Regulatory glossary: DORA, MiCA, AML, MiFID, PSD2 and Maltese gaming

Plain-English definitions of the regulatory terms compliance officers in Cyprus, Greece and Malta meet every day — with the practical context our team adds when we draft policies and respond to supervisors.

DORA

ICT Risk

Any reasonably identifiable circumstance in relation to the use of network and information systems that, if materialised, may compromise the security of those systems, of any technology-dependent tool or process, of operations and processes, or of the provision of services.

In Cyprus, Greece & Malta: Under DORA, every CySEC-regulated firm in Cyprus must maintain a board-approved ICT risk management framework covering identification, protection, detection, response, recovery and learning.

DORA

Critical or Important Function(CIF)

A function whose disruption would materially impair the financial performance of the firm, the soundness or continuity of its services and activities, or its ability to comply with authorisation conditions.

In Cyprus, Greece & Malta: DORA's strictest obligations — including threat-led penetration testing and contractual provisions in Article 30 — apply to ICT services supporting CIFs. For Maltese gaming operators this typically includes player wallet, RNG and KYC systems.

DORA

Critical Third-Party Provider(CTPP)

An ICT third-party service provider designated as critical by the European Supervisory Authorities and placed under direct EU oversight.

In Cyprus, Greece & Malta: Cyprus and Maltese firms using a designated CTPP (typically major cloud, security or core-banking vendors) must reflect the CTPP regime in their concentration risk analysis and exit plans.

DORA

Threat-Led Penetration Testing(TLPT)

Advanced testing based on real-world threat intelligence that simulates the tactics, techniques and procedures of actual attackers against live production systems.

In Cyprus, Greece & Malta: TLPT is required at least every three years for in-scope financial entities. CySEC and the MFSA are the national authorities coordinating with the TIBER-EU framework for Cyprus and Malta respectively.

MiCA

Virtual Asset Service Provider(VASP)

A person whose business is the provision of one or more virtual asset services (exchange, transfer, custody, administration, financial-services participation) for or on behalf of another person.

In Cyprus, Greece & Malta: Cyprus uses the VASP register operated by CySEC under Section 61E of the AML Law; Malta uses the VFA framework. Both regimes transition into MiCA's CASP authorisation in 2024–2025.

MiCA

Crypto-Asset Service Provider(CASP)

A legal person authorised under MiCA to provide one or more crypto-asset services on a professional basis.

In Cyprus, Greece & Malta: Under the Cyprus Crypto-Asset Services Law and Malta's MiCA transposition, existing VASPs/VFA agents follow a simplified fast-track to CASP authorisation, with a transition deadline set by each Member State.

MiCA

Asset-Referenced Token(ART)

A type of crypto-asset that is not an e-money token and that purports to maintain a stable value by referencing another value or right or a combination thereof, including one or more official currencies.

In Cyprus, Greece & Malta: ART issuers face the strictest MiCA regime — significant tokens are supervised directly by the EBA. Maltese issuers should plan capital, reserve and white-paper obligations well before launch.

MiCA

E-Money Token(EMT)

A type of crypto-asset that purports to maintain a stable value by referencing the value of one official currency.

In Cyprus, Greece & Malta: EMTs may only be issued by credit institutions or authorised EMIs. PSD2/EMD2-licensed firms in Cyprus and Malta have a natural path into the EMT market.

PSD2

Strong Customer Authentication(SCA)

Authentication based on the use of two or more elements categorised as knowledge, possession and inherence that are independent, in that the breach of one does not compromise the reliability of the others.

In Cyprus, Greece & Malta: SCA remains the single largest source of PSD2 enforcement findings. Cyprus and Maltese PIs/EMIs should evidence dynamic linking, fraud-rate monitoring and proper application of every exemption claimed.

AML

Politically Exposed Person(PEP)

A natural person who is or has been entrusted with a prominent public function, their family members, and persons known to be close associates.

In Cyprus, Greece & Malta: Cyprus's AML Law and Malta's PMLFTR both require enhanced due diligence for PEPs, including senior management approval, source-of-wealth verification and enhanced ongoing monitoring.

AML

Ultimate Beneficial Owner(UBO)

Any natural person who ultimately owns or controls a customer or on whose behalf a transaction or activity is being conducted, including thresholds of direct or indirect ownership.

In Cyprus, Greece & Malta: Cyprus, Greece and Malta each operate UBO registers. Discrepancies between the register and CDD findings must be reported to the registry.

AML

Money Laundering Reporting Officer(MLRO)

The senior employee designated to receive internal suspicious activity reports and to decide whether to submit a report to the financial intelligence unit.

In Cyprus, Greece & Malta: In Cyprus the MLRO files to MOKAS; in Malta to the FIAU; in Greece to the Hellenic AMLA. The role must be independent, sufficiently resourced and have direct access to the board.

MiFID

Suitability Assessment

The assessment a firm must perform to ensure that a recommended investment service or financial instrument is suitable for the client, considering knowledge, experience, financial situation and investment objectives.

In Cyprus, Greece & Malta: CySEC inspections increasingly probe the evidence behind suitability statements, not just the existence of the policy. Robust contemporaneous documentation is essential.

MiFID

Best Execution

The obligation to take all sufficient steps to obtain the best possible result for clients when executing orders, taking into account price, costs, speed, likelihood of execution and settlement, size, nature and any other relevant consideration.

In Cyprus, Greece & Malta: Annual best-execution reviews and RTS 28-style transparency remain a CySEC priority, particularly for retail-facing CFD providers.

Gaming

Gaming Service Licence

A licence issued under the Maltese Gaming Act to provide one or more of B2C gaming services or B2B critical gaming supplies.

In Cyprus, Greece & Malta: MGA-licensed operators must maintain the Compliance Audit, Key Function role appointments and Player Protection Directive obligations on an ongoing basis. EuroLexAI tracks every MGA directive update for affected operators.