Cyprus due diligence for PR 6.2: MOKAS, the Aliens Police and investor vetting criteria

Cyprus due diligence is the comprehensive vetting process carried out by several government bodies of the Republic of Cyprus on every Permanent Residency application under Regulation 6(2) or Category F. Unlike Caribbean CBI programmes, which use independent third-party firms, Cyprus applies an internal vetting mechanism through the Civil Registry and Migration Department (CRMD), MOKAS (the Financial Intelligence Unit), the Aliens Police and the Central Bank of Cyprus. This is the biggest barrier causing applications to be rejected or delayed — especially for investors from countries with high AML risk.

This article analyses in detail the bodies involved in vetting, the assessment criteria under AML Law 188(I)/2007 and the EU 5th/6th AMLD, how to prepare Source of Funds (SOF) and Source of Wealth (SOW) documentation to international standards, PEP and high-risk cases, and the impact of Law 194(I)/2025 — the new foreign investment screening rules in force from 02/04/2026.

The legal framework of Cyprus due diligence

The vetting system for Cyprus PR applications is built on three overlapping legal foundations. Understanding this framework helps investors know exactly what the authorities are entitled to request — and what falls outside the rules.

AML Law 188(I)/2007

This is the backbone law of the entire anti-money laundering system in the Republic of Cyprus; its full name isPrevention and Suppression of Money Laundering and Terrorist Financing Law. The law sets out KYC (Know Your Customer) and CDD (Customer Due Diligence) obligations for all organisations handling financial transactions, including the lawyers and bank staff who assist PR applicants. Cross-checking against the Cyprus background check file creates the core dual verification for every application.

Section 60 of Law 188(I)/2007 requires identity verification and source-of-funds verification for every transaction above €15,000 EUR — the Cyprus PR 6.2 investment threshold (€300,000 EUR) far exceeds this level. Section 63 sets out the levels of CDD: Simplified Due Diligence (low risk), Standard CDD (medium risk) and Enhanced Due Diligence (high risk). Investors from countries with low to medium AML risk usually fall under Standard CDD, while investors from countries on the FATF (Financial Action Task Force) “blacklist” are subject to mandatory EDD.

The EU 5th and 6th AML Directives

As an EU member, Cyprus automatically applies the AML Directives.5AMLD (Directive 2018/843)broadened the definition of Politically Exposed Persons (PEPs) and requires member states to maintain public PEP lists.6AMLD (Directive 2018/1673)criminalised 22 types of offence related to money laundering and raised the minimum sentence to 4 years in prison.

For Cyprus PR investors, these two Directives have a direct impact: mandatory declaration of PEP status, automatic screening against databases such as the EU Consolidated Sanctions List and OFAC (Office of Foreign Assets Control), and verification of ultimate beneficial ownership for complex investment structures.

Law 194(I)/2025: FDI Screening Mechanism

The new law, in force from 02/04/2026, establishes a national mechanism for screening foreign direct investment in line with Regulation (EU) 2019/452. Threshold: non-EU/EEA/Swiss investors holding ≥25% of the share capital or voting rights in a Cypriot company in a strategic sector.

The law mainly affects PR investors underCategory B (investment in shares of a Cypriot company)in sensitive sectors: technology, telecommunications, energy, transport infrastructure and defence. The review process consists of Phase 1 (20 business days) and Phase 2 (a further 65 business days if in-depth scrutiny is needed). Vietnamese investors considering Category B in these sectors should add 3–4 months to the overall timeline for FDI screening.

The bodies involved in Cyprus due diligence

Unlike CBI programmes that hire third-party firms such as IPSA Group or S-RM, the Republic of Cyprus carries out due diligence internally through a network of government bodies working together. Each body has its own role and access to different databases.

