CySEC Urges Cyprus Firms to Engage With New EU AML Risk Assessment Framework

Cyprus-regulated businesses are being encouraged to participate in a European consultation that could significantly change how money laundering and terrorist financing risks are assessed across the European Union.

The Cyprus Securities and Exchange Commission has urged regulated entities to engage with the Anti-Money Laundering Authority on draft Regulatory Technical Standards designed to establish a common methodology for assessing the money laundering and terrorist financing risk profiles of obliged entities in the non-financial sector.

The initiative represents another step towards the creation of a more harmonised European AML framework. Rather than allowing risk assessments and supervisory approaches to differ substantially between Member States, the proposed methodology seeks to establish common criteria that can be applied consistently across the EU.

AMLA's public consultation on the draft standards opened on July 13, 2026, and is scheduled to remain open until September 27. A public hearing is also scheduled for September 10, providing businesses and other stakeholders with an opportunity to discuss the proposed methodology directly with the European authority before the standards are finalised.

For Cyprus firms, the consultation is particularly relevant because the proposed framework could influence not only how their financial crime exposure is measured but also how supervisory authorities evaluate the effectiveness and proportionality of their AML/CFT controls.

At the centre of the proposal is a distinction between **inherent risk** and **residual risk**.

Inherent risk refers broadly to the level of money laundering and terrorist financing exposure associated with a business before taking its mitigating controls into account. A business operating in a sector with significant exposure to complex ownership structures, international transactions, high-risk jurisdictions or cash-intensive activity may therefore have a relatively high inherent risk.

Residual risk, by contrast, reflects the level of risk remaining after the firm's policies, procedures and controls have been taken into consideration.

The distinction is important because a business can operate in a relatively high-risk sector while maintaining a comparatively lower residual risk if its AML/CFT framework is genuinely effective.

The proposed methodology is intended to help supervisors make that assessment in a more structured and consistent manner.

AMLA has indicated that the draft standards will establish a methodology for assessing and classifying the inherent and residual ML/TF risk profiles of obliged entities in the non-financial sector. The objective is to support a consistent, proportionate and effective risk-based approach to supervision across the European Union.

For businesses, this could represent a meaningful change in how regulatory expectations are translated into supervisory assessments.

Under a more harmonised model, it may become increasingly important for firms to demonstrate not merely that they have AML policies in place, but that those controls are capable of reducing the specific risks inherent in their business model.

This distinction could have significant consequences for compliance departments.

A firm's risk assessment will need to be capable of explaining why particular risks have been identified, how those risks were measured and what controls have been implemented to mitigate them. Generic assessments that classify a business as "medium risk" without explaining the underlying factors may become increasingly difficult to defend.

The quality of the information provided to regulators is also likely to become more important.

AMLA's consultation specifically addresses the data points that would be used as part of the proposed methodology. Stakeholders have been invited to comment on whether the information requested is relevant and proportionate, whether smaller businesses are appropriately treated and whether the proposed reporting framework can realistically be implemented.

This is significant because a data-driven supervisory framework can potentially produce very different outcomes from a predominantly qualitative assessment.

Regulators will increasingly have access to comparable information from firms operating in different Member States. This could allow them to identify patterns, compare risk profiles and determine whether businesses operating within the same sector are being supervised according to broadly consistent standards.

For Cyprus, where the financial and professional services sector has a significant international component, such harmonisation could have particular implications.

Cyprus-regulated firms frequently operate with international customers, cross-border transactions, complex corporate structures and connections to multiple jurisdictions. These characteristics do not automatically indicate elevated financial crime risk, but they can create additional factors that need to be properly identified and controlled.

A firm therefore may need to demonstrate not simply that it has completed customer due diligence, but that its customer risk methodology appropriately captures the particular characteristics of its client base.

Geographic exposure is one example.

A business with customers from numerous jurisdictions may have a substantially different risk profile from a domestically focused business. The proposed methodology could require firms and supervisors to consider those differences systematically rather than relying exclusively on broad sector classifications.

Customer types, products and services, delivery channels and transaction patterns can similarly affect the overall risk profile.

For example, a financial services business offering services through digital channels to internationally mobile customers may face different risks from a professional services firm dealing primarily with locally established businesses.

The proposed methodology is therefore likely to reinforce the principle that AML compliance should be tailored to the actual business model.

The development is also important for smaller firms.

AMLA has specifically identified the treatment of smaller entities as an issue for consultation. Smaller businesses may have fewer customers, simpler structures and lower transaction volumes, but they may also have fewer compliance resources and less capacity to implement sophisticated systems.

A proportionate AML framework should therefore distinguish between the size and complexity of a business while ensuring that genuinely material risks are not overlooked.

The challenge will be finding the correct balance.

If the methodology is too simplistic, smaller firms could be under-assessed despite meaningful risks. If it is excessively complex, smaller businesses could face significant administrative and financial burdens without a corresponding improvement in financial crime controls.

This is one of the reasons stakeholder participation is important.

Businesses operating under the framework are in a position to identify whether proposed data requirements are realistic, whether certain indicators are genuinely useful and whether the methodology could unintentionally produce distorted risk assessments.

For compliance professionals, the consultation should therefore not be viewed merely as a regulatory discussion taking place at European level.

The eventual standards could influence the way firms structure their internal AML risk assessments.

Businesses may need to reconsider how they document inherent risk, how they assess the effectiveness of controls and how they demonstrate the reduction from inherent to residual risk.

This could also affect board and senior management reporting.

A board should increasingly be able to understand not only whether a company has an AML programme but also the principal risks identified, the controls used to address them and the level of residual exposure that remains.

The proposed framework could encourage a more quantitative and evidence-based approach to those discussions.

