CySEC Inspection Day: The 8 Documents You Need for Your Sanctions Screening Audit

What actually happens during a CySEC sanctions screening inspection?

CySEC conducted thematic inspections of the sanctions screening systems used by a sample of regulated entities between April and November 2024. All types of regulated entities were represented, including CASPs. The findings, published in Circular C685 on 27 February 2025, were direct: deficient system tuning, manual screening reliance, alert fatigue from excessive false positives, and irregular testing. These are not abstract regulatory concerns. They are the specific things CySEC tested and chose to publish as inspection benchmarks.

What the circular does not spell out — but what every compliance officer who has been through an inspection will tell you — is that CySEC does not just ask whether you have a screening system. They ask you to prove it worked, document how you handled what it found, and show that your team knows what they are doing. That proof lives in documents.

Below are the eight categories of documentation that a CySEC sanctions screening audit will touch. The first three can be generated automatically if your screening tool is built for compliance. The remaining five require deliberate effort from your compliance officer, regardless of which tool you use.

What are the 8 documents CySEC inspectors ask for?

1. DOC 01
   Screening logs: one record per transaction
   Every transaction your CASP processes must have a corresponding screening record. That record needs to show: the name or address screened, which lists were checked, the timestamp, and the result (clean, flagged, or matched). Inspectors will pull a sample of transactions and verify that a screening record exists for each one. If your system does not log individual transaction checks automatically, you have a fundamental gap.
   Required evidence
2. DOC 02
   Sanctions list version log
   When was your EU Consolidated List last updated? Which UN Sanctions and EU Restrictive Measures data were active at 14:32 on 7 January 2026? If your programme also applies relevant U.S. or UK sanctions-list practices, which versions were used? CySEC expects you to be able to answer those questions. Every screening check must reference the specific list version that was current at that moment. Without version tracking, a clean screening result is legally undefendable — you cannot prove the list was current when you ran the check. This is one of the most commonly missing documents in small CASP audits.
   Required evidence
3. DOC 03
   Match resolution records
   For every alert your system generates, there must be a written record of what happened next. Was it a true match, a potential match, or a false positive? Who reviewed it? What was their conclusion and on what basis? High-risk matches require four-eyes review — two independent reviewers must sign off. If you cleared 200 alerts last month and have no resolution records, CySEC will treat that as 200 unresolved matches.
   Required evidence
4. DOC 04
   Escalation policy (written, approved, dated)
   Your escalation policy defines what triggers escalation, who it goes to, how fast, and what authority they have. It must be a signed document — not a Slack message, not "we have a process," not something that lives only in your compliance officer's head. CySEC will ask to see it. It must be dated and approved by senior management. If it has never been reviewed since you wrote it, that is a problem too: a policy last updated in 2022 that does not reference current list requirements will raise questions.
5. DOC 05
   Staff training records with assessment scores
   Training your compliance team is not enough. You need to document that it happened, when it happened, who attended, what was covered, and how they performed in any assessment. A slide deck sent by email is not a training record. A dated attendance log with an assessment result attached is. CySEC inspectors specifically called out the lack of documented training as a deficiency. Every person who touches sanctions screening decisions needs a training record showing they understood what they were doing.
6. DOC 06
   Sanctions risk assessment
   Your business-level sanctions risk assessment documents the specific risks your CASP faces based on your customer types, transaction volumes, geographies, and service mix. It is not a generic template. It should reflect your actual customer base and explain why your screening configuration is calibrated the way it is. Inspectors use this to evaluate whether your screening approach is proportionate to your risk profile. A risk assessment that says "low risk" for a CASP servicing high-risk jurisdictions will get scrutinised heavily.
7. DOC 07
   SAR filing procedure
   When you confirm a sanctions match, your obligation does not end at blocking the transaction. You must report to MOKAS within two weeks. Your SAR filing procedure documents exactly how that report is prepared, who prepares it, who authorises it, and what your internal record of the filing looks like. CySEC will check that your procedure exists and that your actual filings are consistent with it. Circular C781, dated 21 May 2026, points regulated entities to revised MOKAS STR/SAR/AIF reporting guidelines and the MOKAS Annual Report 2025. The 2025 report shows the scale now facing CASPs: 20,570 STRs/SARs were submitted by CASPs in 2025, out of 24,092 total reports to MOKAS. Your procedure must be capable of handling volume without delays.
8. DOC 08
   Audit trail retention evidence (5-year minimum)
   Cyprus AML record-keeping rules set a minimum five-year retention baseline. EBA/GL/2024/15, dated 14 November 2024 and applying from 30 December 2025, adds PSP/CASP expectations for controls that implement Union and national restrictive measures when performing transfers of funds and crypto-assets, including documenting decisions taken on alerts under the firm's general record-keeping policy. You must be able to demonstrate — not just assert — that your records are retained for the required period and are retrievable. During an inspection, you may be asked to pull a complete screening history for a specific customer or wallet address. If your records are in spreadsheets, email threads, or a system with no export function, you have a retention problem.

What does a CySEC inspection actually look like?

CySEC thematic inspections are not surprise audits in the traditional sense. You will receive advance notice. But advance notice does not mean time to prepare documentation that should have existed already — inspectors know the difference between a compliance programme that has been running and documentation that was created the week before they arrived.

During the 2024 round, inspectors tested systems directly. They submitted misspelled versions of sanctioned names to verify fuzzy matching capability. They checked whether systems would catch deliberate evasion attempts, not just exact hits. Your documentation needs to demonstrate this capability too — your calibration records (Document 06, your risk assessment, your system configuration) should show that you have tuned your matching thresholds and tested them against known cases.

The four things CySEC checks most often

Based on Circular C685 findings, four areas receive the most scrutiny:

• Screening logs per transaction — does a record exist for every processed transaction?
• List version at time of screening — can you prove the list was current when you ran the check?
• Match resolution documentation — what happened to every alert your system generated?
• Staff training evidence — do the people making compliance decisions have documented qualifications to do so?

Most small CASPs, when pressed, can produce evidence for one of these four. That is the gap this document is designed to close.

What is the 5-year retention requirement and what does it mean in practice?

Five years of records is not a theoretical requirement. If a sanctioned party transacted through your platform in 2022 and an investigation opens in 2026, you will be required to produce the screening record from that transaction. "We did not keep records that far back" is not a defence. It is evidence of a compliance failure.

Practically, this means:

• Your screening tool must have persistent storage, not rolling logs that overwrite after 90 days
• You need a documented data retention policy that references the 5-year requirement explicitly
• Records must be exportable — stored in a format that can be produced on demand to a regulator
• Backups must be tested: a retention policy that exists only on paper, backed by a database nobody has tested restoring, is a liability