Cyprus Company Annual Compliance Checklist 2026: Audit, TD4, HE32, UBO, VAT/VIES — Every Deadline and Penalty

Running a Cyprus company is cheap and clean — but only if you treat compliance as a recurring calendar, not a one-off setup. Six obligations repeat every year, they hang off one another, and each has its own deadline and penalty regime. This checklist walks through all of them for the 2026 financial year, with the primary statutory basis for each.Companies Law Cap. 113 (as amended)

Zeno is not a law firm: it coordinates independent Cyprus Bar advocates and ICPAC-licensed accountants and auditors, so the audit, tax and corporate filings below are delivered by the correctly licensed professional for each task rather than by a single generalist.

What must a Cyprus company file every year?

Every Cyprus company — trading, holding or dormant — must each year: hold an AGM, prepare audited or reviewed IFRS financial statements, file the HE32 annual return, submit the TD4 corporate tax return, confirm its UBO register, and file VAT/VIES returns where it trades cross-border. Provisional tax is paid twice during the year.

These are not independent tasks. The audited accounts feed both the HE32 (filed with the Registrar of Companies) and the TD4 (filed with the Tax Department), so a delayed audit cascades into two missed filings. Below is the full annual set, each covered in its own section.

Do I need a statutory audit or a review engagement?

Statutory audit is mandatory for every Cyprus company — there is no small-company audit exemption. But a company below both €300,000 net turnover and €500,000 total gross assets may elect a lighter review engagement instead of a full audit.

Both the full audit under International Standards on Auditing and the review under ISRE 2400 (Revised) must be signed by an ICPAC-licensed statutory auditor — a review is a lighter engagement, not a do-it-yourself one. Dormant companies are not exempt: a company with zero transactions still prepares IFRS statements and has them audited or reviewed every year. Note the two size limbs are cumulative, so a director's loan or a large receivables balance can push gross assets past €500,000 and force a full audit even on modest turnover. The full decision flow is in our Cyprus audit requirements 2026 guide.Companies Law Cap. 113, s.152A (as amended 2026)

What is the TD4 corporate tax return?

The TD4 is the annual corporate income tax return, filed with the Tax Department and based on the audited or reviewed accounts. From 1 January 2026 corporate income tax is a flat 15% with no reduced SME band, and the TD4 self-assesses the year's liability against provisional tax already paid.

Two provisional tax instalments fall due during the tax year itself, on 31 July and 31 December, based on the company's own estimate of taxable profit; the TD4 then reconciles the estimate to the audited outcome. Companies claiming the IP Boxregime — an 80% deduction that can bring the effective rate on qualifying IP income to roughly 3% — must support the claim with a full audit and the relevant nexus documentation. The wider rate framework, including how the 15% base interacts with dividends and the non-dom SDC exemption, is set out in the Cyprus corporate tax guide 2026.Assessment & Collection of Taxes Law N.4/1978

What is the HE32 annual return and when is it filed?

The HE32 is the company's annual return to the Registrar of Companies, filed together with the audited financial statements. It must be filed within 28 days of the AGM, and AGMs must be held no more than 15 months apart (18 months from incorporation for the first).

The HE32 confirms the company's registered particulars — directors, secretary, registered office, shareholders and share capital — and attaches the year's statements. A Cyprus company must maintain at least one director, one shareholder, one secretary and a registered office at all times, and any change to those particulars should be filed promptly rather than saved for the annual return. The €350 annual levy that older guides mention no longer applies — it was abolished from 2024, though pre-2024 arrears remain collectible.Companies (Amendment) Law 2024 (annual levy abolition)

How often must the UBO register be confirmed?

Every Cyprus company must file its ultimate beneficial owners with the Registrar's central UBO register, confirm those details at least once a year, and update them within the prescribed window of any change. The annual confirmation carries its own penalties, separate from the HE32.

A UBO is generally any natural person who ultimately owns or controls more than 25% of the shares or voting rights, or who otherwise exercises control. Because the confirmation obligation recurs annually and both the company and its officers face fixed and continuing daily penalties for default, the sensible approach is to slot the UBO confirmation onto the same calendar entry as the HE32 so neither is forgotten. This is a transparency filing to the Registrar, not a public disclosure of your personal tax affairs.Prevention and Suppression of Money Laundering Laws; RoC UBO Directive

What are the VAT, VIES and OSS obligations?

VAT registration becomes compulsory once taxable turnover exceeds €15,600 in any 12-month period. VAT returns are generally filed quarterly; cross-border B2B supplies within the EU require VIES recapitulative statements, and B2C digital sales use the OSS scheme.

Registration can also be triggered below the €15,600 threshold — for example by intra-EU acquisitions of goods above the relevant limit, or by receiving certain cross-border services under the reverse charge. Once registered, the company charges and reconciles VAT on its periodic returns and, where it sells goods or services to VAT-registered businesses in other member states, lists those supplies on VIES. B2C sellers of digital services across the EU can report through the One Stop Shop rather than registering in each customer's country. The mechanics, thresholds and registration steps are covered in the Cyprus VAT registration guide.VAT Law N.95(I)/2000; EU VAT Directive 2006/112/EC

What are the key 2026 compliance deadlines?

The binding dates for the 2026 year: AGM within 15 months of the last; HE32 within 28 days of the AGM; TD4 for tax year 2026 by 31 January 2028; provisional tax on 31 July and 31 December 2026; and VAT returns broadly quarterly.

In practice the constraint that governs the whole chain is the auditor's calendar: books that close cleanly early in the year get signed accounts by summer, which in turn unlocks the HE32 and TD4 on time. Newly formed companies should also read the company registration guide for the extended first-period timing.

What are the penalties for missing compliance?

Each obligation has its own penalty. Late HE32 costs €50 plus €1 per day, capped at €150; a late TD4 attracts €100 (€200 after a Commissioner's notice) plus a 5% surcharge and interest; UBO and VAT defaults carry separate fixed and daily penalties. Persistent default leads to strike-off.

• HE32 late filing: €50 fixed penalty plus €1 per day of continuing default, capped at €150 per return, on top of the standard filing fees.Companies (Amendment) Law 18(I)/2024
• TD4 late filing: €100 administrative penalty, rising to €200 where the Tax Commissioner has served a notice; a 5% surcharge on unpaid tax plus statutory interest.Assessment & Collection of Taxes Law N.4/1978, Art. 50A
• UBO default: fixed and continuing daily penalties on both the company and its officers for failure to file, confirm or update beneficial-ownership details.
• VAT default: late-registration and late-return penalties, plus 10% on tax paid late and interest; VIES/OSS omissions carry their own fixed penalties.
• Strike-off risk: persistent non-filing lets the Registrar strike the company off; assets vest in the Republic and bank accounts freeze until (costly) reinstatement.