Key Takeaways
- Information filed with the Registrar of Companies and Official Receiver is public, including director and shareholder details on the register.
- Internal records and certain owner information stay confidential beyond what the public register shows.
- Access to the beneficial ownership register is shaped by scope rules and a Court of Justice ruling, rather than being open to anyone.
- Data protection under the GDPR and Cyprus Law 125(I)/2018 governs how authorities, banks, and third parties lawfully obtain company data.
Company Privacy in Cyprus: What an EU Member State Actually Protects
Company privacy in Cyprus rests on a split that matters to every foreign owner: corporate filings sit on an open public register, while the identities of ultimate owners are held in a separate, restricted file. The public side is run by the Department of the Registrar of Companies and Intellectual Property (DRCIP), whose e-search portal anyone can use; the confidential side, the beneficial ownership register, is closed to the general public following a 2022 ruling from the Court of Justice of the European Union.
This affects anyone considering a Cyprus structure for trading, holding, or investment, particularly where ownership confidentiality is a planning goal. The sections that follow set out what shows publicly, what stays private, how the beneficial ownership system works, and where authorities and banks fit in.
The topic is most relevant to non-resident owners and their advisers weighing whether a Cyprus entity gives the privacy they expect against the transparency obligations that come with EU membership.
What Information Is Public at the Registrar of Companies and Official Receiver
The DRCIP maintains corporate and intellectual property records for organisations registered since 1923. Searching by company name or registration number is open to anyone, and basic information is free.
The public file shows the company name, date of incorporation, registered office, and current status: active, struck off, wound up, in liquidation, or under management. It also publishes amendments to founding documents, the certificate of incorporation, any name changes, and the appointment, departure, and personal details of officers.
A full historical search of the electronic file, covering everything from incorporation to the search date, costs €10. Companies within the scope of Law 138(I)/2024 must additionally submit an Income Tax Information Report through the DRCIP cashier, with a submission fee of €20.
One practical point for foreign readers: most documents on file are PDFs in Greek, which creates a real obstacle if you cannot read the language or do not engage a local agent to interpret them. The structure of the register is also described on the European e-Justice Portal.
Cyprus Company Incorporation in Cyprus
Set up your company in Cyprus with Expanship handling registration end to end.
What Stays Confidential: Internal Records and Owner Information Beyond the Register
A large category of company information never reaches the public file at all. Internal beneficial ownership registers, board minutes, management accounts, shareholder agreements, and declarations of trust are not filed with the Registrar.
A Declaration of Trust between a nominee shareholder and a beneficial owner is a private contract that no one, including the Registrar, may inspect. In practice it is produced only when a bank requests it during account opening.
The system operates on two layers: a register the company keeps internally, and a separate external declaration filed with the DRCIP. Personal data processed under the Companies Law (Chapter 113) is subject to the GDPR and national data protection rules, so the handling of officer and owner information is itself regulated.
Unlike jurisdictions that publish ownership data openly, this one keeps the beneficial ownership register closed to the public, a position taken on privacy grounds after the Court of Justice ruling discussed later.
The Beneficial Ownership Register: Scope, Disclosure and Who Can Access It
The Central Register of Ultimate Beneficial Owners was implemented in 2021 under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007), giving effect to the EU's 4th and 5th Anti-Money Laundering Directives. A UBO is any natural person who owns more than 25% of shares, holds more than 25% of voting rights, or exercises equivalent control by other means.
Where no individual meets the 25% threshold, the company registers its senior management officials, typically the directors, as beneficial owners instead. Most entity types fall within scope, including companies under the Companies Law, European public limited liability companies, and partnerships.
Some businesses sit outside the regime. Overseas companies with a Cyprus branch are not caught, and exemptions apply to companies listed on a regulated market subject to EU disclosure rules and to companies meeting equivalent international transparency standards.
Filing follows a fixed rhythm:
- The first submission is due within 90 days of incorporation.
- Subsequent changes must be filed within 45 days.
