Cyprus company accounting-record retention: six-year rule and control file

Start with the directors' section 141 duty

Section 141(1) of the Cyprus Companies Law places responsibility on directors to ensure the company keeps books and records needed to prepare financial statements and correctly explain its transactions. The records must allow its financial position to be determined with reasonable accuracy at any time. They include supporting documents such as contracts and invoices. The Registrar's official guidance repeats that directors are responsible for the accounting books on which the statements are based. Outsourcing data entry to an accountant does not transfer the directors' statutory responsibility to the accountant's firm.

The statutory categories cover money received and spent and the matters for which it moved, all sales and purchases and other transactions, and assets and liabilities. A ledger balance without the underlying contract, invoice, bank evidence or reconciliation may be hard to explain. For a service company, the evidence might include engagement letters, invoices, payment records, supplier bills, expense support and accrual workings. For a trading company, stock movements, returns and purchase documentation also matter. The point is not to retain every file forever; it is to preserve a coherent trail behind the accounts for the required period.

Section 141(2) says records are not proper if they cannot present a true and fair picture of affairs and explain transactions. Directors should therefore test quality as well as quantity. Can a reviewer identify the counterparty, purpose, amount, date and account classification for a material transaction? Can the books be reconciled to bank balances, receivables, payables and tax filings? If a company has many unreconciled suspense accounts or undocumented related-party movements, saving the database for six years will not itself cure the failure to keep useful books.

For the separate filing cycle, use the Cyprus annual-return guide.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Registrar of Companies: financial statements, annual return and directors' record duty

Calculate the retention date from the end of the relevant calendar year

The company-law minimum in section 141(3) is six years after the end of the calendar year to which the books and records relate. A document for a transaction in April 2026 therefore falls in the 2026 calendar-year cohort, ordinarily kept through 31 December 2032 under that provision. A company's accounting year-end may be March or June; the statutory phrase is calendar year, not six years after its financial year-end. Record the cohort year when documents enter the archive rather than letting a software system start deletion six years from each invoice's date.

This is a minimum under the company-law rule, not an instruction to delete every document on the first day after the period. A tax enquiry, dispute, asset-life question, insurance claim or another legal retention obligation may require longer preservation for specific records. A document can support more than one year: a long-term loan agreement executed in 2024 may continue to explain balances and payments in later years. In that case, assigning the original contract only to a 2024 deletion batch would be unsafe. Link enduring documents to the transactions and periods they still support.

The Tax Assessment and Collection Law has a separate records provision in section 30. Its minimum is also at least six years after the end of the tax year to which the records relate, unless the Tax Director notifies otherwise. Do not collapse the two provisions into one sentence or assume that a company-law disposal date automatically satisfies a tax notice. Maintain a legal-hold field and check both clocks before deletion. Where the accounting year, tax year and calendar year differ in a particular file, record the actual statutory basis used for the retention decision.

For a distinct treatment of personal-data minimisation, read the GDPR retention-schedule guide.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Tax Assessment and Collection Law, section 30, books and retention; Cyprus Tax Department: keeping books and records

Make records kept abroad usable in Cyprus

Section 141(3) permits books and records to be kept at the registered office or another place the directors consider proper, with directors always able to inspect them. It includes a specific proviso where books and records are kept outside the Republic: accounts and reports about the business reflected in those overseas records must be sent to and kept at a place in Cyprus, be available to directors and show the financial position with reasonable accuracy at intervals not exceeding six months. Those materials must support preparation of the company's financial statements. A cloud accounting provider's data centre outside Cyprus therefore does not remove the need to analyse this proviso.

A practical board decision should identify the primary system, its data location where known, who can grant access, the Cyprus-held reporting pack, the update schedule and recovery route. The law does not say that a screenshot of the dashboard once a year is sufficient. For significant foreign operations, the pack should let directors see balances and transactions with enough detail to understand the company's position between annual statement dates. Agree with the accountant how the six-month interval will be met and how the Cyprus-held reports can be retrieved if the overseas system or service provider becomes unavailable.

