New sanctions law in Cyprus

On October 20, 2025, Cyprus criminalized any action in favor of sub-sanctioned individuals and companies. Now any interaction - from services to storing funds - can result in fines or jail time.

Context

• Law fulfills EU requirement to criminalize sanctions circumvention
• Valid for citizens, residents, companies and entities under the Cyprus flag
• Russia, Belarus, Iran and other jurisdictions under sanctions
• The wording is broad: virtually any economic relationship can fall under the offense

What is considered a violation

• Transactions in sub-sanctioned banks
• Professional services (IT, iGaming, legal)
• Investments, loans and other financial transactions
• Support for projects related to sub-sanctioned structures
• Even renting an office from a «risky» company can raise questions

Responsibility

• Companies: fine of up to €40 million or 5% of turnover, risk of losing licenses
• Individuals: fine of up to €100k and up to 5 years in prison
• The only exceptions are humanitarian aid

What this means for the market

• Businesses will seek alternative jurisdictions with more predictable regulation
• Cyprus is no longer a suitable hub for projects dealing with sanctions-sensitive markets
• Affiliate networks will strengthen traffic filtering: volumes may decrease, quality requirements will increase
• The cost of players from «risky» regions will increase due to additional compliance checks

What companies should do

• Conduct an audit of partners and customers
• Update Contracts: Sanctions Integrity Obligations and Responsibilities of Parties
• Verify the origin of funds and avoid transit jurisdictions
• Exclude any transactions with sub-sanctioned entities

Conclusions

The law dramatically increases risks for iGaming companies: sanctions compliance becomes a mandatory part of the operating model. Mistakes are now costly, and business sustainability depends on the quality of partner verification and transparency of financial flows.