The 3% Corporation Tax (used to be 2.5%), the Cyprus IP Box

The Cyprus IP Box Tax Regime is one of the most tax advantageous schemes that exist in the world offered to Cyprus Technology companies which create their own intellectual property patterns as it allows for an effective corporation tax for this companies at 3% (instead of 15%). Coupled with 0% dividend tax the IP Box Tax Regime ensures a total tax dominance in the tech space giving a total tax of 3% (corporate and dividend tax) to tech companies.

Companies can relocate to Cyprus of create Cyprus subsidiaries or branches which will create their own intellectual property products such websites, mobile applications, games, plug ins and any innovative software ideas that can be used by a 3rd party.

 

Cyprus Tax Incentives for Technology Companies

Cyprus companies which create their own intellectual property are entitled to a 3% corporation tax of all IP income. This tax treatment is provided by the Cyprus Income Tax Office in writing to the applicant following the successful application.

The IP Box tax incentive conditions are as follows:

 

Conditions for obtaining the Cyprus IP Box Tax Status:

  • Applicant must be a Cyprus Company or a Cyprus branch
  • Applicant must create something innovative that falls under the definition of an intellectual property
  • The IP should be used by 3rd parties and not related parties
  • The creation of the IP must occur using the applicants own resources or by outsourcing work to 3rd parties (non-related parties are excluded)
  • The applicant must use a regulated audit & assurance firm like CYAUSE Audit Services, explain in detail its operations and get the acceptance of the IP Box tax status in writing by the Cyprus Income Tax office.

 

Examples of Eligibility

Example 1

A Cyprus entity will create a software which can be used by users to protect their website from viruses and hacks. This entity will use its own resources to create it and hire independent 3rd parties for the development.

Is this scenario eligible for the Cyprus IP Box: Yes.

  • Applicant is a Cyprus Company
  • Applicant will create the software via the Cyprus entity and with its own and 3rd party resources.
  • The intellectual property (the “IP”) is something unique which will be used by various independent users.

Conclusion: All revenue stream from this Cyprus entity will be taxed at an effective tax rate of 3%.

Example 2

A Cyprus entity belonging to a group will create a software which can be used within the group entities to protect their websites from viruses and hacks. This Cyprus entity will use its own resources to create it and hire independent 3rd parties for the development.

Is this scenario eligible for the Cyprus IP Box: No.

Even though the intellectual property (the “IP”) is something unique it will not be used by various independent users but within the group and as such the application will be rejected.

Conclusion: All revenue stream from this Cyprus entity will be taxed at a the normal corporation tax rate of 15%.

Example 3

A Cyprus entity will create a software which can be used by users to protect their website from viruses and hacks. This entity will use its own resources to create it and hire independent 3rd parties for the development.

The Company revenue streams are indenting to be from the licensing of the usage of the software and subsequent advisory services to these users which are corporates (upselling, cross-selling etc).

Is this scenario eligible for the Cyprus IP Box: Yes.

  • Applicant is a Cyprus Company
  • Applicant will create the software via the Cyprus entity and with its own and 3rd party resources.
  • The intellectual property (the “IP”) is something unique which will be used by various independent users.
  • Revenue streams come directly from the usage of the software and from the advisory services.

Conclusion: Revenue stream from licensing of the software will be taxed at an effective tax rate of 3% whereas the revenue forms the consulting activities will be taxed at the normal corporate tax rate of 15%.

 

Read related articles on the Non Domiciled Tax Status

 

Additional Benefits for Cyprus Companies (technology companies included)

Cyprus IP box together the non-domicile tax regime which can be extended for up to 27 years makes Technology companies established in Cyprus the most tax efficient European Structures in the world with a total tax of 3%; a 3% corporation Tax + 0% dividend tax which applies to Cyprus Tax Residents and non-domiciled shareholders as well as to overseas shareholders.

