Cyprus Online Gambling 2026: Licensing, AML & MLCO Compliance, What Operators and Game Providers Must Do

Online gambling in Cyprus sits at a pivotal juncture in 2026, with licensed internet sports betting already operational, online casinos still formally prohibited, and a growing political and regulatory push toward broader legalisation. The National Betting Authority (NBA) has intensified its 2026–2028 strategic agenda, draft legislation is circulating in parliamentary committees, and the Cyprus Bar Association has updated its Money Laundering Compliance Officer (MLCO) certification requirements. For iGaming operators, game providers and investors, the practical question is no longer whether Cyprus will expand its regulated online gambling market but how fast, and what compliance infrastructure must be in place before it does. This guide delivers the step-by-step licensing process, AML obligations and contractual frameworks that compliance teams need right now.

Executive Summary and Decision Checklist for Online Gambling Cyprus

Cyprus currently permits online sports betting under Class B licences issued by the NBA. Online casino games, including slots, roulette, and live-dealer products, remain unlicensed and illegal for operators targeting the Cyprus market, although industry observers expect legislative movement during 2026. Operators already holding or pursuing a Curaçao gaming licence or an equivalent offshore authorisation should not assume that coverage extends to Cyprus.

Before committing resources to a Cyprus market-entry strategy, decision-makers should work through the following checklist:

• Product classification. Is your product online sports betting (currently licensable) or an online casino/RNG game (currently prohibited)?
• Corporate presence. Does your group have, or can it establish, a Cyprus-registered entity with adequate substance?
• AML readiness. Do you have a documented AML/CFT framework and a qualified MLCO available to be appointed on day one?
• Technical certification. Are your gaming systems, RNG engines and data-storage protocols capable of meeting NBA technical standards?
• Capital and fees. Have you budgeted for application fees, annual licence charges, and the ongoing cost of AML compliance?
• Timeline realism. Are you prepared for a licensing process that typically takes eight to sixteen weeks, with possible delays for incomplete documentation?

Legal Status of Online Gambling in Cyprus in 2026: What Is Permitted and What Is Not

Under current Cyprus gambling law, online sports betting is the only form of internet-based gambling that operators may lawfully offer to customers located in Cyprus. The NBA regulates this activity through its Class B licensing regime. Online casinos, including slot machines, table games, poker rooms and any RNG-based product, remain outside the scope of any existing licence category and are treated as illegal if they target the Cypriot market. The NBA has issued public warnings cautioning consumers against using unlicensed online gambling websites and has flagged misinformation circulating about the legal status of online casinos.

Timeline of Key Developments (2024 – May 2026)

• 2024. The NBA completed a market review and published consultation papers on modernising the betting framework, including initial references to online casino legalisation.
• 2025. Parliamentary committees began debating draft amendments to expand the scope of online gambling in Cyprus. The Cyprus Gaming and Casino Supervision Commission (CGC) published updated policy guidance on its supervisory approach to land-based and integrated-resort operations.
• Early 2026. The NBA announced its 2026–2028 strategic plan, which includes provisions for enhanced digital-product regulation. The Cyprus Bar Association published Circular 03/2026 on MLCO examinations and certification, signalling intensified compliance expectations across regulated sectors including gambling.
• May 2026. Draft bills on online casino legalisation in Cyprus remain at committee stage. No enactment date has been confirmed, and operators should treat any expansion of product scope as prospective rather than imminent.

Product-by-Product Legality

• Online sports betting. Permitted under NBA Class B licence. Operators may offer pre-match and in-play betting on approved sporting events.
• Horse-racing betting. Subject to separate regulation under the horse-racing betting framework; online delivery may require additional authorisation from the NBA.
• Online poker. Not currently covered by any licence category. Operators may not offer real-money online poker to customers located in Cyprus.
• RNG casino games (slots, roulette, blackjack). Prohibited online. Land-based casino gaming is separately regulated by the CGC under the integrated-resort concession.
• Live-dealer games. Not separately addressed, but treated as online casino products and therefore unlicensed and illegal.

