Gambling Lawyers Cyprus 2026: Online Casino Legalisation, Licensing & AML Compliance

Cyprus is at a decisive juncture in its regulation of online gambling. The National Betting Authority’s (NBA) Strategic Plan 2026–2028 has placed online casino legalisation firmly on the regulatory agenda, prompting operators, investors and in-house counsel to reassess market-entry strategies and compliance frameworks. For anyone seeking guidance from gambling lawyers in Cyprus, the central question is no longer whether the regulatory landscape will shift but how quickly, and what licensing, anti-money-laundering (AML) and commercial steps must be completed now to be ready.

This guide provides a practical, decision-oriented roadmap covering the current legal position under the Betting Law 37(I)/2019, the NBA’s planned regulatory milestones, the Class B licence application process, AML obligations including Money Laundering Compliance Officer (MLCO) duties, and the tax and contractual changes operators should prioritise in 2026.

Critical Takeaways For Online Gambling Lawyers Cyprus 2026

Before diving into detailed analysis, the following decision bites summarise the key actions for each reader profile:

• If you are a prospective online betting operator: Confirm that your planned activities fall within the scope of Betting Law 37(I)/2019. Prepare a Class B licence application, appoint an MLCO, and build your AML/KYC programme now, the NBA’s enhanced supervisory measures mean applications will face greater scrutiny.
• If you are an investor evaluating Cyprus market entry: Online sports betting is licensable today; online casino gaming remains unlicensed pending legislative reform. Factor the NBA Strategic Plan 2026–2028 timeline into financial models and secure legal advice on structuring options and transfer-pricing compliance.
• If you are in-house counsel or a compliance officer: Audit existing supplier and platform contracts against the NBA’s strengthened responsible gambling and AML requirements. Ensure that your MLCO reporting lines, suspicious-activity-report (SAR) procedures and customer due diligence (CDD) controls meet the latest guidance from the Cyprus Financial Intelligence Unit (FIU, MOKAS).
• If you are external counsel advising gambling clients: The NBA’s consultation process on online casino legalisation in Cyprus creates an advisory window, position your practice to guide operators through licensing applications, AML gap assessments and commercial contract rewrites.

The primary compliance decision this guide helps you answer: Can my business lawfully enter the Cyprus online casino or betting market in 2026, and what steps and controls are required to obtain and maintain a licence while meeting all AML obligations?

1. Current Legal Position (2026): What Is Permitted and What Is Not

Betting Law 37(I)/2019, Scope and Limitations

The principal legislation governing gambling in Cyprus is the Regulation of Betting Law 37(I)/2019 (the “Betting Law”). This statute established the NBA as the independent supervisory and regulatory authority responsible for licensing, monitoring and enforcing betting activities in the Republic of Cyprus. The Betting Law created a structured licensing regime, defined prohibited activities, and set out obligations for licensees including AML compliance, responsible gambling measures and consumer protection standards.

Under the Betting Law, the NBA issues licences in defined classes. The most commercially significant for online operators is the Class B licence, which authorises the provision of online betting services, principally sports betting. The law imposes strict eligibility criteria, including fit-and-proper-person tests, minimum capitalisation thresholds, and the obligation to maintain adequate internal controls.

What Is Currently Legal vs. What Remains Prohibited

As of May 2026, the position can be summarised as follows:

• Permitted: Online sports betting operated by Class B licensees authorised by the NBA. Land-based casino operations authorised under separate legislation (including the integrated casino resort regime).
• Prohibited: Online casino gaming, including virtual table games, online slots and live-dealer casino products, remains outside the scope of the current licensing framework. Operators offering these products to Cyprus-based consumers without authorisation risk criminal and administrative sanctions under the Betting Law.

Industry observers expect this prohibition to be the subject of formal legislative consultation during the NBA Strategic Plan period, but until amending legislation is enacted, the offering of online casino products in or from Cyprus is unlawful.

