On 13 December 2021, the Cyprus Ministry of Finance announced that the Report on National Risk Assessment (NRA) with respect to virtual assets (VA) and virtual asset service providers (VASPs) commissioned by the Advisory Authority for Combating Money Laundering and Terrorist Financing has been finalised.

The report sets forth a national risk assessment for Cyprus focused on ML/TF risks of VA activities and VASPs and which was taken into account in the drafting of the primary and secondary legislation on AML/CFT enacted in 2021 for this respective sector. It should be noted, however, that the assessment only takes into account factual circumstances as at late 2020.

A summary of key findings of the report is listed below:

• There is very limited VA or VASP (or VASP-type) activity in Cyprus. There have been limited access points for VA into the broader Cyprus economy.
• There is a widespread perception that the VA/VASP sector is high risk, but overall there is limited direct understanding or experience regarding the specific ML and TF risks of VA and VASP sector on the part of key authorities. CySEC has had initial direct supervisory experience supervising ML/TF risks of a small subset of entities.
• The police have acquired some direct experience and sophisticated understanding with VA.
• There is very limited to no use of specialised commercial cryptocurrency AML compliance and intelligence/blockchain forensics and transaction monitoring tools and databases. Supervisors, law enforcement and the FIU have received little to no access to and training on their use.
• As at late 2020 Cyprus had not implemented the so called “travel rule” for transfers of VA by financial institutions (the travel rule referring to the FATF requirement on institutions to monitor transfers exceeding US$1,000).
• Processes for updates from supervisors to obliged entities on designations to sanctions lists and other communications are designed for normal business hours. Because VA markets, unlike traditional financial markets, are active on a 24/7/365 basis, this could be a material gap with regard to VASPs and movement of VA (partly mitigated by other sources of updates available to obliged entities through widely available databases).

A summary of the recommended actions is listed below:

• The Central Bank of Cyprus and the Cyprus Securities and Exchange Commission (CySEC) should update their respective AML/CFT Directives to include measures dealing with VA/VASPs, such as expressly incorporating the so called “travel-rule”.
• In view of CySEC’s role supervising VASPS and VA activities and leading Cyprus’ efforts to mitigate VA/VASP ML/TF risks, it should also provide education to its supervised obliged entities regarding identification of suspicious activity in relation to VAs.
• Financial institutions should expressly adopt written policies and procedures to comply with the wire transfer rule for VA. As the highest priority, CySEC should ensure that FIs already engaging in VASP-type activities do so.
• Authorities should start to maintain and share data and metrics specific to VA/VASPs.
• Training and significant capacity building should be made available with respect to VA/VASP ML/TF risks, as well as technological and market evolution in VA/VASP sector.
• Supervisory authorities, Law enforcement and the FIU should receive in depth training of these issues and enhance their capacity accordingly.
• Cyprus should leverage its collaboration with other jurisdictions that have had additional and complementary experiences with the VA/VASP sector, drawing from these relationships to identify lessons and best practices.
• Cyprus should regularly review whether its VASP registration framework is proportionate to VA/VASP ML/TF risks, or whether a licensing scheme should be considered. Cyprus should also consider whether to establish criminal liability by statute for failure to register as a VASP.
• CySEC should monitor issues with respect to the evolving and novel structures and legal arrangements that VA/VASP entities are likely to operate under due to their decentralized nature, outside of legal persons, (eg “DeFi” and stablecoin arrangements).

This assessment is designed to meet FATF requirements with respect to the ML/TF/ Proliferation Financing (PF) risks for this emerging asset class and technology, which is of importance as Cyprus has recently enacted a legal and regulatory framework for the VA/VASP sector.

The press release can be found here.

The NRA report can be found here.