DAC6 Cyprus: Tax Department Release Updated Guidance

On 29 October 2021, the Cyprus Tax Department released a new publication in the Official Gazette, Decree No. KDP 438/2021, which implements the EU directives on reportable cross-border arrangements (DAC6). The guidance in relation to reporting in Cyprus has also been updated. 

DAC6 in Cyprus

DAC6 refers to the sixth Directive on Administrative Cooperation (DAC) issued by the European Union (EU), Specifically, DAC6 focuses on the reporting of potentially aggressive tax planning schemes, known as “reportable cross-border arrangements.” These arrangements typically involve multiple jurisdictions and may have characteristics that raise concerns regarding their tax implications. The directive requires intermediaries, such as tax advisors or consultants, to report these arrangements to the tax authorities.

As for DAC6 in Cyprus, it refers to the implementation and enforcement of the directive within the tax framework of Cyprus. Cyprus, as an EU member state, has transposed and incorporated the provisions of DAC6 into its domestic legislation. This means that intermediaries and, in certain cases, taxpayers themselves, are obligated to disclose relevant cross-border arrangements to the tax authorities in Cyprus.

By implementing DAC6, Cyprus aims to strengthen tax transparency, deter aggressive tax planning, and ensure effective exchange of information between tax authorities within the EU. It enables tax authorities to identify and respond to potentially abusive tax practices promptly, thus safeguarding the integrity of the tax system and preventing tax avoidance.

Who needs to report under DAC6?

Under DAC6, intermediaries are generally required to report cross-border arrangements to the tax authorities, but taxpayers may also have reporting obligations in the absence of an intermediary or under specific circumstances.

What is included in the updated DAC6 guidance?

The guidance introduces details about the definition of what is included on cross border transactions and who are considered to be intermediaries. There is also new information about when the Cyprus Tax Department considers a transaction to be sufficiently finalised for reporting purposes.

The guidance also goes into detail about what due diligence intermediaries are required to carry out before reporting. The guidance emphasise that this should be determined objectively with reference to:

  1. Relevant facts and circumstances
  2. Available information
  3. Relevant expertise and understanding (given the type of service being provided)

The guidance further emphasises that the information being reported should be in the knowledge, possession or control of the reporting entity. There is no obligation to include in a DAC6 report information that an entity does not know, possess or control.

The new guidance also goes through each of the Hallmark categories, indicating which types of transactions would require reporting. 

What are the reporting deadlines in Cyprus?

Reports for the historic period between 25 June 2018 and 30 October 2021 must be submitted to the Cyprus Tax Department by 30 November 2021.

From 31 October 2021, the deadline for submission of reports relating to new matters, is within 30 days from a triggering event. 

How are reports submitted in Cyprus?

DAC6 reports in Cyprus are via XML upload through the ARIANDI Portal – the Cyprus Government’s Gateway Portal.

VinciWork’s DAC6 Solution

VinciWorks’ DAC6 Solution offers a tracking, auditing and reporting solution for all firms in Cyprus. Get in touch with us to see how Omnitrack can help ensure you are completing your reporting requirements.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.