AMLR LEI Checks in Cyprus: What Companies Need to Know

The AMLR LEI rule will change customer identification checks in Cyprus from 10 July 2027: banks and other obliged entities will obtain a legal entity customer’s Legal Entity Identifier (LEI) where available. It does not require a company without an LEI to obtain one. AMLA has submitted supporting customer due diligence standards, but they remain a non-binding draft as of 17 October 2026.

What this means in Cyprus

The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 (AMLR), will apply directly in Cyprus from 10 July 2027. Its Article 22 identification list for legal entities includes the tax identification number and the LEI where available. Direct application means the AMLR’s rules do not need national transposition.

Cyprus also has Law 188(I)/2007 on the prevention and suppression of money laundering and terrorist financing. The Central Bank of Cyprus supervises AML/CFT compliance of the credit and financial institutions under its supervision. These are distinct points: Cyprus has a national AML law and supervisor, while the AMLR identification list will apply directly from its EU application date.

Consider a private limited company (Ltd) opening a business account with a bank in Cyprus. When the AMLR applies, the bank, as an obliged entity, will collect the company’s LEI if one is available; Article 22 does not tell a company without one to register for it. The same distinction matters when a Ltd is reviewed in its bank’s periodic KYC update: an existing LEI can be provided, but the AMLR wording does not turn an unavailable LEI into a registration duty.

Beneficial owners of Cypriot companies are registered with the Department of Registrar of Companies and Intellectual Property. That registration is a separate matter from whether a company has an LEI to provide during customer checks. If the requirements for a particular entity or account are unclear, check with the relevant regulator or an adviser.

Key points for AMLR LEI checks

• The AMLR was published in the Official Journal on 19 June 2024. It is binding in its entirety, but most obliged entities will apply its customer-identification rules from 10 July 2027.
• Under Article 22, an obliged entity will obtain a legal entity customer’s LEI where available. The text does not require the customer to obtain one.
• AMLA’s final report on draft customer due diligence standards is dated 30 September 2026. AMLA announced their submission to the European Commission on 1 October 2026; they are not yet binding.
• A Cyprus company that already has an LEI can keep its code ready for a bank or other obliged entity’s customer-information request.

Which customer details will Article 22 cover?

Article 22 lists information obliged entities will obtain to identify customers. Article 2(1), point (27), defines a Legal Entity Identifier as a unique alphanumeric reference code based on the ISO 17442 standard and assigned to a legal entity. For a legal entity customer, Article 22(1), point (b), covers its legal form and name, registered or official office address, any different principal place of business, country of creation and names of its legal representatives.

The same provision includes the registration number, tax identification number and LEI where available. It also covers the names of nominee shareholders and directors and their nominee status. The qualification where available is why a request for an existing LEI should not be confused with a requirement under Article 22 to acquire one.

Other customer types also appear in Article 22. For trustees of express trusts or similar arrangements, point (c) includes the tax identification number and LEI where available; for other organisations with legal capacity under national law, point (d) includes the LEI where applicable. The appropriate category depends on the customer’s circumstances.

Article 3 includes credit institutions and financial institutions among obliged entities, alongside auditors, external accountants, tax advisers, trust or company service providers and estate agents. Notaries, lawyers and other independent legal professionals are included for certain transactions. LEI questions may therefore arise outside the opening of a bank account.

What is in AMLA’s draft standards?

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) final report on draft regulatory technical standards under AMLR Article 28(1) is dated 30 September 2026. AMLA’s 1 October 2026 press release says the final draft was submitted to the European Commission. Submission is not adoption: the standards remain subject to review and possible amendment and are not yet binding.

Draft Article 18 addresses low-risk situations. Its minimum information for a legal entity includes legal form, legal name, any different trade name and the registered or official office address, as well as a registration number or tax identification number, or the LEI, where available. Draft Annex I also includes the LEI where available in its mapping of legal-entity data points to attributes for electronic identification means and qualified trust services.

For business relationships already in place before the standards enter into force, draft Article 28 proposes bringing customer documents, data and information into line on a risk-sensitive basis within the periods in AMLR Article 26(2). Under that AMLR provision, the interval between customer-information updates must not exceed one year for higher-risk customers and five years for all other customers. AMLA proposes that the standards apply six months after entry into force, once adopted and published in the Official Journal; this is a proposal, not an application date for binding standards.

How payment-message LEI rules differ

Customer identification under the AMLR is not the same as information accompanying a transfer of funds. Regulation (EU) 2023/1113, Article 4(1)(d) and 4(2)(c), applies from 30 December 2024. Under its stated conditions, the payer’s payment service provider must ensure a transfer carries the current LEI of the payer and payee, or an available equivalent official identifier if there is no LEI.

That payment-message requirement is conditional on the relevant field existing in the payment message format and the payer providing the identifier to its payment service provider. It should not be read as changing Article 22’s where available wording for customer identification.

What to check before 10 July 2027

1. Find out whether your entity already has an LEI. If it does, keep the code available for customer-identification requests.
2. Check an existing identifier’s details. If they need updating, consider renewing an LEI so the information presented to an obliged entity reflects the company’s current details.
3. Distinguish a request from a duty to register. The AMLR does not require a customer without an LEI to obtain one. A company that wants a standard, verifiable identifier for these checks can consider applying for an LEI.
4. Check case-specific questions. Ask the relevant regulator or an adviser if the treatment of a trust, another organisation or a particular transaction is uncertain.

Timeline for Cyprus companies and obliged entities

Date	Event	Status as of 17 October 2026
30 December 2024	Regulation (EU) 2023/1113 applies to information accompanying transfers of funds.	In force
30 September 2026	AMLA’s final report on draft customer due diligence standards is dated.	Final draft, not binding
1 October 2026	AMLA announces submission of the final draft to the Commission.	Subject to review and possible amendment
10 July 2027	The AMLR applies directly in Cyprus, including Article 22’s LEI provision.	Future application date
10 July 2029	The AMLR applies to football agents and professional football clubs.	Future application date

LEIs also feature in two related EU rules: a payer’s bank can offer Verification of Payee checks using an LEI as an alternative to checking the payee’s name, while under DORA banks and insurers identify ICT suppliers in their register of information using a valid LEI or EUID, as explained in our guide to DORA LEI requirements for ICT suppliers.

Check whether your entity has an LEI and keep its code ready if it does. For updates as the draft standards progress, consult our LEI regulation updates for Cyprus.