- Every company must log in between 1 October and 31 December each year to confirm or update its details.
| Item | Detail |
|---|---|
| Public access | Not available |
| Authority access | FIU, Tax Department, Customs, Police (unrestricted) |
| Obliged entity search fee | €3.50 per legal entity, on approval |
| Records held from | 12 March 2021 (no historical data) |
| Non-compliance fine | €200 first day, €100 per day, max €20,000 |
December 2024 amendments narrowed personal liability so that failure to submit attaches to the company itself rather than its officers, with directors liable only on a shared basis for penalties imposed on the entity. The same amendments gave the Registrar power to strike off firms that persistently neglect their reporting duties. A new EU AML Regulation adopted in 2024 takes effect in July 2027 and will set a harmonised EU-wide arrangement for beneficial ownership.
Cyprus Ongoing Compliance in Cyprus
Keep your Cyprus entity compliant with filings, returns, and statutory obligations.
Director and Shareholder Visibility on the Public Register
The Registrar's records are open to inspection by anyone, anywhere. A tax inspector in your home country can visit the registry website and see who the directors, shareholders, and secretaries are, together with their addresses.
A detailed company report from the public file lists current and past shareholders and their addresses, company documents, historic changes, previous names and addresses, and mortgages. These filings can be requested, purchased, and downloaded through the e-filing system.
The most common entity types are the Private Limited Company (LTD) and the Public Limited Company. A private company may have up to 50 shareholders; beyond that figure it must convert to public form.
The names and personal addresses of directors, secretaries, and registered shareholders are therefore visible to the public. Beneficial owners who use nominees, by contrast, do not appear on this open file.
The Role of Nominee Directors and Shareholders in Cyprus
Nominee arrangements are lawful and widely used. Company law does not prohibit a director from acting under contractual or fiduciary arrangements with shareholders or beneficial owners, and there is no requirement to disclose a nominee's status in company filings.
Nominee shareholders hold shares under a Declaration of Trust for the beneficial owner. A nominee director, however, is a full legal director carrying every duty under the Companies Law, and the Supreme Court has confirmed that the responsibilities of office apply from the moment of appointment regardless of any private agreement labelling the role "nominee" or "non-executive".
A nominee arrangement does not limit a director's legal liability, and it does not remove UBO disclosure obligations. Regulated service providers must still run full KYC and due diligence on the actual beneficial owner.
The practical benefit is commercial privacy from ordinary public searches, not concealment from regulators. Nominee directors are also commonly used to place the majority of the board in Cyprus, which supports a tax-residency position. The ultimate beneficial owner must still be disclosed to competent authorities, and nominee providers carry their own AML and counter-terrorist-financing duties to identify their principals.
Cyprus Cyprus Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Cyprus.
Data Protection Under the GDPR and Cyprus Law 125(I)/2018
When the GDPR became directly applicable in May 2018, the island supplemented it with Law 125(I)/2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data, published in the Government Gazette on 31 July 2018. The official English text%20of%202018%20ENG%20final.pdf) sets out the national derogations.
Those national choices include an age of digital consent set at 14, specific conditions for processing employee and special-category data, and provisions balancing data protection against freedom of expression. The supervisory body is the Commissioner for Personal Data Protection, an independent authority that monitors compliance, handles complaints, investigates, and issues guidance.
For a foreign-owned company, this matters because processing personal data under the Companies Law is expressly subject to the GDPR and national law. Penalties run up to €10 million or 2% of global turnover for procedural breaches and up to €20 million or 4% for substantive ones, and the Commissioner has issued fines since 2018 covering cookie consent, marketing without a lawful basis, and excessive employee monitoring.
The Court of Justice Ruling and Its Impact on Beneficial Ownership Access
On 22 November 2022, the CJEU invalidated open public access to UBO registers across the EU. The court found that the 5th AMLD provision making beneficial ownership data public breached the privacy and data-protection rights in Articles 7 and 8 of the Charter of Fundamental Rights.
General public access, the court reasoned, was a serious interference with those rights because it let an unlimited number of people learn a beneficial owner's material and financial circumstances. Striking down the relevant provision revived the earlier 4th AMLD test, under which access is limited to persons able to show a "legitimate interest".
The Cyprus register ceased public access on 3 January 2023. Access since then runs only to competent and supervisory authorities and to obliged entities such as banks and lawyers, and only in the course of customer due diligence.
The court was clear that journalists and civil society organisations must be able to reach information on the individuals behind EU companies, yet a mechanism to deliver that has not been put in place. As Transparency International notes, Cyprus has, alongside Malta and the Netherlands, declined access even to those demonstrating legitimate interest, setting it apart from member states that built limited access routes.