For example, a firm identifying high geographic risk but maintaining that its residual risk is low should be able to demonstrate the basis for that conclusion. It may need to show how enhanced due diligence, transaction monitoring, customer acceptance criteria, sanctions screening and ongoing reviews collectively reduce the identified exposure.

This is fundamentally different from simply assigning a numerical risk score.

It also raises questions about the quality of AML data maintained by firms.

If supervisory assessments become increasingly data-driven, businesses will need reliable information concerning their customers, transactions, beneficial owners, jurisdictions, products, services, suspicious activity and control effectiveness.

Poor-quality data could therefore become a regulatory weakness in its own right.

A business may have strong AML policies but still struggle to demonstrate their effectiveness if relevant information is fragmented across different systems or cannot be extracted reliably.

The proposed framework may consequently encourage greater integration between compliance systems, customer databases, transaction monitoring platforms and management information.

It could also increase the importance of consistent AML terminology and methodologies within multinational groups.

A group operating across several EU Member States may increasingly benefit from maintaining common risk-assessment principles while allowing individual subsidiaries to account for local regulatory and business differences.

For Cyprus firms belonging to international groups, this could provide an opportunity to improve consistency between group-wide AML policies and local implementation.

At the same time, businesses should avoid assuming that a group-level risk assessment can simply replace the entity-specific assessment required for the individual regulated company.

The actual customers, products, jurisdictions and activities of the Cyprus entity remain relevant.

Another important implication concerns the relationship between firms and their supervisors.

A harmonised European methodology could make supervisory conversations more evidence-based. Instead of discussing AML risk primarily in qualitative terms, firms may increasingly be expected to explain their risk profile using defined data points and comparable indicators.

That could ultimately improve consistency, but it may also expose weaknesses that previously remained less visible.

A company that has historically described itself as "low risk" may find that its customer geography, ownership structures, transaction profile or business model result in a materially higher inherent-risk classification under the new methodology.

The appropriate response would not necessarily be to attempt to reduce the formal risk rating.

Instead, the focus should be on ensuring that controls are proportionate to the actual risks.

This is particularly important because a high inherent-risk profile is not necessarily evidence of poor compliance.

A business can legitimately operate in a higher-risk environment while maintaining effective controls. The objective of an effective risk-based framework is not to eliminate all high-risk customers or activities, but to identify and manage the risks appropriately.

The distinction between inherent and residual risk therefore provides an opportunity for firms to demonstrate the effectiveness of their compliance programmes.

However, this will require evidence.

Businesses should be able to demonstrate that enhanced due diligence is actually performed where required, that suspicious transaction alerts are investigated, that sanctions screening operates effectively, that customer risk ratings are reviewed when circumstances change and that senior management receives appropriate information.

The proposed methodology could therefore reinforce the growing European shift from **policy-based compliance towards effectiveness-based supervision**.

Having a policy is increasingly only the starting point.

Regulators want evidence that the policy works.

CySEC's decision to encourage Cyprus firms to participate in the AMLA hearing is therefore timely. The regulator's existing AML/CFT framework already requires supervised entities to maintain appropriate risk-based systems and controls, while its recent communications demonstrate the increasing importance it places on European-level AML developments.

The proposed RTS should also be viewed alongside the wider EU AML reform programme.

The EU is moving towards a more integrated AML architecture, with AMLA taking on an increasingly central role in developing common standards and methodologies. The broader framework is intended to reduce inconsistencies between national regimes and strengthen the overall European approach to financial crime prevention.

For Cyprus firms, this means that European AML developments will increasingly have direct practical relevance even where the immediate supervisory relationship remains with the national regulator.

The transition will require firms to monitor not only CySEC circulars and national legislation but also AMLA consultations, technical standards, guidance and supervisory developments.

Compliance teams should therefore consider establishing a structured process for monitoring AMLA developments.

The latest consultation also provides firms with an opportunity to influence the eventual framework rather than simply adapting to it after implementation.

Businesses that believe particular data requirements are disproportionate, operationally difficult or unsuitable for certain business models can raise those concerns during the consultation process.

The same applies to smaller firms that may face disproportionate compliance costs.

The consultation specifically invites feedback on implementation costs, operational challenges and the treatment of smaller entities, making these issues central rather than peripheral to the process.

The public hearing on September 10 will provide another opportunity for stakeholders to engage directly with AMLA. Registration is required, and places are limited.

For firms that do not participate directly, the development still warrants attention.

Compliance departments should begin assessing whether their current AML risk-assessment methodology would produce sufficiently clear evidence of inherent risk, control effectiveness and residual risk under a more standardised European framework.

They should also review whether the information necessary to support that assessment is readily available.

The likely direction of travel is clear: European AML supervision is becoming more consistent, more data-driven and increasingly focused on demonstrating the effectiveness of controls.

Cyprus firms that engage with this process early may therefore be better positioned to adapt when the final standards take effect.

The immediate issue is a consultation and not yet a final set of binding supervisory requirements. Nevertheless, its potential significance should not be underestimated.

The methodology eventually adopted by AMLA could influence how businesses are classified, how supervisory resources are directed and how firms are expected to demonstrate that their AML/CFT frameworks are proportionate to the risks they face.

For regulated businesses in Cyprus, the message from CySEC is consequently more than an invitation to attend a European hearing.

It is an indication that the next phase of AML regulation will place increasing emphasis on measurable risk, comparable data and demonstrable control effectiveness.

Firms that already maintain detailed, evidence-based and genuinely risk-sensitive AML programmes should be well placed to adapt. Those relying heavily on generic risk assessments, outdated customer information or policies that are not supported by effective operational controls may face considerably greater challenges as the European supervisory framework becomes more standardised.

By fLEXI tEAM