Consumers searching for licensed gambling sites in Cyprus can consult the NBA’s public register of Class B operators, which lists all entities currently authorised to provide online sports betting services.

Who Regulates Online Gambling in Cyprus: The National Betting Authority and CGC

The National Betting Authority (NBA) is the primary regulator for betting activities in Cyprus, including the licensing, supervision and enforcement of online sports betting operations. The NBA holds the authority to grant, suspend and revoke Class B licences and to impose administrative sanctions for non-compliance. It also maintains the public register of licensed operators and publishes consumer warnings about illegal gambling websites.

The Cyprus Gaming and Casino Supervision Commission (CGC) oversees land-based casino operations under the integrated-resort licensing framework. While the CGC’s mandate currently focuses on bricks-and-mortar facilities, industry observers expect its role to expand if online casino products are legalised, potentially sharing supervisory responsibilities with the NBA or assuming jurisdiction over online casino-specific licensing.

NBA Registers and Public Lists

The NBA publishes and regularly updates a register of Class B licensed entities. Operators, compliance professionals and consumers can access the register directly through the NBA’s website. Verifying whether a counterparty holds a valid Class B licence is an essential due-diligence step before entering any commercial relationship, whether as a game provider, affiliate, or payment service provider.

Licensing in Practice: Step-by-Step Guide to Obtaining a Cyprus Gambling Licence

Securing a Cyprus gambling licence under the NBA’s Class B regime involves a structured application process. The following section breaks the process into practical stages, with document requirements and indicative timelines that compliance teams can use for project planning.

Pre-Application: Due Diligence and Corporate Structure

Before submitting a formal application, prospective licensees must satisfy several threshold requirements. The applicant entity must be a company registered in Cyprus or in another EU/EEA member state, although in practice the NBA expects a meaningful local presence, typically including a registered office, local directors, and operational staff based in Cyprus. Foreign operators considering a Cyprus market entry should therefore plan for company registration in Cyprus well ahead of the application timeline. Key pre-application actions include:

• Corporate formation or re-domiciliation. Confirm that the applicant entity’s memorandum and articles permit betting activities. Ensure director and ultimate-beneficial-owner (UBO) details are current and compliant.
• Suitability pre-screening. Directors, shareholders holding significant interests, and key personnel (including the proposed MLCO) are subject to fit-and-proper assessments. Criminal-record checks, financial-standing declarations and CV submissions should be prepared in advance.
• AML framework. The NBA will expect the applicant to present a documented AML/CFT policy and to have appointed, or be in a position to appoint, a qualified MLCO before the licence can be activated.

Application Pack: Required Documentation

The formal application to the NBA typically comprises the following documents:

• Completed application form (NBA prescribed format)
• Certificate of incorporation and memorandum of association
• Share register and UBO declaration (including group structure chart for corporate shareholders)
• Fit-and-proper declarations for all directors, senior managers and significant shareholders
• Business plan covering projected volumes, marketing channels and responsible-gambling measures
• AML/CFT policy manual
• MLCO appointment letter and qualification evidence
• Technical specifications for the betting platform, including data-storage, geolocation and cybersecurity arrangements
• Evidence of financial capacity (audited accounts or bank guarantees)
• Proof of third-party software and RNG certification (where applicable)

Technical and Gaming Systems Requirements

The NBA requires that licensed platforms meet technical standards covering data integrity, transaction logging, geolocation accuracy, and protection of player funds. Operators must demonstrate that betting systems are hosted in a secure environment, that all transactions are recorded and auditable, and that geolocation tools can reliably restrict access to authorised jurisdictions. RNG-based components, even those embedded in ancillary features, must carry valid certification from an accredited testing laboratory.

Fees and Timelines

Processing timelines depend heavily on the completeness of the application pack. Incomplete submissions, particularly missing AML documentation, unverified UBO structures or inadequate technical specifications, are the most common cause of delay. Operators should allow a buffer of at least four additional weeks for regulator queries.

