By Charles Forelle, The Wall Street Journal

There are plenty of reasons why Cyprus’s bailout took so long and came with such tough terms. But one is very clear: Cyprus’s reputation as a site for money laundering and tax avoidance made its rescuers loath to prop up its bulging banks.

The bailout ultimately came with a condition: Cyprus had to undergo an independent examination of its anti-money-laundering practices. The results are now in.

The report, by the consulting firm Deloitte and Moneyval, an arm of the Council of Europe, is secret. But the Web site Stockwatch Cyprus published a four-page summary of its main findings. A person familiar with the matter confirms it is genuine.

The summary paints an unflattering picture: While the country has systems and rules in place to fight money laundering, they don’t appear to be well followed. The auditors found “no regulatory weaknesses” but “substantial shortcomings in the implementation” by banks.

There are two basic ways to fight money laundering. One is to know whose money is deposited in banks. That means pulling aside the curtains of shell companies and trustees and nominees. The other is to watch where the money goes. Banks are generally required both to know who their customers are and to alert authorities to suspicious transactions.

Some highlights from the Cypriot report:

• In a sample of depositors, 27% of banks’ files on their clients had inaccurate information about the customer and the beneficial owner (the actual person who ultimately owns the account, instead of the shell company or nominee whose name might be on the paperwork).
• “Simple commercial database checks” showed that 10% of 390 customers sampled are “politically exposed persons” that the banks hadn’t flagged. Anti-money-laundering rules require banks to pay special attention to high-level government officials who are clients, to prevent corrupt officials from stashing cash in banks.
• Among the sample of 390 customers, banks only conducted four internal investigations for possible money laundering from 2008 to 2012.
• Banks filed no suspicious-transaction reports with Cypriot authorities about customers in the sample between 2008 and 2010, one in 2011 and “a few” in 2012. That’s even though “in a number of cases publicly available information pointed to the customers’ criminal background.”
• Deloitte’s review of activity in the past 12 months found 29 “potentially suspicious transactions.” None was flagged.

A spokesman for the Cyprus central bank didn’t return a message seeking comment. A spokesman for Moneyval—an international body that monitors money laundering—said he couldn’t discuss the report. A Deloitte spokesman declined to comment.

Cypriot officials have long said their country takes serious steps to fight money laundering, and that its reputation is unwarranted. “Cyprus is doing a lot more than other countries” to combat illegal financial activity, Eva Rossidou-Papakyriacou, the longtime head of Cyprus’s anti-money-laundering agency, said for our Page One story. She didn’t immediately return a message seeking comment Friday.

The auditors identified other issues—and called out the “supervisory authority’s failure to adequately monitor the implementation by banks of the [anti-money-laundering] framework.”

Cyprus’s corporate registry functions poorly, the auditors said, and has a “large backlog” of paperwork. A “significant number” of un-submitted annual reports and financial statements goes without follow-up.

It also said Cyprus is over-reliant on “introducers” who serve as middlemen to establish bank accounts and corporations—potentially obscuring the real owners or making it harder for the banks or authorities to establish who they are.

It’s not clear what effect the report will have. Moneyval had previously given Cyprus relatively good marks for its efforts, but the summary said the new findings “significantly revise” that judgment.