Esports Betting in Cyprus 2026: Licensing, AML, KYC & Advertising Rules

Esports betting cyprus has moved from a niche product line into a mainstream commercial opportunity, and in 2026 operators preparing to serve Cypriot customers face a regulatory environment that rewards early, disciplined compliance planning. This guide is written for licensed operators, platform and odds providers, business-to-business suppliers and in-house Money Laundering Compliance Officers (MLCOs) who need practical, operator-facing direction rather than high-level commentary. It sets out the licensing route under the primary Cyprus betting statute, the anti-money-laundering (AML) and know-your-customer (KYC) obligations that attach to virtual-asset and skin flows, the heightened scrutiny around skin betting, and the advertising and influencer rules that now shape how esports products can be promoted.

Throughout, regulatory statements are anchored to primary sources, the National Betting Authority (the regulator established under the Betting Law), the Betting Law 106(I)/2012 and EU and FATF guidance, so you can cross-check before you act.

Who this is for: operators, platform providers, B2B suppliers and compliance teams preparing for market entry or product launch in Cyprus in 2026. Focus: licence route, AML/KYC controls, skin and virtual-item risks, and advertising and influencer restrictions. All checklists and templates below are samples and require legal review before use.

Executive summary: key takeaways for operators

Before you commit resources to an esports betting cyprus launch, the headline compliance position can be reduced to a handful of operational priorities. The detail follows in the sections below, but these points should anchor your project plan.

• Licensing is the gating issue. Betting offered directly to customers in Cyprus falls within the Betting Law 106(I)/2012 framework, which is administered by the National Betting Authority. Esports betting is treated as a betting product, so a licence or recognised authorisation is the baseline requirement for direct provision.
• AML and KYC obligations are mandatory and risk-based. Cyprus applies the EU AML framework, and operators must run customer due diligence, ongoing monitoring and suspicious activity reporting (SAR) proportionate to the risks their products present.
• Skin betting carries elevated regulatory and AML risk. Virtual-item wagering intersects with peer-to-peer marketplaces and crypto rails, drawing FATF virtual-asset guidance into scope and requiring enhanced controls or market blocking.
• Advertising and influencer promotion are constrained. Marketing must not target minors, must not mislead on odds or returns, and influencer content must be clearly disclosed.
• Appoint your MLCO and engage local counsel early. The MLCO, systems audit readiness and a documented risk assessment are prerequisites you cannot bolt on at the end of the process.

Is esports betting legal in Cyprus?

Esports betting cyprus is lawful when conducted within the licensing and supervisory framework that governs betting generally. There is no blanket prohibition on taking bets on competitive video-gaming events, but the activity is not unregulated: it sits inside the statutory perimeter that captures betting offered to Cypriot customers. The practical question for operators is therefore not whether esports betting is permitted, but whether a given product and distribution model requires authorisation and what conditions attach to it.

Legal framework: Betting Law 106(I)/2012 and the regulator’s role

The primary statute governing betting and remote betting in Cyprus is the Betting Law 106(I)/2012 (as amended), and the National Betting Authority is the body responsible for licensing and oversight of betting activity. (Separately, the Cyprus Gaming and Casino Supervision Commission supervises the licensed casino sector. ) The distinction that matters most for esports is the line between a wager on an uncertain outcome, which is betting, and products built around skill or pure entertainment. Betting on the result of an esports match, tournament placement or in-play market is a bet on an uncertain event and falls squarely within the betting regime.

Where a product instead resembles a prize competition decided by skill, a different analysis may apply, but operators should not assume that framing an esports product as “skill-based” removes it from the betting perimeter. The statutory text and the regulator’s published material are the controlling references, and any borderline product should be assessed against them before launch.

Recent 2026 developments and regulator signals

The esports category has attracted increasing regulatory attention across the EU, and Cyprus is no exception. In 2026 the practical focus from supervisors sits on three fronts: the treatment of in-play esports markets and their integrity, the AML exposure created by virtual items and skins, and the control of advertising and influencer promotion. Where the regulator has not issued an esports-specific instrument, the general betting framework continues to apply in full, meaning esports products are regulated as betting products rather than as an exempt category. Operators should monitor official notices directly, because regulator guidance and application expectations are updated outside the primary statute and the current published position should always be confirmed at the point of application.

Do you need a Cyprus betting licence to offer esports betting?

For most commercial models the answer is yes. If you accept bets from customers located in Cyprus, you are providing a regulated betting service and need the appropriate authorisation under the Betting Law 106(I)/2012. The licence route is not a formality: it requires demonstrable AML controls, an appointed MLCO, financial probity and technical systems capable of supporting market integrity. Business-to-business suppliers who do not take bets themselves, platform providers, odds feeds and white-label technology vendors, occupy a different position, but they are not outside the regime entirely; their contracts, client due diligence and technical compliance all feed into the licensed operator’s obligations.

