Key Takeaways
- TIEAs allow Cyprus to exchange information only on request, rather than automatically, and differ in purpose from double tax treaties.
- Requests must meet a foreseeable relevance test, which blocks speculative fishing expeditions for unrelated data.
- Confidentiality rules and procedural safeguards limit how information is requested, used, and shared, protecting the taxpayer.
- Non-resident owners and advisers should understand the scope of covered information and how a request moves through Cyprus in practice.
TIEAs in Cyprus: What Exchange of Information on Request Really Means
A Tax Information Exchange Agreement (TIEA) is a bilateral instrument designed for one task: letting a tax authority in one country request information held in another about a taxpayer it is examining. When it comes to TIEAs in Cyprus, the position for a foreign owner is straightforward and worth stating at the outset. Cyprus has concluded no standalone TIEAs, and its OECD country hub confirms this absence.
That does not mean information stays put. Exchange of information on request (EOIR) operates through other channels: the information-exchange clauses inside Cyprus's double tax treaties, EU cooperation directives, and a multilateral convention.
This article explains why there are no separate TIEAs, what carries the same function in their place, how a request actually works, and what protections a taxpayer retains. It matters most to a non-resident investor, a foreign business owner with a Cyprus entity, or the adviser assessing how exposed that structure is to cross-border information requests.
How a TIEA Differs from a Double Tax Treaty
The two instruments answer different problems. A double tax treaty (DTA) prevents the same income being taxed twice and allocates taxing rights between two states; embedded within it, usually at Article 26 of the OECD Model Tax Convention, sits an information-exchange clause. A TIEA does only the second job. It carries no relief from withholding tax and no residency tie-breaker rules.
The OECD built the TIEA for a specific scenario. High-tax countries wanted a route to obtain information from authorities and banks in jurisdictions with which they had no full treaty, often to trace funds moved offshore.
The substantive standard is shared. Both the 2002 OECD Model Agreement on Exchange of Information on Tax Matters and Article 26 of the Model Convention require exchange of information that is "foreseeably relevant" to enforcing a partner's tax law. A 2015 Model Protocol later allowed parties to extend existing TIEAs to automatic and spontaneous exchange.
The practical takeaway is simple. Where a country already has a wide DTA network containing Article 26 clauses, separate TIEAs add little, because the treaty provision delivers the same reach.
Cyprus Company Incorporation in Cyprus
Set up your company in Cyprus with Expanship handling registration end to end.
Cyprus's Network of TIEAs: How Many and with Which Jurisdictions
The count is zero. No bilateral TIEA has been concluded, a finding confirmed on the OECD country page and in the 2020 Global Forum peer review report. All EOIR capacity rests on treaty and convention instruments instead.
What stands in their place is substantial. The firm operates almost 50 double tax treaties, an unusually large network for a low-tax jurisdiction, with most following the OECD Model and carrying its Article 26 exchange clause.
| Channel | Coverage | Type of exchange |
|---|---|---|
| Bilateral DTAs (Article 26) | ~50 partner states | On request, plus spontaneous |
| EU DAC Directives | All 27 EU Member States | On request and automatic |
| Multilateral Convention (MAC) | All MAC signatories | On request, spontaneous, automatic |
| Standalone TIEAs | None | Not applicable |
The treaty network keeps growing. A first-time Cyprus–Oman treaty was signed on 8 December 2024 and awaits ratification; the Cyprus–Netherlands treaty entered into force on 30 June 2023, effective 1 January 2024; and a revised Cyprus–France treaty was signed on 11 December 2023, also pending ratification.
For a foreign owner, the relevant question is not "is there a TIEA" but "is there a treaty or convention link to my home state." For most major investor countries, the answer is yes.
The Legal Basis for Information Exchange in Cyprus
Three pillars carry the obligation to exchange. The first is the set of EU Directives on Administrative Cooperation (the DAC series), transposed into national law. The second is the bilateral treaty network with its Article 26 clauses. The third is the Multilateral Convention on Mutual Administrative Assistance in Tax Matters.
The EU directives have been adopted in full. DACs 1 through 5 are in force, and the law transposing DAC6 (cross-border arrangement reporting) took effect on 30 March 2021 with retroactive reach back to 25 June 2018. DAC7, covering digital platform reporting, followed through legislation implementing Council Directive (EU) 2021/514.
