The Cyprus UBO register: who counts, the annual confirmation, and the penalties

The UBO register is the youngest of your Cyprus company’s recurring obligations, and the one with the most chaotic history — penalties introduced, imposed, cancelled, refunded, and re-introduced in a different shape, all within about three years. The result is that a lot of founders genuinely don’t know what the current rules are, and a lot of stale articles are happy to misinform them.

Here’s the 2026 state of play: who counts as a beneficial owner, what has to be filed and when, what the annual confirmation window is, and what the penalties actually are now — as opposed to what they were in 2023.

Who counts as a UBO

A beneficial owner is any natural person who ultimately owns or controls the company — the standard trigger being more than 25% of shares or voting rights, held directly or through other entities. For the typical founder-owned company this is trivially simple: you (and any co-founder above 25%) are the UBOs. It gets interesting only with holding structures, nominee arrangements or trusts — in which case the register wants the humans at the top of the chain, not the boxes in between. Where no individual qualifies through ownership, the register falls back to senior management — but for an SME that’s the exception, not the plan.

Since 2021 the information sits in a central register run by the Registrar of Companies, filed electronically at ubo.meci.gov.cy. Access requires a verified CY Login account — in practice the single biggest source of friction for non-resident founders, and the reason this filing so often ends up delegated to the provider. (Delegated or not, the obligation — and the fine — stays with the company.)

The three filing duties

The annual confirmation is the one that catches companies out, because it demands action when nothing has happened. No change in ownership, no event, no trigger — just a recurring three-month window at the end of every year in which someone must log in and confirm. For the 2026 cycle, that window is 1 October to 31 December 2026. Miss it and the daily fines start accruing on 1 January with no warning letter.

The penalties — current regime, not the folklore

The original penalty regime (from 2023) was €200 for the first day plus €100 per day, capped at €20,000, with personal liability for directors and the secretary. It caused an outcry, and in December 2024 Parliament scrapped it: fines imposed from April 2024 were withdrawn and refunded, and a new regime took effect, with enforcement running since 1 February 2025.

The rules in force in 2026:

• €100 for the first day of non-compliance, then €50 per day, capped at €5,000 per breach.
• Fines land on the company only — officers are no longer personally fined (though they can be pursued for payment if they neglect their duties, and criminal liability for false information remains).
• Persistent non-compliance now carries a sharper stick: the 2024 amendment gave the Registrar the power to strike the company off the register for UBO failures — the same terminal outcome as ignoring annual returns.

If you’re reading a guide that still quotes €20,000 caps and personal director fines, it was written before December 2024. That’s a useful freshness test for anything else it says, too.

Who can see the register

Following the 2022 EU court ruling on public access, the general public can no longer browse UBO data freely; access is available to authorities, obliged entities (banks, lawyers, accountants performing KYC) and persons demonstrating legitimate interest. Expect your bank to check it, and expect account opening or periodic reviews to stall if the register contradicts what you’ve told the bank. The register isn’t paperwork for its own sake — it’s infrastructure other institutions actively query.