How to Conduct Tax Due Diligence in Cyprus (2026): Step-by-step for M&A, Inbound Investment & DAC2/CRS

Understanding how to conduct tax due diligence in Cyprus is now more complex, and more consequential, than at any point in the past decade. The Cyprus Tax Reform, effective 1 January 2026, overhauled corporate tax rates, abolished the deemed dividend distribution (DDD) regime, repealed stamp duty on most instruments, and introduced new rules for crypto-asset disposals. Simultaneously, the Cyprus Tax Department issued its announcement of 05 June 2026, titled “Enhancing Due Diligence Procedures (DAC2/CRS)”, which requires Cyprus Financial Institutions (CFIs) and other obliged entities to strengthen their evidence-gathering for the Common Reporting Standard, particularly where citizenship-by-investment (CBI) or residency-by-investment (RBI) programmes are involved.

For any buyer, seller, in-house counsel or adviser approaching a share deal, asset deal or inbound investment in Cyprus, the due diligence playbook must now integrate both sets of changes before signing or completion.

Overview of the Tax Due Diligence Process and Who It Applies To

Tax due diligence in Cyprus is a structured investigation of a target entity’s historical and current tax position, designed to identify, quantify and allocate tax risks before a transaction closes. It applies to buy-side acquirers in share and asset deals, private equity sponsors, sellers preparing vendor due diligence packs, inbound investors setting up or acquiring Cyprus holding or operating companies, and CFIs or other obliged entities that must verify the CRS/DAC2 compliance posture of account holders and controlling persons.

A dedicated tax due diligence review is triggered whenever a transaction involves a change of control, a significant asset transfer, an inbound structuring that creates new tax residence or permanent establishment questions, or where a CFI is onboarding or reviewing high-risk clients under DAC2/CRS. With the 2026 tax reform altering the substantive tax rules and the Tax Department’s 05 June 2026 announcement raising the procedural bar for CRS evidence, any process that omits either dimension risks material post-completion exposure.

When to run a full tax due diligence vs. targeted checks

• Full scope review. Required for mid-market and large M&A transactions, PE-backed acquisitions, inbound investments with complex holding structures, and any deal involving CBI/RBI-related shareholders or controllers.
• Targeted (red-flag) review. Appropriate for small private deals with straightforward structures, bolt-on acquisitions within known groups, or seller-side preparation where scope is limited to identified risk areas (e.g., VAT or transfer pricing only).
• CRS/DAC2-only review. May be a standalone workstream where a CFI needs to remediate existing account holder files in response to the Tax Department’s enhanced due diligence requirements.

Eligibility and Prerequisites for Tax Due Diligence in Cyprus

Before fieldwork begins, certain prerequisites must be in place. The buyer or adviser must execute a confidentiality agreement or professional duty agreement (PDA) with the seller, ensuring that all tax data shared in the data room is protected. An engagement letter between the buyer and its tax adviser should define the scope of the review, the tax heads to be covered, limitations of liability, the deliverable format (report, risk register or both) and the relationship between the tax due diligence and the legal and financial workstreams.

Engagement letter checklist

• Scope definition. Specify which tax heads are in scope: corporate income tax, VAT, payroll/social insurance, transfer pricing, special defence contribution (SDC), IP regime, crypto disposals, and CRS/DAC2 compliance.
• Period under review. Typically the last three to five financial years, plus the stub period to signing.
• Deliverables. Tax report, quantified risk register (likelihood / quantum matrix), and draft warranty and indemnity language.
• Reps and warranties mapping. Confirm that the engagement output will feed directly into the SPA’s tax warranty schedule.

Data room index prerequisites

The seller should prepare a virtual data room indexed by tax head. At a minimum, the index must include folders for corporate tax, VAT, payroll, transfer pricing, tax assessments and correspondence with the Tax Department, CRS/FATCA self-certifications, and corporate documents. The data room should be populated before the buyer’s request list is served to avoid delays.

How to Conduct Tax Due Diligence in Cyprus: M&A Tax Due Diligence Steps

The following eight steps represent the standard M&A tax due diligence procedure for Cyprus transactions. Each step is designed to be completed sequentially, though certain steps, particularly the technical tax review and the CRS/DAC2 checks, can run in parallel where resources permit.

