Cyprus has entered a period of notable regulatory activity, with legislative amendments and supervisory guidance touching corporate governance, financial services, anti-money laundering, and employment law. Businesses operating in or through Cyprus - whether holding companies, investment firms, or operational subsidiaries - face a more demanding compliance environment than in previous quarters. This guide summarises the most consequential developments, explains their practical implications, and identifies the steps businesses should take to remain compliant.
The Registrar of Companies and Official Receiver, which administers the Companies Law Cap. 113 and its successive amendments, has continued to tighten requirements around beneficial ownership disclosure and the maintenance of statutory registers. Recent amendments to the Ultimate Beneficial Owner (UBO) Register framework, aligned with the EU';s Anti-Money Laundering Directives, now impose stricter verification obligations on registered agents and company secretaries. Entities that have not updated their UBO records to reflect current ownership structures face administrative penalties and, in persistent cases, potential striking-off proceedings.
A non-obvious requirement that catches many foreign-owned Cyprus companies is the obligation to maintain a physical registered office - not merely a postal address - where statutory books and records can be inspected. The Registrar has signalled increased scrutiny of companies that list a registered office address without genuine substance at that location. In practice, founders should consider whether their current registered agent arrangement satisfies this requirement, particularly if the company holds assets or conducts transactions of material value.
The annual return filing obligation under the Companies Law remains a recurring compliance trigger. Companies that miss the prescribed filing window accumulate late-filing penalties that compound over time. A common mistake is treating the annual return as a formality and delegating it without proper oversight - only to discover, when a bank or counterparty requests a certificate of good standing, that the company is in arrears. Businesses should build annual return deadlines into their compliance calendars well in advance.
Recent guidance from the Registrar also clarifies the procedure for voluntary strike-off under Section 327 of the Companies Law. Companies seeking dissolution must demonstrate that they have ceased trading, settled all liabilities, and obtained tax clearance from the Tax Department. The process typically takes several months from application to gazette notice, and creditors retain the right to object during the statutory notice period.
The Cyprus Securities and Exchange Commission (CySEC) has issued a series of circulars and guidance notes in the current quarter that affect investment firms, fund managers, and crypto-asset service providers. CySEC, as the competent authority under the Investment Services and Activities and Regulated Markets Law (Law 87(I)/2017, as amended), has reinforced its expectations on governance, risk management, and client asset protection.
One of the most significant developments concerns the transposition of updated EU directives into domestic law. Investment firms authorised in Cyprus are required to review their client categorisation procedures, suitability assessments, and best-execution policies in light of the revised regulatory technical standards. Firms that have not updated their internal policies since their initial authorisation are particularly exposed. CySEC has indicated that thematic reviews of compliance with these requirements are ongoing, and firms selected for review can expect requests for documentation within short notice periods.
For crypto-asset service providers, the Markets in Crypto-Assets Regulation (MiCA) framework continues to reshape the licensing landscape. Cyprus-based providers that previously operated under transitional arrangements must now assess whether they require a full MiCA authorisation or whether their activities fall within an exemption. CySEC has published a dedicated FAQ on its website addressing the most common classification questions, and firms are encouraged to seek legal advice before relying on any exemption.
Fund managers operating under the Alternative Investment Fund Managers Law (Law 56(I)/2013) should note updated guidance on delegation arrangements and substance requirements. CySEC has aligned its supervisory expectations with ESMA';s guidance on letter-box entities, meaning that fund managers must demonstrate genuine decision-making capacity in Cyprus rather than merely holding a licence while delegating all substantive functions abroad. Many underestimate the documentation burden this creates - board minutes, investment committee records, and local staffing evidence are all subject to review.
If your firm is navigating CySEC authorisation, licence amendments, or thematic review preparation, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
Cyprus has strengthened its AML/CFT framework in line with the Financial Action Task Force (FATF) recommendations and the EU';s evolving AML package. The Prevention and Suppression of Money Laundering Activities Law (Law 188(I)/2007, as amended) continues to be the primary domestic instrument, but recent legislative activity has introduced amendments that expand the scope of obliged entities and sharpen due diligence requirements.