2. NBA Strategic Plan 2026–2028: What Gambling Lawyers in Cyprus Are Watching

Key Measures and Policy Directions

The NBA’s Strategic Plan 2026–2028 represents the most significant forward-looking regulatory document for the Cyprus gambling sector. It signals the Authority’s intention to modernise and expand the regulatory framework in several critical areas:

• Online casino legalisation consultation: The Strategic Plan includes provisions to evaluate and potentially recommend the legalisation and regulation of online casino gaming. Early indications suggest a structured consultation process involving stakeholders, licensed operators and international regulatory benchmarks.
• Strengthened responsible gambling framework: Enhanced player-protection tools, including deposit limits, self-exclusion registries and mandatory affordability checks, are flagged as priorities.
• AML and supervisory enhancements: The NBA intends to tighten its AML supervisory capacity, increase the frequency and depth of compliance inspections, and align its framework more closely with EU Anti-Money Laundering Directive requirements and FATF recommendations.
• Licensing framework refinements: Adjustments to licence categories, application procedures and ongoing compliance reporting obligations are anticipated.

Regulatory Timeline and Milestones

While the precise legislative calendar depends on parliamentary processes, the likely practical effect of the Strategic Plan is as follows:

For operators and their gambling lawyers in Cyprus, the immediate action is clear: treat the Strategic Plan as a regulatory signal to invest in compliance infrastructure now, rather than waiting for final legislation. Entities that are licensing-ready when reform lands will have a material first-mover advantage.

3. Cyprus Gambling Licence: Classes, Applications and Practical Steps

Licence Types Under the Betting Law

The Betting Law 37(I)/2019 establishes multiple licence categories. The most relevant for operators, platforms and service providers are:

Class B Licence Cyprus, Eligibility and Documentation

The Class B licence is the gateway for online betting operators. Applicants must satisfy the NBA on a range of eligibility criteria:

• Corporate establishment: The applicant must be a legal entity (typically a Cyprus-registered company or an entity with a licensed branch or establishment in Cyprus).
• Fit-and-proper-person test: Directors, beneficial owners and key personnel must pass background checks covering criminal records, financial standing, and prior regulatory history.
• Minimum capitalisation: Evidence of adequate financial resources to fund operations, meet player liabilities and maintain solvency throughout the licence term.
• Technical compliance: The betting platform must meet NBA-prescribed technical standards for security, data integrity, random-number generation (where applicable) and player account management.
• AML/KYC programme: A documented AML compliance programme, including appointment of an MLCO, customer due diligence procedures, transaction monitoring systems and SAR reporting protocols, must be submitted with the application.
• Responsible gambling plan: Operators must demonstrate player-protection measures including self-exclusion tools, deposit limits, and underage-gambling prevention.

Step-by-Step Application Checklist

1. Pre-application due diligence: Engage Cyprus gambling lawyers to assess eligibility, corporate structure requirements and any regulatory obstacles. Conduct a gap analysis against NBA technical and compliance standards.
2. Company formation or restructuring: Establish or restructure the applicant entity in Cyprus, ensuring share registers, director appointments and UBO declarations are current and compliant.
3. Compile the application dossier: Prepare all required documentation, articles of association, audited financials, proof of capitalisation, fit-and-proper declarations, platform technical specifications, AML programme documentation, and responsible gambling policy.
4. Submit application to the NBA: File the completed dossier through the NBA’s prescribed application process. Pay the application fee as set out in the applicable NBA fee schedule.
5. NBA review and information requests: The NBA will review the application, conduct background checks and may request supplementary information or clarification. Applicants should budget for an iterative review period.
6. Decision and licence grant: Upon satisfaction of all criteria, the NBA issues the Class B licence subject to conditions. The licence is typically time-limited and subject to annual renewal, ongoing compliance obligations and periodic reporting.
7. Post-licence operational compliance: Launch operations in accordance with licence conditions. Maintain continuous compliance with AML, responsible gambling and technical standards. Prepare for NBA supervisory inspections.

Common reasons for refusal or delay: Incomplete documentation, failure to meet fit-and-proper thresholds, inadequate capitalisation evidence, AML programme deficiencies, and non-compliant technology infrastructure. Engaging experienced gambling lawyers in Cyprus at the pre-application stage significantly reduces refusal risk.

