Financial certification used to work on a one-and-done basis. Pass the exam, you're qualified for life. However, that model is gone in Cyprus, and it isn't coming back. This means that training or continuous professional development (CPD) is more important than ever and a mandatory requirement for professionals on a yearly basis. This is where FM Academy comes in, and why your next CPD checklist may be the easiest decision you make in 2026.
At present, all Cyprus Securities and Exchange Commission (CySEC) certified persons, or anyone holding a Basic, Advanced, or AML certification, now must log Continuous Professional Development hours every year to keep their registration valid. This means 10 hours for Basic, 15 for Advanced, 10 for AML, and up to 20 for combined certifications. If an individual misses the December 31 deadline, then they are deregistered automatically. Re-registering costs an extra €280 on top of the standard renewal fee. Unfortunately, there's no appeal for I didn't get to it.
Now this isn't paperwork for its own sake. Rather, its CySEC admitting something regulators across Europe have quietly concluded. A certificate from five years ago tells you nothing about whether someone understands today's rulebook.
The Regulatory Rulebook Doesn't Sit Still
Anyone spending more than five minutes looking at the regulatory space would be hard-pressed to disagree with this assessment, especially given the speed everything is moving. Look at what's landed on Cypriot compliance desks in the last two renewal cycles alone. MiCA reshaped supervision of crypto-asset service providers from the ground up. CySEC has issued fresh AML circulars on beneficial ownership and transaction monitoring annually.
DORA brought operational resilience obligations to compliance officers who never had to think about ICT risk before. Someone who studied for their exam in 2020 isn't slightly out of date. Such people are from a different era entirely, missing entire regulatory regimes that didn't exist when they sat the test.
That's the real case for CPD, separate from the compliance-checkbox version people default to. Regulators aren't requiring hours because they like paperwork. They're requiring it because knowledge decay is a genuine source of risk. AML failures and mis-selling cases rarely come from bad actors. They come from people who didn't know the rule had changed.
CPD Doesn’t Stop at the Three Exams
CPD obligations in Cyprus extend well past CySEC's headline certifications. Employees at CySEC-supervised firms need regular AML/CFT training regardless of whether they hold a certificate, and new hires need it before they touch client work. ICPAC accountants and Cyprus Bar Association lawyers working inside regulated firms carry their own parallel hour requirements. The perimeter keeps expanding. Nobody's shrinking the list of people who need to keep training.
For firms, that changes what training is on a balance sheet. It used to sit in the discretionary column: useful, first thing cut when budgets tighten. Under a CPD regime it's closer to a licensing cost. Let your AML compliance officer's hours lapse and you're not looking at a knowledge gap. You're looking at deregistration, which is a business continuity problem, not an HR one.
Not Every Hour Counts the Same
The content matters as much as the count. CySEC's requirement isn't satisfied by any 10 or 15 hours of vaguely finance-adjacent training. The material must map to the legislative framework tied to the certification: AML-focused content for the AML certification, broader coverage of investment services law and the CIF regulatory regime for Basic and Advanced.
A compliance officer who spends their CPD hours on generic soft-skills training and shows up at renewal with certificates that don't reference the relevant framework risks having that training rejected outright, which puts them back to square one with the clock already running.
That's why a market for accredited CPD providers has grown up around the requirement, offering courses built specifically to CySEC's categories and producing the documentation certified persons need at renewal.
What You Need to Do in 2026
Plan it, don't improvise it. Certified staff need to know exactly how many hours they owe, by when, and whether the training they're doing counts. Individuals or firms that leave this until December end up with a compliance officer who's technically deregistered in January, scrambling to source last-minute accredited content that may not even be available on short notice. Explore the full list of CPD courses and credits on offer at FM Academy.
There's a counterparty-risk angle too. Banking partners and institutional counterparties doing due diligence on Cyprus-regulated firms now routinely ask whether the compliance team's certifications are current. A lapsed certification, even briefly, is exactly the kind of finding that turns up in a correspondent bank's risk review.
None of this is about ticking a box once a year. It's a regulator saying competence has a shelf life, and that keeping people current is now as much a part of running a licensed financial business as the license itself.
