The Cyprus UBO Register (2026): What's Public, What's Private, How to Stay Compliant

The Cyprus UBO register is where the names of the natural persons who own and control Cyprus companies are recorded. In 2022 the Court of Justice of the European Union struck down general public access to EU UBO registers as disproportionate, and Cyprus — along with every other member state — tightened access accordingly. Since then the framework has evolved further: automatic fines in 2024, a standard 45-day change rule, and a clearer legitimate-interest test. This guide explains what actually gets filed, who can see it now, what it costs to miss a filing, and which privacy tools remain available to legitimate businesses.

What the UBO register actually is

Cyprus implements the EU Anti-Money-Laundering Directive through the Prevention and Suppression of Money Laundering Activities Law. Under that framework every legal entity must identify and file with the Registrar of Companies the natural person(s) who ultimately own or control it. The resulting register has two purposes:

• Transparency — competent authorities investigating tax evasion, money laundering or sanctions breaches can see who really stands behind a company, irrespective of nominee arrangements or corporate ownership chains.
• AML / KYC — banks and professional advisers use the register to cross-check UBO disclosures they independently obtain during onboarding.

Who counts as a UBO

A UBO is any natural person who:

1. Holds more than 25% of the shares, voting rights or capital of the entity, directly or indirectly.
2. Exercises control through other means — e.g. by contract, shareholders’ agreement rights, board appointment rights.
3. If no natural person can be identified under (1) or (2), the senior managing official is registered as a proxy UBO.

Indirect ownership is included. If A owns 50% of B which owns 100% of the Cyprus company, then A is a UBO. If A owns 20% of a Cyprus holding that owns 100% of a Cyprus OpCo, A is not a UBO of the OpCo on pure ownership percentages — but if A has board-appointment rights, A is a UBO by control.

What gets filed

For each UBO:

• Full name.
• Date of birth and nationality.
• Country of residence.
• Nature and extent of beneficial interest (shareholding %, voting %, or description of control).
• A recent official identification document reference (passport, national ID).
• Residential address — collected for the register but not displayed to any accessor who has legitimate-interest access (only to competent authorities).

Who can see it after the 2022 CJEU ruling

The CJEU ruling of 22 November 2022 (joined cases C-37/20 and C-601/20) invalidated the provision of the Fifth Anti-Money Laundering Directive that opened UBO registers to the general public. The Court held that the general-public-access regime was a disproportionate intrusion on private life and data protection rights. EU member states — Cyprus included — withdrew general public access shortly after.

Access since then is limited to three tiers:

• Competent authorities — the Cyprus Tax Department, the Police, the Financial Intelligence Unit (MOKAS), CySEC. Unrestricted access to everything including residential addresses.
• Obliged entities — banks, lawyers, accountants, corporate-service providers and other AML-regulated parties. Access when performing customer due diligence on the entity.
• Persons with a demonstrated legitimate interest — typically investigative journalists and civil-society organisations researching suspected financial crime. Must apply, demonstrate the legitimate interest, and are limited to the information strictly necessary for the stated purpose.

General members of the public, commercial competitors, random browsers — no access. A curious visitor to a competitor Cyprus company cannot simply look up who owns it.

The automatic-fines regime (recalibrated 2025)

Cyprus introduced automatic UBO fines on 1 April 2024. The penalty structure was recalibrated under Law L.141(I)/2024 and has applied in its current form since February 2025:

• €100 fixed penalty on the first day of default.
• €50 per day of continued default thereafter.
• Cap: €5,000 per entity AND, separately, €5,000 per responsible officer (director, secretary or person charged with filing).
• The Registrar now also has the power to strike off persistent defaulters.

Fines accrue automatically without individual notice — the Registrar’s portal tracks filing dates. Directors who rely on an outside service provider for UBO filings remain personally liable; a missed filing is theirs too.

Banks check UBO status during onboarding and periodically thereafter. A company with accumulated UBO fines is routinely refused new banking relationships and may have existing accounts suspended.

The 45-day change-notification rule and annual confirmation

When any of the following changes, the update must be filed within 45 days:

• A new UBO arrives or an existing UBO ceases (share sale, control transfer, death).
• An existing UBO’s ownership or control percentage crosses a threshold.
• An existing UBO’s residential address or identification document changes.
• Any other material change to the beneficial-ownership picture.

Every Cyprus company must also file an annual confirmation of its UBO data, even when nothing has changed. For 2026, the confirmation window is 1 October to 31 December. The obligation is on the company; failure triggers the automatic-fines regime.

Legitimate privacy tools (within the rules)

For founders with legitimate privacy concerns — high-net-worth individuals, clients in sensitive industries, people in the public eye — several tools work within the rules:

1. Nominee director. The beneficial owner is not named on the Registrar’s public directors list (which remains public). The nominee is. UBO disclosure is unaffected.
2. Cyprus holding company. Shares of the operating company are held by a Cyprus holding, so the beneficial owner’s personal name does not appear on the operating company’s share register. The UBO of the holding is still the beneficial owner.
3. Corporate secretary and professional registered office. Using a professional corporate-service provider as secretary and registered-office holder keeps the beneficial owner’s personal address off the Registrar record.
4. Trusts and foundations for genuine asset-protection reasons. Cyprus international trusts can hold shares in Cyprus companies; the trust is in turn beneficially owned by the settlor / beneficiaries under separate UBO rules.

None of these remove the UBO filing itself — they manage the other layers of information that are still publicly visible (directors, shareholders, addresses).

Trusts, foundations and nominee structures

Cyprus operates a separate UBO register for express trusts under the Cyprus International Trusts Law and related AML regulations. For each trust, the following are recorded:

• Settlor(s).
• Trustee(s).
• Protector (where appointed).
• Beneficiaries — classes and any identified individuals.
• Any other natural person exercising effective control.

Access follows the same three-tier model as the companies register. A trust structure does not shield UBO data from authorities — it documents it.

Common mistakes we see

1. Assuming the outside service provider is doing it. Many firms include UBO filings in their service pack, but directors remain personally responsible. Check with your provider that UBO is up to date — don’t assume.
2. Filing a nominee as UBO. Filing the nominee director as UBO is wrong and creates both a compliance breach and a false-declaration exposure. UBO is always the beneficial owner.
3. Missing the 45-day window on share transfers. A simple share sale triggers a UBO update. Too often the legal file is closed on the sale and the UBO update is forgotten.
4. Relying on the "senior manager”“ fallback without need. The senior-manager proxy is for companies where no natural person truly controls. Using it while a real 25%+ holder exists is a breach.
5. Historic data left out of date. If UBO records are older than 12 months without an annual confirmation, the automatic-fines regime is already accruing.

If your UBO filings are out of date

The cleanest path is to regularise promptly. In practice that means:

1. Reconstruct the correct UBO position as it currently stands and as of each past change.
2. File the missed changes as a series of disclosures (some may also need penalties settled).
3. File the current-position annual confirmation.
4. Implement a tracking process — bookmark share-change and director-change events for the next 45-day cycle.

We often handle UBO regularisations as part of onboarding a new accounting client. See our accounting and audit retainer for ongoing compliance bundled with UBO tracking.