How to approach an AML and source-of-funds file for a Cyprus counterparty

A Cyprus counterparty arriving on a Hong Kong desk triggers a specific set of questions that offshore counsel, banking intermediaries and internal compliance teams handle differently – and not always well. Cyprus sits at the intersection of European Union regulatory architecture, a substantial beneficial-ownership registry (a publicly accessible or competent-authority-accessible record of the individuals who ultimately own or control a legal entity) framework, and a long-established history as a holding and treasury centre for groups with assets in the former Soviet states, the Middle East and Mainland China. That combination is commercially useful. It is also exactly what a correspondent bank or a compliance officer will flag at the first point of review.

An AML and source-of-funds file for a Cyprus counterparty is built on a defined sequence: entity verification under the Cyprus Companies Law, beneficial-ownership confirmation through the Cyprus Registrar of Companies and the national UBO Register (the register maintained under the EU's anti-money laundering directives for beneficial-ownership disclosure), source-of-funds documentation for the ultimate beneficial owners, and a sanctions screen under both UN-mandate regimes and the EU framework that Cyprus implements as a member state. Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance governs the obligations of the Hong Kong-side party; completing a file that satisfies both the Hong Kong obligation and the correspondent-bank standard is the practical objective.

This guide sets out the sequence in order, the gate at each step, the common mistakes we see, and a short checklist for in-house counsel working through the file for the first time.

Why a Cyprus counterparty raises a specific compliance question

Cyprus is not an inherently high-risk jurisdiction. It is an EU member state with a common-law-derived legal system, a functional courts structure, and a securities regulator – the Cyprus Securities and Exchange Commission (CySEC) – that operates under EU law. That matters because it means a Cyprus company sits inside the EU's Anti-Money Laundering Directives (a series of EU legislative instruments, progressively updated, that require member states to impose customer-due-diligence, beneficial-ownership and suspicious-activity-reporting obligations on financial institutions and certain other sectors). The UBO Register is mandatory, the beneficial-ownership filing is a corporate-law requirement, and the documentary infrastructure is, in principle, accessible.

The specific compliance question arises because Cyprus has functioned for decades as a transit and holding jurisdiction. Groups with Mainland China, CIS-region or Middle Eastern underlying assets routinely hold through Cyprus vehicles precisely because Cyprus offers double-taxation treaties, EU treaty access and a straightforward corporate framework. The result is that a Cyprus holding company may present a single legal-entity layer above a complex multi-jurisdictional beneficial-ownership chain. That chain is the subject of the file.

In our cross-border practice, the most common pattern is a Hong Kong operating entity or financial counterparty receiving a Cyprus-domiciled counterparty at the due-diligence stage of a transaction, loan, or payment relationship. The Hong Kong party is subject to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Its correspondent banks – almost invariably operating under US, EU or UK AML obligations in addition to Hong Kong requirements – apply their own screening standards. The file must serve both audiences.

Step 1 – Entity verification and the Cyprus company record

The first gate is confirming that the Cyprus counterparty is what it represents itself to be: a validly incorporated, active company in good standing under the Cyprus Companies Law.

The starting point is the Cyprus Registrar of Companies, which maintains a public electronic register. The record provides the date of incorporation, the registered address, the current directors, the secretary, the authorised and issued share capital, and the status of annual returns. A certificate of good standing – issued by the Registrar on request – confirms that the company is active and has met its filing obligations. This is a threshold document. Without it, the file has no verified foundation.

Two points are worth establishing at this stage. First, Cyprus companies can be maintained in a dormant state for extended periods without triggering deregistration, so a clean registry entry does not by itself confirm operational activity. Second, nominee director and shareholder arrangements are still encountered in Cyprus structures, particularly in older holdings. Where the directors on the registry record are corporate nominees, the file must proceed immediately to the beneficial-ownership step rather than treating the corporate layer as the answer.

Practical gate: the file does not move to Step 2 until the Hong Kong team has a certified copy of the certificate of incorporation, the certificate of good standing, and the current memorandum and articles of association. These are the foundation documents.

Step 2 – Beneficial-ownership confirmation through the UBO Register

Cyprus implemented mandatory beneficial-ownership registration under the EU's Anti-Money Laundering Directives. The Cyprus UBO Register is maintained by the Registrar of Companies and contains information on the individuals who ultimately own or control the entity above a defined threshold of ownership or control rights.

Access to the register is tiered. Competent authorities and obliged entities (financial institutions, lawyers, accountants and other professionals subject to AML obligations under the EU framework) have direct access. The public has access to a more limited dataset. For a Hong Kong party working through an external adviser admitted in Cyprus, a formal request through the relevant access channel is the standard route.

The UBO Register extract provides the name, month and year of birth, nationality, country of residence, and nature and extent of beneficial interest for each registrable beneficial owner. It does not provide residential addresses or full identification documentation. Those require a separate, direct request to the counterparty.

