Who can see beneficial ownership registers in Cyprus?

The beneficial owner is always a natural person: the individual who ultimately owns or controls the customer, or on whose behalf a transaction is carried out. Holding companies and nominees are only steps along the way.

For a company, a holding of 25% plus one share, or an ownership interest of more than 25%, is treated as an indication of ownership. It counts whether the stake belongs to the individual directly or sits in one or more companies that the same person controls. Control exercised by other means counts too. Companies listed on a regulated market with disclosure rules that meet EU standards fall outside this test, because their ownership is already transparent.

The senior managing official is treated as the beneficial owner only as a fallback: when, after every possible step and with no grounds for suspicion, no owner can be identified, or when it is doubtful whether the person identified really is the owner. The firm then verifies that person and records what it did. For a trust, the beneficial owners are the settlor, the trustees, any protector, the beneficiaries or, if they have not yet been determined, the class of persons the trust mainly serves, and anyone else who ultimately controls it. Foundations and similar arrangements follow the same pattern.

There are three central registers. The Registrar of Companies keeps the one for companies and other legal entities on its register. The General Registrar keeps the one for societies, foundations, federations, associations and charities. CySEC keeps the register of express trusts and similar legal arrangements.

In each case the entity itself, or the trustee, must hold adequate, accurate and current information about its beneficial owners; for companies and foundations, the owners must supply what the entity needs. When a firm takes on a customer that has to register, it asks for proof of registration or an extract from the register; see When must CDD be completed?

Access works in three tiers. The authorities, meaning CySEC and the other supervisors, MOKAS, the Tax Department, the Customs and Excise Department and the Police, see everything, promptly, and for companies and other entities without the entity being told. Obliged entities can use the registers while carrying out CDD.

Anyone else, whether a person or an organisation, needs a legitimate interest, meaning an interest in preventing and combating money laundering and terrorist financing. Such a person sees only the owner's name, month and year of birth, nationality and country of residence, plus the nature and extent of the interest held. Open public access ended after the EU Court of Justice ruled in November 2022 that giving the general public this data breached the rights to privacy and data protection. A March 2026 amendment wrote the legitimate-interest test into the law for the company register and the register of societies, foundations and charities, matching the rule already used for the trust register.

Access for obliged entities and for people with a legitimate interest can be withheld, only in exceptional cases and case by case, for all or part of the data: where it would expose the owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or where the owner is a minor or legally incapable. That exemption never applies to banks and other financial institutions.

A register entry is a starting point, not proof. The law says firms may not rely only on the register to meet their CDD duties and must take a risk-based approach, so they still identify the beneficial owners themselves and take reasonable steps to verify them.

If what the firm finds differs from what the register shows, it reports the discrepancy to the authority that keeps the register, which then acts to resolve it.

CySEC can fine a trustee who fails to submit registration information €100, plus €50 for each day the failure continues, up to €5,000 in total. These amounts apply since December 2024; before then they were €200, €100 a day and €20,000, and older study material may still show them.

For other breaches of the trust register rules, CySEC can impose penalties of up to €500,000, or €1,000,000 for repeated breaches, depending on how serious they are, and can suspend or remove the trust's registration.