into force on 16 January 2023, and required all EU Member States to transpose it into national law by 17 October 2024. It replaced and significantly expanded the original NIS 1 Directive (Directive (EU) 2016/1148). Its objective, as stated in Article 1, is to achieve a high common level of cybersecurity across the Union by requiring Member States to establish national cybersecurity strategies and by imposing cybersecurity risk-management and incident-reporting obligations on a broad range of entities across critical sectors.

Cyprus transposed NIS 2 through Law 60(I)/2025, which amended the Security of Networks and Information Systems Law of 2020. The Digital Security Authority (the “Authority”) is the competent supervisory authority under the Cyprus NIS 2 Law.

2. Scope: Who Is Covered?

Under Article 2(1) of the NIS 2 Directive, mirrored in Section 2A(1)(a) of the Cyprus NIS 2 Law, the Directive applies to public or private entities that operate in one of the sectors listed in Annex I (sectors of high criticality) or Annex II (other critical sectors) and that qualify as medium-sized enterprises or exceed the ceilings for medium-sized enterprises, as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC. The entity must also provide services or carry out its activities within the EU.

The size assessment under Recommendation 2003/361/EC is not a single-variable test. It requires consideration of headcount (fewer than 250 employees for medium-sized enterprises), annual turnover (not exceeding €50 million), and balance-sheet total (not exceeding €43 million), as well as the partner and linked-enterprise rules, which aggregate the data of related entities where certain ownership or control thresholds are met. In the context of shipping groups, where ownership, chartering, and management responsibilities are frequently distributed across multiple legal entities, this aggregation exercise can produce results that are not immediately apparent from a single entity’s own financial data alone.

Article 2(1) sets the general threshold; however, Article 2(2) of the Directive provides that the Directive also applies to entities of any size where specific circumstances are present. These size-independent grounds for inclusion include: being a sole provider in a Member State of a service essential for critical societal or economic activities; a finding that disruption of the entity’s services could have a significant impact on public safety, public security, or public health; a finding that disruption could induce a significant systemic or cross-border risk; and specific importance at national or regional level. Additionally, Article 2(3) brings within scope, regardless of size, any entity identified as a critical entity under Directive (EU) 2022/2557. Member States and the competent authority may also make specific designations on a case-by-case basis. Cyprus shipping companies should not therefore assume that falling below the general size threshold is conclusive.

3. Essential Entities and Important Entities

Entities that fall within scope are classified as either essential entities or important entities under Article 3 of the NIS 2 Directive, as mirrored in Section 27 of the Cyprus NIS 2 Law. The classification matters because the two categories are subject to different supervisory regimes.

Under Article 3(1)(a) of the Directive, entities of a type referred to in Annex I that exceed the ceilings for medium-sized enterprises under Recommendation 2003/361/EC, or an annual turnover exceeding €50 million and a balance-sheet total exceeding €43 million, are classified as essential entities. Entities in Annex I that are medium-sized but do not exceed those ceilings are, by contrast, classified as important entities under Article 3(2), which covers entities falling within Annex I or II that do not qualify as essential. Essential entities are subject to proactive, comprehensive ex ante supervision; important entities are generally supervised subject to ex post supervision following evidence or indications of possible non-compliance.

Certain additional categories are always treated as essential regardless of size, including qualified trust service providers, DNS service providers, and top-level domain name registries (Article 3(1)(b) and (c)). Entities identified as critical entities under Directive (EU) 2022/2557, and any entities specifically designated by the competent authority, may also be classified as essential regardless of size (Article 3(1)(e) and (f)).

4. Maritime Transport Under NIS 2

Transport is listed in Annex I of the NIS 2 Directive as a sector of high criticality. The maritime sub-sector is expressly included. Annex I covers:

“Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004 of the European Parliament and of the Council, not including the individual vessels operated by those companies.”

Three points of the definition are particularly relevant for Cyprus shipping practice.

First, the Directive attaches obligations to the company operating the vessel, not to the vessel itself. Individual vessels are explicitly excluded from scope.

