Cyprus Audit Requirements 2026: Who Needs an Audit — and Who Can Use the New €300k Review Option

"Do I really need an audit?" is one of the first questions every Cyprus company owner asks — and in 2026 the answer finally has two branches. The Companies Law still requires annual financial statements assured by a licensed professional, but an amending law effective early 2026 raised the small-company turnover threshold to €300,000 and formalised the lighter review engagement as an alternative to the full statutory audit.Companies Law Cap. 113 (as amended 2026)

This guide gives you the direct answer, a numbered decision flow, the rules for dormant and first-year companies, group treatment, every deadline, and what non-filing actually costs. For a line-by-line comparison of what an audit covers versus a review, see the companion piece on audit vs review engagement in 2026.

Is an audit mandatory for a Cyprus company in 2026?

Yes, in the sense that every Cyprus company — trading, holding or dormant — must have annual IFRS financial statements signed off by an ICPAC-licensed statutory auditor. What changed in 2026 is the form: companies below both €300,000 net turnover and €500,000 total gross assets may elect a review engagement instead of a full audit.

There is no Cyprus equivalent of the UK's outright small-company audit exemption or unaudited "micro-entity" accounts. The obligation to prepare financial statements and have them examined by a licensed professional applies to every company on the register. What the 2026 amendment did is create a genuine two-tier system: full statutory audit under International Standards on Auditing (ISA) for most companies, and a limited-assurance review under ISRE 2400 (Revised) for companies that pass the size tests.Companies Law Cap. 113, s.152A

Either way, the person signing must be an ICPAC-licensed statutory auditor or authorised audit firm — the review is a lighter engagement, not a do-it-yourself one. And the output feeds two mandatory filings: the HE32 annual return to the Registrar of Companies and the TD4 corporate tax return to the Tax Department, now taxed at the reformed 15% corporate rate covered in our Cyprus corporate tax guide.

What are the new €300,000 / €500,000 review thresholds?

For financial years beginning on or after 6 February 2026, a company qualifies for the review-engagement option if its net annual turnover is below €300,000 (raised from €200,000) and its total gross assets are below €500,000 — and it meets both tests for two consecutive financial years.

Three points practitioners see missed constantly. First, the tests are cumulative — a consultancy invoicing €250,000 but holding €600,000 of receivables and investments fails the asset test and must audit. Second, "total gross assets" means the balance-sheet total before deducting liabilities, so shareholder loans parked in the company count. Third, the two-consecutive-year requirement means one good year is not enough to switch.Companies Law Cap. 113, s.152A (as amended 2026)

How do I work out whether I need an audit or a review?

Walk through five questions in order: regulated status, tax claims, group membership, the two size tests, and the two-year history. Answer "yes" to any of the first three and you audit regardless of size. Pass all five and you may elect the review.

1. Is the company regulated?CySEC-licensed investment firms, funds, EMIs, payment institutions and fiduciary service providers always need a full audit. If yes → full audit.
2. Does it claim audit-triggering tax benefits? Claiming the Notional Interest Deduction, the IP Box 80% deduction, the R&D super-deduction or group loss-relief forces a full audit in practice. If yes → full audit.
3. Is it part of a group?A parent obliged to consolidate, or a subsidiary whose group auditors need audited component numbers, will audit regardless of its own size. If yes → full audit (see group section below).
4. Does it pass both size tests? Net turnover below €300,000 andtotal gross assets below €500,000. If either is breached → full audit.
5. Has it passed both tests for two consecutive financial years? If yes → the company may elect a review engagementunder ISRE 2400 (Revised); if this is only the first qualifying year → full audit once more, review from next year.

Even where the review is available, it is an option, not an obligation — companies heading towards bank onboarding, fundraising or an exit often keep the full audit voluntarily.

When is a full audit compulsory even below the thresholds?

Size is necessary but not sufficient. Regulated entities, group companies whose consolidation exceeds the tests, and companies claiming NID, IP Box, the R&D super-deduction or group loss-relief need a full ISA audit even when turnover and assets sit below the €300,000 / €500,000 lines.

• Regulated entities: CIFs, AIFs, AIFMs, EMIs, payment institutions, administrative service providers.
• Companies claiming NID. Article 9B, Income Tax Law N.118(I)/2002
• Companies claiming the IP Box 80% deduction (effective rate ≈3% on the 15% base). Article 9(1)(l), Income Tax Law N.118(I)/2002
• Companies using group loss-relief or subject to transfer-pricing local-file documentation.
• Members of a consolidated group exceeding the size tests.
• Companies whose banks, investors or counterparties contractually require an audit opinion — commercially compulsory even if not statutorily so.

Do dormant Cyprus companies need an audit?

Yes. Cyprus has no dormant-company exemption. A company with zero transactions must still prepare IFRS financial statements, have them audited or reviewed by an ICPAC-licensed auditor, hold an AGM and file the HE32 — every year, until it is formally struck off or liquidated.