4. AML Obligations, KYC and MLCO Duties for Gambling Operators in Cyprus

The Cyprus AML Framework Applied to Gambling

Cyprus gambling operators are subject to a comprehensive AML regime derived from multiple legal sources. The Prevention and Suppression of Money Laundering and Terrorist Financing Laws transpose EU Anti-Money Laundering Directives into domestic law. The NBA enforces AML obligations specific to licensed betting operators, while the Financial Intelligence Unit (MOKAS) serves as the central authority for receiving and analysing SARs. Additionally, Cyprus aligns with FATF recommendations, which provide the international baseline for AML standards in the gambling sector.

The AML obligations applicable to gambling operators in Cyprus are among the most scrutinised compliance areas, and the NBA Strategic Plan 2026–2028 signals even more intensive supervisory activity ahead.

MLCO Role: Responsibilities, Reporting Lines and Recommended Controls

Every licensed gambling operator in Cyprus must appoint an MLCO. This role carries significant regulatory and personal liability and must not be treated as a paper exercise. Key responsibilities include:

• AML programme design and maintenance: Drafting, implementing and periodically updating the operator’s AML policies, procedures and internal controls.
• Risk assessment: Conducting and documenting periodic money-laundering and terrorist-financing risk assessments covering the operator’s product range, customer base, geographic exposure and delivery channels.
• Training: Ensuring all relevant staff receive adequate AML training, with records of training content, attendance and assessment results maintained.
• SAR management: Reviewing internal suspicious-activity alerts, making determinations on whether to file SARs with MOKAS, and maintaining a complete SAR register.
• Regulatory liaison: Serving as the primary point of contact for NBA and MOKAS on AML matters, cooperating with inspections, and responding to regulatory information requests.
• Board reporting: Providing periodic written reports to the operator’s board of directors on AML compliance status, audit findings, and remedial actions.

Customer Due Diligence, Monitoring, SARs and Recordkeeping

The practical CDD and monitoring obligations for operators include:

• Customer identification and verification: Collect and verify identity documents (government-issued ID, proof of address) for all registered players before they can deposit or place bets. Enhanced due diligence (EDD) applies to high-risk customers, politically exposed persons (PEPs) and players from high-risk jurisdictions.
• Ongoing monitoring: Implement automated transaction-monitoring systems to flag unusual betting patterns, large or rapid deposits/withdrawals, and activity inconsistent with the player’s known profile.
• SAR filing: Where monitoring or staff observation identifies suspicious activity, the MLCO must assess and, where appropriate, file a SAR with MOKAS without delay and without tipping off the customer.
• Recordkeeping: Maintain all CDD records, transaction records, SAR files and internal assessment documentation for the prescribed retention period under Cyprus AML law (generally five years from the end of the business relationship or the date of the transaction, whichever is later).

Sample MLCO KPIs and controls checklist:

• Percentage of new accounts with completed CDD within prescribed timeframe
• Number of automated transaction-monitoring alerts reviewed vs. escalated
• SAR filing rate and average time from alert to SAR submission
• Staff AML training completion rate
• Number and outcome of internal AML audits conducted
• Timeliness and completeness of board AML reports

5. Gambling Tax Cyprus: Fees, Rates and Commercial Considerations

Licence Fees vs. Operator Tax

Operators applying for a Cyprus gambling licence should distinguish between one-off application fees, annual licence fees and the ongoing gambling tax or gross gaming revenue (GGR) obligations. The NBA publishes fee schedules applicable to each licence class. Application fees are payable upon submission, while annual fees are a condition of licence renewal. The practical impact on operator margin varies depending on the licence class, the volume of betting activity and the applicable tax rate on GGR.

Industry observers expect the NBA’s licence-class and fee-structure review (flagged in the Strategic Plan 2026–2028) to introduce adjustments, particularly if online casino licensing becomes available. Operators should model scenarios with revised fee levels when preparing financial projections.

