Cyprus DAC6 & DAC7 Reporting for Founders (2026): Hallmarks, Digital-Platform Rules & Penalty Risk

Founders arriving in Cyprus in 2026 land in a country with the EU compliance stack fully assembled. DAC6 has been live since 2021. DAC7 has been reporting platform-seller data since early 2024. DAC8 — the crypto-asset reporting directive — applies from 1 January 2026. The Cyprus Tax Department knows about your Stripe account, your Airbnb rental, your Binance trades, your cross-border holding structure, and the Luxembourg adviser who built it. Getting compliance right is no longer optional. This guide is written for founders, not tax partners — plain English, worked examples, and clear flags on what tends to go wrong.

Why this matters in 2026

Five years ago, a founder landing in Cyprus could reasonably take the view that cross-border tax planning was a black box and that transparency was someone else's problem. That window has closed. Between DAC6 (cross-border arrangements), DAC7 (digital platforms), and DAC8 (crypto), almost every economically interesting activity a founder conducts is either already reported, or becomes reportable in 2026. The Cyprus Tax Department receives automatic data feeds from 26 other EU tax authorities — plus, via CRS, another 100-plus non-EU jurisdictions.

The right mental model is: compliance is no longer a defence against audit — it is the pre-condition for the regime you came to Cyprus to use. Non-dom status, the 60-day rule, the 15% corporate rate: all of these assume you are a fully visible, fully compliant taxpayer. The directives below are the machinery that makes you visible.

DAC6 in plain English

DAC6 is the common shorthand for EU Directive 2018/822, which amended the Directive on Administrative Cooperation. It was transposed into Cypriot law by amendments to the Assessment and Collection of Taxes Law in 2021. It obliges intermediaries — and in defined cases taxpayers — to disclose to the Cyprus Tax Department any "reportable cross-border arrangement" within 30 days of the trigger event.

A cross-border arrangement is reportable if:

• It concerns more than one EU Member State, or an EU state plus a third country; AND
• It bears at least one of five categories of hallmarks; AND
• For certain hallmarks, the main benefit (or one of the main benefits) is the obtaining of a tax advantage.

The Cyprus Tax Department transmits the report through a central EU directory, making it available to every Member State. It is not published. It is used for risk-assessment and audit selection.

The hallmarks A, B, C, D, E

The hallmarks are grouped in five categories. The main-benefit test gates the first three; the last two are reportable on their face, whether or not a tax benefit was the goal.

Category A — Generic hallmarks (subject to main-benefit test)

• Confidentiality clauses about the tax treatment of the arrangement.
• Fees to the adviser contingent on the obtained tax advantage.
• Standardised documentation or structure marketed to multiple clients.

Category B — Specific hallmarks (subject to main-benefit test)

• Acquisition of a loss-making company principally to use the losses.
• Conversion of income into capital, gifts, or categories taxed at lower rates.
• Circular transactions with round-tripping of funds.

Category C — Specific hallmarks related to cross-border transactions

Some category C hallmarks are subject to the main-benefit test, some are not:

• Deductible cross-border payments to associated enterprises where the recipient is in a zero- or near-zero-tax jurisdiction, or on an EU blacklist, or tax-exempt for the income.
• Deduction of depreciation on the same asset in more than one jurisdiction.
• Double relief for the same item of income.
• Transfers of assets with a material mismatch in valuation between jurisdictions.

Category D — Automatic information exchange and beneficial ownership

Not subject to the main-benefit test. Triggered by arrangements that may have the effect of undermining CRS reporting, or of obscuring the ultimate beneficial owner through opaque legal or beneficial ownership chains.

Category E — Transfer pricing

Not subject to the main-benefit test. Triggered by:

• Use of unilateral safe-harbour rules.
• Transfers of hard-to-value intangibles.
• Intra-group cross-border transfers of functions, risks or assets where the projected EBIT of the transferor over three years is less than 50% of what it would have been absent the transfer.