Foreign operators are eligible to apply, but the NBA’s expectation of local corporate substance means that a Cyprus-incorporated entity (or a properly established EU branch) is effectively mandatory. Operators requiring staff to relocate may also wish to review the rules on employment of third-country nationals in Cyprus in parallel with the licensing process.

AML Obligations for Online Gambling Operators in Cyprus: Operational Checklist

AML compliance in the gambling sector is governed by Cyprus’s transposition of the EU Anti-Money Laundering Directives into national law, supplemented by sector-specific guidance issued by the NBA. Every licensed operator is classified as an obliged entity and must implement a comprehensive AML/CFT programme that meets both the letter of Cyprus gambling law and the NBA’s supervisory expectations.

AML Policy: Required Elements

The operator’s internal AML policy must address, at a minimum, the following components:

• Enterprise-wide risk assessment. A documented assessment of ML/TF risks specific to the operator’s products, customer base, geographic exposure and delivery channels, reviewed at least annually.
• Customer due diligence (CDD) procedures. Tiered CDD, simplified, standard and enhanced, calibrated to the risk profile of each customer segment.
• PEP and sanctions screening. Automated screening of all customers and beneficial owners against Politically Exposed Person (PEP) lists, EU and UN sanctions lists, and any additional lists mandated by the NBA.
• Transaction monitoring. Rules-based and, where appropriate, analytics-driven monitoring of betting patterns, deposits, withdrawals and account behaviour for indicators of ML/TF or fraud.
• Suspicious transaction reporting (STR). Clear internal escalation procedures for flagging suspicious activity and filing STRs with MOKAS (the Cyprus Financial Intelligence Unit).
• Record retention. Retention of all CDD records, transaction data and internal reports for a minimum of five years following the end of the business relationship, or longer if required by a specific investigation or legal proceeding.
• Training. Regular AML/CFT training for all staff, with enhanced modules for customer-facing and compliance personnel.

Customer Identification and Verification (KYC)

Standard KYC procedures require the operator to verify the customer’s identity before, or, in limited low-risk scenarios, shortly after, establishing the business relationship. The operator must collect and verify: full name, date of birth, residential address, and source of funds for customers meeting enhanced due diligence thresholds. For online onboarding, this typically involves government-issued photo ID, proof of address, and electronic identity-verification tools. Enhanced due diligence applies to PEPs, customers from high-risk third countries identified by the EU or FATF, and any customer whose activity triggers a risk alert.

Suspicious Transaction Reporting and Timelines

When a transaction or pattern of activity raises suspicion of ML/TF, the MLCO must evaluate the internal report and, where appropriate, file an STR with MOKAS without delay. Cyprus law does not prescribe a rigid clock (such as a 24-hour window) for STR filing, but the obligation is framed as “promptly” once a suspicion is formed. In practice, licensed gambling operators are expected to file within the shortest practicable period, industry guidance typically suggests same-day or next-business-day submission. Tipping off the customer about the STR is a criminal offence.

The MLCO Role: Responsibilities and Model Job Description for Cyprus Operators

Every licensed online gambling operator in Cyprus must appoint a Money Laundering Compliance Officer (MLCO) who serves as the central point of contact for AML/CFT matters internally and with regulators. The MLCO role in Cyprus is broadly equivalent to the Money Laundering Reporting Officer (MLRO) role used in other EU jurisdictions, although Cyprus-specific legislation and the NBA’s supervisory expectations define certain additional responsibilities.

The Cyprus Bar Association’s Circular 03/2026 reinforced the requirement for MLCO certification, including formal examinations designed to test competency in the areas of ML/TF risk, regulatory obligations, and sector-specific compliance. Operators appointing an MLCO for the first time, or replacing an incumbent, should verify that their candidate holds a valid certification or is enrolled in the next available examination cycle.

