The Cyprus Tax Department recently issued an announcement on the 05 June 2026, titled “Enhancing Due Diligence Procedures (DAC2/CRS)”, signalling an increased regulatory focus on the quality and robustness of due diligence processes applied by financial institutions within the scope of automatic exchange of financial account information.

The announcement forms part of Cyprus’ ongoing commitment to international tax transparency under the Common Reporting Standard (CRS) and the corresponding EU framework under DAC2, which require financial institutions to identify, document, and report financial accounts held by non-residents for exchange with relevant tax authorities.

Regulatory Context

CRS and DAC2 impose obligations on reporting financial institutions to collect information on account holders, including tax residency and financial account data, and to report such information to the Cyprus Tax Department for automatic exchange with other jurisdictions.

A key element of this framework is the due diligence process, which requires institutions to determine the tax residence of account holders, verify the accuracy of self-certifications, and ensure that reported data is complete and reliable. In practice, the effectiveness of the entire automatic exchange system depends on the integrity of these underlying due diligence procedures.

Focus of the Announcement

“Citizenship by Investment” (CBI) and “Residence by Investment” (RBI) schemes are being offered by a substantial number of jurisdictions and allow foreign individuals to obtain citizenship or temporary or permanent residence rights on the basis of local investments or against a flat fee.

Individuals may be interested in these schemes for a number of legitimate reasons, including the wish to start a new business in the jurisdiction, greater mobility thanks to visa-free travel, better education and job opportunities for children, or the right to live in a country with political stability. At the same time, information released in the marketplace and obtained through the OECD’s CRS public disclosure facility highlights the abuse of CBI/RBI schemes to circumvent reporting under the CRS.

CBI/RBI schemes can be misused to undermine the CRS due diligence procedures. This may lead to inaccurate or incomplete reporting under the CRS, in particular when not all jurisdictions of tax residence are disclosed to the Financial Institution. Such a scenario could arise where an individual does not actually or not only reside in the CBI/RBI jurisdiction, but claims to be resident for tax purposes only in such jurisdiction and provides his Financial Institution with supporting documentation issued under the CBI/RBI scheme, for example a certificate of residence, ID card or passport.

Not all RBI/CBI schemes present a high risk of being used to circumvent the CRS. Schemes that are potentially high-risk for these purposes are those that give a taxpayer access to a low personal income tax rate of less than 10% on offshore financial assets and do not require significant physical presence of at least 90 days in the jurisdiction offering the CBI/RBI scheme. This is based on the premise that most individuals seeking to circumvent the CRS via CBI/RBI schemes will wish to avoid income tax on their offshore financial assets in the CBI/RBI jurisdiction and would not be willing to fundamentally change their lifestyle by leaving their original jurisdiction of residence and relocating to the CBI/RBI jurisdiction.

Implications for Financial Institutions

Under Section VII of the CRS, a Financial Institution may not rely on a self-certification or Documentary Evidence if the Financial Institution knows or has reason to know that the self-certification or Documentary Evidence is incorrect or unreliable. The same applies with respect to Pre-existing High-Value Accounts, where a relationship manager has actual knowledge that the self-certification or Documentary Evidence is incorrect or unreliable.

In making the determination whether a Financial Institution has reason to know that a self-certification or Documentary Evidence is incorrect or unreliable, it should take into account all relevant information available to the Financial Institution, including the results of the OECD’s CBI/RBI risk analysis. As a result, where, taking into account all relevant information, the facts and circumstances would lead the Financial Institution to have doubts as to the tax residency(ies) of an Account Holder or Controlling Person, it should take appropriate measures to ascertain the tax residency(ies) of such persons.

To the extent that the doubt is related to the fact that the Account Holder or Controlling Person is claiming residence in a jurisdiction offering a potentially high-risk CBI/RBI scheme, FIs may consider raising further questions, including:

• Did you obtain residence rights under a CBI/RBI scheme?
• Do you hold residence rights in any other jurisdiction(s)?
• Have you spent more than 90 days in any other jurisdiction(s) during the previous year?
• In which jurisdiction(s) have you filed personal income tax returns during the previous year?

The responses to the above questions should assist Financial Institutions in ascertaining whether the provided self-certification or Documentary Evidence is incorrect or unreliable.

Conclusion

The above-mentioned procedure will apply, as part of the due diligence obligations, to all new clients from the date of the announcement. In respect of existing clients, it will apply where the account holder has declared tax residence in a jurisdiction offering a potentially high-risk CBI/RBI programme, and must be completed within six months from the date of the announcement. Furthermore, reporting financial institutions are required to notify the Tax Department via email at dac2@tax.mof.gov.cy, with the subject line “CBI/RBI‑CRS”, where corrective and/or new CRS submissions are made in relation to reportable information concerning existing clients.

The content of this article is valid as at the date of its first publication. It is intended to provide a general guide to the subject matter and does not constitute legal advice. We recommend that you seek professional advice on your specific matter before acting on any information provided. For further information or advice, please contact Stephanos Ayiomamitis, Partner at our Limassol Office, Tel +357 25363685 or email stephanos.ayiomamitis@kyprianou.com.