Payment Processing, VAT and Withholding Considerations

Online betting operators must ensure payment-processing arrangements comply with both NBA requirements and Cyprus tax law. Key considerations include:

• VAT treatment: The VAT treatment of betting and gaming transactions in Cyprus requires careful analysis, the supply of betting services may be exempt or subject to specific rules depending on the nature of the product and the location of the customer.
• Withholding obligations: Operators making payments to non-resident suppliers, affiliates or platform providers should assess withholding-tax obligations under Cyprus domestic law and applicable double-tax treaties.
• Payment-service-provider compliance: Operators must use authorised payment processors and ensure player funds are adequately segregated in compliance with licence conditions.

Cross-Border Operator Models

A critical structural decision for market entrants is whether to establish a local Cyprus entity, operate through a licensed branch, or rely on a remote-operator model. Each approach carries different tax, transfer-pricing and regulatory implications. Cyprus gambling lawyers routinely advise on the optimal structure, factoring in corporate tax rates, intellectual-property holding arrangements, and the NBA’s requirements for local presence and operational substance.

6. Supplier, Platform and Player-Facing Contract Changes

Key Contract Clauses for Platform Suppliers and Game Studios

Licensing applications require operators to demonstrate that their entire supply chain, from platform providers to game studios, meets NBA standards. This means existing commercial contracts will almost certainly need amendment. Priority clauses include:

• Compliance warranties: Suppliers must warrant that their products meet all applicable technical, AML and responsible gambling standards.
• Audit rights: The operator (and, by extension, the NBA) must have the contractual right to audit supplier systems, data and processes.
• Regulatory-change provisions: Contracts should include mechanisms to accommodate changes in law or regulation without requiring full renegotiation.
• Data-protection and security obligations: Suppliers handling player data must comply with GDPR and any NBA-specific data-protection requirements.

IP, Revenue Share and Liability Caps

Operators should review intellectual-property ownership and licensing terms carefully. Revenue-share arrangements must be documented transparently for NBA reporting purposes and transfer-pricing compliance. Liability caps should be calibrated to reflect regulatory risk, if a supplier failure causes a licence condition breach, the operator bears regulatory consequences.

Operational SLAs and RG/KYC Responsibility Allocation

Service-level agreements (SLAs) with technology providers must explicitly address uptime, incident response and responsible gambling tool availability. The allocation of KYC responsibilities between operator and supplier must be clearly documented, as the operator remains ultimately accountable to the NBA for CDD compliance.

Pre-application contract review checklist:

• Insert or strengthen compliance and regulatory-warranty clauses in all supplier agreements
• Secure NBA-compatible audit rights over supplier systems and data
• Update player-facing terms and conditions to reflect responsible gambling obligations, self-exclusion procedures and complaint-handling mechanisms
• Ensure IP licensing and revenue-share arrangements are transfer-pricing compliant
• Align SLA uptime and incident-response commitments with NBA technical standards
• Add regulatory-change and termination-trigger provisions covering licence revocation or regulatory action scenarios

7. Quick Reference: Licence Comparison and 2026 Regulatory Timeline

Anticipated 2026 regulatory milestones:

• Q2 2026: NBA continues implementation of Strategic Plan 2026–2028; enhanced AML inspections likely underway for existing licensees
• Q3–Q4 2026: Industry observers expect the NBA to initiate or advance the consultation process on online casino legalisation in Cyprus
• Ongoing 2026: Responsible gambling framework upgrades phased in; licence-class and fee-structure review progresses

Conclusion

The regulatory environment for online gambling in Cyprus is evolving rapidly. Operators, investors and counsel who act now, completing licensing groundwork, strengthening AML controls and updating commercial agreements, will be best positioned to capitalise on the opportunities the NBA Strategic Plan 2026–2028 is expected to create, including the potential legalisation of online casinos. Engaging experienced gambling lawyers in Cyprus at the pre-application stage is the single most effective step to reduce regulatory risk and accelerate market entry.

Sources

1. Michael Kyprianou, Gaming and Gambling Law Cyprus
2. Chambers & Co, Remote Gambling
3. LLPO Law Firm, Betting and Gaming
4. Panayiotis Z. Toulouras LLC, Gaming Licensing
5. Legal 500 / E & G Economides, Industry Standards and Regulation in the Gaming Industry Under Cyprus Law