Cyprus accounting records requirements: what a company must keep, and for how long

A Cyprus limited company must keep accounting records that explain every transaction, show its financial position at any time, and support every return it files. Since 1 January 2026 the tax law requires those records to be kept for at least six years, counted from the later of the return's filing deadline and the date it was actually filed, which in practice means holding on to a document for roughly eight years after the transaction it records. This guide covers where the duty comes from, the deadlines for writing the books up, what an auditor and a Tax Department inspector expect to trace, and how digital records fit in.

Where the record-keeping duty comes from

The duty comes from two directions at once, which is why a company cannot satisfy one and ignore the other. The Companies Law requires every Cyprus company to keep accounting records sufficient to show and explain its transactions, disclose its financial position with reasonable accuracy at any time, and enable the directors to prepare financial statements that give a true and fair view. Those statements are then submitted for audit by a statutory auditor licensed under the Auditors Law, with one relief: the smallest private companies, with net turnover up to €300,000 and gross assets up to €500,000 for two consecutive years, may have a review engagement instead.

Separately, the Assessment and Collection of Taxes Law requires every company to keep the books, records and supporting documents from which its returns are prepared, and the VAT legislation adds its own record and VAT-account requirements for registered businesses.

The two duties test different things. The Companies Law cares about the ledger and the accounts; the tax laws care about the evidence behind them. A neat trial balance with no invoices behind it fails the tax test, and a drawer of receipts that were never booked fails the Companies Law test. Both duties sit with the company and therefore with its directors, the people who sign the accounts.

How long must a Cyprus company keep its records?

At least six years, and the way the clock runs changed with the 2026 tax reform. Under the amended article 30(2), the six years count from the later of the return's filing deadline, original or revised, and the date the return was actually filed. Before 2026 the period ran from the end of the tax year. If a tax audit begins within the final year, retention extends until the audit completes or one year from its start, whichever comes first.

The clock therefore starts much later than the transaction. Say you receive a supplier invoice in March 2026. It belongs to tax year 2026, whose corporate return is due by 31 January 2028. File on time and the six years run to 31 January 2034, nearly eight years after the invoice arrived. File late and they run from the actual filing date, so delay stretches your own archive obligation.

Two related rules are worth knowing. VAT record retention is set by regulations that may require up to seven years, so for the VAT file assume seven. And the Commissioner cannot demand bank statements once six years have elapsed, extended to twelve where VAT was lost through fraud. The simple policy that satisfies all of this: keep the complete archive for each financial year until at least six years after that year's corporate return was filed, and mark the destruction date on the archive itself.

How quickly must the books be written up?

The books must be written up within four months. Article 30(5) of the same law requires them to be updated no later than the end of the fourth month following the month of the transactions, and article 30(6) requires business invoices to be issued within 30 days of the transaction unless the Commissioner allows longer in writing. So a sale delivered in March must be invoiced by early April, and everything that happened in March must be in the ledger by the end of July.

Most founders find the statutory deadline generous and the practical one tight: your quarterly VAT return is due long before the four months are up, and it can only be right if the quarter's books already are. Treat month-end bookkeeping as the real deadline and article 30(5) as the legal backstop.

What does "proper" actually mean in practice?

The books should survive a stranger reading them. An auditor or inspector has never seen your business, and proper records let them reconstruct what happened from the paperwork alone. Day to day that reduces to four tests.

1. 01

   Every entry traces to a source document

   Each sale is backed by the invoice or credit note you issued; each cost by the supplier's invoice or receipt in the company's name; each payroll entry by the payslip and the contribution calculation; each journal by a note explaining why it was made. An unsupported ledger figure is the first thing an inspector challenges and the hardest thing to defend two years later.

2. 02

   The bank is reconciled

   Every bank, card and payment-platform account agrees to its statement at each period end, with no unexplained differences. Reconciliation proves the ledger is complete in both directions: nothing booked that did not happen, nothing happened that was not booked. A cost paid from a personal card and never reimbursed sits outside the books; a transfer between your own accounts booked as income overstates turnover.