Civil Registry and Migration Department (CRMD)

The CRMD is the lead body that receives MIP1 applications and coordinates with other bodies to complete vetting. The CRMD’s Compliance department is responsible for:

• Checking that the application is complete and valid
• Screening applicants’ names against the Schengen Information System II (SIS II)
• Cross-checking against EU deportation lists and entry bans from member states
• Consulting specialist bodies if red flags are found

The CRMD’s standard processing time for the PR 6.2 fast track is 2 months under Regulation 6(2). In practice, however, it ranges from 2 to 6 months depending on the complexity of the Cyprus due diligence.

MOKAS (Cyprus FIU)

MOKAS — an abbreviation from Greek — is the Financial Intelligence Unit of the Republic of Cyprus, under the Attorney General’s Office. The unit consists of government lawyers, police officers and customs officers and has broad access to financial transaction data.

The role of MOKAS in Cyprus PR due diligence:

• Receiving and analysing Suspicious Transaction Reports (STRs) and Suspicious Activity Reports (SARs) from banks and lawyers
• Exchanging information with other countries’ FIUs through the Egmont Group network
• Issuing orders to freeze accounts and suspend transactions when risks are detected
• Advising the CRMD on applicants linked to money laundering or terrorist financing

According to the MOKAS report for 2022, the unit received 526 SARs and more than 1,900 STRs that year. For Cyprus PR applications, MOKAS does not take part in every case but only handles those the CRMD refers with signs of suspicion.

The Aliens Police and the Cyprus Police

The Cyprus Police is responsible for screening applicants’ criminal records through national and international databases. The Aliens Police — a specialised unit dealing with foreigners — conducts interviews where necessary and checks actual residential addresses in Cyprus after PR is granted.

The Cyprus Police has access to:

• INTERPOL Notices Database (Red Notice, Blue Notice, Yellow Notice)
• Europol Information System
• Schengen Information System II (SIS II)
• EU countries’ criminal record databases through ECRIS (European Criminal Records Information System)

The Central Bank of Cyprus and banking compliance

Although it does not take part directly in PR approval, the Central Bank of Cyprus (CBC) sets the AML standards for Cypriot banks processing applicants’ investment transfers. Bank of Cyprus, Hellenic Bank, RCB Bank and others must apply strict KYC when receiving money from abroad for buying property or investing in shares.

In practice, Cypriot banks are the system’s “first-line defender”. If a €200,000 EUR SWIFT transfer from Vietnam is flagged as suspicious, the bank may refuse to accept it or hold the funds pending verification — a hidden barrier that many lawyers recommend addressing at the account-opening stage rather than waiting until the investment is transferred.

Source of Funds vs Source of Wealth

The two concepts of Source of Funds (SOF) and Source of Wealth (SOW) are often confused by Vietnamese investors — and this is one of the most common mistakes that lead MOKAS to return applications.

Source of Funds (SOF)

Source of Funds refers to the specific origin of the money used for the PR investment. Investors must prove exactly where the €300,000 EUR for buying property or investing in shares came from — which account, which transaction, which date.

Standard documents proving SOF:

• SWIFT confirmation of the transfer from the Vietnamese bank to the Cypriot bank
• Statements of the source account for the last 6–12 months, showing how the money was accumulated
• Asset sale contracts (if the money came from selling a house, land or company shares)
• Dividends received (with personal tax returns)
• Accumulated salary (with copies of the employment contract and payslips)

Source of Wealth (SOW)

Source of Wealth is broader — it refers to how all of the investor’s current assets were accumulated over their entire career. It is the overall financial story, not just the €300,000 EUR for PR.

SOW documentation usually includes:

• A CV/business profile detailing a 10–20 year career
• Dividend history from businesses founded (for entrepreneurs)
• Financial statements of companies owned now or in the past
• Vietnamese personal tax records for the last 5–10 years
• Evidence of other major assets: houses, land, securities, gold

For high-risk profiles (PEPs, business people with government ties, the oil and gas/mining sector), MOKAS may require SOW detailed down to each individual asset.