Second, the definition of “Company” is drawn from Annex I to Regulation (EC) No 725/2004, which integrates Chapter XI-2 of the International Convention for the Safety of Life at Sea (SOLAS — a binding international maritime safety treaty). Under SOLAS Regulation IX/1, and as mirrored in Article 2 of Regulation (EC) No 336/2006 on the implementation of the International Safety Management (ISM) Code within the EU, the “Company” means the shipowner or any other organisation or person, such as the ship manager or bareboat charterer, that has assumed responsibility for the operation of the ship from the shipowner and, in doing so, has agreed to take over all duties and responsibilities imposed by the ISM Code. The entity that formally holds these responsibilities is identified by the Document of Compliance (DOC- a mandatory certificate issued to the managing company by or on behalf of the flag State administration confirming ISM compliance) and is referred to in the vessel’s Safety Management Certificate (SMC- a certificate issued to the individual vessel confirming that the ship and its management company operate in accordance with the ISM Code). The Continuous Synopsis Record (CSR- an onboard record maintained by the flag State documenting the vessel’s registration history) also identifies the ISM-responsible company.

Third, the DOC is a strong indicator of which entity has assumed operational responsibility under the ISM framework and is therefore a significant factor in determining which entity constitutes the “water transport company” for NIS 2 purposes. It is not, however, the sole legal test for scope under the Directive. The full scope analysis must also consider the entity’s sector and activities, its place of establishment within the EU, its size calculated in accordance with Recommendation 2003/361/EC including the partner and linked-enterprise rules, and whether any size-independent ground for inclusion applies. A company that does not hold the DOC and has not assumed ISM responsibility will generally not meet the definition of a water transport operator for purposes of the maritime transport sector classification. However, it may still fall within scope through another activity it performs, another sector in which it operates, or a specific regulatory designation by the competent authority.

5. Jurisdiction: Which Member State’s Law Applies?

The applicable national implementation law for an entity is determined primarily by the entity’s place of establishment within the EU, not by the jurisdiction in which the vessel is flagged or by the law governing the management contract. Article 26 of the NIS 2 Directive sets out specific jurisdictional rules, providing that entities are generally subject to the jurisdiction of the Member State where they are established. Specific rules apply to digital service providers and DNS-related entities operating across borders. For cross-border or cross-sectoral incidents, the competent authorities of affected Member States are required to cooperate and exchange information under Article 37 of the Directive.

In the context of Cyprus shipping structures, this means that a Cyprus-incorporated entity is subject to the Cyprus NIS 2 Law, while a related ship management company incorporated in another EU Member State, even if it holds the DOC for a Cyprus-flagged vessel, is subject to that other Member State’s implementation of NIS 2. A group-wide assessment across all relevant jurisdictions of establishment is therefore essential.

6. Key Obligations for Entities in Scope

Entities that fall within scope as essential or important entities are subject to a comprehensive set of obligations under the Cyprus NIS 2 Law. The principal obligations are:

  • Cybersecurity risk-management measures (Article 35 of the Cyprus NIS 2 Law, reflecting Article 21 of the Directive). Entities must implement appropriate and proportionate technical, operational, and organisational measures to manage risks to their network and information systems. The measures must be based on an all-hazards approach and must include, at a minimum: policies on risk analysis and information system security; incident handling; business continuity and crisis management including backup and disaster recovery; supply chain security; security in network acquisition, development, and maintenance; policies on cryptography and encryption; human resources security, access control, and asset management; and the use of multi-factor authentication where appropriate.
  • Governance (Article 35A of the Cyprus NIS 2 Law, reflecting Article 20 of the Directive). The senior management of essential and important entities must approve the applicable cybersecurity risk-management measures, supervise their implementation and may be held accountable for infringements of those obligations. Where the statutory conditions are satisfied, natural persons holding relevant representation, decision-making or control powers may also bear personal responsibility, including responsibility for the payment of administrative fines. In relation to essential entities, persistent non-compliance may additionally result in a temporary prohibition from exercising managerial functions.
  • Incident reporting (Article 35B of the Cyprus NIS 2 Law, reflecting Article 23 of the Directive). Entities must report to the Authority any incident that has a significant impact on the provision of their services (a “significant incident” — one that has caused or is capable of causing severe operational disruption or financial loss, or that has affected or is capable of affecting others by causing considerable material or non-material damage). The reporting timeline under the Cyprus NIS 2 Law is: an initial warning submitted without undue delay and in any event within six (6) hours of becoming aware of the significant incident; a full incident notification submitted without undue delay and in any event within 72 hours of becoming aware; an intermediate report on request by the Authority; and a final report within one month of submitting the incident notification. Where an incident is still ongoing at the time the final report falls due, entities must instead provide a progress report every 15 days until the incident is resolved, followed by a final report within 15 days of restoration.