The main-benefit test

For hallmarks in categories A, B and parts of C, the arrangement is only reportable if the "main benefit or one of the main benefits that, having regard to all relevant facts and circumstances, a person may reasonably expect to derive" is the obtaining of a tax advantage. The test is objective, not subjective. If two disinterested observers would say the arrangement is principally motivated by tax, the test is met.

Cyprus practice has been to apply the test as it was designed in the directive — commercial purpose is a defence; cosmetic commercial rationalisation dressed around a tax-driven structure is not.

Who reports: intermediary vs taxpayer

DAC6 allocates the reporting obligation in a waterfall:

1. Primary intermediary — anyone who designs, markets, organises, or manages the implementation of the arrangement (typically the tax adviser, lawyer, or structuring firm).
2. Auxiliary intermediary — anyone who provides aid, assistance or advice on the arrangement (accountants, administrators, trustees).
3. Relevant taxpayer — the person for whom the arrangement is made available or who implements it, where:
   • There is no EU intermediary (for example the adviser is in London or Dubai);
   • The intermediary has invoked legal professional privilege under Cyprus law (Cyprus lawyers and, in limited circumstances, members of ICPAC can invoke privilege); or
   • The taxpayer designed the arrangement in-house without external intermediaries.

Where a Cyprus intermediary reports, the taxpayer is relieved. Where a foreign intermediary reports in another EU state, the Cyprus taxpayer is also relieved — but must retain evidence of the filing.

Timing: the 30-day trigger

The 30-day clock starts on the earliest of:

• The day the arrangement is made available for implementation;
• The day the arrangement is ready for implementation; or
• The day the first step in the implementation is made.

Marketable arrangements (arrangements designed for and marketed to multiple clients) require quarterly updates listing new participating taxpayers.

Cyprus DAC6 penalties

The Cyprus Tax Department granted an initial grace period during 2021 that has long since ended. Since 2022 the penalty regime is fully active. The 120,000-euro cap is material but not trivial — and it does not apply where the breach is wilful.

DAC7 for digital platforms

DAC7 — EU Directive 2021/514 — requires "Reporting Platform Operators" to collect, verify and report information about their sellers. It applies from 1 January 2023, with first reports due by 31 January 2024 for calendar year 2023 activity. The Cyprus Tax Department runs the reporting channel, and information is automatically exchanged among EU tax authorities and with qualifying non-EU jurisdictions that have signed the OECD multilateral framework.

Who is a reportable platform operator?

A platform is any software that connects sellers to users for:

• Rental of immovable property (Airbnb, Booking.com, Vrbo);
• Personal services (Uber, Bolt, food delivery, freelance marketplaces);
• Sale of goods (Amazon, eBay, Vinted, Etsy);
• Rental of any mode of transport (car-sharing, boat-sharing).

A platform operator is "Reporting" if it is tax-resident in the EU, incorporated under EU law, or has a permanent establishment in the EU — and, for non-EU platforms, if it facilitates reportable activity by EU sellers or relating to EU property.

Who is a reportable seller?

Any active seller on a covered platform that is resident in the EU, or uses the platform to rent immovable property situated in the EU. There is a de minimis exclusion for occasional goods sellers: fewer than 30 activities per year AND less than EUR 2,000 in total consideration. Below that, no report.

Due diligence on sellers

Reporting platforms must collect — and verify against authoritative sources — each seller's legal name, primary address, tax identification number, VAT number where applicable, date of birth for individuals, business registration number for entities, country of tax residence, and (for accommodation) the address and, where known, the land registry number of each rented property.

What is reported

Consideration received per quarter, number of activities per quarter, fees or commissions withheld by the platform, bank account or payment account identifiers, and, for accommodation, number of nights and property identifiers.

