Audit requirements for Cyprus companies: who needs one and what the small-company review option covers

Founders arriving from the UK or most of the EU get a surprise here: in Cyprus, the audit is not something you grow into. There is no general small-company audit exemption — a one-person consultancy with €60,000 of revenue prepares IFRS financial statements and has them signed off by a licensed auditor, same as a 200-person firm. It’s typically the single largest line on your annual compliance invoice, and it sits on the critical path of almost every other filing.

What most guides undersell is the one meaningful relaxation that exists — the review option for small companies — and the fact that its threshold just moved, in February 2026. Here’s the full picture.

The default: everyone gets audited

Cyprus company law requires every company to prepare financial statements under IFRS as adopted by the EU and have them examined by a statutory auditor licensed by ICPAC (the Institute of Certified Public Accountants of Cyprus). The Tax Department leans on the same documents: the TD4 corporate tax return must be based on audited (or reviewed — see below) financial statements. So even a company small enough to fly under every other radar cannot simply skip the exercise; without statements, neither the tax return nor the HE32 annual return can be completed.

For a simple services company, the audit itself typically runs €1,200–€2,500 a year — the biggest component of the annual professional-fee stack. That money buys something real: an independent signature that banks, tax authorities and future buyers of your company all rely on. But the price scales with how messy your books are — auditors bill for archaeology.

The review option: audit-lite for small companies

Since financial year 2022, qualifying small companies may have their statements reviewed (under the international review standard, ISRE 2400) instead of fully audited. A review is still performed by a licensed statutory auditor, still produces signed statements the Tax Department accepts — but it’s a limited-assurance engagement: less testing, less evidence-gathering, meaningfully less cost and back-and-forth.

The thresholds, both of which must be met:

The limits must be respected on a sustained basis (two consecutive years), and certain companies are excluded regardless of size — regulated entities and parents preparing consolidated accounts among them. The February 2026 increase to €300,000 widens the door noticeably — though check with your auditor which financial year the higher threshold first applies to for your company. (Parliament had debated setting it at €400,000; €300,000 is where it landed.)

The timeline the statements live on

Financial statements aren’t just an annual artifact — they’re a dependency for three other deadlines:

• The AGM. Statements are laid before the general meeting — the first AGM within 18 months of incorporation, and no more than 15 months between AGMs after that.
• The HE32. Each annual return files with the previous financial year’s signed statements attached, within 28 days of the return’s made-up date.
• The TD4. The tax computation starts from the statements — the 2024 return, due 30 November 2026, needs the 2024 accounts signed well before that.

Work the chain backwards and the practical rule appears: for the whole calendar to hold, your books for a year need to be closed and with the auditor within a few months of year-end, not the following spring. Every week of bookkeeping lag propagates directly into audit lag, and from there into filing risk on two fronts at once.

What happens if you just… don’t

No statements means no HE32 attachment (late-filing penalties, then strike-off exposure as returns pile up unfiled), no TD4 basis (the €100 fine is trivial; assessments raised by the Tax Department on estimated figures are not), and — the quiet one — no clean paper trail when a bank, a payment provider or an acquirer asks for “your last two years of audited accounts” and you need them this week. Directors of companies that persistently fail to prepare statements also carry personal exposure under the Companies Law. The audit is annoying; not having one is worse.