Before finalising a market-entry structure, it is worth reviewing the detailed requirements in a dedicated gambling licensing checklist and taking local advice.

Licence types relevant to esports betting cyprus

The authorisation you need depends on your role in the value chain. A direct-to-consumer operator, a B2B platform supplier and an affiliate network each face a different set of obligations. The table below summarises the main categories and should be read as orientation rather than a substitute for the regulator’s current published requirements, which govern in all cases. Licence classes, fees and durations are set by the National Betting Authority under the Betting Law and should be confirmed against the current published schedule.

Application process and expected timeline

A complete application is the single biggest determinant of how quickly you reach the market. The regulator assesses applicants against financial, operational and integrity criteria, and an incomplete submission is the most common cause of delay. In practice the core workstreams are: corporate and beneficial-ownership disclosure and probity checks; an appointed MLCO with the authority and resources to discharge the role; a documented AML/counter-terrorist-financing risk assessment and policy suite; technical systems documentation covering bet acceptance, settlement, data integrity and record retention; and readiness for a systems audit. Processing times vary with the completeness of the pack and the audit stage is frequently the gating item.

Operators should resource the MLCO appointment and the AML documentation first, because these cannot be produced credibly at speed and are scrutinised closely.

When a foreign licence may suffice and passporting limitations

Operators licensed in another jurisdiction sometimes assume their existing authorisation lets them serve Cypriot customers without local registration. That assumption is risky. Betting licences do not “passport” across EU member states in the way some financial services do; offering betting to Cyprus-resident customers engages the Cyprus framework regardless of where the operator is established. A foreign licence may be relevant to probity assessment and may streamline some elements of due diligence, but it does not remove the requirement to be authorised for the provision of betting to Cyprus customers.

Any cross-border model should be validated against the regulator’s current position and with local counsel before go-live, because the consequences of operating without the correct authorisation include enforcement action and reputational damage.

AML and KYC obligations for esports betting

AML and KYC compliance is where esports betting cyprus operators most often underestimate the work involved. The obligations are not a static checklist; they are a risk-based system that must be designed around the specific products, payment rails and customer base you serve. Esports introduces risk features, low-value high-frequency wagering, virtual-item flows and crypto payments, that generic casino AML frameworks do not always address. Building these controls, and documenting the reasoning behind them, is a core MLCO responsibility and is examined in detail in an AML and KYC guide for gambling operators.

AML legal framework and supervisory obligations

Cyprus implements the European Union’s anti-money-laundering framework, principally through the Prevention and Suppression of Money Laundering and Terrorist Financing Law (as amended to transpose the EU AML Directives). Operators are subject to the obligations that flow from that national law. Supervisory expectations are informed by European Banking Authority (EBA) guidance on AML and countering the financing of terrorism, which sets out how risk-based controls, customer due diligence and monitoring should be applied in practice. For products touching virtual assets, FATF guidance on a risk-based approach to virtual assets and virtual asset service providers (VASPs) is the reference point for the controls supervisors expect.

Operators should treat these instruments as the baseline against which their own policies are measured, and should document how each requirement is satisfied within their business.

Risk factors specific to esports and skins

Esports betting presents a distinct money-laundering risk profile. The most significant factors to address in your risk assessment are:

• In-game item and skin trading. Virtual items can hold real-world value and move through peer-to-peer and third-party marketplaces that sit outside your direct oversight.
• Crypto payment rails. Where deposits or withdrawals involve virtual assets, FATF VASP expectations and enhanced due diligence apply to counterparties and transaction sources.
• Low-value, high-frequency transactions. Many small wagers can be used to layer funds or obscure value movement, defeating threshold-only monitoring.
• Account takeovers and multi-accounting. Esports audiences skew digitally sophisticated; credential compromise and collusion are real integrity and AML risks.
• Cross-border flows. International player bases increase the likelihood of sanctioned or high-risk jurisdiction exposure.

Customer due diligence (KYC): procedures and technology

Customer due diligence is the frontline control, and a tiered approach aligned to risk is the standard model. A sample KYC framework for an esports betting cyprus operator would include the following layers, each of which should be reflected in a documented policy and operationalised in your onboarding flow:

• Baseline identity verification. Collect and verify identity data at onboarding using reliable, independent sources, electronic identity (eID) verification, document verification with liveness checks, and sanctions and politically-exposed-person screening.
• Remote verification controls. Because the product is delivered remotely, apply additional safeguards against impersonation and synthetic identities, including device and behavioural signals where appropriate.
• Ongoing monitoring. Re-verify and refresh customer information on a risk-sensitive cadence, and trigger review on material changes in behaviour.
• Enhanced due diligence (EDD). For high-risk customers, high-value flows, crypto deposits, high-risk jurisdictions or adverse screening hits, apply EDD, including source-of-funds and source-of-wealth checks before allowing continued activity.