Note: the Cyprus NIS 2 Law specifies an initial warning period of six hours, which is shorter than the 24-hour period in the NIS 2 Directive itself (Article 23(4)(a)). Cyprus has therefore adopted a more stringent requirement than the Directive’s minimum.

7. Sanctions

The Cyprus NIS 2 Law establishes a tiered sanctions regime under Article 43A. Administrative fines for essential entities that infringe Article 35 (risk-management measures) or Article 35B (incident reporting) of the Cyprus NIS 2 Law are subject to a maximum of at least €10,000,000 or 2% of the total worldwide annual turnover of the undertaking to which the entity belongs in the preceding financial year, whichever is higher. For important entities, the maximum is at least €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher. Fines are intended to be effective, proportionate, and dissuasive, and are assessed having regard to the circumstances of each individual case. The Cyprus NIS 2 Law also provides for criminal offences in cases of failure to report a severe incident or failure to implement required security measures, with penalties including imprisonment.

8. Practical Guidance for Cyprus Shipping Companies

In light of the above, Cyprus-based shipping companies should consider the following.

Conduct a thorough scope analysis. Determine whether the company operates in a sector covered by Annex I or Annex II, calculate size correctly under Recommendation 2003/361/EC including any partner or linked-enterprise aggregation, and consider whether any size-independent ground for inclusion may apply. This analysis should be specific to each legal entity within the group.

Identify the ISM-responsible entity for each vessel. Establish who holds the DOC for each vessel in the fleet. This is a strong indicator of which entity assumes water transport operational responsibilities for NIS 2 purposes, though it is not the only factor in the scope analysis.

Assess the group structure across all EU jurisdictions of establishment. Each entity within the shipping group should be assessed under the NIS 2 implementation law of the Member State in which it is established, which may not be Cyprus. A related DOC-holding ship management company established in another EU jurisdiction will be subject to that jurisdiction’s implementing law.

Engage with the Digital Security Authority. The Authority is in the process of identifying and classifying essential and important entities. Companies that have been listed should review the basis for their classification. Where classification appears incorrect, a formal request for review supported by relevant documentation should be submitted promptly.

Obtain tailored legal advice. The applicable framework involves EU cybersecurity law, international maritime law (SOLAS and the ISM Code), EU maritime security regulation, and Cypriot national law. The scope analysis is necessarily multi-factorial and fact-specific. A legal opinion addressing the particular corporate and fleet structure of your group is strongly recommended before reaching any compliance conclusions.

Conclusion

NIS 2 is now in force in Cyprus and presents real obligations for shipping companies that fall within its scope. Whether a particular Cyprus-based shipping company is in scope, and in which category, depends on a multi-factorial assessment covering the nature of the entity’s activities, its place of establishment, its size calculated under the applicable EU enterprise definition, and whether any size-independent ground for inclusion applies. The DOC is a significant indicator of which entity bears water transport operational responsibility for the purposes of the maritime transport sector classification, but it is one factor among several and is not determinative in isolation. Equally, the absence of a DOC does not, by itself, rule out the possibility of scope through a different route.

For those entities that are in scope, the obligations are immediate and material: robust cybersecurity risk-management measures, board-level governance accountability, structured incident-reporting timelines, and the prospect of significant administrative fines. Early engagement with the regulatory framework, the Digital Security Authority, and specialist legal counsel is the most effective way of managing NIS 2 exposure.

This article has been prepared by Chrysses Demetriades & Co. LLC, Limassol, Cyprus, as at July 2026. It is intended for general information purposes only and does not constitute legal advice. Whether a particular entity falls within the scope of the Cyprus NIS 2 Law depends on the entity’s specific activities, corporate structure, size, place of establishment, and any applicable regulatory designation, and requires a case-specific analysis. For advice specific to your circumstances, please contact our Shipping Department or info@demetriades.com.