Step 1. Plan and scope the tax due diligence

Define the target entity, the transaction structure (share deal vs. asset deal), and the tax areas to cover. For 2026 transactions, ensure the scope explicitly includes review of positions under the new corporate tax rate, the abolished DDD regime, and any crypto-asset disposals. Agree deliverables and timelines with the buyer’s legal team. The output of this step is a signed engagement letter and a tailored request list.

Step 2. Run a quick-scan of public and provided records

Conduct a desk review of the target’s last three years of published accounts, filed tax returns, and any available tax audit history. Identify obvious red flags: large related-party balances, inconsistent effective tax rates, open assessments, or prior-year adjustments. This preliminary review informs the depth and priority of subsequent fieldwork.

Step 3. Serve the data-room request list to the seller

Issue a detailed document request list to the seller. Each item should specify the document name, the period covered, the format required, who produced it, and the date of the most recent version. Include a requirement for CRS/FATCA self-certifications and supporting proof of tax residence for all key shareholders and controlling persons. The full list of documents needed for tax due diligence is set out in the required documents section below.

Step 4. Verify CRS/DAC2 evidence and validate self-certifications

Following the Tax Department’s 05 June 2026 announcement on “Enhancing Due Diligence Procedures (DAC2/CRS)”, this step has become critical. Verify that each self-certification form matches the account holder’s passport, proof of address and declared tax identification number (TIN). Where a shareholder or controlling person has obtained residence through a CBI or RBI programme, request additional evidence that tax residence is bona fide, a CBI/RBI certificate alone is not sufficient proof of tax residence under the enhanced procedures.

If inconsistencies are found, or if corrected CRS returns must be filed, the Tax Department requires CFIs to notify it by emailing dac2@tax.mof.gov.cy. Preserve the full evidence trail for any corrections, including the original self-certification, the corrected version, and the supporting documentation.

Step 5. Conduct the technical tax review

Review corporate tax computations, carry-forward losses, elections, historical tax assessments and open disputes. Particular attention is needed for the transition from pre-2026 to post-2026 rules: confirm whether the target’s tax computations have been updated for the new corporate tax rate, the abolished DDD, and adjustments to the SDC regime. Examine transfer pricing positions for intercompany transactions, especially where the target has back-to-back structures or IP licensing arrangements.

Step 6. Run specialist checks on VAT, transfer pricing, IP and crypto

Engage subject matter specialists where the target has material VAT exposure (cross-border supplies, reverse-charge issues, exempt vs. taxable activity splits), complex transfer pricing arrangements, IP regime claims, or crypto-asset holdings. For crypto disposals, verify treatment under the rules introduced by the 2026 tax reform, industry observers expect the Tax Department to scrutinise positions taken on classification and timing of crypto disposals.

Step 7. Summarise findings and prepare the tax risk register

Consolidate all findings into a structured tax report. Quantify each material exposure using a likelihood/quantum matrix (e.g., probable / possible / remote against estimated tax, interest and penalty amounts). Prepare a tax risk register that can be attached to the SPA as a schedule and used as the basis for warranty and indemnity negotiations.

Step 8. Complete pre-completion actions and file any required notifications

Draft tax warranty and indemnity language tailored to the identified exposures. Negotiate escrow holdbacks for quantified risks. Where the due diligence has identified CRS correction requirements, ensure that corrected returns are filed and that the Tax Department has been notified via dac2@tax.mof.gov.cy before completion. Agree post-completion undertakings, for example, the seller’s obligation to cooperate with any Tax Department enquiry relating to pre-completion periods.

Tax Due Diligence Checklist Cyprus: Required Documents and Information

The documents needed for tax due diligence fall into three categories: core tax records, CRS/DAC2 evidence, and corporate documents that have tax implications. The following table sets out the standard request list for a Cyprus tax due diligence exercise in 2026.

Tax Due Diligence Timeline and Key Deadlines

The time required to complete tax due diligence in Cyprus varies considerably depending on the target’s complexity, the seller’s responsiveness, and the scope of CRS/DAC2 remediation work.

Several external deadlines can compress or extend the tax due diligence timeline. The Tax Department’s 05 June 2026 announcement requires CFIs to apply enhanced due diligence for new clients from the announcement date. Existing customers are in scope where a tax residence is claimed through a CBI or RBI programme, CFIs must email dac2@tax.mof.gov.cy for corrected or new CRS submissions. The annual CRS reporting deadline imposes a hard stop: any corrections must be filed in time for the next reporting cycle to avoid penalties.