Access must work in real life. A director who technically has a username but cannot export records, see historic periods or retrieve attached invoices may not be able to inspect the books meaningfully. Test permissions and sample retrieval at least when systems or advisers change. Document where backups live and how encryption keys or administrator credentials will be transferred on director resignation or provider termination. Avoid relying on a single employee's personal email account to hold the only receipts or authentication device for the accounting system.

For changes in director responsibility and filings, see the director-appointment guide.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Registrar of Companies: financial statements, annual return and directors' record duty

Map source documents to transactions and balances

A retention inventory should separate transaction-level documents, standing agreements and year-end workpapers. Sales invoices and credit notes should connect to customer contracts, payment evidence and VAT treatment. Supplier invoices should connect to approvals, delivery evidence and bank payments. Payroll summaries should reconcile to personnel costs, social-insurance payments and liabilities. Loan and lease contracts may need to remain available for the whole term plus the applicable period for the final transactions. This mapping makes the section 141 requirement to explain the accounts operational rather than an abstract instruction.

For assets, keep acquisition documents, disposal records, depreciation schedules and evidence of ownership where relevant. For inventory, retain movement and valuation support that explains the year-end figure. For intercompany dealings, keep the agreement, invoices or recharge schedules, settlement records and the accounting entries on both sides. A company with a small number of transactions can maintain this with well-structured folders; a high-volume business may need indexed document management. The technology is secondary to consistency, completeness and the ability to retrieve a document against a ledger entry.

When an invoice is corrected, preserve the original and the credit note or replacement trail rather than overwriting the evidence. The same principle applies to journal entries: keep the authorisation and reason for a material adjustment. Scan paper documents in a readable form and ensure the scan includes all pages, attachments and dates. Test a sample by asking a person who did not post the entry to explain it from the archive alone. That exercise often reveals gaps before an audit, tax query or board change makes them costly.

For the distinct invoice-content rules, see the Cyprus VAT invoice checklist.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Tax Assessment and Collection Law, section 30, books and retention; Registrar of Companies: financial statements, annual return and directors' record duty

Check tax and VAT evidence without confusing their legal bases

The Cyprus Tax Department explains that a person deriving income from business profits must keep accounting books and records under section 30(1)(b) of the Tax Assessment and Collection Law, so accounts can be prepared on accepted accounting principles. That tax requirement overlaps operationally with section 141 but is legally separate. A tax return or audited financial statement is an output based on records, not a substitute for the invoices, contracts and reconciliations that substantiate it. Directors should be able to trace figures in filed returns back to the books and to the underlying source documents.

VAT creates its own evidential questions. A zero-rated export, intra-Union supply, credit note or bad debt may depend on specific transaction documents and timing. The company-law six-year clock should be treated as a floor in the overall retention policy, while the relevant VAT and tax requirements are checked for each type of record. Avoid a single 'everything six years' rule that silently deletes customs declarations, property documents or continuing contracts whose significance reaches later periods. Equally, do not keep all customer personal data indefinitely simply because some financial records must be retained.

Separate the retention reason from the access permission. Finance may need invoice data to meet a legal obligation while marketing has no continuing reason to use the customer's details. In a shared accounting and CRM stack, restrict access, document the legal basis and erase or anonymise unrelated data when its own purpose ends. A GDPR retention schedule can cross-reference the legally required accounting records, but it should not claim that all personal information in the business inherits the company-law minimum. This prevents the accounting rule from becoming a vague excuse for indiscriminate storage.

For this separate privacy analysis, consult the GDPR retention schedule.

Basis and guidance: Cyprus Tax Department: keeping books and records; Tax Assessment and Collection Law, section 30, books and retention; Cyprus Companies Law Cap. 113, current consolidated section 141

Give directors reliable inspection and recovery rights

Section 141 says the books and records must always be open to directors' inspection. Build that into service contracts with accountants, bookkeepers and software providers. The company should own its data or have enforceable export and access rights; clarify format, notice, costs and timing on termination. A new director should not need to negotiate with a former accountant to see last year's bank reconciliation. Keep a current data map showing the system owner, administrator, backup location and the person authorised to release records for audit or a lawful request.

