The Central Bank of Cyprus (“CBC”) imposed a €750,000 administrative fine on Banque SBA Cyprus following findings from a supervisory examination carried out in 2023. The decision was taken on 29 September 2026 and announced on 30 September 2026.
The decision is a reminder that AML/CFT compliance is judged not only by the existence of policies, but by whether an organization can show that its controls operated effectively in practice during the relevant review period.
According to the CBC, the fine concerns Banque SBA Cyprus’s failure to comply with certain provisions of the Prevention and Suppression of Money Laundering Activities Law of 2007, as amended, and the CBC Directive to Credit Institutions for the Prevention of Money Laundering and Terrorist Financing, as amended. At the same time, the published notice does not identify the specific provisions breached or the exact nature of the control failures.
That distinction matters. The public material presently supports the conclusion that this was an AML/CFT compliance enforcement action, but it does not support any claim that Banque SBA Cyprus facilitated money laundering or that the failures related to any particular control area such as customer due diligence, beneficial ownership verification, transaction monitoring or suspicious activity reporting.
Who is Banque SBA Cyprus?
Banque SBA was founded in France in 1978 and is headquartered in Paris. Public information from the bank and related group entities describes its core activity as international trade finance, particularly involving the Middle East and Africa, while also referring to corporate banking and wealth management services.
In Cyprus, Banque SBA operates from Limassol. The CBC classifies it as a branch of a foreign EU credit institution operating in Cyprus, rather than as a separately incorporated Cypriot bank.
What the CBC Has Said
The CBC’s published sanctions page records the fine, the decision date, the announcement date and the legal framework under which the sanction was imposed. The same public record states that the sanction followed findings from an examination conducted in 2023.
The CBC has also made clear that enforcement decisions of this kind are taken within the framework of administrative law and that the affected supervised person is given an opportunity to be heard before a final decision is taken. Therefore, it is currently unknown how Banque SBA Cyprus will welcome the fine decision, as the period for seeking judicial review as per relevant Administrative Law has not yet elapsed.
Equally important is the fact that the public documents do not disclose the number of affected files or relationships, the period during which the deficiencies arose, whether the failings were isolated or systemic, or what remedial steps the CBC may have required.
Why This Matters for Regulated Businesses
The main lesson is not limited to banks. The decision is a reminder that AML/CFT compliance is judged not only by the existence of policies, but by whether an organization can show that its controls operated effectively in practice during the relevant review period.
This is especially relevant in Cyprus, where supervisory expectations are shaped by a risk-based framework that includes off-site monitoring and on-site inspections. A business may believe it is compliant because it has an AML manual, onboarding forms and internal policies, but those documents alone are not enough if the underlying controls are incomplete, outdated, inconsistently applied or poorly evidenced.
In practical terms, firms should be able to demonstrate that they:
- Maintain a current business-wide risk assessment.
- Apply risk-based customer due diligence and enhanced due diligence where required.
- Verify beneficial ownership and understand control structures.
- Assess source of funds and source of wealth where the risk profile requires it.
- Carry out ongoing monitoring and periodic reviews.
- Escalate unusual activity through a documented internal process.
- Keep training, governance and oversight records.
- Test and remediate weaknesses before they become supervisory findings.
A Timely Warning for Cyprus-Based and Cyprus-Bound Businesses
Cyprus has strengthened its AML/CFT legal and supervisory framework in recent years. Even so, the jurisdiction remains exposed to material cross-border risk: the Cyprus National Risk Assessment describes the banking sector’s money-laundering threat as high, vulnerability as medium and overall money-laundering risk as medium-high, with international illicit activity presenting a greater threat than domestic crime because of the sector’s cross-border exposure.
For that reason, businesses established in Cyprus, or expanding into Cyprus, should not treat AML compliance as a box-ticking exercise. The relevant question is whether the organization can evidence how it assessed risk, onboarded clients, reviewed ownership and control, monitored activity and documented decisions in a way that can withstand supervisory scrutiny.
That point applies with particular force to businesses operating in regulated or higher-risk environments, including financial services, payments, fintech, corporate and fiduciary services, and other activities with cross-border exposure.
What Businesses Should Do Now
The Banque SBA Cyprus decision is a useful prompt for firms to review whether their AML framework is merely documented or genuinely operational.
A focused internal review should typically consider:
- Whether the business-wide risk assessment is current and tailored to the actual customer and geographic profile.
- Whether KYC files contain complete and reliable evidence.
- Whether beneficial ownership analysis is consistent and defensible.
- Whether periodic reviews are up to date.
- Whether monitoring and escalation procedures are being followed in practice.
- Whether management receives meaningful AML reporting.
- Whether gaps identified in past reviews have been properly closed.
Many businesses have written procedures but limited internal capacity to maintain ongoing reviews, update files, assess higher-risk clients or test the effectiveness of their controls over time. In those cases, outsourced or supplementary AML support can help strengthen governance, improve documentation standards and identify weaknesses before they become enforcement issues.
M. Paraschou & Co LLC supports businesses with AML framework reviews, KYC and client-file remediation, risk assessments, beneficial ownership analysis, ongoing monitoring procedures, AMLCO support and outsourced compliance assistance. Businesses that have not reviewed their framework recently may wish to assess whether their controls are capable of standing up to supervisory review.
Stelios Hadjithomas
LLB, MA, LLM European Public Law
Associate Advocate | AML Compliance Supervisor
M. Paraschou Law
This article is intended for general information only and does not constitute legal advice. It is based on information publicly available as at 15 October 2026.
Read our Additional Articles Here: