Cyprus FDI Screening Law 2026: What Foreign Investors Must Know

For most of the last decade Cyprus has marketed itself as one of the most open economies in the EU — and it largely is. But the legal landscape for inbound investment has tightened. Cyprus has transposed EU Regulation 2019/452 (the EU Foreign Direct Investment Screening Regulation), the Foreign Subsidies Regulation 2022/2560 runs in parallel for larger deals, and sector-specific consent regimes have been refreshed. A non-EU investor targeting a Cyprus company in critical infrastructure, technology, supply chains, dual-use, or media must now plan for a structured review — and the timeline impact on M&A is real.

This guide explains who is in scope, what triggers a filing, how the standstill obligation interacts with the SPA, and how to align an FDI notification with the Foreign Subsidies Regulation and existing sector-specific consents. Zeno coordinates with independent Cyprus Bar-licensed advocates and ICPAC-licensed accountants to deliver joined-up FDI and tax-structuring advice on inbound transactions.

What is FDI screening

FDI screening is the process by which an EU Member State reviews — and, where necessary, restricts or prohibits — an inbound investment by a non-EU investor on grounds of security or public order. The EU framework was created by Regulation (EU) 2019/452, in force since 11 October 2020, which sets a common floor for national screening mechanisms and establishes a cooperation mechanism: when one Member State screens a transaction, other Member States and the European Commission can submit comments and opinions.

Importantly, the Regulation does not centralise decision-making in Brussels. The decision to clear, condition or prohibit a transaction remains with each Member State. In Cyprus, that decision sits with the Council of Ministers, on the recommendation of the Ministry of Energy, Commerce and Industry, after a structured review.

EU and Cyprus legal basis

The relevant instruments stacked on top of each other are:

• EU Regulation 2019/452 — the FDI Screening Regulation. Establishes minimum content for national screening, the cooperation mechanism, the sectoral list, and the definition of foreign investor.
• Cyprus national implementing measures — the domestic legal architecture that designates the competent authority, the procedure, the filing form, the timelines, and the sanctions.
• EU Regulation 2022/2560 (FSR) — the Foreign Subsidies Regulation, applicable from 12 July 2023 with the notification regime in force from 12 October 2023. Centralised notification to the European Commission for qualifying concentrations.
• Cyprus sector consents — pre-existing change-of-control regimes administered by the Central Bank of Cyprus (banks), CySEC (investment firms, CASPs, AIFMs/UCITS), the Commissioner of Electronic Communications (telecoms licences), the Cyprus Energy Regulatory Authority (energy licences), and others.
• EU Merger Regulation 139/2004 — antitrust notification at the Commission if EU thresholds are met, or at the Commission for the Protection of Competition if Cyprus thresholds are met. Antitrust runs in parallel to FDI.

Who counts as a foreign investor

Under Article 2(2) of Regulation 2019/452, a "foreign investor" is any natural or legal person of a third country (i.e. outside the EU) intending to make, or having made, a foreign direct investment. The Cyprus screening practice follows three principles:

• Look-through to ultimate ownership. Where the immediate acquirer is an EU-incorporated SPV, the analysis looks through to the ultimate beneficial owner. An EU SPV controlled by a non-EU UBO is a non-EU investor for screening purposes. This aligns with Cyprus's broader UBO disclosure regime — see our guide to the Cyprus UBO register.
• State-linked investors get more scrutiny.Sovereign wealth funds, state-owned enterprises, and entities subject to the influence of third-country governments draw heightened review. The Regulation expressly lists this as a relevant factor.
• Indirect control counts.Voting agreements, options, and contractual control rights can constitute "control" for screening even without 100% ownership.

Sectors and assets in scope

Article 4 of Regulation 2019/452 sets out a non-exhaustive sectoral list. Cyprus screens with particular focus on:

The 25% and 10% thresholds

Cyprus practice — consistent with most EU Member States — frames the review around acquisition of "control" or significant influence. The working thresholds are:

• > 25% acquisition — the default trigger for a non-EU investor acquiring shares or voting rights in a Cyprus target active in a scope sector.
• > 10% acquisition — the lower threshold applied to the most sensitive cases (defence, dual-use, certain critical infrastructure), and to acquisitions by state-linked investors.
• Crossing-threshold transactions — a follow-on stake increase that takes a holding from below to above the threshold counts. So does the acquisition of incremental rights (board seats, veto rights) without a change in share percentage.

The standstill obligation

The standstill obligation is the legal core of FDI screening. Until clearance is issued (or the statutory waiting period expires without intervention), the parties must not:

• Transfer legal title to the shares or assets;
• Pay consideration to the seller;
• Exercise voting rights at the target's general meeting;
• Appoint or remove directors of the target;
• Integrate the target operationally or commercially.

Breach of standstill (sometimes called "gun-jumping") can result in administrative fines and, in serious cases, can render the underlying share transfer voidable on public-order grounds. The practical implication is that the FDI clearance becomes a hard condition precedent (CP) in the SPA, alongside antitrust and any FSR clearance.

The Cyprus filing procedure

The procedural anatomy of a Cyprus FDI filing is:

1. Pre-notification (optional but recommended).Informal contact with the Ministry of Energy, Commerce and Industry to scope the filing and resolve threshold/sector questions.
2. Filing. A structured notification setting out: the parties (with full UBO disclosure), the transaction, the target's activity in Cyprus, sector classification, dual-use considerations, the funding sources, any state-link of the investor, and the commercial rationale.
3. Phase 1 review. The competent authority assesses the file, requests additional information as needed, and triggers the EU cooperation mechanism by notifying the Commission and other Member States with key transaction data.
4. Cooperation period. Other Member States have 15 calendar days to indicate they wish to comment, and a further period to provide substantive comments. The Commission can issue a non-binding opinion within a defined window.
5. Phase 2 (if needed). Where concerns are raised, an in-depth review with potential mitigation negotiation.
6. Decision. Clearance, conditional clearance with undertakings, or prohibition — issued by the Council of Ministers on the Ministry's recommendation.

Foreign Subsidies Regulation interplay

Regulation (EU) 2022/2560 — the Foreign Subsidies Regulation (FSR) — is a separate, EU-level regime aimed at distortive subsidies granted by third-country governments. The notification obligation has been in force since 12 October 2023. It applies to a concentration where:

• The acquired EU undertaking (or at least one of the merging parties) generates EU turnover of at least €500 million; and
• The parties combined received at least €50 millionin financial contributions from third countries in the three calendar years before signing.

FSR notifications go to the European Commission (DG COMP), not to Cyprus. The standstill obligation under FSR also applies and runs in parallel with FDI standstill. Where both apply, the deal timeline is constrained by the longer of the two — typically the FSR clock, because its initial review period is 25 working days with potential extensions to 90 working days and beyond.

Impact on M&A timelines

A non-EU acquisition of a Cyprus target in a scope sector typically looks like this:

Realistic signing-to-closing in a clean Phase 1 case is 8 to 12 weeks. Where Phase 2 is opened or FSR applies, expect 4 to 6 months.

Worked example: a non-EU buyer

Consider a US-headquartered private equity sponsor acquiring 60% of a Cyprus-incorporated fintech infrastructure company that processes payments for several Cyprus-licensed banks and operates a Tier-3 data centre in Nicosia. Annual EU turnover of the target is €120 million; third-country financial contributions to the buyer's funds in the prior three years are €35 million.

• FDI Cyprus: triggered. The target is critical infrastructure (payments and data centre) and handles sensitive financial data. The 25% threshold is comfortably crossed. Filing required.
• FSR EU: not triggered. EU turnover is below €500 m, financial contributions below €50 m.
• CBC change-of-control:not directly (target is not a bank), but the target's banking customers may have contractual change-of-control consent rights worth diligencing.
• CySEC: if the target operates under any CySEC authorisation (PSP, EMI, CASP), a CySEC change-of-control approval is required and runs in parallel to FDI.
• Antitrust:below EUMR thresholds; consider Cyprus CPC notification thresholds (combined turnover > €3.5 m and at least two parties with > €3.5 m Cyprus turnover).

The likely timeline from signing to closing in this case is 10 to 14 weeks, gated by the longer of FDI Cyprus and CySEC change-of-control, with antitrust running in parallel.

Common mistakes and red flags

1. Treating FDI as optional. Non-EU buyers occasionally assume that smaller, private-market Cyprus targets are not in scope. If the target is in critical infrastructure, technology, dual-use, or media, scale does not exempt it.
2. Closing before clearance. Gun-jumping — exercising voting rights, integrating operations, paying consideration — before clearance breaches standstill and can void the transfer.
3. Ignoring the look-through. EU-incorporated SPVs with non-EU UBOs are non-EU investors. A Luxembourg holding company owned out of the Gulf or East Asia is screened.
4. Missing the FSR clock. The FSR turnover and financial-contribution thresholds are mechanical. Counsel must aggregate parent and fund-family contributions across three years before signing.
5. Forgetting sector consents. CBC, CySEC, ECTA, CERA, and other sectoral change-of-control approvals apply regardless of nationality and on their own statutory clocks.
6. Stale UBO information.The Cyprus filing requires current, full-look-through UBO data. Reconciling this with the Cyprus UBO register and the buyer's internal records frequently uncovers discrepancies — fix them before filing, not during.
7. Drafting weak CPs.SPAs that condition closing on "regulatory clearances" without itemising FDI, FSR, antitrust and sector consents create real allocation-of-risk disputes. List them and assign drop-dead dates.

How to prepare a filing

The work that needs to happen before the filing is submitted:

1. Map the consents. List every regulatory clearance the deal needs: FDI, FSR, EUMR / Cyprus CPC antitrust, CBC, CySEC, ECTA, CERA, sector ministries, and any third-party contractual consents.
2. Build the UBO file.Capture the buyer's ultimate ownership and control chain, including any state link, in a structured chart that ties to source documents.
3. Diligence the target's scope-sector exposure.What is the target actually doing? Where is the critical infrastructure element? Where is the sensitive data? Where is the dual-use technology?
4. Pre-notify if borderline. A short memo to the Ministry of Energy, Commerce and Industry, often without binding the authority, can de-risk the timetable.
5. Draft the SPA with realistic CPs. Long-stop dates aligned with the longer of FDI and FSR. Clear allocation of risk if a mitigation undertaking is required.
6. File the FDI notification. Submit the structured filing with full supporting documentation; respond promptly to information requests.
7. Plan for mitigation. Even where clearance is expected, prepare a menu of potential undertakings (governance ring-fencing, data localisation commitments, security audits, carve-outs) to accelerate Phase 2 if it opens.

For inbound investors, FDI screening rarely blocks a deal — but it will shape its shape and its timetable. Treat it as the first item on the regulatory grid, not the last. Investors building Cyprus platforms for tax and corporate reasons should also read our guide to Cyprus corporate tax 2026 and our Cyprus economic substance guide — the substance dimension materially affects how the post-acquisition operating model is presented to the authority.