How Authorities, Banks and Third Parties Lawfully Obtain Company Data
Closed public access does not mean owner data is hidden from the state. The Financial Intelligence Unit, Tax Department, Customs, and Police all hold unrestricted access to the UBO register, and obliged entities may search it for €3.50 per entity after DRCIP approval, strictly for due diligence.
Cross-border exchange reaches further still. Through the FATCA Intergovernmental Agreement brought in by Decree 281/2015, financial institutions identify and report US account holders to the Tax Department, while participation in the OECD Common Reporting Standard means financial account information, including controlling-person details, is automatically exchanged with partner tax authorities. The Ministry of Finance sets out the mechanics in its CRS and FATCA guidance.
Banks generally require full transparency on beneficial ownership, source of wealth, source of funds, and activity, even where they recognise nominee structures. Foreign entities cannot query the UBO register directly, so financial-crime professionals abroad must rely on multi-source verification rather than the register alone.
Practical Privacy Considerations for the Non-Resident Owner
Confidentiality from a public search and confidentiality from the authorities are two very different things. A nominee director keeps your name off the documents a foreign tax inspector can pull from the registry website, but the beneficial owner behind any nominee must still be declared to competent authorities, and the Registrar looks through every layer of a structure to reach the natural person who ultimately benefits.
International banking arrangements are no longer private from tax authorities, a consequence of automatic exchange rather than any illegality. The point is that home-country tax filings must reflect foreign company and banking interests honestly.
The UBO register archives information without verifying it, so the compliance burden sits entirely with the filing entity. A company lacking genuine management and control on the island, or that looks artificial, risks a challenge to its claimed tax residency or its underlying substance.
Enforcement signals are mixed: penalties were rolled back and deadlines extended in December 2024, which may suggest softening political will, yet the legal obligations remain intact. With the EU AML Regulation adopted in 2024 and effective from July 2027, owners should expect harmonised and potentially tighter beneficial ownership rules and plan accordingly.
Conclusion
Cyprus offers genuine privacy from public corporate searches, especially through lawful nominee arrangements, but no privacy at all from tax authorities, financial regulators, or banks. Owner identities sit in a register closed to the public since January 2023, while directors, shareholders, and their addresses remain openly visible on the corporate file. For a non-resident, the workable position is straightforward: treat the structure as confidential to outsiders, fully transparent to the state, and reported honestly at home. Build real substance, file on time, and the privacy that exists will hold without exposing you to penalty or challenge.
How Expanship Can Help Your Business in Cyprus
Expanship advises non-resident owners on the privacy mechanics that matter in practice, from lawful nominee arrangements and Declarations of Trust to correct beneficial ownership filing and annual confirmation, and supports the wider needs of running a Cyprus entity from abroad.
- Company formation and structuring for foreign owners
- Registered agent and registered office services
- Tax registration and ongoing return filing
- Compliance management, including UBO and annual confirmations
- Accounting and bookkeeping
- Introductions to banking partners
To discuss your structure and obligations, contact Expanship Cyprus.
Frequently Asked Questions
No. Public access to the beneficial ownership register ceased on 3 January 2023 following the CJEU ruling of 22 November 2022. Access is now limited to competent authorities and to obliged entities such as banks and lawyers acting in the course of due diligence.
The DRCIP file shows the company name, incorporation date, registered office, status, and the names and addresses of directors, secretaries, and registered shareholders. Basic searches are free, while a full historical search of the electronic file costs €10.
Nominees keep your name off the public file, giving commercial privacy from ordinary searches. They do not remove your obligation to disclose ultimate beneficial ownership to the authorities, and the Registrar looks through every layer of the structure to find the individual who benefits.
The first filing is due within 90 days of incorporation, and any later changes must be reported within 45 days. Every company must also log in between 1 October and 31 December each year to confirm or update its details, with fines starting at €200 plus €100 per continuing day, up to €20,000.
Yes. Directors and shareholders appear on the open public register, and under FATCA and the OECD Common Reporting Standard, financial account details including controlling-person information are automatically exchanged with partner tax authorities.
Yes. The GDPR applies directly, supplemented by Law 125(I)/2018 and overseen by the Commissioner for Personal Data Protection, and processing of personal data under the Companies Law is expressly subject to those rules.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
