A New Era

For decades, the Republic of Cyprus has served as a primary gateway for international capital into the European Union, defined by a liberal investment climate and a largely “auto-approval” posture. This era ended on April 2.

This is not merely a procedural update; it is a fundamental recalibration of the Cypriot investment landscape. By establishing the Ministry of Finance as the central Screening Authority, Cyprus is transitioning to a “managed-risk” environment where economic growth must be balanced against the imperatives of national security and public order. For third-country investors, the critical question has shifted: it is no longer enough to satisfy the commercial terms of a deal, you must now satisfy the security mandate of the state.

What this means in practice for foreign investors is that their next transaction needs proper guidance, preparation and level of legal diligence to match this level of sovereign scrutiny.

Cyprus has formally joined the European Union’s foreign direct investment (FDI) screening map. On 14 November 2025, the Establishment of a Framework for the Screening of Foreign Direct Investments Law of 2025 (Law 194(1)/2025) was published in the Official Gazette, and it entered into force on 2 April 2026.

The new legislation introduces, for the first time, a domestic mechanism to vet inbound investments from outside the EU, the EEA and Switzerland where they may affect national security or public order. It implements Regulation (EU) 2019/452 and aligns the jurisdiction with the EU’s cooperation mechanism.

For investors, the practical consequence is straightforward: certain transactions can no longer be completed unless and until the Ministry of Finance has issued a written approval. The framework is sectoral and proportionate, but it adds a new gating step to a category of deals that previously moved through Cyprus largely without state-level investment scrutiny.

Who falls under the scope

A foreign investor is defined as a natural person who is not a national of an EU/EEA Member State or of Switzerland, or an undertaking constituted under the laws of any country outside that perimeter (a “third country”).

Mandatory notification arises only where three cumulative conditions are met:

• Qualifying holding: the investment results in the acquisition, directly or indirectly, of at least 25% of the share capital or voting rights of the Cypriot target, or of a corresponding ability to exercise decisive influence over its activities;
• Value: the investment, viewed individually or in aggregate with other transactions between the same parties within a 12-month window from the date of planned completion, equals or exceeds €2.000.000; and
• Strategic importance: the target is an “undertaking of strategic importance”, meaning one engaged in the particularly sensitive sectors listed in the Annex to the Law.

In addition, two threshold crossings trigger notification irrespective of value: where a qualifying holding moves from below <25% to ≤25% or more, or from below <50% to ≤50% or more.

The Law also by design reaches foreign-controlled Cypriot or EU/EEA/Swiss entities, namely, entities in which a foreign investor holds at least 25% of capital or voting rights, is the ultimate beneficial owner, or otherwise exercises control, when such an entity itself invests in a Cypriot undertaking of strategic importance.

Indirect changes of control are equally within scope: a transfer effected through an intermediate holding company, fund or trust may bring a Cypriot target within the regime where the ultimate ownership or decisive influence shifts to a foreign investor. The competent authority assesses substance over form.

A transaction may also fall within the scope of the Law where ownership or control over an undertaking of strategic importance is transferred from one foreign investor to another, provided that the relevant statutory conditions are met.

What counts as “strategic importance”

The Annex to the Law sets out the characteristics of a target that determine strategic importance, namely whether a proposed foreign direct investment is likely to affect the security or public order in the Republic of Cyprus. They mirror, and to some extent supplement, Article 4 of Regulation (EU) 2019/452. The principal categories are listed in Part A of the Annex and include:

• Critical infrastructure (physical or virtual), including energy, transport, water, health, education, tourism, communications, media, data processing or storage, aerospace, defence, electoral and financial infrastructure (including systemically important credit institutions), together with sensitive facilities and land or real estate essential to such infrastructure;
• Critical technologies and dual-use items, notably artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defence, energy storage, quantum and nuclear technologies, nanotechnologies and biotechnologies;
• Critical inputs, including energy, raw materials and food security;
• Sensitive information, including personal data, where the investment may affect access to or control over it; and
• Media freedom and pluralism.

Whether a particular business falls within these categories is, the Ministry of Finance has emphasised in its 2 April 2026 Guidance, a fact-specific assessment based on the activities the target actually carries out in Cyprus, not the sector label of the wider group or the structure of the deal. Where doubts exist, applicants are encouraged to notify and act proactively.

Procedural overview

The Ministry of Finance is the competent authority. It is advised by a seven-member Advisory Committee chaired by the Permanent Secretary of the Ministry, with representatives of the Ministries of Defence, Energy/Commerce/Industry, Foreign Affairs, Interior, Justice, and Transport.