DAC8, which extends automatic reporting to crypto-assets, came later than the original 31 December 2025 deadline. The implementing law entered into force on 27 March 2026, with retroactive effect from 1 January 2026.
Several multilateral commitments complete the framework:
- The Common Reporting Standard agreement was signed on 29 October 2014, with automatic exchange beginning in September 2017.
- The Country-by-Country Reporting agreement was signed on 1 November 2016.
- The Multilateral Instrument (MLI) was signed on 7 June 2017 and ratified on 23 January 2020.
- A FATCA intergovernmental agreement with the United States is in place for reporting on US persons.
The Cyprus Tax Department, under the Ministry of Finance, is the competent authority for every EOIR and automatic-exchange matter. Domestic handling of taxpayer data runs primarily under the Assessment and Collection of Taxes Law of 1978.
Cyprus Ongoing Compliance in Cyprus
Keep your Cyprus entity compliant with filings, returns, and statutory obligations.
Scope of Information Covered by a TIEA Request
Because exchange runs through Article 26, the scope mirrors what a TIEA would cover. Any information "foreseeably relevant" to administering or enforcing a partner state's tax law falls within reach. That standard is identical whether the instrument is a treaty clause, the multilateral convention, or a TIEA.
In practice, a request can reach a wide set of records:
- Bank account details and balances
- Beneficial ownership records
- Shareholding and director information
- Accounting records and financial statements
- Trust and foundation information
Both civil and criminal tax matters are covered. Under the US treaty, the exchange article extends to taxes of every kind imposed at the national level, illustrating how broad the substantive reach can be.
One feature surprises some owners: the tax confidentiality clause takes precedence over domestic freedom-of-information rules, so a third party cannot use transparency laws to pry into what was exchanged.
How a Request for Information Works in Practice
Every incoming request reaches a single point: the Tax Department acting as competent authority. Within the EU, a Central Liaison Office coordinates the flow of requests between Member States under the DAC framework.
A foreign authority cannot simply ask. Before a request is valid, the requesting state must confirm two things: that it has used all available domestic sources of information, and that the request conforms to its own laws and to the applicable agreement.
The request itself must be specific. It needs to identify the person under examination, state the tax purpose, explain why the information is thought to be held in the requested jurisdiction, and cite the legal basis. The OECD publishes a model template to standardise this.
DAC7 introduced joint audits, allowing two or more Member States to conduct inquiries together on persons of common interest. This goes beyond a one-way request and lets authorities coordinate directly.
No public statistics on the Tax Department's processing times have been published. As a general matter, the Global Forum assesses timeliness of responses under Element C.5 of its peer review.
Cyprus Cyprus Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Cyprus.
Confidentiality and Safeguards for the Taxpayer
Information that crosses a border does not become public. It can be used only for the tax purpose for which it was requested, and it may not be handed to law enforcement or other agencies unless the treaty itself permits it or the taxpayer consents. Disclosure to anyone outside the named persons requires written consent from the competent authority of the requested state.
Domestic rules reinforce this. Officers of the Tax Department are bound by professional secrecy under the Assessment and Collection of Taxes Law, which governs access to and handling of taxpayer data.
Within the EU, an extra layer applies. Personal data processed during exchange must comply with GDPR (Regulation 2016/679), and the Global Forum separately tests whether taxpayer rights are both compatible with exchange (Element B.2) and respected in practice (Element C.4).
Foreseeable Relevance and Limits on Fishing Expeditions
The "foreseeable relevance" test is the gatekeeper. A request is valid where there is a reasonable possibility the information will matter to the partner's tax enforcement, not a certainty. Speculative requests with no genuine case behind them fail this standard.
This is the design feature that blocks "fishing expeditions." A request must be detailed and specific, and the requesting authority must confirm it has exhausted its own domestic sources first.
Group requests, which cover a class of taxpayers without naming each individual, are allowed only within conditions the Global Forum approves, and any partner working with the firm must respect that threshold. No published decisions of the Tax Department refusing incoming requests on fishing-expedition grounds are available, which reflects how routinely the standard is applied at the request-drafting stage rather than at refusal.
TIEAs and Cyprus's Standing Under OECD Transparency Standards
The international scorecard is positive. The Global Forum EOIR rating is "Largely Compliant," first awarded in 2015 and maintained in the second-round 2020 peer review report. You can read the 2020 peer review in full.
