Statutory registers audit in Cyprus: what the rules require

A statutory registers audit in Cyprus tests whether a company's register of members, its register of directors and secretaries, and its register of charges match what the Registrar of Companies actually holds on file, and whether the registered office can produce them on request. The exercise matters most at the point a group changes structure, replaces a director, or brings in a new shareholder, because a gap between the internal register and the public file is what a counterparty's due diligence team finds first. Cyprus keeps its own version of the underlying requirement, and it does not track the audit standard used in England & Wales or in the Netherlands term for term.

A Cyprus holding company inside a wider European group appoints a new director after a share transfer, updates its board minutes, and assumes the change is complete once the Registrar's portal shows the filing as accepted. Six months later a bank's compliance team asks for the register of directors and secretaries held at the registered office, and it does not match the filed particulars. The company then has two problems: the mismatch itself, and the fact that nobody can say since when it existed.

This page sets out what the audit tests in Cyprus specifically, what happens once a discrepancy sits on the record rather than being corrected, and where the advisory work stops.

What changes in Cyprus

Cyprus company law does not leave the underlying registers as a matter of internal preference. Every Cyprus company must keep a register of members, a register of directors and secretaries, and a register of charges, each open to inspection at the registered office or at the location last notified to the Registrar of Companies. 01 That is the baseline the audit tests against, and it holds regardless of whether the company is privately held or sits inside a larger group structure.

The point where Cyprus diverges from the generic version of this work is the beneficial ownership layer. Cyprus maintains a central register of beneficial owners at the Registrar of Companies, separate from the statutory registers held at the registered office, and the two must be kept consistent with each other. 02 Confirming that the Cyprus corporate register held centrally and the company's own internal registers agree is the first test the audit applies, and an audit that checks only one of the two has answered half the question.

Read alongside the practice-wide statutory registers audit page, this page covers only what is specific to Cyprus. For the wider governance position, including where board decisions are actually taken, see the Cyprus management and control review. The two audits often surface the same gap from different angles, because weak corporate governance at board level is usually what let the registers drift apart in the first place.

The requirement that drives a statutory registers audit in Cyprus

The audit does not ask whether registers exist somewhere. It asks whether the four registers, the register of members, the register of directors and secretaries, the register of charges, and the beneficial ownership register, agree with each other and with what the Registrar holds, and whether each one sits where the law says it must sit.

A Cyprus company must maintain a registered office address in Cyprus, and the statutory registers must be available for inspection there or at whatever address the company has notified to the Registrar of Companies as the alternative location. 03 The most common failure the audit surfaces is not a missing register. It is a registered office holding a file nobody has updated since incorporation, while every actual change has been filed correctly at the Registrar and nowhere else.

An inaccurate register of members is not a paperwork issue only. Cyprus company law treats the register as primary evidence of who holds shares, so an error there can affect the exercise of shareholder rights, including voting and dividend entitlement, until the entry is corrected and the correction is properly dated.

Personal liability attaches to this gap, not only to the company. The duty to keep the statutory registers current rests with the company and its officers jointly, and a director or secretary who allows the registers to fall out of step with the filed record is in default independently of any liability the company itself carries. 04 Once that default is fixed on a specific date, it cannot be reversed. It can only be corrected going forward, and the period during which it existed becomes part of the record.

The filing, register or forum consequence

An officer of a Cyprus company who fails to ensure the statutory registers are kept as required is liable, on conviction, to a fine, and personal liability attaches to the individual officer in default rather than only to the company. 05 The Registrar does not need to run an inspection to make the gap consequential. A bank's counterparty due diligence, a buyer's disclosure exercise, or a co-investor's own audit does the same work, and by the time any of them asks the question, the officer's exposure for the period already run is fixed.

The forum that matters here is rarely a court. It is the register itself. Once the beneficial ownership filing and the internal register diverge, the divergence becomes visible on the register to anyone with a legitimate interest who applies for access, and the company cannot present a corrected history as though the gap never existed. It can only file the correction with the date the correction was made.

Cyprus is not unusual in attaching officer-level liability to register failures. The equivalent position in Czechia reaches a similar result through a different mechanism, which is a reminder that harmonising registers across a group structure at group level does not remove the jurisdiction-specific test that each entity has to pass on its own.