Core MLCO responsibilities in a Cyprus gambling operation include:

• Oversight of the AML/CFT framework. Designing, implementing, and updating the operator’s AML policies and procedures in line with legislative changes and NBA guidance.
• Internal reporting hub. Receiving, evaluating and documenting all internal suspicious-activity reports from staff across the organisation.
• STR filing. Deciding whether to file an STR with MOKAS, preparing the report and managing all communications with the FIU.
• Risk assessment coordination. Leading the annual enterprise-wide risk assessment and presenting findings to the board.
• Training programme management. Designing and delivering AML training to all staff, maintaining training records, and ensuring that customer-facing teams understand red-flag indicators.
• Regulatory liaison. Acting as the primary point of contact for the NBA and MOKAS on all AML/CFT supervisory matters, including inspections and data requests.
• Record keeping and audit support. Ensuring that CDD files, transaction-monitoring outputs and STR records are complete, accurate and accessible for internal and external audit.
• Board reporting. Providing regular compliance reports to senior management and the board, including KPIs on STR volumes, training completion rates, and risk-assessment outcomes.

Internal Reporting Flows and Audits

The MLCO should establish a documented internal reporting flow: front-line staff report suspicions to the MLCO (or deputy) using a standardised internal disclosure form; the MLCO evaluates the report, requests additional information if necessary, and makes a determination within a defined timeframe. All determinations, including decisions not to file an STR, must be recorded with written reasoning. The entire framework should be subject to periodic independent review, either by an internal audit function or an external AML consultant, with findings reported to the board.

Contracts and Game-Provider Agreements: Key Compliance Clauses for Online Gambling in Cyprus

Game-provider agreements are among the most commercially and legally significant contracts in an operator’s supply chain. In a Cyprus context, these contracts must address not only standard commercial terms but also the specific regulatory and AML compliance obligations that flow from the NBA’s licensing requirements. Poorly drafted agreements expose both operators and suppliers to regulatory risk, contractual liability and potential licence revocation.

Essential clauses and negotiation considerations include:

• RNG and testing-laboratory certification. The game provider should warrant that all games supplied carry valid RNG certification from an accredited testing laboratory recognised by the NBA. The contract should specify the obligation to maintain certification throughout the agreement term and to notify the operator promptly of any suspension or withdrawal.
• AML cooperation and data sharing. The operator’s AML obligations extend to its supply chain. Game-provider agreements should include a clause requiring the provider to cooperate with AML inquiries, share relevant transaction or player-behaviour data on request, and support the operator’s transaction-monitoring systems.
• Regulatory-change adaptation. Given the likelihood of legislative expansion (online casino legalisation in Cyprus), agreements should include a mechanism for renegotiating scope, compliance obligations and fee structures in response to material regulatory change.
• Audit rights. The operator should reserve the right to audit, or commission a third-party audit of, the game provider’s systems, data handling and compliance procedures, with reasonable notice periods and defined cooperation obligations.
• Termination for regulatory breach. Immediate termination rights should be available if the game provider loses a material certification, is sanctioned by a regulator, or fails to cooperate with an AML investigation.
• Indemnities. Cross-indemnities should cover losses arising from regulatory sanctions attributable to the other party’s non-compliance, including fines, licence conditions and remediation costs.
• Jurisdiction and dispute resolution. For Cyprus-licensed operators, specifying Cyprus (or another agreed EU) jurisdiction and selecting arbitration or the Cyprus courts for disputes provides clarity and enforceability. Consider the interaction between dispute-resolution mechanisms and any NBA requirement for prompt reporting of material disputes.

Operators expanding their supply chains into the Cyprus market should also consider how these game provider agreements interact with the broader Cyprus tax environment and transfer-pricing obligations, particularly where the game provider and operator are part of the same corporate group.

Payments, Affiliates and Third-Party Providers: Compliance Hotspots

Payment flows in online gambling attract heightened regulatory scrutiny. Operators must ensure that payment service providers (PSPs) processing deposits and withdrawals are themselves appropriately licensed and subject to AML/CFT obligations. Key compliance considerations include:

• PSP due diligence. Operators should verify the PSP’s licensing status, AML policies and jurisdictional coverage before onboarding. The contract should require the PSP to maintain its licence throughout the relationship and to notify the operator of any regulatory action.
• Geolocation and payment blocking. Where products are restricted to certain jurisdictions, payment systems must support geolocation-based blocking to prevent deposits from or withdrawals to excluded territories.
• Suspicious payment indicators. Compliance teams should monitor for indicators such as rapid deposit–withdrawal cycling, use of multiple payment methods by a single customer, and significant changes in transaction patterns without corresponding betting activity.
• Affiliate risk. Affiliates marketing the operator’s platform are a known vector for AML and advertising-compliance risk. Affiliate agreements should incorporate clauses requiring compliance with NBA advertising standards, prohibiting marketing to minors or excluded persons, and providing the operator with audit and termination rights for non-compliance.

