CRS, FATCA & UBO Registers: What Cyprus Companies Must Do Before Year-End 2025

The global tax transparency landscape has undergone a fundamental transformation over the past decade, and 2025 represents one of the most demanding compliance years to date for Cyprus-registered entities. Three overlapping frameworks — the Common Reporting Standard (CRS), the Foreign Account Tax Compliance Act (FATCA), and the Cyprus Ultimate Beneficial Owner (UBO) Register — each carry distinct obligations, timelines, and penalties that company directors and their advisers must track concurrently.

**The Common Reporting Standard (CRS): Automatic Exchange of Financial Information**

CRS, developed by the OECD and implemented in Cyprus through Law 205(I)/2012 (as amended), requires Cypriot financial institutions — including banks, custodians, brokers, and certain investment entities — to collect and report information on account holders who are tax resident in other participating jurisdictions.

As of 2025, Cyprus exchanges information with over 100 jurisdictions, including all EU member states, the United Kingdom, the United Arab Emirates, and Singapore. Any individual or corporate account holder with financial accounts in Cyprus will have that information reported to their home jurisdiction's tax authority automatically each year.

Practical implications for Cyprus company owners:

- Bank and investment accounts held by your Cyprus company are reportable if beneficial owners are resident in CRS-participating jurisdictions.

- Passive entities (holding companies with primarily investment income) are subject to enhanced due diligence requirements.

- Failure to provide financial institutions with accurate self-certification forms (CRS-1 or CRS-3) can result in accounts being blocked or closed.

**FATCA: Obligations for US-Connected Entities**

Cyprus and the United States operate under an Intergovernmental Agreement (IGA Model 1), under which Cypriot financial institutions report US-person account holders to the Cyprus Tax Department, which then transmits the data to the IRS. The reporting deadline for the 2024 tax year is 30 September 2025.

If your Cyprus company has US shareholders, directors, or beneficial owners — or if the company itself holds accounts with a US nexus — FATCA classification and reporting obligations must be assessed. Non-compliance can result in a 30% withholding tax on US-source income.

**UBO Register: Ongoing Filing Requirements**

Under the Prevention and Suppression of Money Laundering Law (Law 188(I)/2007, as amended by Law 13(I)/2021), all Cyprus companies must maintain an accurate record of their Ultimate Beneficial Owners — individuals who ultimately own or control more than 25% of the company — and file this information with the Registrar of Companies' central UBO register.

Key requirements in 2025:

- **Annual Confirmation:** Companies must confirm or update their UBO data within 14 days of any change in beneficial ownership.

- **Accuracy Obligation:** Directors are personally responsible for the accuracy of UBO filings. Deliberate falsification carries criminal liability.

- **Third-Party Access:** As of the 2023 EU AML Directive transposition, competent authorities (regulators, tax authorities, FIUs) retain full access to the UBO register at all times.

**The Compounding Risk of Non-Compliance**

Operating a Cyprus company in 2025 without a structured compliance calendar creates compounding risk. A late HE32 annual return triggers penalties starting at €50, escalating over time. Inaccurate CRS self-certification can trigger a bank's exit process. A missing or outdated UBO filing can render the company ineligible for certain banking relationships and regulatory approvals.

Beyond financial penalties, non-compliance creates reputational damage that is disproportionately difficult to reverse in jurisdictions where banks conduct enhanced due diligence on Cyprus entities as standard practice.

**What Good Governance Looks Like in 2025**

Ellinas Law maintains a proactive compliance calendar for all managed entities, ensuring that CRS self-certifications are refreshed upon any change in ownership or residency, FATCA classifications are reviewed annually, UBO filings are updated within the statutory 14-day window, HE32 annual returns and audited accounts are filed on schedule, and VAT returns are submitted quarterly without exception.

If your Cyprus company's compliance programme has not been reviewed in the past 12 months, or if you are uncertain about your entity's CRS or UBO classification, contact Ellinas Law for a compliance audit before the year-end deadlines arrive.