What sellers need to know

If you are a Cyprus-based founder using Amazon, Airbnb, Uber, or a comparable platform, DAC7 imposes no direct reporting on you. The platform handles the filing. Your practical obligations:

1. Respond to the platform's KYC request. If you do not provide your Cyprus TIN, the platform must — by EU law — suspend payouts or close your account after two reminder cycles. Some platforms act faster than the directive requires.
2. Match the data on your Cyprus tax return.The Cyprus Tax Department receives the platform's report automatically in the year after the activity. If your declared turnover is lower than what Amazon reported, you will get a letter. The expected turnover and VAT are easy to cross-check.
3. Register for VAT when you cross the threshold. Cyprus VAT registration is compulsory once turnover exceeds EUR 15,600 in any rolling twelve-month period for services, or the applicable distance-selling threshold for goods.

DAC8: crypto reporting from 2026

DAC8 — Council Directive (EU) 2023/2226, adopted 17 October 2023 — extends automatic exchange of information to crypto-asset transactions. It implements the OECD Crypto-Asset Reporting Framework (CARF) inside the EU.

• Transposition deadline: 31 December 2025.
• Application: provisions apply from 1 January 2026.
• First reporting year: 2026.
• First exchange between tax authorities: by 30 September 2027.

The directive imposes reporting obligations on Reporting Crypto-Asset Service Providers — entities that by way of business provide services to effectuate exchange transactions for or on behalf of customers (exchanges, broker platforms, custodial wallet services, in some cases issuers and transfer service providers). It does not impose direct obligations on individual holders.

From the user side, expect the same KYC-reinforcement you saw under DAC7: crypto exchanges will re-ask for your Cyprus TIN, your address, and corroborating identity information. Non-response results in account suspension. Reported data covers exchanges between crypto and fiat, exchanges between different crypto-assets, and transfers to wallets outside the platform.

DAC8 also extends CRS-style reporting to certain e-money instruments and central bank digital currencies (CBDCs) — relevant for founders holding tokenised fiat or using e-money wallets in meaningful size.

Common founder mistakes

1. Assuming the adviser filed. The Cyprus intermediary may not be the only intermediary. If a UK or Swiss adviser designed the arrangement, they may have no EU reporting obligation, and the duty shifts back to the Cyprus taxpayer. Confirm in writing who is filing.
2. Treating DAC6 as a tax-shelter rule. Many reportable arrangements are entirely conventional. Transfers of functions between EU group entities, lightly-taxed intermediate-holding companies, and even IP migrations can all be reportable without being aggressive.
3. Ignoring the 30-day clock.The clock starts on "made available", not on closing. If the adviser's engagement letter says the structure has been designed and is ready to go, the clock has started.
4. Not declaring DAC7 platform income. Cyprus tax returns require disclosure of all sources. If Airbnb reports EUR 40,000 to the tax department and you declare EUR 0, the audit letter is inevitable.
5. Forgetting VAT on services to EU consumers. Platform sellers providing services to EU consumers face EU VAT rules that interact with DAC7 data. Cross-reference applies.
6. Not updating exchanges with Cyprus TIN. When DAC8 kicks in during 2026, every EU-connected exchange will re-KYC its user base. Update now to avoid frozen balances.

How to get compliance right

• Inventory your cross-border arrangements. For every structure involving more than one country, map whether any hallmark is potentially engaged. Document the analysis.
• Put DAC6 responsibility in every engagement letter. When you retain an adviser, specify who files if reportable. Default: the adviser. Second choice: the adviser obtains and files; third: the adviser confirms no hallmark is engaged.
• Reconcile platform data annually. Ask each platform for a year-end statement and match it to your Cyprus tax return before filing.
• Declare crypto gains and holdings. DAC8 will surface them. Non-doms do not pay SDC on crypto-origin dividends or interest, but trading gains are Cyprus-source income taxable at ordinary rates if the activity is commercial.
• Keep records for six years. The Cyprus statute-of-limitations for tax is six years (twelve in cases of fraud). Retain documentation supporting every reportable arrangement and every platform income stream for at least that period.