Cyprus Company Compliance Guide 2026: Every Filing, Deadline, and Penalty
Cyprus company compliance spans three separate authorities, each with its own filings, deadlines, and penalty regime. The Registrar of Companies wants the annual return and the UBO confirmations. The Tax Department wants the tax return, the provisional and final tax payments, and the Summary Information Table. And sitting underneath all of it is the audit, because almost nothing else can be filed until the financial statements are signed.
This guide sets out everything a Cyprus company must do in 2026, in the order the obligations actually arise, with the current penalty for missing each one. Several rules changed recently, including the corporate tax rate, the tax return deadline, the audit thresholds, and the UBO penalty regime, so guides written even a year ago are now wrong in places. Everything below reflects the position as it stands today.
Accounting records and financial statements
The foundation of every other obligation is the directors’ duty under the Companies Law, Cap. 113 to maintain proper books of account. The records must be complete enough to explain the company’s transactions and to support financial statements prepared under IFRS as adopted by the European Union, giving a true and fair view. This duty sits with the directors personally.
A full set of financial statements must be prepared for every financial year.
The audit requirement
Every Cyprus company must, as the default position, have its annual financial statements audited or reviewed by a statutory auditor or audit firm licensed by ICPAC, under International Standards on Auditing.
A narrow alternative exists for very small companies. For financial years beginning on or after 6 February 2026, a company with net turnover below €300,000 and total gross assets below €500,000, both conditions met for two consecutive years, may replace the audit with a review engagement under ISRE 2400. The review still requires a licensed auditor, provides limited assurance, and carries identical filing obligations.
There is no penalty labelled “late audit” as such. The audit’s deadline pressure comes from everything downstream: the AGM cannot receive unsigned accounts, the annual return cannot be filed without them, and the tax return references the audited figures and cannot be filed without signed financial statements. A delayed audit therefore cascades into every penalty listed below, which is why the engagement should be scoped and started early in the year, not in the final quarter.
The annual return (HE32)
Every company must hold an AGM each calendar year, with no more than fifteen months between meetings. A newly incorporated company has eighteen months from incorporation to hold its first AGM. The financial statements are laid before the shareholders at this meeting.
The annual return (form HE32) must then be filed with the Registrar of Companies within 28 days of its made-up date, accompanied by the financial statements together with the auditor’s report or review conclusion. The return confirms the registered office address, the shareholders, the authorised and issued share capital, the directors, and the company secretary.
The penalty for late filing is €50 plus €1 for each day of delay, capped at €150 per return, bringing the total to €190 together with the filing fee of €20 and the late filing fee of another €20. The real sanction however is different. The Registrar actively runs strike-off campaigns against companies with outstanding annual returns under section 327 of the Companies Law. A struck-off company ceases to exist, its assets vest in the Republic as bona vacantia, and restoring it costs multiples of the original filing obligation in time, fees, and disruption. Treat the €190 cap as irrelevant and the strike-off risk as the actual penalty.
The UBO register: three deadlines, one penalty clock
Every Cyprus company must disclose its ultimate beneficial owners, meaning the natural persons who ultimately own or control more than 25% of the company, to the UBO Register maintained by the Registrar. There are three separate deadlines to track.
A newly incorporated company must make its initial UBO submission within 90 days of incorporation, counted in calendar days from the date on the certificate of incorporation. Any change to beneficial ownership must be filed within 45 days of the date the change becomes known to the company or its officers. This includes threshold crossings: a shareholder moving from 24% to 26% becomes a new UBO and starts the 45-day clock even though no new person entered the structure.
The third deadline is the one most commonly missed. Between 1 October and 31 December every year, each company must log into the register and actively confirm that its UBO information remains accurate, even if nothing has changed. The confirmation window is fixed, and leaving it to late December risks missing it through nothing more than adviser capacity in the busiest weeks of the year.
The current penalty is €100 on the first day of non-compliance plus €50 for each day it continues, capped at €5,000 per obligation. Fines accrue automatically from the day after the deadline, with no warning and no grace period. The fine is imposed on the company rather than on the directors personally, although a director who refuses, omits, or neglects to comply remains jointly and severally liable for the company’s fine. For groups with multiple Cyprus entities the cap applies per entity, so a five-company structure that misses its annual confirmations across the board faces exposure of up to €25,000. The Registrar also holds the power to strike off persistently non-compliant entities.
