Hiring in Cyprus for Online Gambling Operators (2026): EOR, Immigration, Employment Law & AML

Online gambling employment Cyprus is entering a decisive phase as the National Betting Authority (NBA) advances its strategic priorities, placing renewed emphasis on formalising online operations and tightening the obligations attached to the people who run them. For operators evaluating market entry or scaling an existing team, hiring is no longer a purely administrative exercise: it sits at the intersection of licensing conditions, immigration rules for non-EU staff, Cypriot employment law and role-based anti-money-laundering (AML) duties. This practical guide sets out the hiring models available, the immigration and payroll mechanics involved, the contractual clauses that matter for gaming roles, and how AML responsibilities map onto specific jobs.

It is written for in-house counsel, HR leads and compliance officers who need actionable choices rather than high-level commentary.

Executive summary: hiring and compliance snapshot for 2026

Cyprus remains an attractive base for licensed betting operators, combining EU membership, a regulated licensing regime and an established professional services ecosystem. The NBA’s strategic direction signals continued focus on the formalisation of online operations, which in practice means operators should expect closer scrutiny of who they employ, how those people are vetted, and how AML controls are embedded across the workforce.

It is important to note that, under the current Cypriot regime, the scope of legally permitted online activity is limited. The Betting Law 37(I)/2019 regulates betting, including online betting under Class B licences, but online casino games (such as slots and roulette) fall outside the licensable classes and are not currently authorised. Operators should confirm the precise scope of activity they intend to offer against the licence classes actually available before building a team.

When it comes to building headcount, operators typically choose between direct employment, an Employer of Record (EOR), engaging contractors, or outsourcing to a local payroll provider. Each model carries different consequences for licensing control, immigration sponsorship, payroll liability and AML oversight, and none of them removes the operator’s underlying regulatory responsibilities.

Immigration is a live consideration for any team drawing on non-EU talent. Work permits, salary thresholds and documentation requirements published by the Civil Registry and Migration Department must be planned into recruitment timelines. Meanwhile, AML training and the designation of a Money Laundering Compliance Officer (MLCO) are not optional extras but structural obligations flowing from EU and domestic frameworks.

This guide covers:

• The regulatory context governing online gambling employment Cyprus, including legality and licensing.
• A comparison of hiring models: direct hire, EOR, contractors and payroll providers.
• A step-by-step immigration and work-permit checklist for non-EU gambling staff.
• Employment contract essentials, IP protection and restrictive covenants for gaming roles.
• Role-based AML responsibilities, training and reporting duties.
• Payroll, tax and social insurance mechanics for local and remote staff.
• A practical 30/60/90-day onboarding and compliance checklist.

Regulatory context: legality, licensing and NBA priorities

Understanding online gambling employment Cyprus starts with the regulatory architecture that governs the sector. Cyprus operates a regulated licensing regime, and the obligations placed on operators cascade directly onto the people they hire, from senior controllers to customer-facing agents.

Betting Law and licensing basics

The principal statute governing the sector is the Betting Law 37(I)/2019 (which replaced and consolidated the earlier 2012 framework), establishing the licensing framework and the supervisory role of the National Betting Authority. The law provides for classes of betting licence, including a Class A licence for land-based betting (other than horse racing) and a Class B licence for electronic (online) betting. The law requires licensees to ensure that persons exercising effective control over the business are fit and proper, and to put in place the compliance arrangements expected of a regulated betting operator, including the designation of officers responsible for compliance.

For hiring purposes, the practical takeaway is that certain roles, particularly senior management, controllers and compliance functions, are not simply commercial appointments. They are positions the regulator has an interest in, and the operator must be able to demonstrate that the individuals occupying them meet the applicable standards. This has direct implications for how contracts are drafted, how background checks are conducted, and how quickly a role can be filled.

NBA priorities: implications for hiring

The NBA’s published strategic priorities reflect the regulator’s direction for the coming years, with a continued emphasis on formalising and strengthening supervision of online operations. For operators, the practical effect is likely to be sustained attention on the integrity of the workforce: fit-and-proper controls, robust AML functions, and clear internal accountability. Operators who invest early in properly structured employment and compliance frameworks will generally find licensing interactions smoother than those who treat hiring as an afterthought.

Because a strategic plan signals direction rather than prescribing every operational detail, operators should treat it as a reason to strengthen, not merely maintain, their hiring and compliance playbooks. Documented onboarding procedures, evidenced AML training and a clearly empowered MLCO are the kinds of measures that align with the regulator’s formalisation agenda.

