Cyprus accounting records requirements: what a company must keep, and for how long

A Cyprus limited company must keep accounting records that explain every transaction, show its financial position at any time and back up every return it files. Since 1 January 2026 the tax law says to keep them for at least six years, counted from the later of the return's filing deadline and the date it was actually filed. In practice, that means keeping a document for about eight years after the transaction it records.

Where the record-keeping duty comes from

It comes from two places, so meeting one and ignoring the other doesn't work. The Companies Law requires every Cyprus company to keep accounting records that show and explain its transactions, disclose its financial position with reasonable accuracy at any time, and let the directors prepare financial statements that give a true and fair view. Those statements then go to a statutory auditor licensed under the Auditors Law for audit. There is one relief. The smallest private companies, with net turnover up to €300,000 and gross assets up to €500,000 for two years in a row, may have a review engagement instead, which is a lighter check than a full audit.

Separately, the Assessment and Collection of Taxes Law requires every company to keep the books, records and supporting documents behind its returns. VAT law adds its own rules on records and the VAT account for registered businesses.

The two duties test different things. The Companies Law cares about the ledger and the accounts. The tax laws care about the evidence behind them. A neat trial balance with no invoices behind it fails the tax test. A drawer of receipts that nobody booked fails the Companies Law test. Both duties sit with the company, and so with its directors, who sign the accounts.

How long must a Cyprus company keep its records?

At least six years, and the 2026 tax reform changed when the clock starts. Under the amended article 30(2), the six years count from the later of the return's filing deadline, original or revised, and the date the return was actually filed. Before 2026 the period ran from the end of the tax year. If a tax audit starts in the final year, you keep the records until the audit ends or for one year from its start, whichever comes first.

So the clock starts long after the transaction. Say a supplier invoice arrives in March 2026. It belongs to tax year 2026, and the corporate return for that year is due by 31 January 2028. File on time and the six years run to 31 January 2034, nearly eight years after the invoice arrived. File late and they run from the day you actually filed, so a late return also means a longer archive.

Two related rules are worth knowing. VAT regulations may require records for up to seven years, so for the VAT file, assume seven. And the Commissioner can't demand bank statements after six years, or twelve where VAT was lost through fraud. One simple policy covers all of it. Keep the complete archive for each financial year until at least six years after that year's corporate return was filed, and write the destruction date on the archive itself.

How quickly must the books be written up?

Within four months. Article 30(5) of the same law says the books must be updated no later than the end of the fourth month following the month of the transactions. Article 30(6) says business invoices must go out within 30 days of the transaction, unless the Commissioner allows longer in writing. So a sale delivered in March is invoiced by early April, and everything that happened in March is in the ledger by the end of July.

Most founders find the legal deadline generous and the practical one tight. Your quarterly VAT return is due long before the four months are up, and it can only be right if that quarter's books already are. Treat month-end bookkeeping as the real deadline and article 30(5) as the legal backstop.

What does "proper" actually mean in practice?

Proper books make sense to a stranger. An auditor or inspector has never seen your business, and proper records let them rebuild what happened from the paperwork alone. Day to day, that comes down to four tests.

Two of those tests have their own guides. Cyprus invoice requirements sets out what a compliant invoice must show, yours and your suppliers'. Tax-deductible expenses for a Cyprus company covers which supported costs the Tax Department accepts. Everything else, from the chart of accounts to the software, matters less than those four tests. A company that passes them hands the auditor a trial balance to test. A company that fails them pays the auditor by the hour to rebuild the books.

What audit trail do the auditor and the Tax Department expect?

The same trail, approached from opposite ends. The auditor starts from the financial statements and works down. They pick balances and transactions, ask for the documents behind them, and test that the bank reconciliations, the VAT account and the payroll records tie to outside evidence. A Tax Department inspector starts from the return and works the same way. They usually ask whether declared turnover is complete, whether the costs claimed are supported and wholly for the business, and whether the VAT charged and reclaimed matches the invoices. Both expect to pick any entry and reach its document, and to pick any document and find its entry. Cyprus audit requirements explains what the auditor does with that trail, and when a review engagement is available instead.

