Cyprus Defensive Withholding Tax 2026: Articles 21A & 33A on Payments to Blacklisted and Low-Tax Jurisdictions

Cyprus has spent the past three years rebuilding its outbound payment regime around two ideas: payments to recipients in EU-blacklisted jurisdictions are taxed at source, and payments to recipients in low-tax jurisdictions are either taxed at source or denied deductibility. Articles 21A and 33A of the Income Tax Law, together with the parallel rules under the Special Defence Contribution Law, give the Cyprus Tax Department a coordinated set of tools to deny Cyprus' usual zero-WHT treatment when the recipient sits in a jurisdiction the EU or Cyprus considers harmful.

This article explains the regime as it stands at 31 May 2026: the legal mechanics, the two lists that drive scope, the 50% association test, the 2026 expansion to low-tax jurisdictions, the carve-outs, the GAAR overlay, and the practical compliance steps every Cyprus company with foreign group entities needs to take this year.

What the defensive WHT regime does

Cyprus has long been an outbound-payment-friendly jurisdiction. The default Income Tax Law and Special Defence Contribution Law together impose no withholding tax on dividends, interest or royalties paid by a Cyprus tax-resident company to a non-resident, regardless of whether a tax treaty applies. That neutrality is exactly what makes Cyprus useful as a European holding and licensing jurisdiction.

The defensive WHT regime is a targeted exception to that neutrality. It says: if the recipient is a company that is more than 50% associated with the Cyprus payer, and the recipient is resident in either an EU Annex I blacklisted jurisdiction or, from 2026, a low-tax jurisdiction, then Cyprus will either tax the payment at source or deny the deduction. The policy purpose is to align Cyprus with the EU Code of Conduct Group's defensive-measures playbook and to remove the incentive for groups to route value through Cyprus into harmful jurisdictions.

Legal basis: Articles 21A and 33A

Three statutory provisions carry the defensive regime:

• Article 21A of the Income Tax Law N.118(I)/2002imposes a 10% withholding tax on royalty payments by a Cyprus tax-resident company to a company resident in an EU Annex I blacklisted jurisdiction, where the recipient is associated (>50%) with the payer.
• Article 33A of the Income Tax Law is the transfer-pricing-adjacent article that, together with amendments introduced by Laws N.96(I)/2022, N.118(I)/2023 and the 2025 amendments under Law N.47(I)/2025 and Law N.49(I)/2025, sets out the wider defensive framework, including non-deductibility of interest and royalty payments to low-tax associated companies from 1 January 2026.
• The Special Defence Contribution Law N.117(I)/2002 imposes 17% SDC on dividends and 17% SDC on the gross interest where the payment is made by a Cyprus company to an associated company resident in an EU Annex I jurisdiction; from 1 January 2026 the same 17% applies to dividends to associated companies in a low-tax jurisdiction.

The first wave of these rules took effect on 31 December 2022 for dividends and interest, on 31 December 2023 for royalties (with the royalty mechanic moved into Article 21A), and the 2026 expansion to low-tax jurisdictions for dividends and to non-deductibility for interest and royalties took effect on 1 January 2026.

The 2026 rates at a glance

Each rate is an effective gross-up: the defensive WHT is computed on the gross amount of the payment and is not creditable in the recipient state in most cases, because the recipient state's domestic tax is either nil or extremely low. For interest and royalties to low-tax jurisdictions, the cost is converted from a tax-deductible expense into a permanent disallowance, which at the 15% corporate rate is functionally similar to a 15% cost.

Two lists: EU Annex I and Cyprus low-tax

The EU Annex I list

Annex I to the EU list of non-cooperative jurisdictions is updated twice a year by ECOFIN, in February and October, on the recommendation of the Code of Conduct Group on Business Taxation. After the 17 February 2026 update, Annex I contains:

• American Samoa
• Anguilla
• Guam
• Palau
• Panama
• Russian Federation
• Turks and Caicos Islands
• US Virgin Islands
• Vanuatu
• Viet Nam

Turks and Caicos and Viet Nam were added in February 2026; Fiji, Samoa and Trinidad and Tobago were removed. The next update is scheduled for October 2026. Cyprus tracks the EU list automatically — there is no separate Cyprus blacklist for Annex I purposes — so a payer must monitor the EU list at least at every six-month cycle and ideally at every contractual payment date.

The Cyprus low-tax jurisdiction list

The 2026 expansion to low-tax jurisdictions introduces a second list based not on EU politics but on a mechanical numerical test: any jurisdiction whose headline corporate income tax rate is lower than 50% of Cyprus' corporate income tax rate falls within scope. With Cyprus' rate now 15% (raised from 12.5% on 1 January 2026), the threshold is 7.5%. Jurisdictions commonly captured include:

The headline rate, not the effective rate, is the legal test. Tax holidays, IP regimes or local incentives that drop the effective rate below 7.5% in a particular jurisdiction do not, on their own, bring that jurisdiction within scope. Conversely, a jurisdiction with a headline rate at or above 7.5% (such as the UAE at 9%) stays outside the regime even if a particular taxpayer enjoys a free-zone exemption.