AML framework (EU and Cyprus)

AML obligations affecting gambling operators in Cyprus flow from the EU framework transposed into domestic law through the Prevention and Suppression of Money Laundering Activities Law, which implements the relevant EU Anti-Money Laundering Directives, reinforced by international standards set by the Financial Action Task Force (FATF). These frameworks establish expectations around customer due diligence, staff training, suspicious activity reporting and recordkeeping. For employers, this means AML is a workforce-wide responsibility that must be built into job design, training programmes and internal controls, a theme returned to in detail below.

Hiring models: direct employment vs EOR vs contractor vs payroll provider

Choosing the right hiring model is the central operational decision for gambling operator hiring in Cyprus. The four common routes, direct employment, Employer of Record, contractors, and local payroll providers, differ significantly in who bears legal, immigration and compliance responsibility. Crucially, none of them transfers away the operator’s licensing obligations under the Betting Law.

Direct hire (contract and compliance)

Under a direct hire model, the operator is the legal employer. It signs the employment contract, registers with the tax and social insurance authorities, runs payroll, and assumes full responsibility for compliance with Cypriot employment law. This model gives maximum control over staff, is generally preferred for licensed and compliance-sensitive roles, and provides the cleanest line of accountability to the regulator. The trade-off is that it requires an established Cypriot legal entity, registration formalities and the internal capacity to administer HR and payroll, which lengthens setup for operators entering the market for the first time.

Employer of Record (EOR): how it works in Cyprus

An Employer of Record Cyprus arrangement means a third-party provider becomes the legal employer of the worker on the operator’s behalf, handling the employment contract, payroll, tax withholding and social insurance contributions, while the operator directs the day-to-day work. For operators testing market entry or standing up a short-term team quickly, an EOR reduces setup time and removes the need to incorporate before hiring.

However, the EOR route requires careful contractual mapping in a licensed sector. Licensing conditions, including fit-and-proper controls over key persons and AML oversight, remain the operator’s responsibility even where an EOR is the formal employer. The engagement documentation must therefore clarify who conducts background vetting, who owns AML training records, who controls intellectual property, and how the operator retains the control it needs to satisfy the regulator. An EOR is a solution to administrative and payroll burden, not a substitute for regulatory accountability.

Contractors and freelancers

Engaging contractors or freelancers can offer flexibility for project-based work, such as short-term development or design tasks. The principal risk is misclassification: if the working relationship in substance resembles employment, the arrangement may be recharacterised, exposing the operator to back-dated tax, social insurance and employment liabilities. Contractor engagements also raise heightened concerns over IP ownership and confidentiality, which must be addressed expressly in the contract. For roles touching customer funds, KYC or AML functions, a contractor model is generally ill-suited because of the control and oversight the regulator expects.

Local payroll providers and PEOs

A local payroll provider administers payroll, contributions and withholding for staff the operator directly employs, without becoming the legal employer. This suits operators that already have a Cypriot entity but want to outsource payroll administration. It offers cost predictability on the payroll function while leaving employment, immigration and licensing responsibilities squarely with the operator.

Immigration and work permits for non-EU gambling staff: a practical checklist

Recruiting internationally is common in the sector, which makes immigration for gambling staff Cyprus a core planning issue. EU and EEA nationals enjoy freedom of movement and generally do not require work permits, but non-EU nationals typically require work permits or an equivalent immigration status to be employed in Cyprus. The Civil Registry and Migration Department, within the Ministry of Interior, publishes the routes, documentation and procedures. Certain companies of foreign interests may also access a dedicated framework for employing third-country nationals, administered through the Business Facilitation Unit, subject to eligibility criteria set by the authorities.

A practical checklist for hiring non-EU staff includes:

1. Confirm the role and the appropriate permit category before making an offer.
2. Verify any applicable salary threshold and prepare evidence of the offered remuneration.
3. Assemble supporting documentation, including passport, qualifications, contract of employment and any sector-specific requirements.
4. Establish the operator’s role as sponsoring employer, with the required corporate documentation.
5. Submit the application to the relevant authority and track processing timelines.
6. Plan for renewals well in advance of expiry to avoid gaps in the right to work.
7. Consider family dependants where relevant and their separate immigration status.

Because processing timelines, salary thresholds and documentary requirements can change, operators should confirm the current position directly with the Civil Registry and Migration Department or the Business Facilitation Unit and build realistic lead times into recruitment plans.

Short-term secondments and intra-company transfers

Where an operator moves an existing employee from a group company abroad to Cyprus, an intra-company transfer or secondment route may apply. These arrangements have their own documentary and eligibility requirements and are distinct from a standard local hire. Operators should verify which route fits the assignment length and the employee’s role, and ensure the underlying employment and tax position is coherent across the two jurisdictions.