Foreign Direct Investment Screening Regime – Update on commencement of operation and the Ministry’s Guidance on scope of application and procedural aspects in Cyprus

Recent developments continue to shape the implementation of the Republic of Cyprus’ foreign direct investment screening framework under the Establishment of a Framework for the Foreign Direct Investment Screening Law of 2025 (Law 194(I)/2025).

Following a joint announcement by the Ministry of Finance of Cyprus and the Deputy Ministry of Research, Innovation and Digital Policy a dedicated electronic service has been introduced for the submission and review of Applications.

The platform that was set up for this purpose enables foreign investors and their authorised representatives in Cyprus to:

  • Submit FDI screening Applications electronically, and,
  • Upload supporting documentation in accordance with the Law.

This establishment of the electronic service is complemented by the issuance of a detailed official Guidance on the practical application of the FDI screening framework and the application submission process, which provide important clarifications on the scope and notification requirements of the regime and the practical steps involved in submitting an application.

Entry into force and Notification Requirement

The Cypriot FDI regime entered into force on 2 April 2026. As of 2 April 2026 any foreign direct investment falling within the scope of the legislation must be notified to the Ministry of Finance prior to completion.  

The Guidance confirms that notification is mandatory where the relevant criteria are met including (among others):

  • the acquisition of a qualifying holding (generally 25% or more in shareholdings or decisive influence),
  • a transaction value of €2 million or more, and
  • undertaking operating in a sector of “strategic importance” as defined in the Law and the Annex to it.

The submission of a complete application does not automatically result in a full screening; after the submission of a Notification, the competent authority will determine whether the investment will undergo screening.

As the Guidance clarifies, whether a particular business falls within the scope of the Law must be assessed by reference to the actual activities carried out in Cyprus. The assessment is fact specific. As further noted in the Guidnace, the focus is on the nature and scope of the activities conducted by the target undertaking and on whether those activities are capable of giving rise to risks to the security or public order of the Republic of Cyprus.

The Guidance also helpfully clarifies that:

  • Greenfield investments do not fall within the scope of the Law.
  • Transactions in which both the foreign investor and the EU target are owned or controlled by the same parent company do not require mandatory notification. If ultimate control does not change, no notification will be required.

Application process – Key practical points

The newly introduced electronic platform formalises the application process, which includes:

  • Completion of online fields and submission of a Notification Form in English
  • Upload of detailed supporting documentation (including ownership structures, transaction documents and investor information)
  • Ongoing interaction with the authority for clarifications, where required.

Practical implications for Investors

Investors planning transactions with potential relevance to Cyprus should:

  • Assess at an early stage whether their investment falls within the scope of the FDI regime
  • Carefully evaluate whether the mandatory notification thresholds and sectoral criteria are triggered
  • Ensure timely and accurate preparation of the application and supporting documentation
  • Factor in review timelines (which may extend depending on information requests and potential screening) when structuring transactions.

Future Outlook

At the EU level, the Council of the European Union on 8 June 2026, under the Cyprus Presidency, adopted a regulation revising the EU framework for screening foreign direct investments (FDI), strengthening the EU’s ability to identify, assess and address risks to security and public order linked to certain foreign investments.

The revised EU Regulation introduces a more harmonised framework with mandatory screening mechanisms in all Member States covering a common minimum scope of sensitive sectors, technologies and infrastructure (such as dual-use items and military equipment, critical raw materials, artificial intelligence, energy, transport and digital infrastructure), including foreign investments made through EU-based subsidiaries, while maintaining sole national responsibility for screening decisions.

This will likely trigger amendments to the national legislation of the EU Member States in the near future. Since Cyprus is one of the last Member States to enact an FDI regime, its FDI regime to an extent reflects the approach that is followed in the revised EU Regulation..

How we can assist

The Cyprus FDI regime introduces a substantive and procedural layer of regulatory complexity, particularly in assessing whether an investment falls within its scope and in preparing the detailed notification Form.

Our team has been closely following the developments and implementation of the newly enacted framework and has already been active in advising on the application of the new regime and preparation of notifications. Through our extensive experience advising on the merger control review of foreign investment, regulatory approvals and cross-border transactions we are well placed to:

  • Assess whether a transaction triggers a notification obligation
  • Advise on structuring considerations and timing implications
  • Prepare and coordinate the submission of an FDI Application
  • Liaise with the competent authority throughout the process.