A complete trail holds at least:

• the general ledger and journals
• bank statements and reconciliations for every account
• sales invoices in sequence, with credit notes
• purchase invoices and receipts, matched to payments
• the VAT account and the returns filed, with the working behind each box
• payroll records and employer filings
• the fixed-asset register
• the agreements that explain balances, from leases and loans to the director's loan account

The statutory registers and minutes are a separate Companies Law duty, kept by the company secretary. The auditor will ask for those too.

Do records have to be on paper?

No. The VAT Law's Tenth Schedule lets a company meet the record-keeping duty by preserving the information in any way the Commissioner approves, and copies count as evidence just as originals do. The direct-tax laws also recognise electronic records and filings. The test is the same as for paper. Can you find the document, read it and tie it to the entry it supports, for the whole retention period?

Digital is the stronger choice in practice. A scanned invoice attached to its ledger entry can be searched and produced in seconds. Language isn't a barrier either. No Cyprus law requires records in Greek, and the only rule is that the Commissioner may ask for a translation of a VAT invoice that isn't in an official language. Keep paper originals where a specific rule or counterparty needs them, such as some customs, grant and banking documents. And make sure the company holds the archive and can actually get to it, rather than leaving it in a former bookkeeper's personal account. The records belong to the company, so the company must be able to produce them, whoever did the work.

What happens if the Tax Department inspects?

You are asked to produce the records, and the state of your books decides how the visit ends. A VAT or income tax inspection usually opens with a request for the ledger, the bank statements, the sales and purchase documents for the periods under review, and the working behind the returns. An inspector who can trace a sample of entries cleanly tends to stop sampling. One who finds unsupported costs, unexplained money coming into the bank or VAT reclaimed without an invoice widens the search.

The consequences grow with what's missing. Costs without support are disallowed for income tax. Input VAT without a valid invoice is refused. Income that shows on the bank statement but not in the books is added to turnover. Where the records are too poor to rely on, the Tax Department raises an estimated assessment, and it is up to the company to prove it wrong. Underpaid VAT then carries an additional 10% tax, plus €100 for each return filed late, and interest at 3.5% for 2026. The bigger bill is usually the professional time spent rebuilding what should have been recorded at the time.

How do the books feed every filing the company makes?

Every return a Cyprus company files is a report out of the ledger. That's why the records are the whole compliance system, not one item on a checklist. The VAT return is the VAT account summarised into the official boxes, due by the 10th day of the second month after the quarter ends. The VIES statement, the list of your sales to business customers in other EU countries, comes from the same books. Provisional tax, the corporate tax you pay in advance on an estimate of the year's profit, rests on the profit the ledger shows so far. The financial statements are the closed ledger presented under IFRS, the international accounting standards. The corporate income tax return is the accounting profit adjusted to the taxable profit, and it is due by 31 January of the second year after the tax year from tax year 2026, while the 2025 return keeps its 31 March 2027 deadline. The Cyprus tax deadlines guide lists every date in that chain.

A gap spreads through all of it. A sale never invoiced understates VAT, VIES, provisional tax, the accounts and the corporate return at once. A cost without an invoice is lost from both the VAT reclaim and the tax deduction. Keeping the records right as you go costs far less than fixing five filings later.

How does Sumly keep the records a Cyprus company needs?

Sumly builds the audit trail as part of the bookkeeping. Drop an invoice, receipt or statement into Sumly, or forward it to your company's private inbox address. The AI reads it, books it in double entry and stores it against the company, and the file stays linked to the ledger entry it created. Any entry traces back to its document and any document forward to its entry, which is the trace an auditor and an inspector ask for. Bank feeds are read-only open banking connections that match transactions to invoices and recorded purchases automatically. Every line carries its Cyprus VAT code. Filed periods lock, so the figures behind a submitted return can't change underneath you, and corrections go through reversing entries with the history kept.

When the audit comes, your auditor gets their own Sumly login, works through the books directly and can put questions to Ask Sumly AI, which answers from your live books with the figures behind each answer. On Base, Sumly prepares the returns and you review and file them. On Plus, Sumly files every return except the year-end accounts. On Premium, your Sumly certified bookkeeper reviews the books and submits the filings. A statutory auditor always performs the audit itself. The software starts with a 30-day free trial.

Questions founders ask