A group that discovers the mismatch through a counterparty's question rather than its own review is already answering that question from a weaker position. The period during which the registers were wrong is fixed by then, whichever route surfaces it, and confirming the position before it is tested externally is the only point at which the company keeps the answer within its own control.

Check what your jurisdiction requires. Write to info@hreithlaw.com with the jurisdiction and the structure.

What this service does not include in Cyprus

The audit maps what the four registers say against each other and against the Registrar's file, sets out where the discrepancy arose, and produces the correction the board needs to file. It does not include acting as, supplying, sourcing or arranging a director, a secretary, a nominee shareholder or a trustee for the company under audit, and it does not include any activity that requires authorisation as an administrative service provider in Cyprus.

That boundary is not a matter of preference. Providing directors, secretaries or nominee shareholders as a business, or arranging for a third party to do so, is a regulated activity in Cyprus under the framework governing administrative service providers, and carrying it out without the relevant authorisation is itself an exposure. 06 The firm will not create that exposure for a client by stepping into the role. It advises on what the registers must show and who is exposed if they do not; it does not become the officer whose register entry is then in question.

For a company that sits within a wider group structure, this boundary matters as much as the audit itself, because a gap in one entity's registers rarely stays isolated from the group's own reporting lines. For a group weighing whether to hold the entity in Cyprus at all or restructure toward a different disclosure regime, the comparison between Cyprus and the BVI on disclosure registers sets out that trade-off in more detail than this page can.

• The requirement mapped against the four registers specific to Cyprus
• The discrepancy identified and dated, not just described
• The correction drafted for filing, with the officer in default named internally
• The beneficial ownership entry checked against the internal register, not assumed

For a Cyprus entity sitting inside a larger structure, the audit is only useful if it is scoped to the entity's own registers and to the group's own reporting lines at the same time. A correction filed in Cyprus without reference to the parent's own disclosure obligations can create a second mismatch instead of closing the first.

Check what your jurisdiction requires. Write to info@hreithlaw.com with the jurisdiction and the structure.

Frequently asked questions

What does statutory registers audit in Cyprus require in practice?

It compares the register of members, the register of directors and secretaries, and the register of charges held at the registered office against what the Registrar of Companies has on file, and checks the beneficial ownership entry separately. The audit is a reconciliation exercise, not a compliance certificate, and the common misconception it corrects is the assumption that filing a change with the Registrar automatically updates the register held at the registered office. It does not; the two records only match if someone updates both.

Who inside the company is responsible for statutory registers audit in Cyprus?

The company carries the primary duty, but the director and the secretary each carry personal exposure as officers in default if the registers are not kept as required. This reflects a basic corporate governance principle in Cyprus company law: officers, not only the company, answer for the registers. That exposure exists independently of whatever liability the company itself carries.

What evidence should the board keep on statutory registers audit in Cyprus?

A dated record of the discrepancy found, the correction filed, and the date the registers were brought back into line with the Registrar's file. A board that keeps only the corrected register, without the record of when the gap existed, cannot answer the question a counterparty is most likely to ask, which is how long the mismatch ran.

What happens if statutory registers audit in Cyprus is not addressed?

The exposure does not expire on its own. An officer in default remains liable to a fine for the period the default ran, and a counterparty's own due diligence, a bank, a buyer, an investor, will eventually surface the mismatch whether or not the company raises it first. Addressing it before it is found externally is the only point at which the company controls how the gap is presented.

How often should statutory registers audit in Cyprus be reviewed?

There is no fixed statutory interval for the audit itself. The trigger is usually an event, a director change, a share transfer, a new group reporting line, rather than a calendar date. A separate note sets out the specific events that most often drive an off-cycle review, and why waiting for the annual return to surface a gap is usually too late.

Fredrik Lund, Expert author, corporate secretarial compliance and disclosure. Fredrik focuses on statutory registers, board and shareholder record-keeping, and the point at which a filing gap in one jurisdiction becomes a disclosure problem for a wider group. He works across common-law and civil-law company registers and writes on the practical sequence a company follows once a discrepancy is found, rather than on the doctrine alone.