Further information

For a further overview of the Cypriot FDI regime and its scope of application, please also refer to our previous article on this topic (https://demetriades.com/foreign-direct-investment-fdi-cyprus-screening-framework-qa-2/). For further information or assistance, please contact Polyvios Panayides (polyvios.panayides@demetriades.com) or your usual contact at Chrysses Demetriades & Co LLC.

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

CJEU clarifies the interaction between AML obligations and the right to a basic payment account

Case C-81/24, LH v OTP banka d.d. (Judgment of 11 June 2026)

Introduction

On 11 June 2026, the Court of Justice of the European Union (“CJEU”) delivered an important judgment on the relationship between consumers’ right to access a payment account with basic features and the anti-money laundering (“AML”) obligations imposed on credit institutions.

In Case C-81/24, LH v OTP banka d.d., the Court held that Article 16(4) of Directive 2014/92 does not permit Member States to require credit institutions to refuse an application for a payment account with basic features solely because the applicant is included on a sanctions list maintained by a third country. Instead, institutions must carry out an individual assessment of the money laundering and terrorist financing risks associated with the proposed business relationship. A refusal is justified only where those risks cannot be effectively managed through measures proportionate to the institution’s nature and size.

The judgment provides important guidance on how the EU AML framework interacts with consumers’ right to access essential banking services.

Background

The proceedings arose after a Slovenian bank refused to open a payment account with basic features for an individual whose name appeared on a sanctions list maintained by the United States Office of Foreign Assets Control (OFAC). Although the applicant had never been convicted of the relevant criminal offence and was not subject to restrictive measures imposed by the United Nations, the European Union or Slovenia, the bank refused the application.

The Slovenian court referred questions to the CJEU concerning the interpretation of Directive 2014/92/EU on payment accounts and Directive (EU) 2015/849 on the prevention of money laundering and terrorist financing. Having answered the first question, the Court found it unnecessary to address the remaining questions concerning the absence of criminal convictions or the presumption of innocence.

The legal framework

Directive 2014/92 grants consumers legally resident in the European Union the right to open and use a payment account with basic features. However, Article 16(4) requires Member States to ensure that credit institutions refuse an application where opening the account would result in an infringement of the AML provisions contained in Directive 2015/849.

The Court also recalled that Recital 34 of Directive 2014/92 makes clear that AML legislation must not be used as a pretext for rejecting commercially less attractive consumers. Similarly, Recital 47 states that refusal is justified only where the consumer does not comply with AML legislation, and not because compliance procedures are considered too burdensome or costly.

Directive 2015/849 requires credit institutions to identify and verify customers, assess the risks associated with the proposed business relationship and apply customer due diligence measures proportionate to those risks. Depending on the level of risk identified, institutions may be required to apply enhanced customer due diligence.

The Court’s Judgment

Inclusion on an OFAC List does not automatically justify refusal

The central issue before the Court was whether inclusion on an OFAC sanctions list automatically justified refusing to open a payment account with basic features. The CJEU answered that question in the negative. The Court held that inclusion on an OFAC list (or on any comparable list established by a third country) may constitute a relevant risk factor in assessing money laundering and terrorist financing risks.

However, that fact alone does not automatically prevent a credit institution from establishing a business relationship. Accordingly, Article 16(4) of Directive 2014/92 does not permit Member States to require credit institutions to refuse an application solely because the applicant appears on such a list.

Instead, institutions must carry out an individual assessment of the proposed business relationship, taking into account all relevant risk factors. Where that assessment identifies a higher risk of money laundering or terrorist financing, the AML Directive requires enhanced customer due diligence. However, the Court emphasised that the identification of a higher-risk customer is not automatic and must itself result from an evidence-based assessment.

Refusal may still be justified

The Court recognised that, following an individual assessment, a credit institution may conclude that it is unable to manage effectively the identified money laundering or terrorist financing risks through measures proportionate to its nature and size, even where the proposed relationship concerns only a payment account with basic features. Only in those circumstances may a refusal be justified under Article 16(4).

The Court therefore left it to the Slovenian court to determine whether the bank had carried out the required individual assessment, taking into account all relevant risk factors beyond the applicant’s inclusion on the OFAC list, and whether the identified risks could have been managed through proportionate measures, including ongoing monitoring of the business relationship under Article 13(1)(d) of Directive 2015/849.