Long-term hires and permanent residency considerations

For long-term appointments, operators should consider not only the initial work permit but the pathway to renewal and, over time, longer-term residency options for valued staff. Retention of skilled compliance, technology and management personnel is a recurring challenge in the sector, and a clear immigration roadmap can be a meaningful part of the employment proposition.

Remote non-resident workers: when permits are not required

Where an individual works entirely outside Cyprus and is not resident there, a Cyprus work permit is generally not required. However, this does not end the analysis. Economic employer tests, permanent establishment risk and the labour and tax rules of the country where the person actually works must all be considered. Engaging remote workers in a way that inadvertently creates a taxable presence or triggers local employment obligations is a common trap, and cross-border arrangements should be structured with advice.

Employment law practicalities: contracts, IP, confidentiality and restrictive covenants

Well-drafted contracts are the foundation of compliant online gambling employment Cyprus. Gaming roles raise particular issues around intellectual property, confidentiality and the protection of commercially sensitive information, and contracts should be tailored accordingly rather than lifted from generic templates. The sample clause guidance below is for orientation only and should be adapted and legally reviewed before use.

Mandatory employment terms and Cyprus social insurance and tax

Cypriot employment law requires employers to provide employees with written information on the essential terms of the employment relationship, and employers must register with the relevant authorities to operate payroll, deduct tax and pay social insurance contributions. Contracts should clearly state job title and duties, remuneration, working hours, leave entitlements, notice periods and the applicable disciplinary and grievance framework. Because contribution rates and thresholds are subject to periodic change, employers should confirm the current figures with the tax authorities and the Social Insurance Services at the point of hire.

IP and developer agreements

For technical and creative roles, game developers, designers, data specialists, the contract must contain a clear and effective assignment of intellectual property created in the course of employment, together with a waiver of moral rights where applicable and an obligation to assist with registration and enforcement. Where work is performed by contractors, IP does not automatically vest in the operator, so express assignment provisions are essential. Ambiguity here can jeopardise ownership of the very assets that underpin the business.

Confidentiality, non-compete and garden-leave clauses

Gaming operators hold sensitive commercial, customer and technical information, making confidentiality obligations critical. Employers frequently use restrictive covenants, non-competition, non-solicitation of staff and customers, and garden-leave provisions to protect their position during and after employment. Under Cyprus law, restrictive covenants must be reasonable in scope, duration and geography to be enforceable, and clauses that operate as an unlawful restraint of trade may not be upheld; overly broad drafting risks being struck down. Covenants should be calibrated to the seniority and access of the individual role.

Termination and redundancy considerations

Termination must be handled in accordance with Cypriot employment law, including minimum notice requirements under the Termination of Employment Law and, where relevant, redundancy procedures and payments. Contracts should set out notice periods clearly and address the treatment of confidential information, IP and company property on exit. For roles subject to regulatory or fit-and-proper considerations, the departure process should also address the orderly handover of compliance responsibilities.

AML and compliance responsibilities by role: MLCO, customer-facing staff and developers

AML is a workforce-wide obligation, and mapping duties to roles is central to compliant online gambling employment Cyprus. Rather than treating AML as a single function, operators should identify how obligations differ across senior officers, customer-facing staff, compliance teams and technical personnel, and design job descriptions, training and controls to match.

Role description: MLCO duties

The Money Laundering Compliance Officer (MLCO) is the linchpin of the AML framework. Typical responsibilities include maintaining the operator’s AML policies and procedures, overseeing customer due diligence and KYC processes, receiving internal suspicious activity reports, deciding on external reporting to the Unit for Combating Money Laundering (MOKAS), maintaining records, and delivering or coordinating staff training. The role must be occupied by a suitably experienced and empowered individual with direct access to senior management. Because the position is compliance-critical, its appointment, seniority and independence should be reflected in both the employment contract and the internal governance structure.

Onboarding staff KYC responsibilities

Customer-facing and account-management staff often sit at the front line of KYC (Know Your Customer) and customer due diligence. Their duties may include verifying customer identity, monitoring for red flags, applying enhanced due diligence where required, and escalating concerns internally. Job descriptions should spell out these responsibilities explicitly, and onboarding should confirm that each employee understands the procedures they are expected to apply.

AML training programme outline and sample curriculum

AML training gambling Cyprus obligations require operators to deliver role-based training and to keep records evidencing it, consistent with EU AML Directives, domestic AML law and FATF guidance. A robust programme typically includes:

• Foundations. The legal framework, the operator’s obligations, and the consequences of non-compliance.
• Risk indicators. Sector-specific money-laundering typologies and suspicious-activity red flags relevant to online gambling.
• Procedures. How to apply KYC and customer due diligence, and when enhanced measures are required.
• Reporting. How and when to make internal reports, and the prohibition on tipping-off.
• Role-specific modules. Tailored content for customer-facing staff, compliance teams and senior management.