The most consequential change for corporate service providers, lawyers, and accountants is the enhanced customer due diligence (CDD) threshold for occasional transactions. The threshold below which simplified CDD may be applied has been revised downward, meaning that more transactions now trigger full CDD procedures including source-of-funds verification. Firms that have not updated their internal AML policies and training programmes to reflect this change are technically non-compliant, even if they have not yet been subject to supervisory examination.
The Unit for Combating Money Laundering (MOKAS), which serves as Cyprus';s Financial Intelligence Unit, has issued updated guidance on suspicious transaction reporting (STR) obligations. The guidance emphasises that the obligation to file an STR arises as soon as a suspicion forms - not after internal investigation is complete. A common mistake among compliance officers is delaying the STR filing pending further due diligence, which can itself constitute a breach of the reporting obligation.
Practical scenario one: a Cyprus-registered holding company receives a capital injection from a shareholder based in a jurisdiction that FATF has placed on its grey list. The company';s bank, acting as an obliged entity, requests enhanced due diligence documentation. If the company cannot produce adequate source-of-funds evidence, the bank may file an STR and freeze the transaction. Businesses in this position should prepare a comprehensive funds trail before initiating the transfer.
Practical scenario two: a law firm providing corporate services to a Cyprus company discovers, during a periodic review, that the beneficial owner has changed but the UBO Register has not been updated. The firm is itself an obliged entity and must consider whether a suspicious circumstance exists, in addition to advising the client to update the register immediately. The intersection of AML obligations and corporate law duties creates a layered compliance challenge that requires coordinated legal and compliance advice.
The Cyprus Bar Association and the Institute of Certified Public Accountants of Cyprus (ICPAC) have both issued sector-specific AML guidance for their members. Regulated professionals should ensure they are working from the most current version of their supervisory body';s guidance, as outdated internal procedures are a recurring finding in supervisory inspections.
The Cyprus Tax Department, operating under the Income Tax Law (Law 118(I)/2002, as amended) and the Assessment and Collection of Taxes Law (Law 4/1978, as amended), has introduced or clarified several measures that affect both resident companies and non-resident entities with Cyprus-source income.
Transfer pricing has moved from a relatively light-touch area to a formal compliance requirement following the introduction of the Transfer Pricing Rules under the Income Tax Law. Cyprus-resident companies that engage in controlled transactions with related parties are now required to maintain contemporaneous transfer pricing documentation and, above certain thresholds, to submit a Local File and Master File to the Tax Department. The thresholds are defined by reference to the aggregate value of controlled transactions in a given tax year, and companies that have not yet assessed whether they meet these thresholds should do so promptly.
The Notional Interest Deduction (NID) regime, which allows Cyprus companies to claim a deduction on new equity introduced into the business, remains a significant planning tool. However, the Tax Department has issued guidance clarifying the conditions under which NID will be accepted, particularly in relation to back-to-back financing structures. Companies relying on NID should review their structures against this guidance to ensure the deduction is defensible on audit.
The Special Defence Contribution (SDC) continues to apply to dividend, interest, and rental income received by Cyprus tax residents. Recent administrative guidance has clarified the treatment of dividends received from non-Cyprus subsidiaries, particularly where the paying entity is resident in a jurisdiction with which Cyprus has a double tax treaty. Businesses should review their dividend flows to confirm that the correct SDC treatment is being applied and that treaty benefits are being claimed where available.
Cyprus has also implemented the EU';s Directive on Administrative Cooperation (DAC6) and its subsequent iterations, requiring intermediaries and taxpayers to report cross-border arrangements that bear hallmarks of potential tax avoidance. The reporting obligation falls on lawyers, accountants, and financial advisers who design or promote such arrangements, as well as on taxpayers themselves where no intermediary is involved. A non-obvious requirement is that the obligation can arise even where the arrangement is ultimately not implemented - the trigger is the making available of the arrangement, not its execution.
The employment law landscape in Cyprus has seen incremental but important changes, primarily driven by the transposition of EU directives into domestic legislation. The Employment of Employees Law (Law 112(I)/2012, as amended) and the Minimum Wage Law govern the core employment relationship, and both have been subject to recent amendments.