KYC for gambling in Cyprus is not a one-time gate at registration; it is a lifecycle control. The MLCO should be able to demonstrate not only that checks were performed but that they were calibrated to the risk each customer presents, with escalation paths and record-keeping that would withstand supervisory review.

Transaction monitoring and suspicious activity reporting

Transaction monitoring should be tuned to the esports risk profile rather than inherited from a generic template. Effective monitoring combines rule-based thresholds with behavioural analytics so that patterns, rapid deposit-withdrawal cycles with minimal betting, structuring below reporting thresholds, or unexplained crypto flows, are surfaced for human review. Red flags warranting escalation include mismatches between declared source of funds and actual activity, activity inconsistent with the customer’s profile, and transactions linked to high-risk jurisdictions. Where suspicion arises, the operator must file a suspicious activity report with the Unit for Combating Money Laundering (MOKAS), the national Financial Intelligence Unit, and must not tip off the customer.

The MLCO owns the SAR decision and must maintain a defensible record of the rationale, whether or not a report is ultimately filed.

MLCO role and internal documentation

The Money Laundering Compliance Officer is the accountable individual for the AML framework. The MLCO is responsible for the risk assessment, policies and procedures, staff training, monitoring oversight and SAR decisions, and must have sufficient seniority, independence and resources to act. Supporting documentation, the written risk assessment, policy suite, training records, monitoring outputs and SAR decision logs, must be retained and kept audit-ready, because these records are the primary evidence of compliance when the regulator or an auditor examines the business.

Skin betting and virtual items: legal and enforcement risks

Skin betting cyprus sits at the sharp end of regulatory attention because it fuses gambling mechanics with virtual-item economies that are difficult to supervise. Operators considering any product that accepts, pays out in, or is denominated by virtual items should treat this as a high-risk design decision requiring specific legal and AML sign-off. The deeper analysis is covered in a dedicated skin betting and virtual items resource, but the core risks and mitigations are set out below.

What is skin betting and why regulators focus on it

“Skin betting” describes wagering that uses in-game cosmetic items (skins) as the stake or the prize, often routed through third-party sites and marketplaces rather than regulated payment systems. Regulators focus on it for three reasons: skins have real-world monetary value yet trade in opaque secondary markets, the activity frequently reaches younger audiences, and the value transfer can bypass conventional AML controls. From a Cyprus perspective, a product that functions economically as betting does not escape the betting perimeter simply because the stake is a virtual item rather than fiat currency, and the AML exposure attaching to virtual-asset flows is squarely in scope of FATF’s risk-based expectations.

How to mitigate legal, AML and consumer-protection risks

Where an operator chooses to offer or adjacently support skin-related markets, risk mitigation must be built in by design. Practical controls include:

• Market blocking. Where a product cannot be supervised to the required standard, the safest control is to block the market entirely rather than attempt partial mitigation.
• Item provenance verification. Where virtual items enter or leave the platform, verify their source and treat unexplained provenance as an AML red flag.
• Contractual controls with suppliers and marketplaces. Impose due diligence and compliance obligations on any third party in the value chain and retain audit rights.
• Cooperation with game publishers. Publishers increasingly restrict item trading; align with their terms to avoid facilitating prohibited transfers.
• Enhanced customer controls. Apply EDD, age verification and robust transaction monitoring to any virtual-item flow, given the elevated AML and consumer-protection risk.

Advertising, sponsorships and influencer promotions for esports betting cyprus

Marketing is now a frontline compliance area. The reach of esports content on social and streaming platforms means that advertising and influencer activity can quickly expose an operator to consumer-protection and regulatory risk, particularly around minors. A disciplined approach, documented sign-off, clear influencer contracts and platform-aware moderation, protects the brand and the licence. Operators building a creator programme should also review a dedicated esports sponsorships and influencer marketing resource.

Cyprus advertising rules and the consumer-protection overlay

Gambling advertising in Cyprus is governed both by the betting-specific rules the regulator oversees and by the general consumer-protection and advertising-law principles that apply to all commercial communications. The common thread is that advertising must be truthful, must not mislead, including on the likelihood of winning or the nature of bonuses, and must not be directed at or appeal to minors. For esports, where audiences include younger viewers, the obligation to avoid targeting and to apply age-gating is especially acute. Operators should maintain a documented advertising sign-off process so that every campaign is assessed against these standards before publication.

