On October 20, 2025, Cyprus introduced criminal liability for any actions that benefit sanctioned individuals or companies. Now, any interaction — from providing services to holding funds — may lead to fines or imprisonment.
Context
🔵 The law fulfills the EU requirement to criminalize sanctions evasion
🔵 Applies to citizens, residents, companies, and entities under the Cypriot flag
🔵 Sanctions apply to Russia, Belarus, Iran, and other jurisdictions
🔵 Wording is broad: almost any economic connection may fall under violation
What counts as a violation
🔴 Transactions with sanctioned banks
🔴 Professional services (IT, iGaming, legal, etc.)
🔴 Investments, loans, and other financial operations
🔴 Supporting projects linked to sanctioned structures
🔴 Even renting an office from a "high-risk" company may raise red flags
Liability
🔵 Companies: fines up to € 40M or 5% of annual turnover, risk of losing licenses
🔵 Individuals: fines up to € 100,000 and up to 5 years in prison
🔵 Exceptions apply only to humanitarian aid
What this means for the market
🔴 Businesses will look for alternative jurisdictions with more predictable regulation
🔴 Cyprus stops being a suitable hub for projects working with sanction-sensitive markets
🔴 Partner networks will tighten traffic filtering: volumes may drop while quality requirements rise
🔴 Player acquisition costs from "high-risk" regions will increase due to enhanced compliance checks
What companies should do
🔵 Conduct a full audit of partners and clients
🔵 Update contracts with sanction-compliance clauses and shared liability
🔵 Verify source of funds and avoid transit jurisdictions
🔵 Eliminate any operations involving sanctioned entities
Conclusion
The new law sharply increases risks for iGaming companies: sanctions compliance becomes an essential part of the operating model. Mistakes are now costly, and business resilience depends on the quality of partner verification and transparency of financial flows.
🔵 The law fulfills the EU requirement to criminalize sanctions evasion
🔵 Applies to citizens, residents, companies, and entities under the Cypriot flag
🔵 Sanctions apply to Russia, Belarus, Iran, and other jurisdictions
🔵 Wording is broad: almost any economic connection may fall under violation
What counts as a violation
🔴 Transactions with sanctioned banks
🔴 Professional services (IT, iGaming, legal, etc.)
🔴 Investments, loans, and other financial operations
🔴 Supporting projects linked to sanctioned structures
🔴 Even renting an office from a "high-risk" company may raise red flags
Liability
🔵 Companies: fines up to € 40M or 5% of annual turnover, risk of losing licenses
🔵 Individuals: fines up to € 100,000 and up to 5 years in prison
🔵 Exceptions apply only to humanitarian aid
What this means for the market
🔴 Businesses will look for alternative jurisdictions with more predictable regulation
🔴 Cyprus stops being a suitable hub for projects working with sanction-sensitive markets
🔴 Partner networks will tighten traffic filtering: volumes may drop while quality requirements rise
🔴 Player acquisition costs from "high-risk" regions will increase due to enhanced compliance checks
What companies should do
🔵 Conduct a full audit of partners and clients
🔵 Update contracts with sanction-compliance clauses and shared liability
🔵 Verify source of funds and avoid transit jurisdictions
🔵 Eliminate any operations involving sanctioned entities
Conclusion
The new law sharply increases risks for iGaming companies: sanctions compliance becomes an essential part of the operating model. Mistakes are now costly, and business resilience depends on the quality of partner verification and transparency of financial flows.