Associated companies: the 50% test

The defensive regime only applies where the recipient company is associated with the Cyprus payer. Association is defined as more than 50% direct or indirect ownership of capital or voting rights, held either by the Cyprus payer alone or together with associated persons. The mechanics:

• Direct ownership — straightforward shareholding percentage.
• Indirect ownership — multiplied through chains, so a 60% × 60% chain produces 36% indirect ownership, but a 100% × 60% chain produces 60% (above the threshold).
• Aggregation with associated persons — sibling and cousin entities under common ultimate control are aggregated. Family attribution applies to natural-person shareholders (spouse, parents, children, siblings) so that a structure cannot be cleansed by splitting ownership across a single family group.
• Look-through of nominees — nominee arrangements, trusts and similar vehicles are looked through to the beneficial owner where the Tax Department has access to UBO information (which it now does post-DAC8 and the strengthened UBO register).

A payment to a blacklisted-jurisdiction company that is less than 50% owned by the Cyprus payer (and its associates) is outside the defensive WHT. A payment to an unrelated portfolio shareholder in Anguilla, for example, attracts 0% Cyprus WHT.

Scope, carve-outs and the treaty question

Carve-outs by recipient type

• Individuals — payments to natural-person shareholders or lenders are outside Articles 21A and 33A. Cyprus' general zero-WHT regime applies (although other rules — SDC on dividends to Cyprus-domiciled individuals, for example — may still bite).
• Unassociated companies— payments to companies in blacklisted or low-tax jurisdictions where the >50% ownership test is not met are outside scope.
• Listed entities — the Tax Department applies a practical carve-out for payments to listed recipients on EU-regulated markets whose ultimate ownership is sufficiently diffuse that no single shareholder group exceeds 50%.

The treaty override question

In principle, where Cyprus has a double tax treaty with a blacklisted or low-tax jurisdiction, that treaty's reduced source-state rates should apply. In practice the treaty override is narrow for three reasons:

1. Most blacklisted jurisdictions have no treaty with Cyprus.American Samoa, Anguilla, Guam, Palau, Turks and Caicos, USVI and Vanuatu have no Cyprus DTT. Russia's treaty was terminated; Vietnam's remains in force but is under review.
2. The MLI Principal Purpose Test applies to modern treaties.Cyprus signed the MLI and deposited its ratification on 23 January 2020; the MLI's minimum-standard PPT is read into all of Cyprus' covered tax agreements. A taxpayer that relies on a treaty rate for a payment routed to a low-tax jurisdiction can have the benefit denied where one of the principal purposes of the structure was to obtain it.
3. Domestic GAAR overlay. Even where a treaty technically applies, Cyprus' GAAR under Article 33 of the Assessment and Collection of Taxes Law can disregard arrangements that lack commercial substance. See our companion guide on the Cyprus GAAR and anti-avoidance framework.

Anti-abuse safeguards and GAAR interplay

Articles 21A and 33A do not stand alone. They sit inside a larger anti-abuse architecture:

• Look-through — Cyprus will look through interposed conduit entities. Routing a payment through a Cyprus-friendly treaty jurisdiction before it reaches a blacklisted recipient does not, by itself, defeat the regime; the Tax Department applies a substance-and-purpose test to the chain as a whole.
• Beneficial-owner test — the regime focuses on the beneficial owner, not the immediate recipient. A conduit lender or licensor with no functional substance will be disregarded.
• GAAR overlay (ATAD GAAR / ACTL Article 33) — an arrangement whose main purpose is to escape the defensive WHT will be disregarded under the Cyprus GAAR.
• Ministerial Decree 110/2025 — gives the Tax Department a structured substance test for assessing recipient entities, including a requirement that at least one board member be qualified and resident in the recipient jurisdiction. Failure on two or more substance criteria triggers a rebuttable presumption that the recipient is a conduit.

Worked examples

Example 1: dividend to a BVI parent

CyCo is a Cyprus tax-resident operating company whose sole shareholder is a BVI parent. The BVI parent is wholly owned by an EU-resident individual. In financial year 2026, CyCo declares a dividend of €1,000,000 to the BVI parent. The BVI has a headline CIT of 0% and is a low-tax jurisdiction; the BVI parent is >50% associated with CyCo.

• Defensive SDC at 17% on €1,000,000 = €170,000 withheld at source.
• The BVI does not allow any credit for Cyprus SDC.
• The individual ultimately receives €830,000 net of Cyprus SDC.

Restructuring the BVI parent into a Cyprus or EU-resident holding company (with proper substance and a non-tax commercial rationale) would eliminate the SDC, because Cyprus charges 0% WHT on dividends paid to non-blacklisted, non-low-tax recipients.

Example 2: royalty to a Cayman IP holder

CyOp is a Cyprus operating company that licenses software from CayIP, its 100% Cayman parent. In 2026, CyOp pays €500,000 in royalties to CayIP. CayIP is associated (>50%) with CyOp; Cayman is a low-tax jurisdiction.

