Accounting for an IT company in Cyprus: IP Box accounting, payroll, and reporting

Accounting for an IT company in Cyprus requires particular attention to three areas: accounting for development costs, payroll calculation, and compliance with corporate and tax reporting obligations. For companies creating software or other qualifying intellectual property assets, the IP Box regime can play an important role.

However, the IP Box is not applied automatically. A company must confirm its rights to the intellectual property, document its development costs, and correctly calculate the share of qualifying profit. Errors in R&D accounting or payroll can reduce the tax benefit and trigger additional questions from the tax authorities.

What the IP Box regime is in Cyprus

The IP Box is a special tax regime for profit derived from the use of certain intellectual property assets. From 2026, the standard corporate income tax rate in Cyprus is 15%. Under the IP Box, 80% of qualifying profit is deducted from the taxable base, so the effective rate on fully qualifying profit can be around 3%.

This rate does not apply to the company's entire profit — only to the portion of income that:

relates to a qualifying intellectual property asset;
has been calculated in line with the nexus rules;
is supported by documentation;
meets the requirements of the tax legislation.

Which assets can qualify

For IT companies, the most common example of a qualifying asset is software that meets the requirements of the IP Box regime. Patents and certain other results of intellectual activity may also qualify if they meet the established criteria.

The following are generally not treated as qualifying assets:

trademarks;
brands;
domain names;
marketing-related designations;
other assets whose value derives mainly from product promotion.

Simply having code, or registering rights to software, does not in itself guarantee the benefit. The company must be able to confirm who developed the asset, who owns the rights, what costs were incurred, and what income relates to that asset.

Who can apply the IP Box

The regime may be applied by a Cyprus company that holds a qualifying IP asset and carries out relevant activity in developing, enhancing or exploiting it.

The following circumstances matter:

the company must hold legal rights to the IP;
R&D activity and costs must be documented;
income and expenses must be linked to a specific asset;
it must be determined which work was performed by the company itself, by independent contractors, or by related parties;
the calculation must comply with the modified nexus approach.

Having a registered company in Cyprus is not sufficient on its own. It is also important to demonstrate genuine activity, employee functions, decision-making, risk management, and the economic connection between the company and the IP being created.

How the nexus fraction is calculated

The size of the benefit depends on the nexus fraction — a ratio showing what share of the profit from a specific IP asset relates to qualifying development expenditure.

In simplified form:

Nexus fraction = (QE + uplift) / OE

where:

QE — qualifying R&D expenditure;
OE — overall expenditure on developing the relevant IP asset;
uplift — the permitted increase in qualifying expenditure, within the limits set by the rules of the regime.

Qualifying profit is calculated using the nexus fraction and the income attributable to the specific IP asset:

Qualifying profit = Profit from IP × Nexus fraction

80% of the resulting amount is then deducted from the taxable base.

Which costs are usually treated as QE

Qualifying expenditure may include:

salaries of employees engaged in qualifying R&D activity;
costs of materials and tools used in development;
testing and technical research costs;
R&D performed by the company itself;
services of independent contractors engaged for development work;
other costs directly connected with creating or enhancing the IP.

A developer's salary is not necessarily included in QE in full. If an employee works on several projects at once, only part of their cost may qualify. This requires time records, timesheets, project reports and a justified allocation of time.

Which costs can reduce the nexus fraction

The ratio can be adversely affected by:

costs of acquiring already-created IP;
R&D outsourced to related companies;
payments to group companies for development work;
costs that cannot be linked to a specific IP asset;
unsupported or incorrectly classified expenses.

Outsourcing development to a related company does not necessarily exclude the IP Box entirely, but such costs may not count as qualifying and can reduce the share of profit to which the benefit applies.

How to account for development costs

To apply the IP Box, it is advisable to maintain analytical records not only at company level, but for each significant IP asset or project.

In practice, this means:

setting up separate analytical codes for projects and IP assets;
allocating developers' salaries across projects;
keeping timesheets with descriptions of the tasks performed;
accounting separately for services of independent and related contractors;
retaining contracts, acceptance certificates, invoices and technical specifications;
recording development stages and deliverables;
confirming the transfer of rights to the software created;
separating IP income from income for other services;
documenting the method used to allocate shared costs.

If a company develops several products, combining all development costs into one general account can make the nexus calculation difficult. The more precisely project accounting is organised, the easier it is to substantiate qualifying profit.

Developer salaries and mandatory contributions

Payroll in Cyprus covers salary calculation, withholding of PAYE and employee contributions, accrual of employer contributions, and submission of the relevant reporting.

Main contributions in 2026

For employees, these include in particular:

Social Insurance — 8.8% employer and 8.8% employee;
GESY — 2.9% employer and 2.65% employee;
Redundancy Fund — employer contribution;
Human Resource Development Fund — employer contribution;
Social Cohesion Fund — employer contribution.

For Social Insurance, the maximum insurable income in 2026 is EUR 5,742 per month, or EUR 68,904 per year. GESY has its own separate maximum base, so it cannot automatically be equated with the Social Insurance cap.

The total cost of an employee to the employer is higher than their gross salary, since the company additionally funds mandatory contributions and, in some cases, a holiday fund.

PAYE

Income tax on salaries is withheld by the employer under the applicable progressive scale. The specific amount of PAYE depends on annual income, the employee's tax status, applicable reliefs and the thresholds in force for the relevant tax year.

