VAT on digital services from Cyprus: B2B, B2C and the One Stop Shop

A Cyprus company selling software, subscriptions or other digital services charges VAT based on who the customer is and where they belong. An EU business with a valid VAT number gets an invoice without Cyprus VAT and accounts for the tax at home under the reverse charge. An EU consumer pays their own country's VAT once your cross-border consumer sales pass €10,000 a year, and the One Stop Shop lets you declare all of that through one quarterly return filed in Cyprus. A customer outside the EU pays no Cyprus VAT at all.

What counts as a digital service for VAT?

A digital service, or electronically supplied service as the law calls it, is one delivered over the internet in an essentially automated way, with little or no human intervention. Software-as-a-service, app subscriptions, downloadable software, hosting and cloud storage, streamed media, e-books, online courses that run without a live teacher, and access to databases or marketplaces all sit inside the definition.

What sits outside it matters just as much. A consultancy report emailed as a PDF is not a digital service. Neither is a live online class taught by a person, bespoke development invoiced by the hour, or a physical product ordered through a website. Those follow their own place-of-supply rules. The distinction decides whether the consumer rules below apply at all, so a company selling a mixture, say a subscription plus a paid onboarding service, should classify each line of its price list once and record the classification against the product.

How do you invoice an EU business customer?

You invoice an EU business customer without Cyprus VAT. Under the general rule for business-to-business services, the place of supply is where the customer is established, so a digital service sold to a VAT-registered business in Germany is taxed in Germany, by the customer. Your invoice shows your Cyprus VAT number, the customer's VAT number, no VAT on the line, and wording that says the customer accounts for the tax. The full mechanics are in our guide to the reverse charge in Cyprus.

Two obligations come with that VAT-free invoice. First, validate the customer's VAT number in the EU's VIES database before you invoice and keep a record of the check. If the number is invalid, the customer counts as a consumer, and you have priced a sale without the VAT that was due on it. Second, the sale goes on your monthly VIES statement, which is filed through Tax For All by the 15th of the following month, and its total also lands in box 8B of your VAT return. Our guide to VIES submissions walks through the filing itself. B2B digital sales never touch the One Stop Shop.

When does an EU consumer pay their own country's VAT?

An EU consumer pays their own country's VAT once your cross-border consumer sales pass the EU-wide threshold. While the combined value of your distance sales of goods and digital services to consumers in other member states stays at or under €10,000 excluding VAT, in both the current and the preceding calendar year, you may keep charging Cyprus VAT at the 19% standard rate on those sales and report them in your ordinary Cyprus return.

Say your subscribers outside Cyprus bring in €700 a month. That is €8,400 a year, under the limit, so every EU consumer pays 19% Cyprus VAT and your pricing is the same everywhere. The month those sales accelerate past €10,000, the rules flip: a German subscriber owes German VAT, an Irish subscriber Irish VAT, and your checkout has to know the difference.

This threshold has nothing to do with the €15,600 Cyprus registration threshold covered in our guide to VAT registration in Cyprus. One measures your cross-border consumer sales, the other your Cyprus taxable turnover, and a company can be above either one and below the other.

How does the One Stop Shop work?

The One Stop Shop turns what would be a VAT registration in every consumer's country into one registration in Cyprus. You register for the OSS Union scheme with the Cyprus Tax Department, which becomes your member state of identification. Each quarter you file one electronic return listing, per country, the consumer sales and the VAT due at that country's rate, and pay the total to Cyprus in a single payment. The Cyprus administration forwards each country's share.

The OSS return is due by the end of the month following each quarter: 30 April, 31 July, 31 October and 31 January. It is separate from your ordinary Cyprus VAT return, with its own period and its own deadline. OSS records must be kept for 10 years from the end of the year of the transaction and produced electronically when any member state asks.

What about customers outside the EU?

A digital service supplied to a customer outside the EU is outside the scope of Cyprus VAT. No VAT on the invoice, the sale reported in the out-of-scope box of the return, and the input VAT on your own costs still recoverable.

Cyprus is only half the story, though. The United Kingdom, Norway, Switzerland, Australia, Canada and a growing list of other countries tax foreign suppliers of digital services to their consumers and expect a local registration once a domestic threshold is crossed. That is their tax, collected under their rules, and the OSS does not cover it. If one non-EU country produces a meaningful share of your consumer revenue, check its rules. App stores and some payment platforms collect the tax for you in certain markets, and the platform's terms say whether they do. Our explainer on Cyprus tax for software companies puts these VAT rules next to the corporate tax and IP Box side of the same business.

What evidence of customer location must you keep?