The good news is that a dormant engagement is cheap and fast: expect €700–€1,500 for a dormant audit or €500–€900 for a review, since there are few balances to test. The bad news is that owners who assume "no activity means no filings" accumulate HE32 penalties and unfiled TD4s until the Registrar threatens strike-off. If the company genuinely has no future use, a managed strike-off or liquidationis almost always cheaper than years of dormant compliance. Note the separate €350 annual levy is no longer a factor — it was abolished by a 2024 amending law (arrears for 2011–2023 remain collectible).Companies (Amendment) Law 2024 (annual levy abolition)

What are the audit rules for a company's first year?

New companies get extended first-period timing, not an exemption. The first financial statements may cover up to 18 months from incorporation, the first AGM must be held within 18 months, and the first HE32 is made up to a date within 18 months of incorporation. The review option is rarely available in year one.

1. Incorporate (see the full company registration guide) and pick a financial year-end — most choose 31 December.
2. A company incorporated late in the year may run a long first period (up to 18 months) so its first accounts cover, say, October 2026 – December 2027 as a single set.
3. Hold the first AGM within 18 months of incorporation; subsequent AGMs no more than 15 months apart.
4. File the first HE32 within 28 days of that AGM.
5. Appoint the auditor early — in practice at incorporation or with the first accounting engagement — because the two-consecutive-year rule means a brand-new company cannot yet demonstrate the qualifying history for a review, so the default first engagement is a full audit.

What are the filing deadlines for audited accounts?

Financial statements are filed with the HE32 annual return within 28 days of the AGM, and they underpin the TD4 corporate tax return, due — under the 2026 permanent deadline — by 31 January of the second year following the tax year. Provisional tax instalments fall on 31 July and 31 December.

In practice the binding constraint is the auditor's calendar, not the statute: fieldwork for calendar-year companies runs roughly April–August, so books that close cleanly by February get signed accounts by summer. The complete date map lives in the Cyprus tax calendar 2026.

What are the penalties for not filing?

Late HE32 filing costs €50 plus €1 per day, capped at €150 per return; a late TD4 attracts a €100 fixed penalty (€200 after a Commissioner's notice) plus a 5% surcharge and interest on unpaid tax. Persistent non-filing leads to strike-off, frozen accounts and directors' exposure.

• HE32 late filing: €50 fixed penalty plus €1 per day of continuing default, capped at €150 per return, on top of the standard filing fees.Companies (Amendment) Law 18(I)/2024
• TD4 late filing: €100 administrative penalty, rising to €200 where the Tax Commissioner has served a notice; 5% surcharge on unpaid tax plus statutory interest.Assessment & Collection of Taxes Law N.4/1978, Art. 50A
• Strike-off risk: the Registrar can strike off a company in persistent default. Assets vest in the Republic as bona vacantia and bank accounts freeze until (costly) reinstatement.
• Knock-on damage:no signed accounts means no tax residency certificate, stalled bank reviews, and blocked dividend documentation — often more expensive than the penalties themselves.

How are groups and subsidiaries treated?

A Cyprus parent required to prepare consolidated financial statements must have the consolidation audited, and the review option falls away once group size tests are exceeded. Subsidiaries of international groups almost never qualify for review because intercompany balances inflate total gross assets past €500,000.

Small groups can be exempt from preparing consolidated accounts under the Companies Law's size criteria, but each Cyprus company in the group still needs its own audited or reviewed statements — the consolidation exemption is not an audit exemption. And where a foreign parent's group auditor needs component sign-off, the Cyprus subsidiary will be audited for group purposes even if Cyprus law would have allowed a review. Holding structures weighing this trade-off should read the Cyprus holding company guide alongside this article.Companies Law Cap. 113, s.142A–142B (consolidated accounts)

What does audit and review compliance actually cost?

For a straightforward small trading company, budget €1,500–€3,000 for a statutory audit or €800–€1,800 for a review; dormant companies sit at €700–€1,500 audited. Complexity — cross-border trade, payroll, IP Box claims, regulation — moves the number up quickly.

Indicative 2026 market ranges for Cyprus mid-tier firms (Big Four typically 40–100% higher) are set out in our audit vs review cost breakdown; the short version: dormant €700–€1,500, small domestic trader €1,500–€3,000, cross-border trading company €3,500–€7,000, IP Box / R&D claimants €5,000–€10,000, regulated entities €10,000–€30,000+. Where the audit fee sits inside the whole annual budget — accounting, registered office, tax filings — is mapped in the true cost of running a Cyprus company. Zeno's fixed annual accounting & audit packages bundle bookkeeping, the audit or review, HE32 and TD4 filings into one fee, delivered by independent ICPAC-licensed accountants and auditors.