When SOF is needed and when SOW is needed

In vetting practice:

• Standard CDD: only SOF is needed for the €300,000 EUR investment + €50,000 EUR annual income
• Enhanced Due Diligence (EDD): both SOF and detailed SOW are needed, with written explanations for each part
• PEP screening: besides SOF/SOW, a sworn declaration on political connections and a security record from the home country are needed

Typical middle-class/HNWI Vietnamese investors (business, real estate, securities) usually fall under Standard CDD. EDD applies to applicants with factors such as: PEP status, citizenship of FATF blacklist countries (Iran, North Korea, Myanmar…), or questionable information in adverse media.

PEP cases and Enhanced Due Diligence

Politically Exposed Persons (PEPs) is a concept specific to AML — referring to individuals who hold or have held important public positions. Cyprus applies the broadened definition under 5AMLD, covering both domestic PEPs (Cyprus’s own PEPs) and foreign PEPs.

The PEP definition under 5AMLD

Under 5AMLD, PEPs include the following groups:

• Heads of State and Government, Ministers and Deputy Ministers
• Members of Parliament or equivalent legislative bodies
• Judges of Supreme Courts and Constitutional Courts
• Members of the boards of Central Banks
• Ambassadors, chargés d’affaires and high-ranking military officers
• Board members of state-owned enterprises (SOEs)
• Leaders of political parties

The broadened PEP definition includes immediate family (spouse, parents, children, siblings) andclose associates— business partners, company co-owners or people known to have close relationships.

The EDD process for PEPs

When an applicant is identified as a PEP or a family member/close associate of a PEP, Cyprus due diligence switches to EDD mode:

• Approval is required from the Senior Management of the bank/law firm handling the application
• Detailed SOW verification from before the position was taken up is mandatory
• Ongoing monitoring after PR is granted is increased — annual reviews instead of every 3 years
• A letter of confirmation from the home country’s government on security status is required

PEPs from Vietnam often face difficulties because EU public PEP databases do not fully cover Vietnam. However, MOKAS may require a declaration in the policy form and cross-check through adverse media (press coverage, name search results).

Adverse Media Screening

An important but rarely mentioned vetting step: adverse media screening through databases such as World-Check (Refinitiv), Dow Jones Risk & Compliance and LexisNexis. Applicants’ names are checked against millions of news sources, blogs and investigative reports worldwide.

Vietnamese investors whose names appear in business scandals (even without prosecution), press investigations or even negative social media posts may be flagged. In such cases, applicants should prepare a detailed letter of explanation through their lawyer before applying.

The vetting pathway and realistic timeline

Cyprus due diligence runs in parallel with the CRMD’s processing of the MIP1 application, not afterwards. This is why processing times range from 2 to 6 months depending on complexity.

Stage 1: Pre-submission (1–2 months)

This takes place before the formal application. The applicant’s lawyer carries out:

• Internal due diligence on the applicant through the World-Check and Dow Jones databases
• A preliminary assessment of PEP, sanctions and adverse media risks
• Advice to the applicant on handling any issues found (explanations, additional documents)
• Preparation of an SOF/SOW file to EDD standards

This stage determines the success rate. Investors who skip it often hit red flags at the CRMD and have to fight fires after applying — extending the timeline by 3–4 months.

Stage 2: CRMD initial review (2–4 weeks)

After the MIP1 is submitted, the CRMD checks completeness and carries out basic screening:

• Checking names against SIS II, the EU sanctions list and OFAC
• Verifying that the criminal record certificate has been fully legalised
• Requesting additional documents if anything is missing (average delays of 2–3 weeks per request)

Stage 3: Inter-agency consultation (4–12 weeks)

The CRMD refers the application to specialist bodies where necessary. This is the longest and least predictable stage:

• MOKAS vets SOF/SOW (4–6 weeks for complex applications)
• The Cyprus Police vets criminal records through INTERPOL/Europol (2–4 weeks)
• The Ministry of Finance carries out FDI screening if Law 194(I)/2025 applies (3–4 months for Phase 2)

Stage 4: Decision and biometrics (2–4 weeks)

The CRMD makes the final decision. If approved:

• The applicant is notified by email and post
• Within 12 months, the applicant must enter Cyprus to provide biometrics
• After biometrics, the PR card is issued within 2–4 weeks

The realistic total timeline from preparing the application to receiving the card: 6–12 months for Standard CDD and 9–18 months for EDD.

