Cyprus taxes for software companies: IP Box and the founder stack

A Cyprus software company pays corporate income tax at 15% from tax year 2026, the same as every other Cyprus limited company. Profits of tax years through 2025 were taxed at 12.5%. Software founders keep choosing Cyprus anyway because of the IP Box. Profit from copyrighted software the company developed gets a deemed deduction of 80%, which brings the effective rate on that profit down to 3%. Selling the software across borders adds VAT and VIES duties. They're easy to get right from month one and slow to fix later.

What does a Cyprus software company pay?

The standard corporate rate of 15% on taxable profit, from tax year 2026. There's no reduced band for tech companies, no turnover threshold below which a lower rate applies, and no start-up holiday. A SaaS business works the same way as a bakery. Taxable profit is built from accounting profit. You file a provisional tax estimate and pay it in two instalments during the year. The annual return follows. Our guide to corporate tax in Cyprus walks through all of it.

Two software companies with the same revenue can still pay very different amounts of tax, because deductions shrink the base before the rate applies. For a company whose product is code it wrote, the biggest deduction available is the IP Box.

Does your software qualify for the IP Box?

In principle, yes, if the company developed it. Copyrighted software developed by the company is a qualifying intangible asset under the Cyprus IP Box regulations, which is why the regime matters so much to product and SaaS businesses. Qualifying profit gets the 80% deemed deduction, which leaves 20% in the tax base. At the 15% rate, that's 3 cents of tax per euro of qualifying profit. Through tax year 2025, at 12.5%, the effective rate was 2.5%.

Trademarks, brands and other marketing intangibles are expressly excluded. The regime rewards development work, not owning a brand. Revenue is the other place where expectations slip. Support contracts, implementation projects and consultancy days generally fall outside the qualifying slice, even when they're on the same invoice as the licence.

Claiming it is refreshingly simple. There's no advance approval and no separate application. You claim the deduction in the annual corporate return, and you choose year by year, so you can skip it in a year when it doesn't help. Plan around one thing. The new extra 20% R&D deduction, for spending incurred from 2025 to 2030, is not available for assets that have used the IP Box, so each asset picks one regime. The IP Box explained covers the whole regime, with worked numbers.

What is the nexus fraction?

It's the share of the development you actually funded and carried out, and it scales the 80% deduction down when that share is small. Work by your own team counts for you. Work bought in from unrelated third parties also counts for you. Work pushed to a related company abroad, and software bought ready-made, sit in the denominator of the fraction and pull it down.

An uplift softens this. Qualifying spending is increased by up to 30%, capped at the actual acquisition and related-party costs, and the fraction can never go above one. In practice, a company doing its own R&D in Cyprus lands at or near a full fraction. A company whose code was written by a related company abroad doesn't.

The regulations also require books and records of income and spending separately for each intangible asset. The fraction adds up over the asset's whole life, so years later you need to show which costs belonged to which asset and who did the work. Start that split in month one, while there are ten transactions instead of ten thousand.

How does VAT work when you sell software abroad?

VAT on digital services follows the customer, and the rules depend on who that customer is. Sales to businesses are B2B. Sales to consumers are B2C.

For a business customer in another EU country, you invoice without Cyprus VAT and the customer accounts for the VAT at home. This is the reverse charge. It depends on holding a valid EU VAT number for the customer and checking it in VIES, the European Commission's tool for validating VAT numbers. Make the check part of onboarding every new EU client, and keep the confirmation.

For consumers in another EU country, the VAT goes to the customer's country, at its rate, once your cross-border B2C sales across the EU pass €10,000, measured over the current and the previous calendar year. Below that combined threshold, you may keep charging Cyprus VAT. Above it, the One Stop Shop, or OSS, lets you declare every EU country's VAT in a single quarterly return filed with the Cyprus Tax Department, instead of registering country by country. If you plan to sell to consumers at all, set up OSS before the first campaign. Splitting a year of consumer sales across countries after the fact is slow, expensive work.

B2B services to customers outside the EU are generally outside the scope of Cyprus VAT. Some countries do make foreign digital suppliers register with them, so check the rules of any country that becomes a real market for you.

When does a software company have to file VIES?

From your first B2B sale to a VAT-registered customer in another EU country, and then every month. No money moves with a VIES statement. It tells your customer's tax authority to expect the reverse charge on their side. You file it through Tax For All, the Tax Department's online portal, by the 15th of the following month. That's a different rhythm from the quarterly VAT return, which is exactly why founders miss it. A late statement costs €50. A continuing failure to file is a criminal offence, with a fine of up to €850 on top.

The other common failure is a customer's VAT number lapsing between contract and renewal. That quietly turns a zero-rated B2B sale into one where Cyprus VAT was due. Re-check numbers from time to time. Our guide to VIES submissions has the full mechanics.

What should you set up first?

The company, the books, and a separate record for each IP asset, before there are many numbers to separate. Where development happens and who owns the IP shape your nexus fraction for the life of the asset. Decide both on purpose at formation, rather than untangling them at the first audit.

Start the bookkeeping earlier than feels necessary. Cyprus income tax has no deduction window for costs from before the company existed, and formation costs are capital in nature and not deductible. VAT works differently. With invoices in hand, a newly registered company can recover input VAT on services received up to 6 months before registration, and on goods up to 3 years. Our article on pre-establishment expenses has the details. It's one reason formation through Sumly starts your bookkeeping the day you order, before the incorporation certificate arrives. The early invoices land in the books, not in a drawer.

This is also where Sumly earns its keep for a software company. The IP Box add-on tracks qualifying income and calculates the deduction on top of the ledger you already keep. Every entry stays linked to the document behind it, so you can trace the per-asset trail the regulations demand from your own records. Every Cyprus VAT code in the books maps to a box of the VAT return, so the return and the monthly VIES statement build themselves from the sales you invoiced, with reminders before the 15th. Sumly prepares those returns. On Base, you review and submit them through Tax For All. On Plus, Sumly files them for you. On Premium, your Sumly certified bookkeeper does it. An IP Box claim itself deserves a tax adviser's sign-off, and an adviser working from clean per-asset books quotes a very different fee from one handed a shoebox.

On the personal side, how you pay yourself is half the picture. If you've moved to Cyprus, read up on non-dom status before you decide how to take money out. Company tax and founder tax are one calculation.

Questions founders actually ask