Influencer promotions: dos, don’ts and sample disclosure language

Influencer promotions of esports betting carry particular risk because the content is personality-led and audiences can be young. The essential controls are:

• Require clear disclosure. Paid or incentivised promotion must be identified as advertising in a way that is prominent and unambiguous, a sample disclosure line such as “Paid partnership, gamble responsibly, strictly for adults aged 18 and over” should appear clearly, not buried in a caption.
• Enforce age-gating and audience screening. Do not engage influencers whose audience is predominantly under the legal age, and apply platform age controls where available.
• Contract for compliance. The influencer agreement should mandate disclosure, prohibit misleading claims, require responsible-gambling messaging and reserve takedown and termination rights.
• Moderate and monitor. Review live and recorded content and keep records of approvals and takedowns.

Examples of prohibited or high-risk marketing

Certain approaches are either prohibited or carry such high risk that they should be avoided. These include glamorising gambling or presenting it as a route to financial success; any content that targets, features or appeals to minors; misleading presentation of odds, returns or “risk-free” offers; and bonus or free-to-play baiting that obscures wagering conditions. Treating these as hard stops in your marketing sign-off checklist is the simplest way to avoid the most common enforcement triggers.

Compliance playbook: pre-launch checklist and templates

A structured pre-launch playbook turns the obligations above into an auditable sequence. The items below are sample headings and must be adapted and legally reviewed for your business before use.

Minimum documentation operators must hold

At minimum, an esports betting cyprus operator should assemble and maintain:

• Licence application pack. Corporate structure, beneficial-ownership disclosure, probity evidence and financial standing documentation.
• AML/CFT risk assessment. A documented assessment covering products, customers, geographies and delivery channels, including the specific esports and virtual-asset risks.
• KYC policy. Tiered verification standards, EDD triggers, source-of-funds procedures and ongoing-monitoring cadence.
• Transaction-monitoring and SAR procedures. Rule logic, red-flag catalogue, escalation paths and reporting workflow.
• Advertising and influencer policy. Sign-off process, prohibited-content list and sample influencer contract clauses.
• Technical and record-retention documentation. Systems descriptions, data-integrity controls and retention schedules.

Sample MLCO reporting route and audit readiness

The MLCO reporting route should be documented so that any staff member knows how to escalate a concern and so that the regulator can see the chain of accountability. A sample route runs from frontline detection or a monitoring alert, to a compliance analyst for triage, to the MLCO for the reporting decision, with onward reporting to MOKAS where suspicion is established and board-level reporting on AML performance. Audit readiness means these steps are not only designed but evidenced: retained alerts, decision logs, training records and policy-version history should be retrievable on request. Operators that treat audit readiness as a continuous discipline rather than a pre-inspection scramble consistently fare better under supervision.

Enforcement, sanctions and common pitfalls

The consequences of non-compliance are material. Supervisory action can range from directions and financial penalties to licence suspension or revocation, alongside the reputational harm that follows public enforcement. Operating without the correct authorisation while serving Cyprus customers can also attract criminal liability under the Betting Law. The most common pitfalls are predictable: operating without the correct authorisation while serving Cyprus customers, a weak or undocumented AML risk assessment, KYC that stops at onboarding and is not maintained, advertising that reaches or appeals to minors, and skin or virtual-item products launched without adequate controls.

The practical remediation playbook is to identify gaps through an honest internal review, document and prioritise fixes, strengthen MLCO oversight and, where issues are serious, engage the regulator proactively and take local legal advice rather than waiting for enforcement to force the conversation.

Next steps for operators and recommended resources

If you are planning an esports betting cyprus launch in 2026, sequence your work so that the hardest elements come first. Confirm the current licensing requirements directly from the National Betting Authority; appoint a qualified MLCO and begin the AML risk assessment and policy suite early; design KYC and transaction monitoring around esports and virtual-asset risks rather than a generic template; and build your advertising and influencer sign-off process before any marketing goes live. Engage local counsel at the outset, you can identify suitable advisers through a Cyprus lawyers directory, and treat every sample template in this guide as a starting point that requires legal review for your specific model.

Sources

1. National Betting Authority of Cyprus, regulator and licensing pages
2. Cyprus legal portal (primary legislation repository), CyLaw
3. European Commission, Anti-Money Laundering overview
4. FATF, Guidance for a Risk-Based Approach to Virtual Assets and VASPs
5. European Banking Authority (EBA), AML/CFT policy pages
6. Law Office of the Republic of Cyprus, Unit for Combating Money Laundering (MOKAS)
7. Cyprus Bar Association, professional practice and referral