You must keep two pieces of non-contradictory evidence of each consumer's location. The location sets the rate and the country that receives the VAT, so EU law makes you prove it: under Implementing Regulation 282/2011 the acceptable items include the billing address, the IP address of the device, the bank or payment-card country, the SIM country code, the location of a fixed landline and other commercially relevant information. For a subscription product that usually means the billing country entered at checkout plus the IP or card country recorded by the payment provider.

Smaller sellers get a simplification: while your cross-border digital-service sales to consumers stay within €100,000 a year, one piece of evidence from a third party, such as your payment provider, is enough.

Capture the evidence automatically at the point of sale, because it cannot be reconstructed a year later, and store it against the transaction so the country on the invoice, the country in the books and the evidence behind them always agree.

How should the books code each sale?

Every sale needs three facts recorded at line level when it happens: whether the customer is a VAT-registered business or a consumer, which country the customer belongs to, and the VAT treatment that follows from those two. From the codes, the filings fall out. Cyprus customers take Cyprus VAT in the domestic boxes of the return. Validated EU business customers take the reverse-charge code, box 8B, and a line on the monthly VIES statement. EU consumers take Cyprus 19% below the €10,000 threshold and their own country's rate above it, totalled per country for the quarterly OSS return. Everyone else takes the out-of-scope code and appears on neither VIES nor OSS.

The coding has to happen per sale rather than at quarter-end, because the same product at the same price lands in a different return depending on who bought it. A month of revenue cannot be split by looking at bank deposits; a payment provider's payout arrives net of fees and pooled across every country. The split lives in the invoices and the VAT code on each line. Our walk-through of how to file a Cyprus VAT return maps which boxes each bucket reaches.

Where Sumly fits in

Sumly's invoicing applies a Cyprus VAT code to every line, and the codes cover this whole article: domestic rates, reverse charge, EU sales, zero-rated, exempt and out-of-scope. Each code maps to the official boxes of the Cyprus VAT return, so the return assembles itself from the books, ready to review, and the monthly VIES statement is prepared from the same books, with reminders before the 15th. Because the AI books each sale against its document, the coding discipline this guide asks for happens at the moment of recording, and the consumer sales an OSS return needs are already separated from everything else when the quarter closes.

On Base you review what Sumly prepared and submit through Tax For All yourself. On Premium your Sumly certified bookkeeper reviews and submits for you. Either way, nothing is filed without a person signing off on it, and filed periods lock so submitted numbers cannot shift underneath you.

Questions people ask

Frequently asked

Does a Cyprus SaaS company charge Cyprus VAT to every customer?

No. Cyprus VAT at 19% applies to customers in Cyprus, and to EU consumers while your EU-wide cross-border consumer sales stay within €10,000 a year. A VAT-registered business in another EU country is invoiced without Cyprus VAT under the reverse charge. An EU consumer is charged their own country's VAT once the €10,000 threshold is passed. A customer outside the EU is outside the scope of Cyprus VAT. The customer decides the treatment, so the same product carries different VAT depending on who buys it.

What is the €10,000 OSS threshold?

An EU-wide limit on cross-border sales to consumers. While your combined distance sales of goods and digital services to consumers in other EU countries stay at or under €10,000 excluding VAT, in both the current and the previous calendar year, you may charge Cyprus VAT on those sales and report them in your normal Cyprus VAT return. Once you cross it, VAT is due in each consumer's country, starting with the very sale that crosses the line.

Is the One Stop Shop compulsory?

No. Once you owe VAT in other EU countries on consumer sales, you can either register for VAT in each of those countries or register once for the OSS Union scheme in Cyprus and declare everything through one quarterly return. For a software company with customers spread across the EU, the OSS is almost always the practical choice. The scheme is optional; the underlying VAT is not.

Do OSS sales go on my VIES return?

No. The VIES statement reports supplies to VAT-registered businesses in other EU countries. Consumer sales go through the OSS return. Every cross-border EU sale lands in exactly one of the two, which is why each sale must be coded as business or consumer when it is recorded.

How do I prove a customer is a business and not a consumer?

By their valid EU VAT number, checked in the EU's VIES validation database before you invoice, with a record of the check kept. A customer who cannot give you a valid VAT number is treated as a consumer for VAT purposes, even if it is obviously a company, and the sale follows the consumer rules.

Does Sumly handle VAT on digital services sold across the EU?

Yes. Sumly's invoicing applies Cyprus VAT codes per line, including reverse charge and out-of-scope, and every code maps to the official boxes of the Cyprus VAT return, so the return assembles itself from the books. The monthly VIES statement is prepared from the same books, with deadline reminders. On Base you review and submit through Tax For All yourself; on Premium your Sumly certified bookkeeper reviews and submits. OSS registration itself is a step you take with the Tax Department once your consumer sales cross €10,000.