For the 2026 tax reform changes, the effective date was 1 January 2026. Any target whose financial year ends after that date will have a stub period under the old rules and a period under the new rules, adding complexity to the computation review. Buyers should factor this transitional analysis into the timeline from the outset.

Tax Due Diligence Cost in Cyprus: Fees and Considerations

Fees for tax due diligence in Cyprus depend on the transaction size, the number of tax heads in scope, and whether specialist workstreams (transfer pricing, crypto, enhanced CRS/DAC2 checks) are required. The buyer typically pays its own advisers’ fees; certain items, such as seller-side vendor due diligence, are negotiated as part of the transaction cost allocation.

What Changes in 2026: DAC2/CRS Compliance Cyprus and Tax Reform Impact

Two regulatory developments in 2026 have fundamentally altered how to conduct tax due diligence in Cyprus. Both must be reflected in every due diligence exercise initiated this year.

Cyprus Tax Reform (effective 1 January 2026)

The reform package, enacted through laws published in the Official Gazette on 31 December 2025 and effective from 1 January 2026, introduced changes across multiple tax heads. The corporate income tax rate was adjusted, the special defence contribution regime was modified, the deemed dividend distribution (DDD) mechanism was abolished, stamp duty was repealed for most instruments, and new rules for crypto-asset disposals were introduced. Each of these changes has direct implications for the due diligence review.

Tax Department announcement: “Enhancing Due Diligence Procedures (DAC2/CRS)”, 05 June 2026

The Tax Department’s announcement signals a materially higher enforcement posture on CRS/DAC2 compliance. CFIs must now apply enhanced due diligence where account holders or controlling persons have obtained residence through CBI or RBI programmes. The announcement requires CFIs to verify self-certifications against independent evidence, and to email dac2@tax.mof.gov.cy when filing corrected or new CRS returns.

Common Pitfalls in Cyprus Tax Due Diligence and How to Avoid Them

• Treating CBI/RBI documentation as proof of tax residence. A CBI or RBI certificate demonstrates immigration status, not tax residence. Always obtain independent evidence, such as local tax returns, tax residence certificates issued by the Tax Department, or domicile certificates, to validate residency claims.
• Ignoring self-certification inconsistencies. Where the declared country of tax residence on a CRS self-certification does not match the address on file, the account holder’s passport nationality, or transaction patterns, escalate immediately and request corrected documentation.
• Under-estimating VAT exposures. Cross-border supply chains, reverse-charge misapplication, and exempt-activity apportionment errors are common sources of material VAT risk in Cyprus. Always engage a VAT specialist where the target has international operations.
• Mis-classifying crypto-asset disposals. The 2026 reform introduced specific rules for crypto disposals. Applying the old treatment or failing to classify disposals correctly can create significant tax risks for the buyer post-completion.
• Delaying CRS corrections. The Tax Department expects CFIs to file corrected CRS returns promptly. Delayed corrections increase penalty risk and may trigger adverse regulatory attention. File corrections and notify dac2@tax.mof.gov.cy as soon as the need is identified.
• Relying solely on seller warranties without quantification. Warranties provide contractual protection but do not eliminate risk. Always quantify exposures, negotiate escrow holdbacks for material items, and seek specific indemnities for identified tax risks rather than relying on general warranty language alone.

Conclusion

Knowing how to conduct tax due diligence in Cyprus in 2026 requires integrating two major regulatory shifts into a single, disciplined process. The substantive tax reform has changed the way exposures are calculated, while the Tax Department’s enhanced DAC2/CRS requirements have added new procedural steps and evidence standards that cannot be omitted. The step-by-step procedure, document checklist, timeline scenarios, and cost estimates set out above provide a practitioner-ready framework for buyers, sellers and advisers approaching any Cyprus M&A transaction or inbound investment.

Those who embed the DAC2/CRS compliance checks into their standard tax due diligence workflow from the outset, rather than treating them as an afterthought, will be best positioned to avoid post-completion surprises, satisfy the Tax Department’s expectations, and close transactions with confidence.

Sources

1. Cyprus Tax Department, CRS / DAC2 page (Gov.cy)
2. Cyprus Tax Department, Announcements (MOF site)
3. MOF, DAC8 / DAC2 Amendment Announcement
4. Grant Thornton Cyprus, Tax Reform 2026
5. OECD, Cyprus CRS Guidance
6. Kyprianou, Cyprus Tax Department Strengthens Due Diligence Requirements under DAC2/CRS