Notifications are submitted exclusively in English through the e-services portal at gov.cy, free of charge, using the official Notification Form together with any supporting documents. The application may be filed either by the foreign investor or by an authorised representative. The foreign investor remains responsible for the accuracy and completeness of the information provided, even where the application is submitted through a representative.

As a rule, one notification per foreign direct investment is required. A single notification may cover multiple undertakings or investors where the investment is coordinated, specifically where one investor acquires multiple undertakings as part of a single transaction, or where multiple investors share the same UBO or belong to the same group. Conversely, separate notifications are required where investors are unrelated, lack a common UBO or controlling link, acquire participations independently, or where the transaction’s elements are not sufficiently connected. The determining factor is the structure and substance of the transaction, and parties are expected to coordinate to ensure the notification accurately reflects the investment in its entirety.

The application has three components:

1. the completion of certain online fields containing summary information;
2. the upload of the duly completed Notification Form; and
3. the upload of the supporting documentation.

Mandatory uploads include an organisational chart showing the target’s ownership structure prior to the investment and two further charts showing the foreign investor’s ownership structure pre- and post-investment; the post-investment chart must depict the target as part of the investor’s ownership structure together with the percentage of shares or voting rights acquired, and each chart must identify every legal entity and natural person in the ownership chain, their respective ownership percentages and the ultimate controlling entity or ultimate beneficial owner.

Optional documents may be uploaded to assist the Authority in the assessment of the application including but not limited to the investment agreement, letter of intent, or other transaction document; market studies or business plans and competitor information, including estimated market shares in Cyprus.

Screening Process and Timelines

After receipt of a fully completed application, the competent authority has 20 working days to decide whether the investment will undergo formal screening. The substantive information required for the screening assessment is set out in Article 4 of the Law and includes:

• the details of the parties to the transaction;
• the ownership structure of the foreign investor and of the undertaking of strategic importance, including the ultimate investor or beneficial owner and the participation in the capital;
• the approximate value of the investment;
• the products, services and business operations of both parties;
• the nature of the economic activities carried out in the Republic of Cyprus;
• the funding of the investment and its source;
• the planned date of completion;
• the State(s) under whose laws the parties are incorporated, registered or otherwise established;
• the countries in which the parties conduct business;
• the annual turnover and total number of employees of each party;
• whether sanctions or restrictive economic measures under the United Nations or European Union frameworks have been imposed on the parties or on persons connected with the third-country undertaking that is a party to the transaction;
• whether the person has been convicted, or whether any criminal case is pending, in the Republic or abroad for an offence carrying a term of imprisonment of three years or more;
• any information or documents contained in forms issued by the European Commission or other competent Union bodies for the better implementation of Regulation (EU) 2019/452; and
• any further information the competent authority considers necessary.

The Ministry of Finance may, at any stage, request additional or clarifying information from the investor and may seek confirmation of the notified information from any third person, including the target undertaking.

Where the competent authority considers that the investment will not undergo screening, it informs the foreign investor accordingly within 5 working days from the day of its decision. If screening is triggered, a final decision must follow within a further 65 working days.

The timeframes may be paused at any point in the process, including during the initial assessment and screening phase, if the competent authority requests additional data, information, explanations, or clarifications. The clock resumes only once the requested information has been provided. Total elapsed time may therefore extend to approximately 85 working days, plus suspension periods.

Where the application proceeds to screening, the Ministry of Finance assesses on a case-by-case basis whether the investment is likely to affect the security or public order of the Republic of Cyprus by reference to the indicative factors set out in the Annex to the Law. Part A of the Annex, referenced earlier in this guide, lists factors relating to the target and its activities.

Part B of the Annex sets out investor-related and contextual factors, namely:

• (a) whether the foreign investor is directly or indirectly controlled by the government of a third country, including state bodies or armed forces, through ownership structure or significant funding;
• (b) whether the investor has already been involved in activities affecting security or public order in an EU Member State;
• (c) whether there is a serious risk that the investor engages in illegal or criminal activities;
• (d) any comments from other Member States and any opinion of the European Commission referred to in Article 6(9) of Regulation (EU) 2019/452;
• (e) the extent to which the investment affects or is likely to affect security or public order in a Member State other than Cyprus, or in the Union as a whole; and
• (f) whether the investment may affect projects or programmes of Union interest as defined in the Annex to Regulation (EU) 2019/452.

These criteria are indicative rather than exhaustive; the substantive assessment is conducted in consultation with the seven-member Advisory Committee and may also draw on the input of the line ministry within whose competence the investment principally falls.