3. 03

   VAT is analysed line by line

   For each line of each transaction the record shows the treatment applied: standard, reduced, zero-rated, exempt, reverse charge or out of scope. The VAT account then sums to the return filed. On inspection this analysis is examined first, because the return is only as defensible as the per-line coding beneath it.

4. 04

   Posted entries are never silently changed

   Once an entry is posted, and especially once a return has been filed on it, corrections are made by a dated reversing or adjusting entry rather than by editing the original. The audit trail is the history of what was booked and when. Overwriting it destroys exactly what the auditor and the inspector need to see.

Two of those tests have their own guides: Cyprus invoice requirements sets out what a compliant invoice must show, yours and your suppliers', and tax-deductible expenses for a Cyprus company covers which supported costs the Tax Department accepts. Everything else, from the chart of accounts to the software, is secondary to those four tests. A company that passes them hands the auditor a trial balance to test; a company that fails them pays the auditor to rebuild the books at an hourly rate.

What audit trail do the auditor and the Tax Department expect?

They expect the same trail, approached from opposite ends. The auditor starts from the financial statements and works down, selecting balances and transactions, asking for the documents behind them, and testing that the bank reconciliations, the VAT account and the payroll records tie to external evidence. A Tax Department inspector starts from the return and works the same way, usually focused on whether declared turnover is complete, whether costs claimed are supported and wholly for the business, and whether the VAT charged and reclaimed matches the invoices. Both expect to pick any entry and reach its document, and to pick any document and find its entry. Cyprus audit requirements explains what the auditor does with that trail, and when a review engagement is available instead.

A complete trail contains, at minimum: the general ledger and journals; bank statements and reconciliations for every account; sales invoices in sequence, with credit notes; purchase invoices and receipts matched to payments; the VAT account and the returns filed, with the working behind each box; payroll records and employer filings; the fixed-asset register; and the agreements that explain balances, from leases and loans to the director's loan account. The statutory registers and minutes are a separate Companies Law requirement kept by the company secretary, and the auditor will ask for those too.

Do records have to be on paper?

No. The VAT Law's Tenth Schedule allows the record-keeping duty to be discharged by preserving the information by any means the Commissioner approves, with copies admissible as evidence to the same extent as originals, and the direct-tax legislation likewise recognises electronic records and filings. The substance test is the same as for paper: can the document be found, read and tied to the entry it supports, for the whole retention period?

Digital is the stronger medium in practice, because a scanned invoice attached to its ledger entry can be searched and produced in seconds. There is also no language barrier to worry about: no Cyprus statute requires records in Greek, and the only rule is that the Commissioner may require a translation of a VAT invoice that is not in an official language. Keep paper originals where a specific rule or counterparty requires them, certain customs, grant and banking documents among them. And make sure the archive is held by the company and genuinely retrievable, rather than sitting in a former bookkeeper's personal account. The records belong to the company, so the company must be able to produce them whoever did the work.

What happens if the Tax Department inspects?

You are asked to produce the records, and the quality of the books decides how the visit ends. An inspection, VAT or income tax, typically opens with a request for the ledger, the bank statements, the sales and purchase documents for the periods under review and the working behind the returns. An inspector who can trace a sample of entries cleanly tends to stop sampling. One who finds unsupported costs, unexplained bank receipts or VAT reclaimed without an invoice widens the scope.

The consequences scale with what is missing. Unsupported costs are disallowed for income tax; input VAT without a valid invoice is refused; income visible on the bank statement but absent from the books is added to turnover; and where the records are too poor to rely on, the assessment is raised on an estimated basis, with the burden on the company to displace it. Underpaid VAT then carries additional tax of 10%, with €100 more for each return that was filed late, plus interest at 3.5% for 2026. The larger bill is usually the professional time spent reconstructing what should have been recorded at the time.

How do the books feed every filing the company makes?

Every return a Cyprus company files is a report out of the ledger, which is why the records are the whole compliance system rather than one item on a checklist. The VAT return is the VAT account summarised into the official boxes, due by the 10th day of the second month after the quarter ends. The VIES statement is the EU B2B sales from the same books. The provisional tax estimate rests on the year-to-date profit the ledger shows. The financial statements are the closed ledger presented under IFRS, and the corporate income tax return, due 31 January of the second year after the tax year from tax year 2026, with the 2025 return keeping its 31 March 2027 deadline, is the accounting profit reconciled to the taxable one. The Cyprus tax deadlines guide lists every date in that chain.