The nature of basic payment accounts

The Court also observed that the limited functionality of payment accounts with basic features may reduce the money laundering and terrorist financing risks associated with such accounts. Nevertheless, this remains only one element of the institution’s overall assessment and does not prevent refusal where the identified risks cannot be effectively managed.

Practical Implications

The judgment confirms that financial institutions cannot adopt blanket policies under which customers appearing on third-country sanctions or watch lists are automatically denied access to payment accounts with basic features.

Instead, institutions should ensure that:

  • sanctions screening informs, rather than replaces, the individual AML risk assessment;
  • enhanced customer due diligence is applied where justified by the identified risks;
  • decisions refusing an application are supported by a documented, evidence-based assessment of all relevant risk factors; and
  • consideration is given to whether ongoing monitoring of the business relationship would enable identified risks to be effectively managed.

Conclusion

The CJEU’s judgment confirms that inclusion on a third-country sanctions list is only one factor in the assessment required under Directive 2015/849. It cannot, by itself, justify refusing a payment account with basic features. Instead, credit institutions must carry out an individual, evidence-based assessment of the proposed business relationship and determine whether any identified money laundering or terrorist financing risks can be effectively managed through measures proportionate to their nature and size. The decision reinforces both the EU’s risk-based AML framework and the objective of ensuring access to essential banking services under Directive 2014/92. For more information please contact our Compliance team at compliance@demetriades.com or your usual contact at Chrysses Demetriades & Co LLC.

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Cost of Living Allowance (COLA) / Α.Τ.Α. – Ministry of Finance Circular

The Ministry of Finance of the Republic of Cyprus issued Circular No. 1780 on 8/1/2026, setting out the framework for the application of the Cost of Living Allowance (COLA), aka A.T.A., for the period 1 January 2026 to 30 June 2027 in the public sector.

The Circular is based on the agreement on the reinstatement of the Automatic Price Indexation mechanism and on the confirmation of positive economic growth during 2025. Under the Circular, COLA is applied as follows:

  • 1 January 2026 – 30 June 2026: COLA is payable at 80% of the annual increase of the relevant Consumer Price Index for 2025.
  • 1 July 2026 – 30 June 2027: COLA increases to 90% of the same annual CPI increase, provided that the annual change in real GDP for 2025 is positive, as confirmed in the Circular.

The Circular further specifies the exact adjustment percentages applied to basic salaries, distinguishing between cases where COLA is already incorporated into the salary base and those where it is not, and sets out maximum monetary caps for the application of the allowance. The revised COLA amounts are taken into account for the purposes of future salary calculations, in accordance with the applicable rules.

Circular No. 1780 serves as a practical reference for public-sector payroll authorities and other competent bodies and requires careful application depending on the salary structure concerned.

For more information, please contact Thomas Christodoulou (thomas.christodoulou@demetriades.com) or your usual contact at Chrysses Demetriades & Co LLC.

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Construction and workplace accidents: Recent guidance from the Cyprus Supreme Court

In two decisions delivered in early December 2025 (Α. ΕΡΓΟΛΗΠΤΙΚΗ ΕΤΑΙΡΕΙΑ ΓΙΑΝΝΑΚΗΣ ΓΙΑΝΝΗ ΣΥΜΕΟΥ & ΥΙΟΙ ΛΤΔ v. ΔΗΜΗΤΡΗ ΣΑΒΒΑ, Civ App. 266/2017, 2/12/2025 and ΑΛΕΞΗ ΑΛΕΞΑΝΔΡΟΥ ν. ΓΕΩΡΓΙΟΣ ΑΛΕΞΑΝΔΡΟΥ (ΚΑΛΑΜΟΥΔΙΑΣ) ΛΤΔ Civ App.301/2015,1/12/2025), the Supreme Court of Cyprus revisited key principles governing liability for workplace accidents in the construction sector. The cases concerned injuries sustained during construction activities and required the Court to assess the respective responsibilities of employers and employees where safety arrangements on site were found to be inadequate.