On the basis of that assessment the Ministry of Finance issues a reasoned final decision. The investment may be approved unconditionally; approved subject to specific terms and conditions notified to the investor; or prohibited, terminated or reversed where it is considered to affect the security or public order of the Republic, or where the investor fails to comply with the conditions imposed. Approval is effective only upon written confirmation by the Ministry; silence does not amount to approval.

The Law defines “completion of the investment” as the point in time at which the last condition precedent in relation to an investment decision of the parties to a foreign investment transaction is fulfilled. Crucially, the investment may not be completed before written approval is issued, and contracts requiring approval are deemed by Article 8 of the Law to be subject to that approval as a condition precedent.

Until the investor complies with any conditions imposed, neither the investor nor persons acting in concert with it may exercise any rights derived from the investment in the undertaking of strategic importance, including voting, management or control rights.

Decisions taken by the Ministry of Finance under the Law are administrative acts subject to recourse before the Administrative Court of the Republic of Cyprus under Article 146 of the Constitution.

The Cypriot procedure also feeds into the EU cooperation mechanism. The European Commission and other Member States may submit comments or issue opinions, but they cannot communicate directly with the investor or impose a particular decision. Final decision-making power rests with the Republic of Cyprus.

Confidentiality and Personal Data

Information obtained through the screening process is treated as confidential and is used solely for the purposes for which it was requested. Investors may designate documents, statements and other material containing trade secrets or confidential information as such, with reasons, and must supply a non-confidential version for disclosure; failing such designation, the Ministry may treat the materials as non-confidential.

The Ministry, the Advisory Committee and any person acting on their behalf are bound by an obligation of secrecy, and any classified information exchanged with the European Commission or other Member States may not be downgraded or declassified without the prior written consent of its originator.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679, Regulation (EU) 2018/1725 and the national data-protection legislation, and only to the extent necessary for screening and for the cooperation mechanism under Regulation (EU) 2019/452.

Exceptions & Edge Cases

Several categories are excluded outright or at the margins of the regime:

• Greenfield investments: the establishment of a new undertaking in Cyprus falls outside the scope of the Law, in contrast to a number of other Member States that have extended screening to such projects;
• Pure portfolio investments that do not confer effective participation in management or control are generally not FDIs, although the assessment turns on substance rather than label;
• Intra-group restructurings where ultimate control does not change are not subject to mandatory notification;
• Receivership, examinership and liquidation do not, in themselves, trigger notification, but transactions executed in that context may, where they confer a qualifying holding or control on a foreign investor;
• Ships under construction or being sold are exempt except for Floating Storage and Regasification Units (FSRUs), which remain in scope; and
• Retroactivity: the Law applies to FDIs planned or completed after 2 April 2026. This means that even where a foreign direct investment was agreed or planned prior to 2 April 2026 but remains uncompleted, it may still be subject to the notification obligation, as long as the conditions prescribed by the Law are satisfied.
• Joint ventures are assessed by substance. The mere formation of a new vehicle does not, by itself, attract notification; but where a foreign investor obtains, through the joint venture, a qualifying holding or decisive influence over an existing Cypriot undertaking of strategic importance, the obligation can arise even via veto rights, governance arrangements or shareholder agreements.

Practical implications

The timing of the deal

A predictable 20- plus 65-working-day window, together with potential information requests and the EU cooperation cycle, can add three or more months to the closing of an in-scope transaction. Signing-to-closing planning, signing protections and break-fee arrangements should reflect that reality, and conditions precedent should expressly mirror the Law.

Documentation readiness

The Notification Form is detailed and aligned with the Commission’s Article 6 template. Investors and targets should expect to produce complete pre- and post-investment ownership charts to ultimate beneficial owner level, financial information, specific business activities classification, funding source, sanctions exposure and information about EU-funded projects of Union interest. These materials should be assembled in parallel with legal due diligence, not after signing.

Foreign-controlled Cyprus vehicles

The capture of Cypriot, EU/EEA or Swiss entities that are foreign-controlled means that fund structures and holding companies are not insulated from the regime when they themselves invest in Cypriot strategic sectors. Sponsors should map control chains carefully.

Greenfield carve-out and precautionary notification

Cyprus has deliberately left greenfield projects outside the mandatory regime, preserving its attractiveness for new establishment but producing a sharp asymmetry between acquisition and new build. However, the EU’s forthcoming reform of Regulation 2019/452 may revisit that line. Where scope is uncertain, the Guidance explicitly encourages a precautionary notification, and the five-year ex officio window for unnotified mandatory deals makes that conservative proactive course often the rational one.