What the register does provide is a cross-check. If the beneficial owners declared to the Hong Kong party differ from the UBO Register record, that discrepancy is a material red flag that must be resolved before the file closes. Discrepancies of this kind are more common than might be expected – particularly in structures where the UBO filing was made at inception and has not been updated to reflect changes in shareholding or control.

The sequence also matters for the correspondent bank review. A correspondent bank reviewing a Cyprus-origin payment relationship will run its own UBO check. If the Hong Kong party's file produces a different beneficial-ownership picture from the bank's independent check, the payment relationship is at risk regardless of the strength of the underlying transaction.

For a deeper look at how beneficial-ownership screening applies to Greater China supply-chain relationships, see our note on counterparty screening for Greater China supply chains.

Step 3 – Source-of-funds documentation for the ultimate beneficial owners

Confirming the identity of the beneficial owners is not the same as confirming the source of the funds they deploy. This is the step where most files stall or fail.

Source-of-funds documentation answers the question: where did the money that capitalised or funds this entity come from, and can that origin be verified? For a Cyprus holding company sitting above a complex corporate structure, this is rarely a single-document answer. In practice, it requires a layered evidential package assembled at the level of each ultimate beneficial owner, not the Cyprus entity itself.

The documents in scope vary by the profile of the UBO. Common categories include: audited financial statements for the operating entities that generated the underlying wealth; corporate structure charts showing the route from the operating entities to the Cyprus holding layer; evidence of dividends, loan repayments or capital reductions that moved funds from the operating layer to the Cyprus vehicle; and, for individual UBOs, evidence of the personal wealth event (sale of a business, inheritance, professional income) that funded their initial contribution.

A critical point: the source-of-funds analysis must trace the funds to a plausible origin. It does not require certainty, but it does require a coherent narrative that can be articulated to a compliance officer and, if necessary, to a regulator. Where the narrative relies on unaudited financial statements from a jurisdiction with limited accounting oversight, the file should note that limitation and consider whether additional evidence is available.

For Cyprus counterparties with Mainland China, CIS-region or Middle Eastern underlying assets, the source-of-funds step frequently intersects with the question of funds that originated in a jurisdiction with a different regulatory standard. That intersection does not make the file impossible. It does make the evidential standard higher, and it makes the documentation of the analysis more important.

In our cross-border practice, we regularly act in this intermediate role: coordinating the source-of-funds evidence request between the Hong Kong party, allied counsel admitted in Cyprus, and the counterparty's own advisers. The file that satisfies the correspondent bank is usually more detailed than the minimum required under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance alone.

Step 4 – Sanctions screening: the Hong Kong, EU and correspondent-bank layers

A Cyprus counterparty must be screened against at least three sanctions frameworks, for different but complementary reasons.

Hong Kong implements United Nations sanctions. The United Nations Sanctions Ordinance gives effect to UN Security Council sanctions designations in Hong Kong. A Cyprus entity or its beneficial owners that appear on a UN consolidated list are subject to asset-freeze and dealing-prohibition obligations in Hong Kong.

As an EU member state, Cyprus also implements EU autonomous sanctions. These include sectoral and individual measures across a range of jurisdictions and matters. A Cyprus-registered entity cannot lawfully transact in a manner that violates EU sanctions, even with a Hong Kong counterparty. The practical effect is that the Hong Kong party's correspondent banks – which almost invariably operate under EU or US regulatory obligations in parallel – will apply those measures to the payment channel regardless of Hong Kong's own sanctions posture.

Hong Kong does not give domestic legal effect to unilateral measures of other states, including those of the United States, the United Kingdom or the European Union. The compliance relevance of EU sanctions for the Hong Kong party is therefore not legal obligation but banking access: a correspondent bank that is itself subject to EU sanctions rules will not process a payment involving a designated party, irrespective of the Hong Kong legal position.

The practical screening approach therefore covers: the UN consolidated list; the EU financial sanctions database; and, where the correspondent-bank relationship requires it, any additional screening datasets that the bank applies as a condition of the relationship. For a Cyprus counterparty with beneficial owners who have CIS-region connections, the EU measures in force since 2022 are a particularly active screening area.

The key operational point is sequencing: sanctions screening should be completed before the source-of-funds analysis proceeds to the document-collection phase. If a beneficial owner appears on a sanctions list, the commercial question changes fundamentally, and the file may need to be closed rather than completed.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For an initial assessment of your Cyprus counterparty's profile and the applicable screening obligations, write to us at info@lockhartyip.com.

What foreign counsel get wrong: the common mistakes

Three mistakes appear consistently in files that arrive on our desk after an earlier attempt has stalled.