Use a monthly close checklist: reconcile bank accounts, review unpaid invoices and credit notes, investigate suspense balances, check payroll and tax liabilities, and save signed or approved working papers. A quarterly board pack can then show whether the company can determine its position with reasonable accuracy, as the statute requires. Keep a simple exception log for missing documentation, with owners and dates to cure it. The aim is to find one missing contract in the month of signing, not four years later when a director is asked to explain a large related-party payment.

Continuity controls matter when people leave. Rotate access credentials, preserve business email and accounting attachments, and export a verified archive before changing software providers. Test restoration of a sample invoice and period-end trial balance from backup. A backup that has never been restored is an assumption, not evidence. If records are held by a foreign subsidiary or third-party platform, secure the Cyprus reporting pack and director access before terminating the relationship. Document the board's choice of record location and review it as systems and operations evolve.

For governance around board decisions generally, see the company meeting guide.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Registrar of Companies: financial statements, annual return and directors' record duty

Test the policy against three real-world record problems

A Cyprus consultancy closes its 2026 accounts in June 2027 and wants to delete its April 2026 invoices in April 2032 because they are six years old. Section 141(3) measures six years after the end of the 2026 calendar year, so that deletion date is too early for the company-law minimum. The finance team assigns the documents to a 2026 cohort with a normal end-of-2032 floor, checks the separate tax position and confirms that no dispute or continuing contract needs a longer hold. It records the decision before authorising any bulk deletion.

A Cyprus holding company uses an overseas cloud ledger and stores all supporting documents with a foreign accounting firm. Its directors cannot produce an up-to-date report in Cyprus. The board maps the overseas books, grants reliable director access and establishes a Cyprus-held reporting pack at intervals no longer than six months, sufficiently detailed to show financial position and support statement preparation. It tests retrieval of a loan agreement and a bank reconciliation. This responds to the section 141(3) proviso rather than assuming a cloud subscription automatically meets it.

A retailer switches bookkeeping software. The migration brings across opening balances but leaves purchase-invoice images and original journal support in the old platform, which will be closed. The company exports the underlying documents and transaction map, verifies checksums or counts, and tests sample retrieval before the provider deletes the old workspace. It retains the old-year records for their statutory period and connects them to the new opening balances. The business gains a usable audit trail, not merely a spreadsheet of totals.

For another company-record process, read the director-appointment guide.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Tax Assessment and Collection Law, section 30, books and retention; Registrar of Companies: financial statements, annual return and directors' record duty

Keep a retention register that can actually control deletion

A workable register has one row per record class or cohort, not one vague row for the whole company. Record the owner, system and physical or cloud location, calendar or tax year covered, statutory basis, minimum end date, any later business need, legal hold, access level and approved destruction method. Standing contracts should show the last relevant transaction or termination date, since their significance can extend beyond signature year. VAT, customs, employee and litigation files may need separate rows. Revisit the register at each year-end and after a new legal notice or dispute.

Before deleting a cohort, run a hold check with finance, tax advisers and legal staff as appropriate. Preserve proof of the review and the authorised destruction, without exposing more personal data than needed. Avoid irreversible automated deletion based only on file creation date; imported scans may carry the date of scanning rather than the transaction year. Conversely, endless retention creates search, security and privacy problems. The company should be able to explain why each class remains available and why a destroyed class had passed every relevant clock and hold.

Use the current consolidated section 141 and the Tax Department's section 30 guidance when reviewing the policy. The Registrar's English translation of Cap. 113 is older and should not be treated as the final source for later amendments; the current consolidated Greek provision is decisive for this guide's six-year and overseas-location details. The legal rule is short, but the implementation is a chain of custody from transaction evidence to books, financial statements and eventual defensible disposal. A company that maintains that chain can answer directors, auditors and authorities without reconstructing years of lost records.

Basis and guidance: Cyprus Companies Law Cap. 113, current consolidated section 141; Tax Assessment and Collection Law, section 30, books and retention; Cyprus Tax Department: keeping books and records; Registrar of Companies: financial statements, annual return and directors' record duty

Primary sources and scope

Sources checked: October 8, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Companies Law Cap. 113, current consolidated section 141
• Registrar of Companies: financial statements, annual return and directors' record duty
• Tax Assessment and Collection Law, section 30, books and retention
• Cyprus Tax Department: keeping books and records