Cyprus has a financial crime problem that is getting harder to ignore. Three interlocking risks — gambling-sector laundering, technology-driven fraud, and the money mule pipelines that connect them — have been brought into sharp focus by the latest round of reports from the Cyprus Strategic AML/CFT Public-Private Collaboration Initiative. What emerges from those reports is not a tidy taxonomy of threats but a picture of criminal methods that borrow from one another, exploit the same digital infrastructure, and increasingly outpace the compliance tools designed to catch them.
The Gambling Problem
Start with the numbers. European gambling revenue hit €123.4 billion in 2024.
Cyprus’s own betting market generated roughly €1.224 billion in gross gaming revenue — a figure that has been climbing steadily. More volume means more transactions, and more transactions mean more cover for illicit funds.
An analysis of 404 Suspicious Activity Reports and Suspicious Transaction Reports filed between 2021 and 2025 shows what that cover looks like in practice. The most persistent pattern is simple: a customer deposits an amount that makes no sense given what the operator knows about them, gambles minimally or not at all, then withdraws the balance. The money has now passed through a regulated entity. That regulated entity’s name can appear on whatever documentation the customer needs to explain where the funds came from. It is not a sophisticated scheme. It works because volume and speed make individual cases easy to miss.
Online platforms carry specific vulnerabilities — third-party funding, multiple payment methods, customers who cannot explain their source of funds — but the reports are careful to flag that physical casinos remain in a category of their own. Large cash buy-ins, denomination swaps, structuring deposits just below reporting thresholds, chip purchases followed by immediate cash-out with almost no play: these are old techniques, but they are still being used. Counterfeit notes turning up at casino cages is not an emerging risk; it is an ongoing one.
The Documents Are Fake. The AI Made Them.
The verification side of the problem has grown considerably more difficult. Regulated entities are encountering forged identity documents and fabricated financial records at a rate that was not the case even three or four years ago. That shift is largely attributable to generative AI.
Fabricating a convincing bank statement or payslip used to require some technical skill and time. It no longer does. The quality of AI-generated documentation has reached a point where standard document review procedures — checking formatting, fonts, layout consistency — provide much weaker protection than they once did. This matters acutely for enhanced due diligence on high-risk customers, where the whole exercise depends on being able to trust supporting documents.
The reports stop short of prescribing specific technological countermeasures, but the implication is unavoidable: verification workflows built around visual document inspection alone are no longer adequate. The challenge for operators and financial institutions is that better verification is expensive, slows onboarding, and — if applied inconsistently — creates its own regulatory exposure.
Fraud at Scale
The fraud picture in Cyprus reflects a broader European pattern. Phishing, smishing, vishing, business email compromise, investment fraud, romance scams, online shopping fraud, holiday rental scams: all of these are active and, in most cases, growing. What has changed is the role of technology in making them more convincing and more scalable.
Deepfake audio and video are no longer theoretical risks. Criminals are using them to impersonate executives, family members, and customer service representatives with enough fidelity to deceive people who are paying attention. Social media has become the dominant recruitment channel for fraud victims, though email, SMS, and telephone remain heavily used. Elderly individuals remain disproportionately targeted, but that framing can obscure the breadth of the problem — victims come from every demographic.
The common thread across these schemes is speed. Once a victim transfers funds, the money moves quickly across accounts and jurisdictions. By the time a complaint is filed and law enforcement begins to act, recovery is often impossible. That is not accidental. It is the point.
The Mule Networks
Here is where the reports break genuinely new ground, or at least put a sharper frame on a risk that is often underestimated. Money mules — individuals who receive criminal proceeds and forward them onward, typically for a commission — are not a peripheral feature of modern financial crime. They are load-bearing infrastructure.
Without mule networks, fraud operations at scale become significantly harder to run. The mule layer creates distance between perpetrators and the point of initial theft, fragments the money trail across multiple accounts and jurisdictions, and absorbs much of the tracing effort that law enforcement would otherwise direct at the criminals themselves.
Recruitment has become more systematic. Fake job advertisements, investment opportunities, social media promotions, peer referrals: criminal groups have learned to target students, unemployed individuals, recent migrants, and people in financial difficulty — populations that may be predisposed to overlook warning signs when offered what sounds like easy income. The pitch is usually some variant of “receive money into your account, forward it on, keep a percentage.”
One finding in the reports deserves particular attention: a meaningful number of mules do not fully understand what they are participating in. Some have been deceived. Some have been told a plausible story about currency conversion, business payments, or investment activity and have chosen to believe it. This creates what the reports describe as hybrid victim-offender scenarios — situations where a single individual is simultaneously a victim of fraud and a participant in money laundering. That complexity has real implications for prosecution, for regulatory liability, and for how financial institutions think about customer relationships when suspicious activity is identified.
What to Watch For
The detection guidance in the reports is worth taking seriously. On the transactional side: rapid fund movement, high velocity of transactions, multiple small incoming credits from unrelated sources, immediate onward transfers following receipt, sudden activity in previously dormant accounts, and frequent cash withdrawals immediately after incoming credits. These are not individually diagnostic, but combinations of them warrant scrutiny.
Behaviourally: customers who cannot explain what their account activity is for, who reference online jobs or cryptocurrency opportunities when asked, who are reluctant to provide documentation, or who appear to be taking instructions from someone else during interactions. That last indicator is particularly relevant for the mule population.
The Public-Private Angle
The initiative producing these reports is itself worth noting. Cyprus has structured its analytical work around genuine collaboration between financial institutions, law enforcement, and the Financial Intelligence Unit — not simply information flowing one direction from regulator to industry. That model allows typologies and emerging patterns to be shared in something closer to real time, which matters when criminal methods are evolving as quickly as they currently are.
Whether the collaboration is producing sufficient intelligence to meaningfully disrupt the networks described in the reports is a harder question. The reports are candid about vulnerabilities that persist despite existing frameworks. Progress is real; the problem has not been solved.
Where This Leaves Compliance Professionals
The honest summary of these reports is that the risk environment is getting more complex, not less. The underlying laundering typologies in gambling — minimal play, source-of-funds evasion, cash structuring — have not changed fundamentally, but the volume of transactions and the sophistication of documentation fraud have both increased. At the same time, fraud operations are generating more illicit proceeds that need to be moved, and mule networks are the mechanism by which that movement happens.
For compliance teams, the practical challenge is prioritisation. Enhanced monitoring, improved document verification, and better detection of mule-related indicators all cost money and require sustained investment. The reports do not offer a hierarchy. What they do make clear is that entities that have not updated their frameworks to account for AI-generated documentation risks and mule network typologies are operating with a meaningful gap in their defences.
That is not a comfortable position, and the reports do not suggest it should be treated as one.
