CySEC CASP Compliance Checklist: Sanctions Screening Requirements in 2026

What does the CySEC CASP landscape look like?

As of 17 August 2026, the Cyprus Securities and Exchange Commission (CySEC) no longer publishes one simple CASP list. The official pages split crypto entities into the national-regime CASP Register, MiCAR Authorised CASPs under Article 63, Article 60 notifications by certain financial entities, and MiCAR member-state entities. The visible national-regime register lists 9 entries, while the Article 63 authorised CASP page lists 14 entries.

Do not add these categories together as if they were one register: some names can appear on more than one CySEC page, and each page answers a different regulatory question. Circular C685 should still be treated as current supervisory context for CASPs because its sanctions-screening expectations apply across regulated entities.

What did CySEC find during thematic inspections (Circular C685)?

On 27 February 2025, CySEC published Circular C685 and a guidance paper following thematic inspections conducted between April and November 2024. The inspections assessed a sample of regulated entities across entity types, including CASPs; they were not a register-wide CASP inspection.

What they tested

CySEC tested both exact match detection and fuzzy matching capabilities. Inspectors submitted manipulated and misspelled names to evaluate whether screening systems could catch deliberate evasion attempts — not just direct hits.

Deficiencies identified

• Poor system tuning — screening systems were not calibrated to detect variations in sanctioned names
• Over-reliance on manual screening — staff performing lookups by hand instead of using automated systems
• Excessive false positives — systems flagging too many legitimate transactions, leading to alert fatigue and missed real matches
• Irregular testing — companies not routinely testing their screening systems to verify they work as expected

Best practices CySEC expects

• Automated screening systems — not manual lookups
• Real-time, ongoing screening — not periodic batch runs
• Regular calibration — tuning fuzzy matching thresholds and testing with known names
• Dedicated compliance teams — not a shared responsibility dumped on operations staff
• Senior management oversight — board-level awareness and reporting on sanctions screening effectiveness

Sanctions lists to screen against

CySEC's official wording distinguishes legal requirements from relevant wider practices:

• UN Sanctions and EU Restrictive Measures — the legal requirements C685 focused on for screening designated persons
• Relevant U.S. and UK sanctions practices — C685 discusses these as relevant screening practices, especially where business exposure makes them important
• Union and national restrictive measures — the wording used by EBA GL/2024/15 for PSP and CASP controls when performing transfers of funds or crypto-assets

What are CySEC’s organizational requirements beyond the EU baseline?

Cyprus imposes requirements on CASPs that go beyond what MiCA mandates at the EU level. If you are establishing or maintaining a CASP in Cyprus, these are non-negotiable:

• Minimum 4 directors — at least 2 executive and 2 independent non-executive directors
• Majority Cyprus-based — the majority of the board must be based and resident in Cyprus
• Dedicated Compliance Officer — must be Cyprus-resident, cannot be shared with another entity
• Dedicated MLRO (Money Laundering Reporting Officer) — also Cyprus-resident
• Physical office — virtual offices are not accepted; CySEC requires a staffed physical presence
• Capital requirements — EUR 50,000 to EUR 150,000 depending on the class of services provided

These requirements mean that compliance is not just a technology problem. You need people on the ground in Cyprus, with the authority and budget to implement proper sanctions screening.

What are the critical MiCA transition deadlines?

The Markets in Crypto-Assets Regulation (MiCA) is now the governing framework for CASPs across the EU. For Cyprus-registered CASPs that were operating under the national transitional regime, the transition has ended.

• 27 February 2026 Passed CySEC's deadline for Cyprus CASPs operating under national rules to submit a MiCA authorisation application. After the transition, the application deadline is no longer the live issue; authorisation status is.
• 1 July 2026 Ended End of the transitional period. CySEC Circular C790, dated 7 July 2026, states that firms must obtain MiCAR-compliant CASP authorisation to continue providing crypto-asset services within the European Union.

What does non-compliance cost under the penalty framework?

