CySEC issues guidance on sanctions screening systems
This guidance stems from thematic inspections conducted between April and November 2024, which assessed compliance with legal requirements tied to UN, EU, US, and UK sanctions.
Key findings from thematic inspections
CySEC's inspections covered all regulated entities, including Cyprus Investment Firms (CIFs), Administrative Service Providers (ASPs), Funds and Fund Managers, and Crypto Asset Service Providers (CASPs). The inspections evaluated the performance of screening systems by answering pivotal questions:
- Do the tools generate alerts for exact matches with sanctioned names?
- Are the tools effective at detecting manipulated names (eg, misspellings, wrong dates, word duplication, missed words)?
- Are the levels of false positives manageable?
- How do the systems compare with industry peers, global standards, and CySEC expectations?
Both automated and manual screening practices were tested, including control tests using exact sanctioned names and manipulated tests with algorithm-altered data. A specialised third-party firm supported the testing efforts, providing analysis and benchmarking results.
The findings revealed notable best practices, but they also highlighted areas requiring improvement in the overall efficiency and effectiveness of screening systems.
Purpose and CySEC expectations
The new guidance consolidates the insights and findings from these inspections to:
- Clarify CySEC’s expectations regarding sanctions screening practices
- Provide best practices for testing, tuning, and optimising screening systems
- Offer practical benchmarks for implementing risk-based, proportionate compliance measures
The guidance outlines weaknesses in current systems, such as ineffective screening configurations, and emphasises the importance of ongoing management, quality assurance, and testing methodologies for screening tools.
Obligations for regulated entities
CySEC underscores that all regulated entities must implement robust internal policies and procedures to ensure compliance with sanctions and restrictive measures. These systems should be tailored to the nature and scope of their operations and customer base, ensuring alignment with global standards and industry comparisons.
The guidance will be updated periodically to reflect advancements in sanctions compliance practices.
CySEC’s press release can be found here and the guidance here.