Corporate tax compliance
The corporate income tax rate is 15% from 1 January 2026, raised from 12.5% under the tax reform enacted in December 2025. The compliance cycle around it has three components: provisional tax during the year, the balancing payment after year end, and the tax return. For FAQ on corporate tax compliance refer to our relevant article here.
Provisional tax is a self-assessment of the current year’s taxable profit, paid in two equal instalments by 31 July and 31 December of the tax year itself. The estimate matters. If the declared provisional income turns out to be less than 75% of the final taxable income, a 10% additional tax is imposed on the difference between the tax paid and the tax due. The estimate can be revised upward before the second instalment, which is the standard correction route for a year that outperforms the original projection.
The final balancing payment of any remaining tax is due by 1 August of the year following the tax year, and from the 2026 tax year onwards it moves to 31 January of the second year, aligned with the TD4 filing deadline. Late payment attracts a penalty of 5% on the unpaid tax, a further 5% where it remains unpaid two months after the deadline, and interest at the statutory rate, set at 3.50% for 2026.
The corporate tax return (TD4) is filed electronically through the Taxisnet and Tax For All systems and must be filed by a licensed tax advisor or auditor. For financial years up to and including 2025, the deadline is 31 March of the second year following the tax year, subject to the transitional decrees currently in force: the 2023 return is due by 31 March 2026 and the 2024 return by 30 November 2026 under decrees 358/2025 and 359/2025. From the 2026 financial year onwards, the deadline moves permanently to 31 January of the second year following the year end, so a 31 December 2026 year end has a TD4 deadline of 31 January 2028. This acceleration pulls the entire cycle forward, and because the return references the audited figures, the audit must be complete well before the January deadline. The penalty for a late TD4 is €250 for a company, rising to €500 where turnover or gross assets exceed €1,000,000, with interest running on any unpaid tax.
Every company with controlled transactions of any value must also file a Summary Information Table (SIT) together with the TD4. There is no minimum threshold for the SIT, a point that catches many groups whose intercompany balances are small. The penalty for a late SIT is €500. Companies whose controlled transactions exceed the documentation thresholds must additionally maintain a Cyprus Local File, but the SIT obligation applies to everyone with related-party dealings. For more information on transfer pricing refer to our detailed guide.
One transitional point for companies with Cyprus tax resident and domiciled shareholders. The deemed dividend distribution rules are abolished for profits earned from 2026 onwards, but they remain in effect for profits of 2024 and 2025, which are deemed distributed as to 70% two years after the relevant year end. Companies in this position have SDC compliance obligations running into January 2028, since the deemed distribution of 2025 profits occurs on 31 December 2027 with the SDC payable by 31 January 2028, and should plan distributions accordingly.
VAT and VIES
A company must register for VAT once its taxable supplies exceed €15,600 in a rolling twelve-month period, or earlier voluntarily. VAT returns are filed quarterly through Tax For All, with the return and payment due by the tenth day of the second month following the quarter end. A late VAT return carries a penalty of €100 per return, and late payment of the VAT due attracts an additional tax of 10% of the unpaid amount plus default interest at the statutory rate, set at 3.50% for 2026.
Companies making intra-EU supplies of goods or services must also file VIES declarations monthly, by the fifteenth day of the following month, with a penalty of €50 for each late submission. Persistent VIES failures can escalate to criminal liability, so the monthly cycle should sit in the same calendar as payroll rather than being handled ad hoc.
Employer obligations
A company with employees carries a parallel monthly cycle, and the mechanics changed with the migration to Tax For All. From tax year 2025 onwards, employers file a monthly TD7 withholding declaration through the TFA system covering PAYE and related contributions, due together with payment by the end of the month following the payroll month. The monthly submission itself generates the payable liability in the system, so filing comes before payment. Social insurance and GHS contributions are likewise remitted monthly by the end of the following month.
The annual TD7 remains as a year-end summary on top of the monthly filings, and every employee and company officer, including directors and secretaries with no withholdings, must appear in at least one monthly TD7 for the annual return to be accepted. Transitional deadlines apply during the migration: the 2024 annual return is due by 31 March 2026 and the 2025 annual return has been extended to 30 September 2026. Late payment of contributions attracts percentage surcharges and interest, and unlike most other penalties in this guide, social insurance arrears can trigger personal liability and criminal exposure for directors, so payroll compliance should never be the item that slips.
