In a significant development for Cyprus's regulatory framework, July 2025 marked the establishment of a National Sanctions Implementation Unit (NSIU), which will serve as the country's dedicated authority for implementing and monitoring compliance with national, EU and UN sanctions.
The establishment of the NSIU – also known by its Greek acronym EMEK – is part of a broader reform effort aimed at modernising Cyprus's sanctions infrastructure and aligning it with evolving international standards, including EU Directive 2024/1226 on the criminalisation of EU sanctions violations. The reform is based on the following laws, enacted with effect as of 25 July 2025:
- The Law on the Establishment of the National Sanctions Implementation Unit
- The Law on the Criminalisation of the Violation of EU Restrictive Measures
- An amendment to the Law on the Protection of Persons Reporting Violations of EU and National Law
Together, these laws introduce a comprehensive regime which consolidates previously fragmented licensing and enforcement mechanisms and strengthens both administrative and criminal tools available to authorities.
What the NSIU Will Do
Operating under the Ministry of Finance, the NSIU has been given broad powers to coordinate sanctions enforcement across public bodies and to provide direction to the private sector. Its key functions include:
- Investigating suspected violations of national, EU and UN sanctions and imposing administrative fines (up to €100,000 plus €100 per day for ongoing non-compliance)
- Reviewing applications and issuing sanctions-related licences and exemptions
- Issuing binding directives, circulars and guidance
- Collecting information – including through formal information requests, reporting channels and national beneficial ownership registers – and exchanging information with local and foreign authorities
- Coordinating enforcement efforts across local regulatory and law enforcement authorities
The NSIU is expected to become fully operational by the end of 2025. It will work closely with international partners, including the UK and the US, which have already offered technical support and training to help improve cross-border enforcement.
New Reporting And Disclosure Obligations
The new framework introduces standalone reporting obligations to the NSIU, which apply to all natural and legal persons independently of any existing reporting obligations towards other regulatory or competent authorities under applicable AML legislation. Individuals and entities who become aware of funds or economic resources within EU territory which are owned by, are under the possession of or are controlled by sanctioned persons – and which should have been frozen but were not, or which were transferred or used within the two weeks preceding the relevant designation – must report this to the NSIU within two weeks of becoming so aware.
Designated persons themselves must, within six weeks of being listed on EU sanctions, declare to the NSIU all funds and assets which they own, hold, or control within Cyprus.
The NSIU may also directly issue formal requests for information to any person it considers to be in a position to provide relevant data.
Failure to comply with these reporting and disclosure obligations may give rise to administrative sanctions imposed by the NSIU and potential criminal liability.
It is important to note that information covered by legal privilege is exempted from relevant reporting and disclosure obligations.
National Sanctions
For the first time, a dedicated legal framework allows for the imposition of national sanctions by the Republic of Cyprus. These may include financial restrictions, travel bans, and controls on movement of goods.
A person or entity may be designated under national sanctions by decision of the Council of Ministers, following a recommendation of the Minister of Foreign Affairs, if found to:
- Threaten or breach international peace and security
- Violate human rights within Cyprus
- Endanger national security, public order, or the interests of Cyprus
- Be involved in terrorism or proliferation of weapons of mass destruction
- Undermine the sovereignty, sovereign rights, or territorial integrity of Cyprus
- Threaten Cyprus's rights over its natural resources, including underground water and cultural heritage
This new capability enhances Cyprus's flexibility to act autonomously in response to emerging threats, while complementing existing EU and UN sanctions frameworks.
Higher Stakes for EU Sanctions Violations
A key component of the reform is the transposition of EU Directive 2024/1226, which harmonises criminal offences and penalties for violations of EU sanctions across Member States. In Cyprus, this marks a significant escalation of penalties for non-compliance, compared to the previous legal framework, as intentional violations of EU sanctions may now attract:
- Fines of up to 5% of total global turnover or up to €40 million
- Prison sentences of up to 5 years
- Additional punitive measures, such as revocation of operating licences, exclusion from public positions, funding or tenders, suspension of business activities or even liquidation.
What This Means for Businesses
The new legal framework and the expected establishment of the NSIU will impact how businesses manage sanctions risk and regulatory obligations. Key implications include:
- Centralised oversight: A single authority will now oversee sanctions matters, reducing fragmentation, increasing efficiency and enhancing clarity.
- More efficient licensing: A streamlined process for applying for licences and exemptions has been put in place, including administrative appeal rights.
- Clearer obligations: Businesses must take proactive steps to comply with any reporting and disclosure obligations within statutory timeframes.
- Exposure to penalties: Administrative fines and potential criminal prosecution form part of the enforcement toolkit.
- Procedural updates: The NSIU is authorised to accept documents in English, easing procedural hurdles for international clients.
Looking Ahead
This reform signals a fundamental shift in Cyprus's sanctions regime. While further guidance is expected in the coming months, including through secondary legislation and procedural clarifications, businesses operating in regulated sectors or otherwise dealing with high-risk jurisdictions, counterparties, or structures should ensure their internal systems and processes are updated to reflect and adequately address requirements under the new legal framework, with a view to minimising exposure and ensuring operational readiness.
Our team is available to assist with evaluating exposure under the new framework, submitting applications to the NSIU, and developing tailored compliance strategies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
