The Cyprus Securities and Exchange Commission (CySEC) issued
a circular on July 9, 2025, updating the requirements for verifying customer
identities under the country’s anti-money laundering law. The circular applies
to all entities regulated by CySEC, including investment firms that offer
Contracts for Difference (CFDs).

CySEC Updates Rules on Client Verification

The updated rules affect how firms onboard new clients,
especially when accepting early deposits. The new guidance replaces a previous
version issued under Circular C367.

Firms are generally required to verify the identity of
clients and beneficial owners before starting a business relationship or
allowing any transactions. This includes collecting proof of ownership for
corporate clients.

However, the law allows firms to begin a relationship before
completing full verification if certain conditions are met. CySEC has now set
out stricter requirements for using this exception.

Funds Returned If Verification Not Completed

Under the new rules, total deposits from a customer cannot
exceed €2,000 before full verification is complete. Funds must come from a bank
account in the customer’s own name. Firms must complete verification within 15
days of first contact or the initial deposit. If they do not, they must end the
relationship and return all funds and any profits, after deducting losses.

Funds cannot be frozen unless the firm files a report with
the Money Laundering Reporting Authority. Customers must be informed in
advance if the firm intends to apply this exception, and their consent must be
obtained.

Firms are required to update their anti-money laundering
procedures to reflect the new rules. Importantly, no funds can be accepted
without at least initial identification and an economic profile of the client.

You may find it interesting at FinanceMagnates.com: CFDs
Brokers Are to Adjust as CySEC Moves Away from Excel Reporting.

ASPs Excluded from Verification Exception

Administrative Service Providers (ASPs) are excluded from
using the exception due to their higher risk profile. They must verify
identities before beginning any business relationship, unless they provide
written justification explaining why early verification would disrupt
operations and why the risk remains low.

CySEC has urged firms to prioritize full verification before
starting any business activity. It also warned against frequent or unnecessary
use of the exception.

While the circular applies broadly, the updated measures are
likely to influence how CFD providers handle small deposits and monitor
early-stage risks when onboarding clients.