• No defensive WHT applies to royalties paid to a low-tax (as opposed to blacklisted) jurisdiction.
• However, the €500,000 royalty expense is non-deductible for CyOp.
• At the 15% corporate rate, the disallowance increases CyOp's Cyprus tax liability by €75,000.

Had CayIP been resident in, say, Anguilla (a blacklisted jurisdiction), the same royalty would attract a 10% Article 21A WHT of €50,000 and remain deductible to CyOp. The two regimes produce different mechanics for the Cyprus tax base, although the overall cost is similar.

Example 3: interest on a related-party loan from a Vanuatu lender

CyCo has a €10,000,000 related-party loan from VanCo, a Vanuatu company that is 100% under common control with CyCo. The loan carries 5% interest, paid annually. Vanuatu is on Annex I.

• Annual interest = €500,000.
• Defensive SDC at 17% on €500,000 = €85,000 withheld.
• The interest itself may also be subject to interest-limitation rules under ATAD (capped at 30% of EBITDA), and transfer-pricing arm's-length scrutiny.

Compliance: vetting, documentation, filings

Vetting counterparties

For every payment to a foreign group company, the Cyprus payer should answer four questions:

1. What is the tax residency of the recipient (with a current certificate of residence)?
2. Is that residency in an EU Annex I jurisdiction or in a low-tax jurisdiction (headline CIT < 7.5%)?
3. Is the recipient associated with the payer (alone or with associated persons) on a >50% basis?
4. If yes to (2) and (3), what is the appropriate defensive WHT or deduction treatment?

Documentation

• Current tax-residence certificate for each foreign recipient.
• UBO chart of the group, refreshed at least annually.
• Shareholder register and indirect-ownership computation for each chain.
• Board substance file for each recipient (board composition, location of meetings, qualifications).
• Annual confirmation that the recipient jurisdiction has not been added to Annex I in the latest ECOFIN update.
• For royalty and interest payments: transfer-pricing file under Article 33.

Filings

Defensive SDC is withheld at source and remitted to the Tax Department on the standard monthly SDC return (IR 614A); defensive Article 21A royalty WHT is similarly remitted through the non-resident WHT mechanism. The annual corporate income tax return (TD4) should disclose the non-deductibility of interest and royalties paid to low-tax recipients, with supporting schedules.

Restructuring options for affected groups

For groups holding Cyprus operating companies through a blacklisted or low-tax parent, three restructuring patterns are common in 2026:

1. Migrate the parent to Cyprus or another EU member state. Most defensible where the individual ultimate beneficial owner intends to relocate or where the group already has substance in Cyprus or an EU treaty jurisdiction. Combine with the non-dom regime for personal tax efficiency.
2. Migrate the parent to a non-blacklisted, non-low-tax treaty jurisdiction. Typical destinations include the UAE (9% CIT, above the 7.5% threshold), Singapore (17%), Hong Kong (16.5%), Ireland (12.5%) and Luxembourg (24.94%). Each comes with its own substance and treaty considerations.
3. Collapse the structure. For founder-owned groups, simplest is to remove the offshore parent entirely and hold the Cyprus operating company directly. This typically requires a tax-neutral share-for-share exchange and clearance.

See our holding company structuring guide for the full set of post-2026 patterns.

EU Code of Conduct Group dynamics

Cyprus' defensive WHT regime is not a domestic-policy choice — it is a coordinated EU-level instrument. The EU Code of Conduct Group on Business Taxation, established in 1997 and reinforced by the 2017 Council Conclusions on the EU list of non-cooperative jurisdictions, asks member states to apply at least one of four defensive measures (non-deductibility of costs, CFC inclusion, WHT, limitation of participation exemption) to payments to Annex I jurisdictions. Cyprus initially applied WHT, then extended to non-deductibility for the low-tax expansion in 2026, satisfying more than the EU minimum.

The list itself is updated on the recommendation of the Code of Conduct Group, which reviews jurisdictions against three core criteria: tax transparency, fair taxation, and implementation of BEPS minimum standards. Annex II (the "grey list") captures jurisdictions that have committed to reforms but not yet implemented them. Annex II jurisdictions are not in scope of Articles 21A and 33A, but their movement to Annex I in a future ECOFIN update can trigger immediate Cyprus consequences, so Annex II should be watched as an early-warning list.

Year-end checklist

1. Run the EU Annex I list as at the February and October ECOFIN updates against every foreign recipient.
2. Run the 7.5% headline-CIT test against every foreign recipient.
3. Recompute >50% ownership for each chain, including indirect and aggregated holdings.
4. Refresh tax-residence certificates for all foreign group recipients.
5. Document the substance position of each recipient under Ministerial Decree 110/2025.
6. Confirm the Article 33 transfer-pricing position for interest and royalty payments.
7. Apply defensive SDC / Article 21A WHT or deduction disallowance, as applicable, to each in-scope payment.
8. Disclose on the TD4 corporate income tax return with supporting schedules.
9. Review GAAR exposure for any recent restructurings that reduced exposure to the defensive regime.
10. Refresh the counterparty file before the next dividend, interest or royalty payment date.