Strategies for preparing a due-diligence-ready application

For an application to pass Cyprus due diligence smoothly, investors need to prepare from a very early stage — not only once they have decided to buy a property. Cypriot lawyers have distilled some practical strategies.

Building a paper trail in advance

The golden rule: the thicker and older the paper trail, the easier the vetting. Investors planning Cyprus PR in the next 2–3 years should start building their financial records now:

• Open a separate bank account for the money intended for the PR investment
• Transfer money into this account on a regular schedule from clear sources
• Keep all business contracts, dividend statements and personal tax statements
• Avoid large cash transactions without documentation
• Do not borrow from relatives to fund the investment (this creates an unexplainable gap)

MOKASapplies the “follow the money” principle — tracing money back to its origin. An account with a clear 3–5 year transaction history is much easier to vet than an account opened just a few months before applying.

Handling PEP and high-risk profiles

Applicants with PEP factors or connections to PEPs should not try to hide them. Cyprus applies a “self-declaration with verification” principle — honest declarations lead to EDD but still have a chance of approval. False declarations lead to outright rejection and blacklisting from all EU PR/CBI programmes.

The right way to handle it:

• Declare PEP status with your lawyer at the pre-submission stage
• Prepare a letter explaining political connections and career history
• Obtain a letter of confirmation from the competent authority in Vietnam (if possible)
• Provide detailed SOW from before the position was taken up
• Be ready for close ongoing monitoring after PR is granted

Combining with the lawyer’s pre-submission diligence

Most reputable Cypriot lawyers carry out internal due diligence on applicants before accepting the case — known as an Anti-Money Laundering Officer assessment. This step usually costs €500–€1,500 EUR but helps reduce the CRMD rejection rate to 1–2%.

According to the guidance of theEuropean Commission on AMLapplied in Cyprus, AML compliance lawyers are allowed to refuse applications if they detect high risk. This is a good sign — a lawyer turning down a case early helps avoid bigger losses at the CRMD stage.

A clear investment ownership structure

For Category B (investment in company shares), investors should keep the ownership structure simple — direct ownership is better than an offshore holding. The reasons: fewer layers of UBOs to verify, shorter vetting time, and avoiding triggering FDI screening under Law 194(I)/2025 if ownership exceeds 25%.

The optimal structure for Category B:

• Vietnamese individual investor → direct shareholder of the Cypriot company
• Avoid BVI/Cayman holdings unless really necessary
• If a holding is needed, use a Singapore or Cyprus holding (EU jurisdiction)
• Clearly document the role of each party in the structure

Common mistakes in Cyprus due diligence

After reviewing thousands of applications, Cypriot lawyers share the mistakes Vietnamese investors often make when facing Cyprus due diligence.

Not declaring PEP status

Many Vietnamese investors are former state officials, relatives of state-owned enterprise leaders or have business ties with PEPs but think they do not need to declare it because they are “not famous in Vietnam”. MOKAS has access to the Vietnam News Agency, VnExpress, Tuổi Trẻ and international press sources through adverse media databases — discovering concealed information is legal grounds for immediately cancelling the application.

Routing investment money through many layers

Some investors send €300,000 EUR through offshore companies (BVI, Cayman) before transferring it to Cyprus for confidentiality. Cyprus applies a “look-through approach” — requiring verification of the ultimate beneficial owner and not accepting verification only at the final layer. Applications routed through too many layers usually fall into EDD and take longer to process.

