CySEC urges firms to prepare systems for AMLA’s final draft standards

CySEC has urged regulated firms to study AMLA’s final draft anti-money-laundering standards and make the necessary changes to policies, checks, systems and procedures. Circular C806, dated 13 October, addresses Cyprus investment firms and crypto-asset service providers alongside other supervised businesses, turning the European publication into a direct preparation signal.[1]

AMLA published the three sets of final drafts on 1 October. They cover customer due diligence, the distinction between business relationships and occasional or linked transactions, and group-wide arrangements. The package is intended to make verification, risk management and information sharing more consistent across the EU.[2]

The drafts have gone to the European Commission. CySEC’s circular expressly preserves the next legal steps: adoption and Official Journal publication, with application proposed six months after entry into force. Its request for preparation supplies no automatic commencement date for the new standards.[1]

Remote onboarding and group responsibility

The due-diligence draft makes alternative remote identity verification conditional. Where a customer cannot reasonably present documents in person and lacks suitable electronic identification, an alternative solution must include controls linking the person to the document, secure communications and usable records. Firms must justify the alternative route and demonstrate that it meets the safeguards.[3]

For a broker using a remote-onboarding provider, the consequence is a need to understand both the verification method and the evidence it retains. The method’s suitability and the records supporting it would remain part of the broker’s responsibility.[3]

The group draft addresses EU affiliates sharing a head office outside the Union where none is the others’ parent. It sets criteria for identifying the EU entity responsible for group-wide arrangements and requires notification to its supervisor. Decision-making powers, control and risk-management capacity would matter in allocating that role.[4]

This makes the preparation exercise organisational as well as technical. A broker group would need to connect customer-checking tools with an accountable entity capable of overseeing controls across its European businesses. CySEC’s circular gives firms a reason to resolve those dependencies while the Commission process continues.[1][4]

Report an error or submit an update