Setting up or running a business in Cyprus is straightforward if you follow a few core regimes: company law, tax & VAT, payroll & social charges, beneficial ownership (UBO), AML, data protection, competition/merger control, and sector oversight. Below is a plain-English, source-based breakdown you can keep by your desk.
Cyprus companies operate under Cap. 113 (Companies Law) and file an annual return (HE32) within 28 days of the drafting date. Crucially, you must attach the audited financial statements for the previous year to the HE32. Late filing triggers automatic fees calculated by the Registrar. Therefore, plan your AGM → draft HE32 → file in 28 days timeline early.
Practical tip: block audit fieldwork before year-end so audit sign-off and the HE32 package leave on time.
Also note: Employers must record essential terms on the ERGANI system (per late-2024 decree), and probation rules were tightened in recent labour updates. Consequently, keep HR templates current.
All Cyprus companies must enter and keep UBO data up to date in the Registrar’s Beneficial Ownership Register. New companies file within 90 days of incorporation; changes must be submitted within 45 days of becoming aware. Moreover, for 2025 the Registrar requires one annual confirmation of UBO details between 1 Oct and 31 Dec—with penalties for non-compliance. Set calendar reminders now.
Cyprus implements the Prevention and Suppression of Money Laundering laws, with supervisors by sector (e.g., ICPAC for accounting firms, CySEC for investment entities, and the Central Bank for banks/PSPs). Expect customer due diligence, risk assessment, ongoing monitoring, and records as baseline duties. If you’re an obliged entity, align internal policies with your supervisor’s directive.
The Commissioner for Personal Data Protection enforces GDPR and national rules. For most SMEs, “good enough” starts with a clear privacy notice, a records-of-processing log, DPA clauses with processors, and a simple breach plan. When in doubt, use the Commissioner’s site as your checklist.
Cyprus applies the Control of Concentrations Law 83(I)/2014, enforced by the Commission for the Protection of Competition (CPC). Major concentrations that meet national turnover thresholds must be notified and cleared before implementation—unless the deal falls under the EU one-stop-shop. Because thresholds and forms are technical, run an early screen before signing.
(Where applicable, your sector licence will sit on top of company law, tax, and GDPR duties.)
Do I always file audited accounts with the HE32?
Yes. The Registrar expects the annual return to be filed with the audited financial statements for the prior year.
What VAT rates do I budget for?
Use 19% as standard and check the 5%/9%/3% reduced rates list for your goods/services. File through TFA.
How long can I carry forward losses?
Five years. Plan to use losses before they expire; coordinate with group relief when relevant.
Is the Cyprus IP Box still live?
Yes – under nexus rules. It can lower the effective rate on qualifying IP income to ~2.5%, if substance tests are met.
When do I notify a merger?
Notify the CPC before implementation if national thresholds are met-or use the EU system when the deal is EU-dimension.
Cyprus offers a clear, EU-aligned legal framework for business. If you close your books on IFRS, file HE32 + audited FS on time, use TFA for VAT/VIES, apply SI/GHS caps correctly, keep your UBO up to date, and screen M&A for CPC thresholds, you’ll avoid most fines and surprises. Add the IP Box or sector licences only when the facts fit, and keep AML/GDPR basics tight.
For printable calendars, filing checklists, and accountant shortlists, visit Soneverse and explore our business guides.
On everything business-related