The Court confirmed that construction sites present heightened risks and therefore demand a structured and effective approach to health and safety. Particular attention was given to situations involving subcontractors or external specialists, who may not be fully embedded in the main contractor’s safety procedures. The judgments underline that those in control of a site cannot rely on the experience or autonomy of such workers as a substitute for clear instructions, proper coordination and an organised system of work addressing foreseeable hazards.

While deficiencies in safety management were identified, the Court also examined the conduct of the injured workers. In both cases, the employees were found to have contributed to their accidents by failing to take reasonable precautions in circumstances where the risks were apparent. As a result, contributory negligence was assessed at 25%. The Court emphasised that employees are expected to exercise judgment and care consistent with their experience and the nature of the work being performed.

At the same time, the Court reaffirmed that an employee’s failure to act prudently does not displace the employer’s overarching duty to ensure a safe working environment. That duty encompasses multiple elements, including the design of safe work systems, the provision of suitable equipment, competent supervision and safe premises. The decisions confirm that, in practice, where shortcomings in workplace safety remain the dominant cause of an accident, liability will generally rest with the party controlling the site, with contributory negligence typically reflected through a moderate reduction in damages rather than a transfer of responsibility.

Our Experience in Workplace Accident Litigation

Our firm has also successfully represented defendants in complex workplace accident litigation before the Cyprus courts, including Action No. 4005/2015 before the District Court of Limassol, where judgment was delivered on 19 November 2024.

The case concerned a claim for damages arising from an alleged workplace accident at a construction site, involving multiple defendants, including an employer and a subcontractor. The claimant alleged that he had been instructed to operate machinery outside his usual duties and sustained serious injuries when dismounting from a tractor.

The Court undertook a detailed analysis of the factual matrix, including the credibility of witnesses, the allocation of responsibilities between contractors and subcontractors, and the extent of any alleged breach of statutory and common law duties. Particular emphasis was placed on inconsistencies in the claimant’s evidence and the absence of reliable proof supporting key aspects of his account.

Importantly, the Court rejected significant parts of the claimant’s testimony as unreliable and internally contradictory, while also scrutinising allegations that he had been instructed to perform tasks beyond his role. The decision illustrates the Court’s willingness to closely examine evidential credibility and to dismiss claims where negligence is not adequately established.

The action was ultimately resolved in favour of our client, reaffirming the principle that liability in workplace accident cases must be grounded in clear, credible evidence of breach and causation, and not merely on the occurrence of an accident.

For more information, please contact Costas Georgiades or your usual contact at Chrysses Demetriades & Co LLC.

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

Balancing Environmental Protection, Heritage, and Development: Lessons for Cyprus

Balancing environmental protection, cultural heritage and development is no longer a theoretical exercise; it is fast becoming a defining challenge for courts and policymakers alike.

In her latest article, our partner Katia Kakoulli, published in the e-newspaper of the Great Britain-Cyprus Business Association, examines how recent Greek case law offers valuable guidance for Cyprus; articularly in light of the strengthened constitutional framework for environmental protection.

The evolving jurisprudence signals a clear shift toward substantive, evidence-based decision-making, where accessibility, inclusion, and heritage preservation are treated as interconnected, rather than competing, interests. As environmental litigation continues to mature, success will depend less on formalities and more on robust reasoning, proportionality, and scientific grounding.
Read the full analysis here (click here to access the analysis).


Cyprus Tax Reform Package 2026: An overview for individuals and companies

Widely welcomed by professionals and service providers, Cyprus’ most significant tax reform in over two decades marks a major step forward in modernising the country’s fiscal framework.

The Cyprus Tax Reform Package 2026 introduces a comprehensive set of legislative changes affecting both individuals and companies, including developments in income taxation, capital gains tax, dividend taxation, special defence contribution, as well as tax assessment and enforcement procedures.

Most provisions entered into force on 1 January 2026, with the measures aiming to modernise the tax system, enhance transparency, and further strengthen Cyprus’ position as a competitive international business and investment hub, while aligning the framework with evolving international standards.

In our latest memo, we provide a concise overview of the principal changes and outline the potential implications for different categories of taxpayers.


https://demetriades.com/wp-content/uploads/2026/03/Cyprus-Tax-Reform-Package-CD-ME-new-template-1.pdf

Disclaimer: This article provides general information and does not constitute legal advice. The application of the law and regulatory requirements depends on the specific facts and circumstances of each case.

1 2 3 4 5