Is Gambling Legal in Cyprus?

Software Certification and Technical Standards

• All betting software and systems used by operators must be certified by approved independent testing laboratories to ensure fairness, randomness, and compliance with technical standards set by the National Betting Authority.
• Operators are required to implement secure, reliable, and auditable systems for bet processing, transaction recording, and game result generation.
• Technical systems must support real-time monitoring and allow the regulator to access data for oversight purposes.
• Software updates or significant changes must be reported to the authority and may require re-certification before deployment.

Data Protection, Privacy Measures, and Server Location

• Operators must comply with the General Data Protection Regulation (GDPR), ensuring the protection and confidentiality of all player and transaction data.
• Personal and sensitive data must be stored securely, with access restricted to authorized personnel only.
• Operators are required to implement robust cybersecurity measures, including encryption of data in transit and at rest, firewalls, and intrusion detection systems.
• All primary servers handling player data and betting transactions must be physically located within the territory of Cyprus or another EU/EEA member state, unless otherwise approved by the regulator.
• Regular penetration testing and vulnerability assessments are required to maintain data security.

Anti-Money Laundering (AML) and Know Your Customer (KYC) Procedures

• Operators must implement comprehensive AML policies in line with national and EU directives, including customer due diligence and ongoing monitoring of transactions.
• KYC procedures must be in place to verify the identity, age, and source of funds of all customers before allowing betting activity or withdrawals.
• Enhanced due diligence is required for high-risk customers and transactions that exceed specified thresholds.
• Operators must maintain systems to detect and report suspicious transactions to the relevant authorities without delay.
• All KYC and AML procedures must be documented and regularly reviewed for compliance and effectiveness.

Financial Reporting, Auditing Standards, and Record-Keeping

• Operators are required to maintain accurate and up-to-date records of all betting transactions, customer accounts, and financial operations.
• Financial statements and operational reports must be prepared in accordance with international accounting standards and submitted to the regulator as required.
• Annual independent audits of financial and technical systems are mandatory, with audit reports submitted to the National Betting Authority.
• Records must be retained for a minimum period specified by the regulator, typically at least five years, and be available for inspection upon request.

Technical Implementation Requirements for Responsible Gambling Tools

• Operators must integrate responsible gambling tools into their platforms, allowing players to set deposit, loss, and session time limits.
• Self-exclusion functionality must be available, enabling players to voluntarily exclude themselves from betting for specified periods or indefinitely.
• Systems must provide real-time monitoring and automatic enforcement of self-imposed and regulator-mandated limits.
• Information about responsible gambling and support resources must be clearly accessible on all operator platforms.
• Operators are required to implement systems for identifying and intervening with at-risk players based on behavioral monitoring and predefined risk indicators.