Cyprus Crypto Tax - FAQs

 

 

 

 

Auditing Crypto-Assets under International Standards on Auditing (ISA)

How Independent Auditors Obtain Audit Evidence in Blockchain and Digital Asset Businesses

The emergence of blockchain technology and digital assets has transformed the way businesses create, transfer and safeguard value. Crypto-assets, distributed ledger technology and decentralised transaction processing present auditors with new challenges that require both technical expertise and a thorough understanding of International Standards on Auditing (ISA).

Although blockchain technology is innovative, the objective of a statutory audit remains unchanged. The auditor's responsibility is to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error, and to express an independent opinion on those financial statements.

Auditing a blockchain business therefore requires the application of established auditing principles to a technology-driven environment, supported by an understanding of digital assets, wallet infrastructure, custody models and blockchain transaction flows.

The Objective of a Statutory Audit

A statutory audit is conducted in accordance with International Standards on Auditing, which require auditors to:

  • identify and assess risks of material misstatement;

  • understand the entity and its internal control environment;

  • obtain sufficient appropriate audit evidence;

  • evaluate accounting estimates and judgements;

  • assess the appropriateness of accounting policies;

  • conclude whether the financial statements have been prepared in accordance with the applicable financial reporting framework; and

  • issue an independent auditor's report.

These objectives apply equally to blockchain businesses and traditional organisations. What differs is the nature of the audit evidence and the specific risks that must be addressed.

Understanding the Business and Its Technology

Audit planning begins with developing a detailed understanding of the client's business model.

For a Crypto-Asset Service Provider (CASP) or blockchain business, this typically includes understanding:

  • the services offered;

  • the types of crypto-assets handled;

  • blockchain networks utilised;

  • custody arrangements;

  • wallet infrastructure;

  • revenue streams;

  • technology architecture;

  • outsourced service providers;

  • governance framework; and

  • regulatory environment.

This understanding enables the auditor to identify areas where material misstatements are more likely to arise.

Risk Assessment in Blockchain Audits

Every audit is risk-based.

Blockchain businesses often involve risks that differ from those encountered in conventional industries.

Examples include:

  • unauthorised wallet access;

  • loss of private keys;

  • inaccurate recording of blockchain transactions;

  • complex digital asset valuations;

  • reliance on third-party custodians;

  • smart contract vulnerabilities;

  • rapidly changing technology;

  • cybersecurity incidents;

  • fraud involving digital assets; and

  • evolving regulatory requirements.

The auditor assesses these risks before determining the nature, timing and extent of audit procedures.

Obtaining Audit Evidence for Crypto-Assets

One of the most significant aspects of a blockchain audit is obtaining sufficient and appropriate audit evidence relating to crypto-assets.

Unlike physical assets or traditional bank balances, crypto-assets exist on distributed ledger networks and may be controlled through private cryptographic keys.

Audit procedures are designed to obtain evidence regarding:

  • existence;

  • ownership and control;

  • rights and obligations;

  • completeness;

  • valuation;

  • presentation; and

  • disclosure.

The precise procedures depend on the entity's business model, the custody arrangements in place and the assessed audit risks.

Verifying Ownership and Control

Establishing that the entity controls the crypto-assets recognised in its financial statements is a key audit objective.

Depending on the circumstances, auditors may evaluate:

  • wallet ownership records;

  • custody agreements;

  • internal authorisation procedures;

  • governance over private keys;

  • documentation supporting wallet creation;

  • evidence relating to multi-signature arrangements; and

  • confirmations obtained from independent custodians where appropriate.

Ownership cannot be established solely by observing blockchain balances. Auditors must also consider whether the entity has the legal rights and practical ability to control the assets.

Reviewing Blockchain Transactions

Public blockchain networks provide transparent records of transactions.

These records may assist auditors in tracing transactions between wallets, confirming transaction dates and understanding transaction histories.

However, blockchain data alone is rarely sufficient.

Auditors also examine:

  • accounting records;

  • contracts;

  • invoices;

  • exchange reports;

  • reconciliation schedules;

  • supporting management documentation; and

  • explanations for unusual or significant transactions.

Combining blockchain information with conventional audit evidence enables the auditor to reach appropriate conclusions.

