Tax News Update    Email this document    Print this document  

November 14, 2023

Cyprus enacts law implementing tax transparency rules for digital platforms (DAC 7)

  • On 3 November 2023, the law requiring the automatic and mandatory exchange of information reported by platform operators comes into force, and the first reports must be filed with the Cypriot Tax Department no later than 31 January 2024.
  • The law also introduces certain changes to the existing legislation on administrative cooperation in tax matters and amends the common reporting standard (CRS/DAC2) and DAC6 laws to comply with data protection requirements.

Executive summary

On 3 November the "Law amending the Administrative Cooperation in the Field of Taxation Laws" (Law) was published in the Official Gazette of the Republic of Cyprus.

The Law implements Council Directive (EU) 2021/514 of 22 March 2021 (DAC 7), amending Directive 2011/16/EU on administrative cooperation in the field of taxation, and introduces new obligations for Platform Operators.

In addition to adding new rules, the Law amends a number of other provisions of the Law on the Administrative Cooperation in the Field of Taxation, with regard to the provisions of CRS/DAC2 and DAC6.

Detailed discussion

Obligations for platform operators

The Law provides for an automatic exchange of information on certain data to be reported by platform operators. However, platform operators should only need to collect data on certain types of sales (so-called relevant activities). Specifically, the following activities are covered: (1) renting immovable property; (2) providing personal services; (3) selling goods; and (4) renting any mode of transport.

Platform operators, as defined in the Law, must:

  • Register with the Cypriot Tax Department (CTD) or notify the CTD if they are already registered in another European Union (EU) Member State
  • Carry out specific due diligence procedures and report to the CTD certain determined information on the sellers as required in the Law

Failure to perform the prescribed due diligence and reporting obligations may result in monetary penalties and reputational damage.

It should be mentioned that platform operators that demonstrate to the CTD that as per their business model no reportable sellers perform any relevant activities through the platforms, should be considered as excluded platform operators.

Data protection — changes to CRS/DAC2 and DAC6 laws

In addition to introducing new rules, the Law makes changes to existing laws. Amendments made in the CRS Law help ensure that personal data is protected as per Regulation (EU) 2016/679 of the European Parliament and European Council of 27 April 2016 (on the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation (GDPR)). Specifically, the Law clarifies that a Cyprus reporting financial institution must (i) inform each individual concerned that information relating to that individual will be collected and transferred in accordance with the Law and (ii) transmit to each individual concerned all the information that the individual is entitled to receive from the data controller, providing sufficient time for the individual to exercise his/her data protection rights and, in any event, transmitting the information before it is communicated to the CTD.

A similar obligation for the reporting intermediary is now also established in the MDR Law, for Cyprus-based intermediaries.

Administrative cooperation in the field of taxation

Exchange of information upon request

To ensure that information is effectively exchanged upon request and to prevent requests from being unnecessarily refused, the Law furthermore delineates and codifies the internationally agreed standard of "foreseeable relevance." The Law also clarifies the legal framework of requests for information concerning groups of taxpayers that cannot be identified individually. In such cases, the foreseeable relevance of the requested information must be described based on a common set of characteristics.

Automatic exchange of information on the ownership of real estate

Furthermore, for taxable periods starting on or after 1 January 2025, the Law extends the mandatory automatic exchange of information to information on Cypriot real estate owned by individuals and entities resident in another EU Member State.

Joint audits

The Law also introduces joint audits as a new tool for administrative cooperation and clarifies the framework and principles that apply to a joint audit. A joint audit is an administrative inquiry conducted jointly by the competent authorities of Cyprus and one or more additional EU Member State and relating to one or more persons of common or complementary interest to these competent authorities.

What is coming next?

Except for certain rules relating to joint audits, the Law takes effect from 1 June 2023. The form and operating details of the registration and DAC7 report will crystalize in the coming weeks.

Reporting platform operators will have to register with the CTD by 31 December 2023, at the latest. A Reporting platform operator commencing its activity after 31 December 2023 must register no later than the date it begins its activity.

The first DAC 7 reporting deadline is 31 January 2024.


Affected companies should determine what changes might be needing their processes and systems to enable reporting of the type prescribed in the Law.

Similarly, taxpayers should closely assess the other expansions of administrative cooperation within the EU.

Financial institutions and intermediaries should also assess what changes are needed in their procedures and communications to comply with the newly introduced requirement to inform individuals regarding potential reporting under DAC2/CRS and DAC6.


For additional information with respect to this Alert, please contact the following:

EY Cyprus Advisory Services Limited

Published by NTD’s Tax Technical Knowledge Services group; Carolyn Wright, legal editor