Payment-Provider Contractual Clauses Checklist

• Licence-maintenance warranty and notification obligation
• AML cooperation and data-sharing clause
• Geolocation and territorial-blocking requirements
• Transaction-monitoring integration (API or data-feed provisions)
• Chargeback handling and fraud-loss allocation
• Termination rights on regulatory breach

Enforcement, Penalties and Risk Mitigation

The NBA has the statutory authority to impose a range of sanctions on non-compliant operators, including financial penalties, licence suspension, licence revocation, and referral to criminal-prosecution authorities for serious offences. The NBA has publicly warned operators and consumers about the risks of illegal online gambling, and industry observers expect enforcement activity to increase as the regulatory framework matures.

Practical risk-mitigation steps include:

• Proactive remediation. If a compliance gap is identified internally, operators should document the issue, implement corrective action and consider voluntary disclosure to the NBA before the matter is discovered during a supervisory review.
• Regulatory engagement. Maintaining an open, cooperative relationship with the NBA, including prompt responses to information requests and voluntary participation in consultations, can mitigate reputational and enforcement risk.
• Insurance. Directors’ and officers’ liability insurance and professional-indemnity coverage should be reviewed to ensure adequate protection against regulatory fines and investigation costs.

Practical Annexes, Checklists and Templates

The following resources are designed to support operators and compliance teams implementing the requirements outlined in this guide. Operators are strongly encouraged to adapt these templates to their specific business models and to obtain qualified legal advice before finalising any compliance documentation.

• MLCO job description template. A model job description covering the core responsibilities, reporting lines, KPIs and qualification requirements for a Cyprus-based MLCO in a gambling operation.
• AML policy checklist. A structured checklist covering all mandatory AML/CFT policy components, mapped to Cyprus legislative requirements and NBA guidance.
• Licence application document checklist. A step-by-step list of all documents required for a Class B licence application, with status-tracking columns for project-management use.
• Sample game-provider clause pack. Model contract clauses covering RNG warranties, AML cooperation, audit rights, termination for regulatory breach and indemnity provisions.

For tailored compliance support, operators and game providers can connect with a qualified gambling-law practitioner through the Global Law Experts directory.

Conclusion: Preparing for the Next Phase of Online Gambling in Cyprus

The regulatory environment for online gambling in Cyprus is evolving rapidly. Operators and game providers that invest in robust licensing preparation, AML compliance infrastructure and carefully drafted commercial agreements will be best positioned to capitalise on the expanding market, whether through existing Class B sports-betting opportunities or through the anticipated legalisation of online casino products. The likely practical effect of the NBA’s 2026–2028 strategic plan will be a more rigorous supervisory regime, higher compliance expectations and a competitive advantage for early movers who can demonstrate regulatory readiness from day one. For a comparative overview of gambling licence costs and jurisdictions, operators evaluating Cyprus alongside other markets will find further guidance across the Global Law Experts resource library.

Sources

1. National Betting Authority (NBA), Official Website
2. NBA Class B Register, Licensed Operators
3. NBA Public Warning, Illegal Online Gambling and Misinformation
4. Cyprus Gaming and Casino Supervision Commission (CGC)
5. Cyprus Bar Association, Circular 03/2026 (MLCO Certification)
6. AML Watcher, Cyprus AML/CFT Coverage
7. Gofaizen & Sherle, Cyprus Gambling License Guide
8. LegalBison, Cyprus Gambling Licence Overview
9. European Commission, AML/CFT Directives