Evaluating Digital Asset Valuation

Valuing crypto-assets can be challenging because market prices may fluctuate significantly over short periods.

Auditors evaluate whether management's valuation methodology is appropriate and consistently applied.

Considerations may include:

  • the accounting framework adopted;

  • availability of observable market data;

  • principal markets;

  • pricing sources;

  • valuation techniques;

  • impairment assessments, where applicable; and

  • disclosures relating to estimation uncertainty.

Material valuation judgements frequently receive particular audit attention.

Internal Controls and Technology

Strong internal controls remain fundamental to reliable financial reporting.

Auditors assess controls relevant to the preparation of the financial statements, which may include controls over:

  • wallet administration;

  • transaction approvals;

  • reconciliation processes;

  • user access;

  • segregation of duties;

  • information security;

  • system changes;

  • backup procedures;

  • outsourced technology providers; and

  • incident management.

Where controls operate effectively, they may influence the nature and extent of substantive audit testing.

Fraud Considerations

International Standards on Auditing require auditors to consider the risk of fraud in every audit.

Within blockchain businesses, fraud risks may include:

  • misappropriation of digital assets;

  • fictitious transactions;

  • unauthorised transfers;

  • management override of controls;

  • related-party transactions;

  • manipulation of valuations; and

  • concealment of liabilities.

Auditors maintain professional scepticism throughout the engagement and design procedures responsive to assessed fraud risks.

The Importance of Documentation

Audit conclusions must be supported by appropriate documentation.

Management should therefore retain comprehensive records including:

  • wallet inventories;

  • blockchain transaction references;

  • custody documentation;

  • reconciliation schedules;

  • accounting policies;

  • contracts;

  • board approvals;

  • valuation support; and

  • evidence supporting significant judgements.

Good documentation not only facilitates the audit but also strengthens financial reporting and corporate governance.

Specialist Knowledge Matters

Blockchain technology continues to evolve rapidly.

Auditors working with digital asset businesses benefit from understanding:

  • blockchain architecture;

  • wallet technologies;

  • consensus mechanisms;

  • custody models;

  • digital asset accounting;

  • information technology controls;

  • cybersecurity risks;

  • financial reporting requirements; and

  • the regulatory environment applicable to crypto businesses.

Combining technical audit expertise with an understanding of blockchain enables auditors to focus on the risks that matter most while delivering an efficient and high-quality statutory audit.

Frequently Asked Questions

Can blockchain itself replace a statutory audit?

No. Blockchain technology provides transparent transaction records, but a statutory audit involves evaluating the financial statements as a whole, including internal controls, accounting policies, estimates, disclosures and governance. A blockchain ledger is only one source of audit evidence.

Is viewing a wallet balance enough to verify ownership?

Not necessarily. Auditors must obtain sufficient appropriate evidence regarding the entity's rights and control over the crypto-assets, not merely confirm that a wallet contains a particular balance.

How do auditors assess digital asset valuations?

Auditors evaluate whether management has applied an appropriate valuation methodology consistent with the applicable accounting framework and whether sufficient supporting evidence exists for the recorded values.

Why are technology controls important?

Weak IT controls can increase the risk of unauthorised transactions, inaccurate financial reporting and loss of digital assets. Auditors therefore assess those controls that are relevant to the audit.

Do blockchain businesses require specialist auditors?

While statutory audits are conducted in accordance with the same International Standards on Auditing across all industries, experience in blockchain technology, digital assets and crypto-asset business models enables auditors to understand sector-specific risks more effectively.

Independent Audit Services for Blockchain Businesses

Digital asset businesses require auditors who combine rigorous application of International Standards on Auditing with an appreciation of the technology, governance and operational risks that characterise the blockchain ecosystem.

Our firm provides statutory audit services to Cyprus Crypto-Asset Service Providers (CASPs) and other blockchain businesses, delivering independent assurance supported by expertise in financial reporting, blockchain technology and digital asset operations. We work closely with management and those charged with governance to deliver audits that are efficient, risk-focused and aligned with professional standards.