The minimum wage in Cyprus applies to a defined category of employees and is subject to periodic review. Employers who have not reviewed their payroll against the current minimum wage level risk underpayment claims and administrative penalties. The Department of Labour Relations, which enforces employment law, has increased the frequency of workplace inspections, particularly in sectors such as hospitality, retail, and construction where non-compliance has historically been more prevalent.
The transposition of the EU Transparent and Predictable Working Conditions Directive has introduced new obligations on employers to provide written statements of employment terms within a short period of the employment commencing - typically within the first week of work. The statement must cover a broader range of matters than was previously required, including details of any probationary period, training entitlements, and social security arrangements. Employers using legacy employment contract templates should review and update them to ensure compliance.
For businesses employing third-country nationals, the Civil Registry and Migration Department administers work permit and residence permit applications. Processing times have varied, and employers should factor realistic lead times into their hiring plans. A common mistake is initiating a work permit application only after the employee has already arrived in Cyprus, which can create a period of unlawful employment and expose the employer to penalties under the Aliens and Immigration Law.
Remote work arrangements involving employees based in Cyprus but employed by foreign entities raise complex questions about social insurance contributions, tax withholding, and employment law applicability. The Social Insurance Services, which administers contributions under the Social Insurance Law (Law 59(I)/1980, as amended), has issued guidance on the treatment of such arrangements, but the position remains nuanced and fact-specific.
To discuss employment compliance or workforce structuring in Cyprus, contact info@vlolawfirm.com. We can assist with documents and filings.
What are the main risks for a Cyprus company that has not updated its UBO Register?
Failure to maintain an accurate UBO Register exposes a Cyprus company to administrative penalties under the Companies Law and the AML legislation. In practice, the consequences extend beyond fines: banks and regulated counterparties routinely request UBO Register extracts as part of their own due diligence, and discrepancies between the register and actual ownership can trigger account restrictions or transaction delays. The Registrar of Companies has the power to initiate striking-off proceedings against persistently non-compliant companies. Where a regulated professional such as a lawyer or accountant is aware of an inaccuracy, they may also face their own reporting obligations under the AML framework. Correcting the register promptly, and documenting the correction process, is the most effective way to manage this risk.
How long does it typically take to obtain or amend a CySEC licence, and what does it cost?
CySEC licence applications and material amendments are subject to statutory review periods that vary by licence type and the complexity of the application. In practice, new investment firm authorisations have taken anywhere from several months to over a year, depending on the completeness of the application and the volume of queries raised by CySEC. Amendments to existing licences - such as adding a new investment service or changing a key person - typically take less time but still require careful preparation. Professional fees for preparing a full authorisation application are substantial, generally running into the mid-to-high tens of thousands of euros when legal, compliance, and consulting costs are aggregated. Applicants should budget for ongoing compliance costs after authorisation, including annual supervisory fees payable to CySEC, which are calculated by reference to the firm';s capital and revenue.
Should a Cyprus holding company use a local director, and what difference does it make?
The use of local directors in Cyprus is relevant to both tax residence and substance requirements. Under the Income Tax Law, a company is considered tax resident in Cyprus if it is managed and controlled in Cyprus. Management and control is determined primarily by where the board of directors meets and makes decisions. A company with a majority of non-Cyprus-resident directors who meet and decide outside Cyprus risks being treated as non-resident, losing access to Cyprus';s tax treaty network and the benefits of the NID regime. Beyond tax, CySEC and other regulators assess substance when evaluating licence applications and renewals. A single nominee director who attends board meetings without genuine involvement in decision-making is unlikely to satisfy either the tax residence test or the regulatory substance requirement. Businesses should ensure that local directors have genuine authority, relevant expertise, and documented involvement in key decisions.
Cyprus remains an attractive jurisdiction for international business, but the regulatory environment has become materially more demanding across corporate, financial services, AML, tax, and employment law. Businesses that treat compliance as a periodic exercise rather than an ongoing discipline are increasingly exposed to penalties, supervisory scrutiny, and reputational risk. Staying current with regulatory developments and reviewing internal policies against the latest requirements is not optional - it is a core operational responsibility.
VLO Law Firms advises international clients on regulatory compliance and corporate matters in Cyprus. We can assist with UBO Register updates, CySEC licence applications and amendments, AML policy reviews, transfer pricing documentation, and employment law compliance. To request a consultation, contact: info@vlolawfirm.com