Cyprus has enacted a new sanctions framework that criminalises the violation or circumvention of EU restrictive measures. The Criminalisation of Violation of Union Restrictive Measures Law 2025 [Law 149(I)/2025] aligns Cyprus with Directive (EU) 2024/1226 and introduces clear offences, extraterritorial reach, and a tiered penalties regime for both individuals and companies. It replaces the prior approach and signals closer coordination with EU bodies and national authorities.
Key features of the new regime
1. Clear offence definitions
The law specifies prohibited conduct such as making funds or economic resources available to designated persons, failing to freeze assets, facilitating entry or transit, engaging in banned trade or financial dealings, and any scheme aimed at circumvention, including concealing ownership or providing false information. Certain export-control breaches involving dual-use items may be criminal even where committed with gross negligence.
2. Humanitarian activities preserved
Humanitarian assistance and activities supporting basic human needs, carried out in line with humanitarian principles, are not criminalised.
3. Jurisdiction and reach
Cyprus asserts jurisdiction over offences with a Cyprus nexus, including acts in Cyprus, acts abroad by Cypriot nationals or Cyprus-registered entities, conduct on Cyprus-flagged ships or aircraft, and other scenarios set out in the statute.
Penalties at a glance
Natural persons
Depending on the conduct and value involved, individuals face imprisonment of up to five years and fines that scale with the value thresholds set by the law. Courts may additionally impose measures such as licence revocation or temporary prohibitions on certain activities.
Legal entities
Companies face percentage-of-turnover fines—up to five percent of the worldwide annual turnover—or fixed-sum caps, including up to forty million euros where turnover cannot be determined or for specified offences. Ancillary measures can include exclusion from public funding or tenders, temporary or permanent business-activity bans, revocation of licences and, in extreme cases, court-ordered liquidation.
What has changed and why it matters
The law brings Cyprus fully in line with EU minimum standards, moving from a more general sanctions offence landscape to a detailed list of criminalised behaviours and calibrated penalties. It sits alongside the establishment of the National Sanctions Implementation Unit (ΕΜΕΚ) under separate legislation, with CySEC and other national authorities playing defined roles in supervision and administrative enforcement.
Lessons for businesses and professionals
Evidence and governance
The framework demands robust documentary controls over ownership, funds flows and beneficial ownership. Inadequate records or reliance on informal assurances will not suffice where the law requires freezing, reporting or refusal to deal. Independent verification and auditable screening are key.
Counterparty diligence
Due diligence should extend beyond list checks to capture ownership and control (direct and indirect), circumvention indicators, and sector-specific exposures such as dual-use items and export routing. Where licensing applies, conditions must be tracked and observed; breach of conditions is itself an offence.
Incident response
Firms should have a freeze-and-report protocol, a clear internal investigation playbook, and rapid escalation paths for licensing or exemptions where humanitarian considerations arise. The new penalties and ancillary measures significantly increase regulatory risk if action is delayed.
Protecting your organisation in practice
• Screening and escalations: implement risk-based onboarding and ongoing screening of clients, UBOs, vessels, cargo, payment chains and relevant intermediaries, with value-threshold-triggered escalation aligned to the law’s penalty bands.
• Ownership transparency: maintain current UBO files, control diagrams and source-of-funds evidence; challenge unexplained intermediaries or opaque holding structures.
• Trade controls: map products and services against dual-use and military controls and ensure contracting, logistics and transit routes are compliant.
• Licences and exemptions: maintain a central register of licences, conditions and expiries; train teams on humanitarian carve-outs and when to seek guidance.
• Board oversight: ensure board minutes reflect sanctions risk assessments, resource allocation to compliance, and periodic audits; document remedial actions and testing.
• Coordination with authorities: be prepared for cooperation requests and align with guidance from ΕΜΕΚ and sector regulators such as CySEC as their frameworks and circulars develop.
Final note
The new framework demands heightened vigilance from all businesses and professionals operating in or through Cyprus. Even unintentional dealings with sanctioned persons or entities can result in serious consequences. Every transaction, partnership or financial movement should therefore be reviewed through a sanctions-compliance lens. Companies and individuals are strongly advised to seek legal guidance before engaging in any activity that could fall within the scope of EU restrictive measures, to ensure full compliance and avoid exposure to criminal liability under the new law.