Cyprus Compliance — HE32, IR4, VAT, UBO & Audit (Founder's Guide)

The Cyprus compliance stack — what every Ltd files each year

A Cyprus private limited company has filings with three different authorities: the Registrar of Companies (HE32 annual return, UBO register, director / secretary / share-capital changes), the Cyprus Tax Department (IR4 corporate tax return, IR6 provisional tax, IR1 personal income tax for directors), and the VAT Department (VAT returns, VIES recapitulative statements). Plus the statutory audit by an ICPAC-registered auditor — mandatory regardless of size or turnover, with no small-company exemption.

All Cyprus filings have hard deadlines and penalty regimes. The penalties are structured to be minor on a per-filing basis but compounding — the genuine cost of poor compliance is loss of good standing, which restricts banking, M&A diligence, and tax-residency claims.

Registrar of Companies — HE32, UBO, change-of-officer

The Registrar maintains the public register of Cyprus companies. Three filings are routine for every Ltd:

Cyprus Tax Department — IR4, IR6, IR1

VAT, VIES, OSS and IOSS

Cyprus VAT is 19% standard, with reduced rates of 9%, 5% and 0% on specific categories. Most operating Cyprus companies should register for VAT voluntarily at incorporation to recover input VAT. Mandatory registration triggers at €15,600 turnover in any 12-month period or for any EU B2B service supply.

• VAT returns: monthly or quarterly per assigned filing frequency. Filed by the 10th day of the second month after the period ends.
• VIES (recapitulative statements): monthly for EU B2B service / goods supplies, filed by the 15th of the following month.
• OSS (One-Stop Shop): for EU B2C digital service supplies above €10,000 cross-border total. Quarterly filing.
• IOSS (Import One-Stop Shop): for non-EU goods imports under €150 to EU B2C customers.
• Late VAT penalties: €100 for late return + 10% on tax due + interest at the prevailing rate.

Statutory audit — non-negotiable, even for small Ltds

Cyprus has no small-company audit exemption (unlike the UK or Ireland). Every Cyprus private limited company must have its annual financial statements audited by a licensed ICPAC-registered auditor regardless of size, turnover, or activity level — including dormant companies.

Audit fees in 2026 typically range €900–€2,500 + VAT for small operating companies, scaling with transaction volume, complexity (IP Box, transfer pricing, multi-jurisdictional revenue), and audit-quality requirements. Engagement letter usually signed in the first quarter for the previous financial year.

Audit timing: financial statements typically signed off 6–9 months after year-end. The audit must be filed with the IR4 corporate tax return on TAXISnet by 31 March of the year after the tax year.

AML, 5MLD, 6MLD and KYC obligations

Cyprus has implemented the EU 5th and 6th Anti-Money-Laundering Directives. Beyond the UBO register, Cyprus companies have ongoing KYC obligations on counterparties, employees and beneficial owners. ICPAC-registered service providers (auditors, accountants, secretaries) and Cyprus Bar Association lawyers operate as obliged entities under the AML framework — they must collect, refresh and retain KYC documentation on every client.

For most operating Ltds the AML obligation manifests as: annual KYC refresh (passport, address proof, source of funds), counterparty due diligence on material vendors / customers, and Suspicious Activity Reporting (SAR) where red flags appear.

Transfer pricing — Local File and Summary Information Table

From 2022 Cyprus has applied OECD-aligned transfer pricing rules. Companies engaged in cross-border related-party transactions must prepare and retain transfer-pricing documentation: Master File (group-level), Local File (Cyprus-entity level) and the Summary Information Table (SIT) summarising controlled transactions. Country-by-Country Reporting applies to ultimate parents of MNE groups with consolidated revenue ≥€750m.

Local File / SIT thresholds: Local File required for controlled transactions exceeding €750,000 per category in a year; SIT mandatory regardless of threshold for any controlled transaction. See our transfer-pricing service.

Pillar Two — only relevant for €750m+ groups

Cyprus has implemented the OECD's Pillar Two global-minimum-tax framework via EU Directive 2022/2523. For groups with consolidated revenue ≥€750m, a 15% effective tax rate applies on Cyprus operations through the Income Inclusion Rule (IIR), Undertaxed Profits Rule (UTPR), and the Cyprus Qualified Domestic Minimum Top-up Tax (QDMTT).

Founder-led businesses below the €750m threshold are not in Pillar Two scope and continue to be taxed at the headline 15% Cyprus CIT (~3% effective on qualifying IP profits via the IP Box). Pillar Two changed nothing for the typical founder.

The annual compliance calendar at a glance

• 31 January: deadline for IR4 corporate tax return for the second-prior tax year (extended deadline).
• 31 March: deadline for IR4 corporate tax return for the prior tax year (standard).
• 30 June: deadline for HE32 annual return (where year-end is 31 December and 18-month rule has elapsed).
• 31 July: 1st instalment of IR6 provisional tax + IR1 personal tax return for prior year.
• 1 August: balance of corporate income tax for prior year.
• 31 December: 2nd instalment of IR6 provisional tax + revised IR6 if material variance.

Frequently asked questions

Is the audit really mandatory for every Cyprus company?

Yes — every Cyprus private limited company must have its annual financial statements audited by a licensed ICPAC-registered auditor regardless of size, turnover or activity level. There is no small-company audit exemption like in the UK or Ireland. Even dormant companies need an audit.

When is the HE32 annual return due?

The first HE32 is due 18 months after incorporation. After that, annually. Late filing penalty: €50 per return + interest. Persistent non-filing leads to strike-off proceedings by the Registrar.

What happens if I miss the UBO filing deadline?

UBO non-filing is a criminal offence under Cyprus AML law (5MLD/6MLD implementation). Penalties up to €100,000 plus director-level liability. Updates must be filed within 14 days of any change in beneficial ownership. This is the highest-risk filing on the Cyprus compliance calendar — never miss it.

When does VAT registration become mandatory?

Once Cyprus turnover exceeds €15,600 in any 12-month period, or for any EU B2B service supply (regardless of turnover), or for cross-border B2C digital supplies above €10,000 (OSS). Most operating companies should register voluntarily at incorporation to recover input VAT.

When are corporate tax returns due?

IR4 (corporate income tax return) is due 31 March of the year following the tax year — e.g. tax-year-2026 IR4 due 31 March 2027. Must be accompanied by audited financial statements. Balance of tax payable is due 1 August of the year after the tax year. IR6 provisional tax: 31 July and 31 December instalments.

Do I need transfer-pricing documentation?

Required for cross-border related-party transactions. Local File: required for any single controlled-transaction category exceeding €750,000 in a year. Summary Information Table (SIT): mandatory regardless of threshold for any controlled transaction. Country-by-Country Reporting applies only to MNE-group ultimate parents with consolidated revenue ≥€750m.