CySEC issued a 2026-05-22 alert to Cyprus investment firms (CIFs) after a sharp spike in MOKAS suspicious-transaction-report (STR) alerts. The Financial Intelligence Unit’s data points to growing cross-border financial activity and increased AML risk exposure for the 808 supervised entities under CySEC supervision (47 new CIF licences approved in 2025 alone).
What CySEC is telling CIFs. Per CySEC’s communication: regulated entities must implement strengthened AML guidelines + new risk reports. For CFD brokers specifically, the regime requires:
- Real-time screening of customers, beneficial owners, intermediaries, and counterparties against EU, UN, and US sanctions lists - both at onboarding and on an ongoing basis.
- Immediate escalation frameworks integrating sanctions, AML, and market abuse monitoring.
- Comprehensive documentation of screening results including false positives.
The procurement implication for the regtech stack. The regtech pillar’s vendor universe covers six functional layers - institutional sanctions/PEP screening (LSEG World-Check), transaction monitoring (NICE Actimize, SAS AML), trade surveillance (eflow Global, ACA Group ComplianceAlpha), CLM/entity resolution (Fenergo, Quantexa), regulatory reporting (MAP FinTech, Cappitech, TRAction). The MOKAS alert spike implicates the transaction monitoring + sanctions screening layers most directly. CIFs running below institutional-grade transaction monitoring (rules-based vs entity-centric, batch-mode vs real-time) face the highest STR-quality risk.
The 2026 applicants pivot. Per CySEC, 2026 CIF applicants are expected to demonstrate a sanctions compliance framework that meets the new standard at the point of application, not as an afterthought post-licensing. The implication for new CIF launches: the regtech stack is now part of pre-licence procurement, not a post-licence integration project.
Cross-pillar reference. This dispatch threads into the existing Sumsub × ComplyAdvantage Mesh partnership dispatch - the historical pattern of broker-CRM + standalone-KYC + standalone-sanctions is collapsing as vendors absorb each other’s functionality. Brokers running the integrated stack (Sumsub-with-Mesh, Fenergo’s FinCrime OS, NICE Actimize SAM-10) have a structural advantage in the MOKAS-alert era over operators running multi-vendor disconnected stacks.
What Brokerage Atlas recommends for procurement teams. Map the current regtech stack against the six functional layers + score each layer’s MOKAS readiness. Vendors with documented STR-quality improvements + entity-centric analytics + real-time screening (NICE Actimize SAM-10, Fenergo FinCrime OS, ComplyAdvantage Mesh via Sumsub) score highest. The full 6-layer scoring framework appears in the chapter’s methodology section.