Crypto AML compliance audits in Cyprus

It is an independent review of the anti-money-laundering controls you actually operate, tested against the obligations that apply to you. We look at customer due diligence and onboarding, ongoing monitoring, transaction monitoring rules, sanctions and PEP screening, blockchain analytics screening of wallet exposure, Travel Rule handling, suspicious transaction reporting, record-keeping, training, and the compliance officer function. The output is a written report with findings ranked by severity and a remediation plan you can work through.

Crypto-asset service providers supervised by CySEC, firms preparing an authorisation application, and any obliged entity whose AML framework has to withstand supervisory review. It is also common for firms whose banking partner, payment processor, or acquirer asks for independent assurance before opening or keeping an account. Cyprus AML law, implementing the EU directives, requires obliged entities to maintain an independent audit function to test their AML policies and controls where that is appropriate to the size and nature of the business — and for smaller firms, outsourcing that review is usually the practical route. Whether it applies to you specifically is a question for your own counsel.

No. We are not a regulator and we cannot bind one. An audit is an independent opinion on the controls we tested, on the evidence we saw, at the time we saw it. CySEC, MOKAS, and any other authority reach their own conclusions and may weigh things differently. What an audit gives you is a documented, independent view of where you stand and what to fix, which is materially better than discovering both during an inspection.

MiCA brought crypto-asset service providers into a harmonised authorisation regime, so the AML framework is now assessed as part of a supervised firm rather than a voluntary standard. Separately, the EU AML package introduces a directly applicable AML Regulation and the new EU authority AMLA, which narrows national discretion and raises expectations on risk assessment, beneficial ownership, and group-wide policies. The Transfer of Funds Regulation applies the Travel Rule to crypto transfers with no de minimis threshold. In practice this means we test against a rulebook that is converging across the EU rather than a purely Cypriot one.

We check whether originator and beneficiary information is collected, transmitted, and received in the required form on every in-scope transfer, not just the ones your provider happens to cover. That includes how you handle counterparties who do not respond, transfers to and from self-hosted wallets, the due diligence you perform on other providers before exchanging data, and what happens to a transfer when required information is missing. Most gaps we find are in the exception handling rather than the happy path.

We test them and tell you what we find. That means reviewing whether the rule set reflects your actual customer base and product risk, sampling alerts to check the thresholds are producing meaningful output rather than noise, and looking at how alerts are dispositioned and escalated. A monitoring system generating thousands of alerts nobody closes is a finding, not a control. We recommend changes; implementing and validating them is work your team or your vendor performs.

Screening addresses and counterparties against risk data is now an expected control, and it is one we can test on the chain itself rather than only on paper. We review which provider you use, how risk scores feed into your decisions, what thresholds trigger escalation, and whether exposure is reassessed over time. We also independently sample wallets and flows to see whether the exposure your tooling reports matches what the chain shows.

We tell you plainly, in writing, with the evidence. Findings are ranked so you can sequence the work, and we distinguish between a control that is missing, one that exists but is not operating, and one that is operating but is not documented. We do not report to your regulator on your behalf, and we do not make suspicious transaction reports for you. Deciding what to report to MOKAS and when remains your obligation, and remediation is yours to execute.

For a mid-sized firm, typically a few weeks from scoping to report, depending on how quickly policies, system exports, and case files reach us. Annual is the usual cadence, with a follow-up review after remediation if the first round found material gaps. A review also makes sense ahead of an authorisation application, after a change of business model or major new product, or when onboarding volume grows faster than the compliance function did.