Inconsistent SOF documents

A basic mistake is declaring SOF as “personal savings” while the account statements only show money arriving in the last 3–6 months in an unnatural pattern. MOKAS immediately recognises this as a sign of borrowed money or funds received from a third party — inconsistent with the “own funds” requirement of Regulation 6(2).

Not reporting financial changes

After PR is granted, investors must notify the CRMD of significant financial changes: selling the investment property, liquidating Category C shares or changing their permanent address. Failing to notify can lead to the annual assessment finding inconsistencies and revoking PR.

Believing in a “fast track” without due diligence

Some brokers advertise “Cyprus PR 6.2 granted in 2 months without verifying the source of funds”. This is false — the fast track applies only to the CRMD’s processing time and does not bypass MOKAS or Cyprus Police screening. Every application must undergo full due diligence. Investors who believe this promise usually lose their consultancy fees and still have to start again from scratch.

Benefits after passing Cyprus due diligence

Although Cyprus due diligence is a rigorous and time-consuming process, the result is not just a PR card. Having passed the vetting of an EU country opens up many other administrative and financial benefits investors can use.

Greater credibility with EU financial institutions

After Cyprus PR is granted, the applicant has been “vetted” by MOKAS and the Cyprus Police — equivalent to many of the KYC steps EU banks and financial institutions usually require. Opening accounts in France, Germany or the Netherlands becomes easier because banks can rely on the results of the Cypriot vetting rather than starting from scratch.

Saving time on Schengen visas and future citizenship

Cyprus PR holders have an advantage when applying for Schengen visas (even though Cyprus has not yet joined Schengen) — the approval rate for multiple-entry Schengen visas rises significantly. When Cyprus officially joins Schengen (under negotiation, expected in 2026–2027), PR holders will automatically be able to move freely within the area.

For the citizenship path after 8 years of residence, the results of Cyprus due diligence from the PR stage are kept on file and reused — reducing repeat vetting requirements at the naturalisation stage.

Access to the EU financial system

PR holders are entitled to:

• Open investment accounts on EU stock exchanges (Euronext, Frankfurt Stock Exchange)
• Invest in real estate and investment funds across the EU without being vetted again
• Own companies in other EU countries with simpler KYC procedures
• Borrow from EU banks on better terms than non-residents

Ongoing monitoring and maintenance obligations

However, Cyprus due diligence does not end when PR is granted. Holders must keep a “clean” record:

• Update the criminal record certificate every 3 years (as mentioned in the background check article)
• Notify the CRMD of major changes in financial status
• Maintain the qualifying investment
• Do not engage in activities flagged as suspicious by MOKAS

Investors found to have breached the rules during ongoing monitoring may have their PR revoked — a long-term risk that needs a management plan from the outset.

Summary and next steps

Cyprus due diligence is one of the most rigorous vetting processes in the EU’s PR systems, carried out jointly by the CRMD, MOKAS, the Cyprus Police and the Central Bank of Cyprus. The legal framework is based on AML Law 188(I)/2007 and the EU 5th/6th AMLD, with Source of Funds + Source of Wealth checks, PEP screening and adverse media monitoring.

For Vietnamese investors taking part inCyprus residency by investmentunder Regulation 6(2), success depends not only on preparing complete documents but also on working with a lawyer experienced in handling complex cases. Pre-submission internal due diligence is the most important step — identifying and dealing with red flags before the CRMD finds them itself.

The realistic timeline for Standard CDD applications is 6–12 months, and 9–18 months for EDD. Category B investors in strategic sectors need to add 3–4 months for FDI screening under Law 194(I)/2025. Investing in professional legal services (€5,000–€10,000 EUR) saves a great deal of time and risk compared with handling it yourself — especially for applications involving PEP factors, multi-layer structures or complex sources of funds.