The first is treating the UBO Register extract as the end of the beneficial-ownership step rather than the beginning. The register provides a declaration; it does not verify the declaration against identity documents, independent corporate records, or the counterparty's own disclosed structure. A file that rests on the register alone has not completed the beneficial-ownership step.

The second is conflating source-of-funds with source-of-wealth. Source-of-wealth asks how the UBO accumulated their overall asset base. Source-of-funds asks specifically where the money in this transaction or this entity came from. Both are relevant. They require different documentary answers. Files that conflate them – or that address only one – are routinely rejected at the correspondent-bank stage.

The third is sequencing the sanctions screen at the end of the process rather than the beginning. This is an efficiency failure with significant consequences: a large evidential file assembled over several weeks can be rendered unusable by a sanctions hit that could have been identified in the first hour. Sanctions screening is always the first substantive step after entity verification, not the last.

A related point applies specifically to the Hong Kong–Cyprus corridor. It is tempting for in-house teams to delegate the file entirely to the Cyprus-side advisers and treat the resulting report as complete. Cyprus-side advisers are well positioned to obtain registry documents and legal opinions on Cyprus law. They are not positioned to assess the file against the Anti-Money Laundering and Counter-Terrorist Financing Ordinance or against the correspondent-bank standards that govern the Hong Kong payment channel. The Hong Kong-side analysis is a distinct step and cannot be substituted.

If an earlier filing, structure or compliance attempt produced an adverse or stalled result, a second read can identify where the file broke down and the routes still available. Write to us at info@lockhartyip.com to discuss your position.

The decision checklist

Before a file for a Cyprus counterparty is treated as complete, the following points should each have a documented answer.

• Is the certificate of good standing current and certified? A registry printout is not a substitute for a sealed certificate.
• Have the current directors and shareholders been verified against the most recent filing, not the incorporation documents? Nominee arrangements should be identified and the principal behind each nominee confirmed.
• Has the UBO Register extract been obtained through the correct access channel, and does it match the beneficial-ownership information provided by the counterparty?
• Have all beneficial owners above the applicable ownership or control threshold been identified? Where the threshold is close to the reporting level, consider whether effective control rather than formal ownership changes the picture.
• Has source-of-funds documentation been obtained at the UBO level, not only at the Cyprus entity level? Does it trace to a plausible and documented origin?
• Has sanctions screening been completed against the UN consolidated list and the EU financial sanctions database before document collection proceeded?
• Has the file been assessed against the Anti-Money Laundering and Counter-Terrorist Financing Ordinance obligations of the Hong Kong party, not only against Cyprus or EU standards?
• Has the correspondent bank's own requirements been identified and does the file address them? Where those requirements go beyond the statutory minimum, has the gap been documented?

A file that can answer each of these points with a documented yes – or a documented explanation of why a particular item is not applicable on the specific facts – is a file that will survive scrutiny at the banking level and, if relevant, at the regulatory level.

For a comparison with how the same sequence applies to a BVI-domiciled counterparty, see our analysis of AML and source-of-funds files for BVI counterparties. For the full scope of our sanctions and AML advisory work, see our Sanctions & AML practice page.

How the Hong Kong–Cyprus cross-border interface works in practice

The legal systems engaged in this file are distinct and do not overlap by default. Hong Kong operates a common-law system under the one country, two systems framework; its AML obligations run under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Cyprus, as an EU member state, operates under the EU Anti-Money Laundering Directives framework; its corporate and beneficial-ownership rules derive from EU law implemented through national legislation. The correspondent banks operating the payment channel bring a third layer – typically US, UK or EU AML and sanctions obligations – that is not coextensive with either.

What this means operationally is that the compliance objective is not simply to satisfy the lowest common denominator. It is to produce a file that is defensible under each relevant standard simultaneously. In most cases, the correspondent-bank standard is the highest practical threshold, because correspondent banks apply their own risk appetite in addition to the regulatory minimum. A file that satisfies the Anti-Money Laundering and Counter-Terrorist Financing Ordinance alone may still result in a payment being declined or a relationship being terminated at the banking level.

Consider a mid-market transaction between a Hong Kong trading entity and a Cyprus-registered treasury vehicle owned by a group with operating assets in the Greater Bay Area and a shareholder base in Central Asia. The Hong Kong party assembles a file under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The file correctly identifies the beneficial owners and obtains source-of-funds documentation. But the file does not address the EU sanctions measures that the correspondent bank applies to one of the beneficial owners' connected entities. The payment is declined. The commercial relationship is disrupted for several months while the file is reconstructed.

That pattern is preventable. It is prevented by mapping the applicable standards before beginning the file, rather than discovering the gap at the payment stage.

Related practices

Related practices

• Sanctions & AML – counterparty screening, compliance files and AML advisory across jurisdictions
• Holding Structures – Cyprus, BVI and Cayman holding structures assessed for substance and risk

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.