Cyprus company compliance through the year
Put together, a Cyprus company with a 31 December year end runs the following cycle. The audit engagement is scoped and started early in the new year, so the financial statements can be signed by mid-year. The AGM receives them, and the HE32 goes to the Registrar within 28 days of its made-up date. On 31 July the first provisional tax instalment for the current year is paid, followed by the balancing payment for the prior year on 1 August, moving to 31 January of the second year from the 2026 tax year onwards. Between 1 October and 31 December the UBO annual confirmation is filed, and on 31 December the second provisional instalment is paid, with the estimate revised if the year has outperformed. The TD4 and SIT for the year before last are filed by the applicable deadline, which becomes 31 January of the second year from the 2026 financial year onwards. Throughout, VAT runs quarterly, VIES and payroll run monthly.
Miss the start of that chain, meaning the audit, and every subsequent link tightens. That is the practical reason audit timing matters more than any individual penalty amount.
What non-compliance actually costs
Add up the headline penalties and they look survivable: €190 including fees for the annual return, €5,000 cap for UBO, €250 to €500 for the tax return, €500 for the SIT. The genuine costs sit elsewhere.
A company that cannot produce current audited financial statements stalls at its bank’s periodic review, and a stalled review can freeze the account. A tax residency certificate, which treaty relief and many cross-border payments depend on, is issued against a clean compliance file and becomes unobtainable while filings are outstanding. Dividends cannot be properly documented, which matters to any shareholder who needs to evidence the source of funds. For subsidiaries of international groups, a late Cyprus file delays the parent’s consolidation and draws exactly the kind of attention no group finance team wants. And at the end of the road sits strike-off, with the company’s assets vesting in the Republic.
Compliance in Cyprus is not about avoiding small fines. It is about keeping the company usable as a banking, contracting, and dividend-paying entity.
One engagement, one calendar
The obligations above span two authorities, three portals, and a dozen deadlines, and the most common failure mode is fragmentation: the auditor does the audit, a corporate administrator does the HE32, someone is presumed to be watching the UBO window, and no one owns the whole calendar.
At Nikita & Partners we run audit, annual return, UBO filings, and tax compliance as a single engagement with partner-level oversight, mapped to your year end at the start of each cycle. If you want one answer to the question of whether your Cyprus company is fully compliant for 2026, send us the company details and we will map every deadline above to your structure.
Frequently Asked Questions
Audited or reviewed financial statements presented at the AGM, an annual return (HE32) filed with the Registrar within 28 days of its made-up date, a UBO annual confirmation between 1 October and 31 December, a corporate tax return (TD4) with a Summary Information Table where there are controlled transactions, and provisional tax payments on 31 July and 31 December. Companies with VAT registration or employees carry additional quarterly and monthly cycles.
What is the penalty for a late HE32 annual return in Cyprus?
€50 plus €1 per day of delay, capped at €150, bringing the total to €190 together with the €20 filing fee and €20 late filing fee. The larger risk is strike-off by the Registrar for persistent non-filing, in which case the company’s assets vest in the Republic.
What are the UBO deadlines and penalties for Cyprus companies?
Initial submission within 90 days of incorporation, updates within 45 days of any change, and an annual confirmation between 1 October and 31 December even if nothing changed. The penalty is €100 for the first day of non-compliance plus €50 per day thereafter, capped at €5,000 per obligation, accruing automatically with no grace period.
When is the Cyprus corporate tax return due?
Under the transitional decrees, the 2023 return is due by 31 March 2026 and the 2024 return by 30 November 2026. From the 2026 financial year onwards, the deadline moves permanently to 31 January of the second year following the year end. The late-filing penalty is €250 for a company, or €500 where turnover or assets exceed €1,000,000, and a late Summary Information Table carries a €500 penalty.
What is the corporate tax rate in Cyprus in 2026?
15%, effective from 1 January 2026, raised from 12.5% under the tax reform enacted in December 2025. Provisional tax on the current year is paid in two instalments, and underestimating final income below 75% triggers a 10% additional tax.
Does a small Cyprus company still need an audit?
Yes, unless it qualifies for a review engagement, which requires net turnover below €300,000 and gross assets below €500,000 for two consecutive financial years for periods beginning on or after 6 February 2026. The review still requires a licensed ICPAC auditor and identical filings. Companies within groups rarely qualify.
Does a dormant Cyprus company still have to file?
Yes. A dormant company remains a registered legal entity and carries the same obligations as an active one: financial statements, audit or review, the HE32 annual return, and the UBO annual confirmation all still apply. Dormancy reduces the work involved, not the obligations, and dormant companies are among the most common recipients of UBO penalties precisely because their owners assume nothing needs filing.