A gap propagates through all of it. A sale never invoiced understates VAT, VIES, provisional tax, the accounts and the corporate return in one stroke; a cost without an invoice is lost from both the VAT reclaim and the tax deduction. Keeping the records right as you go is far cheaper than fixing five filings later.

How does Sumly keep the records a Cyprus company needs?

Sumly builds the audit trail as a by-product of the bookkeeping. Every invoice, receipt or statement you drop into Sumly or forward to your company's private inbox address is read by the AI, booked double-entry and stored against the company, and the file stays linked to the ledger entry it created. Any entry traces back to its document and any document forward to its entry, which is exactly the trace an auditor and an inspector ask for. Bank feeds are read-only open banking connections that match transactions against invoices and recorded purchases automatically, every line carries its Cyprus VAT code, and filed periods lock, so the figures behind a submitted return cannot change underneath you. Corrections go through reversing entries with the history preserved.

When the audit comes, your auditor gets their own Sumly login, works through the books directly and can put questions to Ask Sumly AI, which answers from your live books with the figures behind each answer. On Base you review and file the returns Sumly prepares; on Premium your Sumly certified bookkeeper reviews the books and submits the filings, and the audit itself is always performed by a statutory auditor. You can try all of it on a 30-day free trial, no card needed.

Questions founders ask

Frequently asked

What records must a Cyprus company keep?

Enough to explain every transaction and to produce true and fair financial statements: sales invoices and credit notes issued, supplier invoices and receipts received, bank and card statements, payroll records, contracts and agreements that give rise to income or costs, the VAT account and the returns filed, fixed-asset records, and the ledger itself (journals, general ledger, trial balance). The statutory registers and board minutes sit alongside these as a separate Companies Law obligation.

How long must accounting records be kept in Cyprus?

At least six years. From 1 January 2026 the period runs from the later of the tax return's filing deadline and the date the return was actually filed, under article 30(2) of the Assessment and Collection of Taxes Law as amended by Law 243(I)/2025. Because a company's return for a tax year is itself due over a year after the year ends, this works out to roughly seven and a half to eight years from the transaction. If a tax audit starts within the final year, retention extends until the audit completes or one year from its start, whichever comes first. VAT regulations can require records for up to seven years.

How quickly must the books be written up?

By the end of the fourth month following the month of the transaction, under article 30(5) of the Assessment and Collection of Taxes Law. Sales invoices must be issued within 30 days of the transaction unless the Commissioner allows longer in writing. A sale made in March must therefore be invoiced by early April and booked by the end of July at the latest.

Can a Cyprus company keep its accounting records digitally?

Yes. The VAT Law's Tenth Schedule lets the record-keeping duty be discharged by preserving the information by any means the Commissioner approves, and copies are admissible as evidence to the same extent as originals. The test is practical: the records must be complete, legible and producible on request to the auditor and the Tax Department. Keep paper originals only where a specific rule or counterparty requires them, such as certain customs and grant documents.

Is a bank statement enough evidence for an expense?

No. A bank line shows that money left the account. It does not show what was bought, from whom, whether VAT was charged or whether the cost was for the business. To deduct the cost and reclaim the input VAT you need the supporting document, normally a VAT invoice or receipt in the company's name, matched to the payment.

Do invoices and accounting records have to be in Greek?

No. No Cyprus statute requires invoices or records to be in Greek, so invoicing in English or any other language is valid. The only language rule is that the Commissioner may ask for a translation into an official language of a VAT invoice received in Cyprus that is not in one. Invoice in whatever language suits your clients and be ready to supply a translation if asked.

What happens if the books are not properly kept?

The consequences escalate in cost. The auditor cannot obtain the evidence needed and qualifies or refuses the opinion. The Tax Department disallows costs that cannot be supported, refuses input VAT claimed without a valid invoice, and can raise an assessment on an estimated basis where the records are too poor to rely on, with the burden on the company to displace it. And the directors are personally exposed, because keeping proper books is a duty the law places on them. Penalties and interest then attach to whatever filings were late or wrong.