Training should be delivered on induction and refreshed periodically, with content and frequency aligned to the operator’s risk profile and to regulatory guidance. Attendance and completion records should be retained as part of the AML documentation.

Reporting and internal escalation

Operators must have a clear internal escalation path so that staff know how to raise concerns and how those concerns reach the MLCO for a decision on external reporting. The process should be documented, protect the confidentiality of reporting, and be supported by recordkeeping that demonstrates the operator’s controls are functioning in practice.

Payroll, tax, social insurance and benefits for gaming staff

Payroll and contributions are where employment obligations become concrete. Gaming industry payroll Cyprus arrangements must account for income tax withholding under the PAYE mechanism, employer and employee social insurance contributions, the General Healthcare System (GESY) contributions, and the correct treatment of taxable benefits. Employers must register with the Tax Department and the Social Insurance Services before running payroll, and should maintain accurate records for each pay period. Because rates and thresholds are periodically updated, current figures should be verified with the Tax Department and the Social Insurance Services at the time of hire.

Remote workers and cross-border payroll

Where staff work remotely, whether within or outside Cyprus, payroll becomes more complex. The residency and tax status of the worker, the location where duties are actually performed, and the risk of creating a permanent establishment or an “economic employer” relationship all affect where tax and contributions are due. Operators engaging cross-border remote workers should map these questions before finalising the arrangement, as errors can create liabilities in more than one jurisdiction.

EOR payroll flows and employer liabilities

Under an EOR arrangement, the provider runs payroll, withholds tax and pays social insurance as the legal employer, giving the operator predictable, consolidated costs. Operators should nonetheless understand the underlying flows and confirm which liabilities remain with them, particularly where licensing, AML oversight or IP are concerned. A clear service agreement should set out reporting, record access and the division of responsibilities so that the operator can satisfy both its commercial and regulatory obligations.

Practical compliance checklist and onboarding timeline

To translate the above into action, operators can structure onboarding around a 30/60/90-day framework that aligns HR, immigration and compliance:

• Before day one. Confirm the hiring model, complete fit-and-proper vetting for relevant roles, finalise the employment contract with IP, confidentiality and restrictive covenant clauses, and secure any required work permit for non-EU staff.
• First 30 days. Register the employee for payroll, tax and social insurance; deliver induction AML training; issue policies and confirm the employee’s KYC and reporting responsibilities.
• By 60 days. Confirm completion and recording of AML training; verify system and data access controls; embed the employee within the internal escalation and reporting structure.
• By 90 days. Review performance and role fit; confirm all compliance documentation is complete and retained; schedule the next AML refresher and any permit renewal reminders.

Documenting each of these steps creates the evidenced, formalised approach that aligns with the regulator’s direction of travel and supports smoother licensing interactions.

How Global Law Experts can help with online gambling employment Cyprus

Operators building or scaling teams in Cyprus benefit from integrated advice that connects licensing, immigration, employment and AML. Support typically spans EOR advisory and vendor due diligence, immigration and work-permit assistance for non-EU staff, drafting of employment and developer contracts, MLCO advisory services, and the design and delivery of AML training programmes. For tailored guidance on online gambling employment Cyprus, you can explore the Global Law Experts, Cyprus region directory to identify appropriate counsel.

Conclusion

Online gambling employment Cyprus in 2026 rewards operators who treat hiring as an integrated legal and compliance exercise rather than a purely administrative one. With the NBA reinforcing the formalisation of online operations, the choices made at the point of hire, the model used, the immigration route, the contract terms and the AML architecture, increasingly determine how smoothly an operator interacts with the regulator. By selecting the right hiring structure, planning immigration timelines realistically, drafting enforceable contracts and embedding role-based AML controls with a properly empowered MLCO, operators can build teams that are both commercially effective and demonstrably compliant. The practical steps and checklists above are a starting point; jurisdiction-specific advice should be taken before finalising any arrangement.

Sources

1. CyLaw, Cyprus legislation and case law database
2. National Betting Authority (NBA)
3. Civil Registry & Migration Department, Ministry of Interior (Cyprus)
4. Ministry of Labour and Social Insurance (Cyprus)
5. EUR-Lex, Directive (EU) 2018/843 (5th AMLD)
6. Financial Action Task Force (FATF)
7. Cyprus Bar Association