Enforcement & Sanctions

The Law gives the competent authority a robust enforcement toolkit. Administrative fines may be imposed of €5.000 to €50.000 for failure to notify, up to €100.000 for the supply of false or misleading information, up to €50.000 for failure to provide required information, and up to €100.000 (plus daily fines of up to €8.000) for non-compliance with measures imposed by the authority.

Sanctions are in addition to, and not in lieu of, any prohibition, termination or reversal of the investment, and during any prohibition the foreign investor (and persons acting in concert) cannot exercise voting, management or control rights in the target.

The competent authority may also screen an investment ex officio, that is, without prior notification. Where an investment did not require notification, that power may be exercised within 15 months of completion; where it required notification but was not notified, the window extends to 5 years.

Where the Ministry ascertains a breach or an impending breach of the Law, it may also apply to the Court for prohibitory or mandatory orders, including interim orders, requiring the immediate cessation (and non-repetition) of the breach, the taking of corrective measures within a specified deadline, or any other act or measure that may be necessary or reasonable in the circumstances of the case.

Case Study Xella Magyarország (C-106/22)

Xella Magyarország is the CJEU’s first substantive ruling on EU FDI screening. It matters for two reasons: it drew a sharp limit on the scope of the FDI Screening Regulation (EU) 2019/452 by excluding indirect investments, and it set a high bar for Member States seeking to block intra-EU acquisitions. The gap it exposed has since driven the most significant overhaul of EU FDI rules since the 2019 Regulation was adopted.

Facts of the Case

In 2021, Hungary’s Minister for Innovation and Technology blocked the acquisition of a Hungarian quarry (sand, gravel, clay) by Xella Magyarország Kft., also a Hungarian company, on two grounds:

• Security of supply: indirect third-country ownership (Xella’s chain ran through German and Luxembourg entities to a Bermudan holding company, ultimately owned by an Irish national) threatened Hungary’s supply of construction aggregates.
• Anti-speculation: preventing speculative third-country investment in a strategic asset.

Xella had already contracted to purchase ~90% of the target’s output before the acquisition. It challenged the block; the Budapest High Court referred questions to the CJEU.

AG Capeta’s Approach: Opinion of 30 March 2023

AG Capeta took a broad, purposive approach. Her key conclusions:

• The Regulation covers any investment by which a third-country investor gains control over an EU company, including indirect acquisitions via EU subsidiaries. This falls within Art. 207 TFEU (Common Commercial Policy), an area of EU exclusive competence, and the Regulation delegates screening powers back to Member States.
• Blocking decisions require a “genuine and sufficiently serious threat to a fundamental interest of society” and must be proportionate. Security of supply could in principle qualify, but she referred the proportionality question to the national court.

The Court’s Approach: Judgment of 13 July 2023

The CJEU departed from the AG on scope, adopting a strict textual reading:

• The Regulation applies only to direct investments by non-EU legal entities. Intra-EU acquisitions fall entirely outside it, even where the acquirer is ultimately third-country owned.
• The block was instead assessed under Art. 49 TFEU (freedom of establishment). Hungary failed the justification test: the materials had very low market value, and since Xella already purchased ~90% of output, the control sought to be prevented already existed. The block violated Art. 49 TFEU.

Subsequent Reforms: Closing the ‘Xella Problem’

The ruling created a loophole: indirect investments routed through EU subsidiaries escaped the Regulation’s cooperation mechanism entirely. The legislative response:

• 24 Jan 2024: Commission proposed a comprehensive revision of the 2019 Regulation.
• 10 Jun 2025: European Parliament adopted its position.
• 11 Dec 2025: Provisional political agreement between Parliament, Council and Commission.

The new Regulation closes the gap by extending scope to intra-EU investments by subsidiaries controlled, directly or indirectly, by a non-EU investor, the AG’s purposive approach adopted at legislative level. It also makes screening mandatory for all 27 Member States and sets a minimum sectoral scope. The Xella justification threshold is preserved and reinforced. Formal adoption is expected in H1 2026; full effect 2027-2028.

Commentary

Law 194(1)/2025 aligns Cyprus with a maturing EU framework while leaving meaningful policy choices intact, most notably the exclusion of greenfield investments and the focused, threshold-based design of mandatory notification. For most cross-border deals into Cyprus, the regime will not bite.

While many European FDI regimes focus strictly on defence and energy, Cyprus has designated Tourism and Education as sectors of “Strategic Importance” in its legislative Annex. This reflects a sophisticated understanding of the Cypriot economic reality, where these sectors are not just commercial activities but critical components of national stability.

For transactions touching the Annex sectors and crossing the value or ownership thresholds, it should now be treated as a standard regulatory clearance, alongside merger control and any sector-specific approvals.