That rating places the jurisdiction in good company. Of 132 jurisdictions fully reviewed in the second round, 91% received a satisfactory rating of "Compliant" or "Largely Compliant," and the firm sits within that majority. The current Global Forum ratings list this standing alongside peers.
EU lists tell the same story. The entity appears on neither the EU blacklist (Annex I) nor the grey list (Annex II); the February 2026 grey list naming Belize, the British Virgin Islands, Brunei, Eswatini, Greenland, Jordan, Montenegro, Morocco and Türkiye does not include it.
Newer commitments continue the pattern. The Crypto-Asset Reporting Framework agreement was signed on 19 November 2024, and the GloBE Information Return agreement on 12 May 2026. A third-round EOIR review has not yet been published.
What This Means for a Non-Resident Owner or Adviser
The absence of standalone TIEAs changes nothing about your exposure. A foreign tax authority can still obtain Cyprus-held information; it simply uses a treaty's Article 26 clause, an EU directive, or the multilateral convention instead. The practical effect matches that of a TIEA.
Treaty coverage is wide enough that most home states have a channel:
- Around 50 treaties mean the UK, US, Germany, France, India, China, the UAE and most major investor states hold an Article 26 link.
- All 27 EU Member States exchange both on request and automatically; there is no practical information barrier within the bloc.
- Since September 2017, financial account data has been reported automatically each year to CRS partner states, making bank and investment balances visible to a residence-state authority without any request being filed.
- US-person accounts are reported to the IRS under the FATCA agreement.
- DAC8 now pulls crypto-asset transactions, e-money, and certain advance rulings into automatic exchange.
The lesson for planning is to treat Cyprus-held information as reachable by your home tax authority. Before placing assets or expanding here, examine which agreements link the two states and on what conditions information can move. This connects to your wider obligations on tax residency and beneficial ownership, each addressed in its own article.
Conclusion
For a foreign owner, the headline is that there is no TIEA to track because none exists, yet information still flows freely through treaties, EU directives, and the multilateral convention. The "Largely Compliant" rating and the early adoption of automatic exchange mean a legitimate request from your home state will be answered, and your account data may already be reported without any request at all. Plan on the basis that Cyprus-held information is visible to the authority where you are resident. The right response is accurate reporting at home and clean records here, not reliance on any gap in the exchange network.
How Expanship Can Help Your Business in Cyprus
Expanship advises non-resident owners on how the information-exchange framework reaches their structure, which treaties and directives apply to their home state, and what records to keep so that any request or automatic report reflects an accurate, defensible position. Beyond that, the team handles the full lifecycle of a foreign-owned entity.
- Company formation and entity setup
- Registered agent and registered office services
- Tax registration and return filing
- Ongoing compliance and statutory deadline management
- Accounting and bookkeeping
- Introductions to banking partners
To discuss your structure and reporting obligations, contact Expanship Cyprus.
Frequently Asked Questions
No. No bilateral TIEA has been concluded, a fact confirmed on the OECD country page and in the 2020 Global Forum peer review. Exchange of information on request runs instead through Article 26 clauses in the double tax treaties, EU DAC directives, and the Multilateral Convention.
Yes, and the practical effect is the same as a TIEA. A partner state uses the information-exchange clause inside its tax treaty, an EU directive, or the multilateral convention to make the request, all routed through the Cyprus Tax Department as competent authority.
In most cases, yes. Under the Common Reporting Standard, financial account data has been exchanged automatically with partner jurisdictions each year since September 2017, and US-person accounts are reported to the IRS under the FATCA agreement, neither of which requires a request to be filed.
The "foreseeable relevance" standard. A request must identify the taxpayer, state its tax purpose, and explain why the information is held in the requested jurisdiction, and the requesting authority must first confirm it has exhausted its own domestic sources, which together block "fishing expeditions."
The Global Forum EOIR rating is "Largely Compliant," awarded in 2015 and maintained in the 2020 second-round review. The jurisdiction appears on neither the EU blacklist nor the grey list.
Yes. The DAC8 implementing law entered into force on 27 March 2026 with retroactive effect from 1 January 2026, extending automatic exchange to crypto-asset transactions, e-money, and certain advance cross-border rulings.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