Since 1 August 2025, Cyprus has a comprehensive penalty framework for AML/sanctions violations by CASPs. The penalties are severe and designed to be dissuasive:

For individuals

• Up to 5 years imprisonment
• Fines up to EUR 100,000

For legal entities

• Fines up to 5% of annual global turnover or EUR 40 million, whichever is greater
• Asset freezes and confiscations

Dual enforcement

Both NSIU (National Sanctions Implementation Unit) and CySEC have enforcement authority. This means a single compliance failure can trigger parallel investigations and penalties from two separate bodies.

Why are CASPs the #2 MOKAS reporting sector?

MOKAS (the Cyprus Financial Intelligence Unit) reported that CASPs submitted 760 Suspicious Activity Reports (SARs) in 2024, representing 19.64% of all SARs filed. This makes CASPs the second-largest reporting sector in Cyprus — a significant compliance burden for a small, fast-changing market.

When designated assets are discovered, CASPs must report to MOKAS within 2 weeks. Delays in reporting can themselves constitute a compliance violation.

What is the 10-point sanctions screening compliance checklist?

This checklist is derived directly from CySEC Circular C685 findings, EBA Guidelines on Restrictive Measures, and Cyprus AML/CFT law requirements. Use it as a working document for your next internal audit or board compliance review.

1. 01
   Automated screening system deployed
   CySEC explicitly flagged manual screening reliance as a deficiency. Your system must be automated, not dependent on staff performing manual lookups against downloaded lists. Verify: can you screen an address or name without human intervention?
2. 02
   UN/EU legal requirements plus relevant U.S./UK practices
   CySEC C685 focuses on UN Sanctions and EU Restrictive Measures, and also refers to relevant U.S. and UK sanctions screening practices. EBA GL/2024/15 uses the frame of Union and national restrictive measures. Verify: does your system cover the lists required by law and policy for your exposure, and can you prove it with timestamped records and list versions in an audit?
3. 03
   Real-time pre-transaction screening
   Screening must happen before a transaction is processed, not after. Post-transaction screening means you have already processed a potentially sanctioned transfer. Verify: is screening a blocking step in your transaction flow?
4. 04
   Fuzzy matching enabled and tested
   CySEC inspectors submitted misspelled and manipulated names during their 2024 inspections. Exact-match-only systems will fail. Verify: test your system with deliberate misspellings of known sanctioned names. Does it catch them?
5. 05
   Regular re-screening on list updates
   Sanctions lists update frequently. Addresses and names that were clean yesterday can be designated today. Verify: when a list updates, do you automatically re-screen your existing customer base and stored addresses?
6. 06
   Documented match handling procedures
   When a potential match is identified, what happens next must be documented. High-risk matches should require four-eyes review (two independent reviewers). Verify: do you have a written procedure for true matches, potential matches, and false positives? Is there a senior sign-off for high-risk cases?
7. 07
   Audit trail with 5-year retention
   Every screening check must be logged with timestamp, list version used, result, and action taken. Cyprus AML law requires 5-year record retention. Verify: can you pull a complete screening history for any customer or address going back 5 years?
8. 08
   Staff training with documented assessment
   Compliance staff must be trained on sanctions screening procedures, list updates, and escalation protocols. Training must be documented and assessed — not just a slide deck sent by email. Verify: do you have dated training records with assessment scores for every relevant team member?
9. 09
   Annual system review and calibration
   CySEC flagged irregular testing as a deficiency. Your screening system must be reviewed and calibrated at least annually. This means testing with known sanctioned names, adjusting fuzzy matching thresholds, and documenting the results. Verify: when was your last calibration? Is it documented?
10. 10
    Senior management oversight and reporting
    Board-level oversight is not optional. Senior management must receive regular reports on screening effectiveness, match rates, false positive rates, and system changes. Verify: does your board receive a quarterly sanctions screening report? Is there a named senior manager responsible for sanctions compliance?

What is the compliance budget reality — EUR 100–250K per year?

Compliance is the largest operational cost for a small CASP after staff salaries. Here is a realistic annual budget breakdown based on Cyprus market rates and vendor pricing as of 2026:

Sanctions screening tools represent 9–13% of total compliance spend. This is where tool selection matters most: enterprise solutions at EUR 30,000+ per year eat into your budget significantly, while purpose-built tools covering the same list requirements can reduce this line item by 60–70%.