Payroll therefore requires regular checks on:

tax thresholds;
income tax rates;
maximum bases for contributions;
changes to GESY rules;
payroll form requirements;
deadlines for remitting withholdings and contributions.

Employee documentation

An IT company should put in place:

registration of the company as an employer;
registration of employees with the social insurance system;
employment contracts;
payslips;
PAYE documentation;
proof of payment of contributions;
timesheets and allocation of time across R&D projects;
documents transferring rights to development results.

For IP Box purposes, it is particularly important that an employee's job duties confirm their involvement specifically in developing, enhancing or testing the qualifying IP.

Reporting obligations of an IT company

Obligations depend on the company's structure, turnover, headcount, client types and the nature of its operations.

Monthly and recurring tasks

A company will typically need to:

calculate salaries;
withhold PAYE;
accrue Social Insurance and GESY;
remit employer and employee contributions;
submit the required payroll reports;
maintain accounting records;
process source documents;
monitor settlements with contractors;
check VAT obligations;
track transactions with group companies.

VAT

VAT on IT services depends on several factors:

whether the client is a business or a private individual;
whether the client is in Cyprus, another EU country, or outside the EU;
whether the company provides development, technical support, SaaS, licensing or electronic services;
where the place of supply is deemed to be;
whether the reverse charge applies;
whether the transaction must be reported in VIES.

A single rule cannot be applied automatically to all IT services. Contracts and invoices must accurately describe the nature of the transaction, the client's status and the VAT treatment applied.

If a company is VAT-registered, it submits VAT returns at the prescribed intervals. Certain cross-border transactions may also require VIES reporting.

Annual reporting

The main annual tasks may include:

preparation of financial statements;
a statutory audit or review, where the relevant regime applies;
submission of the corporate income tax return;
calculation of the final corporate income tax;
calculation of provisional tax;
preparation of annual payroll reporting;
filing of the Annual Return HE32;
payment of the annual levy;
updating company and beneficial ownership information, where required.

Deadlines depend on the tax year, the financial year-end date and the company's specific status. They should be checked annually against the current calendar published by the Cyprus registries and tax authorities.

Audit and financial statements

A Cyprus company is required to maintain accounting records and prepare financial statements in accordance with applicable requirements. Many companies need a statutory audit, although certain small companies may benefit from exemptions or the option of a review engagement if the established criteria are met.

Even where a full audit is not required, a company may still need to:

prepare financial statements;
substantiate transactions with group companies;
collect IP documentation;
support R&D expenditure;
prepare data for the tax return;
ensure consistency between accounting and tax records.

For an IT company using the IP Box, the audit and tax computation are best planned in advance. Reviewing documents after the year-end often means that some costs can no longer be reliably attributed to a specific asset.

Common mistakes made by IT companies

The most frequent problems are:

treating the IP Box as an automatic benefit;
recording all development costs in a single general account;
not allocating developers' salaries across projects;
having no timesheets;
failing to formalise the transfer of rights to the software;
incorrectly including costs paid to related companies in QE;
not separating IP income from consulting or technical service income;
not checking the status and jurisdiction of contractors;
missing PAYE, Social Insurance and GESY deadlines;
automatically applying the Social Insurance cap rules to GESY;
determining VAT incorrectly on cross-border IT services;
preparing the Annual Return and financial statements at the last minute;
maintaining substance only formally;
claiming the IP Box in marketing or contractual documents without a prior tax analysis.

In-house accountant or outsourcing

The choice depends not only on headcount, but on the complexity of the structure.

When outsourcing works

Outsourcing can be convenient if:

the company has up to a few dozen employees;
there are international clients or group companies;
payroll and regular reporting are required;
the IP Box is used;
VAT and VIES need to be managed;
access to auditors and tax advisers is needed;
the company does not want to build a full finance department.

When an in-house specialist is needed

An in-house finance specialist may be justified if:

there is a high volume of daily transactions;
there are many projects and divisions;
real-time management accounting is required;
there are several legal entities;
financial processes require constant internal control.

In practice, a hybrid model is often used: an internal finance manager handles budgets, payments and management information, while an external provider handles bookkeeping, payroll, tax reporting and liaison with auditors.

Checklist for an IT company

Before applying the IP Box, a company should:

identify which assets may qualify;
confirm rights to software and other IP assets;
set up accounting by individual project and asset;
introduce timesheets for developers;
separate QE and OE;
account separately for costs paid to related and independent companies;
document R&D activity;
register as an employer;
calculate PAYE, Social Insurance and GESY correctly;
monitor the caps and rates for the current year;
check VAT and VIES for each category of service;
prepare financial statements in good time;
determine whether an audit or a review is required;
track TD4, HE32, VAT and payroll reporting deadlines;
update the tax and corporate calendar every year.

How GarnetWise can help

GarnetWise handles accounting, payroll and ongoing reporting for companies in Cyprus, including IT companies with foreign founders and distributed teams. This covers income and expense accounting, salary and mandatory contribution calculations, VAT, preparation of financial and tax reporting, and liaison with auditors and tax authorities in English, Russian and Greek.

The company was founded by Gulnara Konstantinou — a member of ACCA and ICPAC with over 17 years in accounting, audit and taxation, including work with leading audit firms in Cyprus and roles as Chief Accountant and CFO.

If you need accounting and payroll for a Cyprus IT company, get in touch with GarnetWise to discuss your structure, headcount, types of IT services and reporting requirements.