Cyprus tax refunds: from 5 October, IBAN changes go through Tax For All only

From 5 October 2026, the Cyprus Tax Department will only accept requests to register or change the bank account (IBAN) used for its payments, such as refunds, through the Tax For All portal, logged in with CY Login. Requests sent any other way, including by email, will be rejected. The exception for entities without CY Login does not cover companies that simply have not obtained one yet.

What exactly changes on 5 October 2026?

On 22 September 2026 the Tax Department announced that, from 5 October 2026, requests to register or amend the IBAN held on a taxpayer’s record will be submitted exclusively through the Tax For All (TFA) taxpayer portal.

The request has three parts:

1. Log in to TFA with CY Login, the government’s single sign-on.
2. Complete Form T.D. 2008 electronically.
3. Upload an IBAN certificate issued by the bank.

The Tax Department has published a step-by-step guide to the process on its website, under its information material.

From 5 October, a request that is not submitted after logging in with CY Login will not be accepted. The announcement gives email as the example. It will be rejected.

Why does the IBAN on your tax record matter?

Because it is where the Tax Department sends money it owes you. The announcement speaks of the bank account used for payments from the Tax Department in general, not of one kind of refund.

For a business that is usually one of two things:

• Overpaid provisional tax. Where the two instalments exceed the final liability, the excess is refunded after the company tax return is assessed. See how Cyprus provisional tax works.
• Overpaid corporate income tax from an earlier year, once the assessment is final.

If you expect a VAT repayment, ask whoever files your VAT return whether it is paid to the same account. The announcement does not say either way.

Individuals are covered by the same rule. An employee whose personal return shows tax withheld above the final liability is owed a refund, and the account on record is where the Tax Department would pay it. See personal income tax in Cyprus 2026 for what changed this year.

A refund is only as quick as the payment details behind it. If the account on file is closed, belongs to the wrong person or was never registered, the refund cannot simply be paid into it.

What does the account have to be?

The Tax Department states that the IBAN declared must belong to the person entitled to the payment.

In practice that rules out a few habits that are common with small companies:

• a director’s personal account used for a company refund,
• the accountant’s or a group company’s account,
• a joint or family account for an individual’s refund where the taxpayer is not the holder.

The bank’s IBAN certificate is what shows the name on the account, which is why it has to be uploaded with the form.

Is there an exception if a company has no CY Login?

There is one, and it is narrower than it looks.

An entity for which obtaining CY Login is objectively impossible, because the entity cannot be identified through the system, may submit the request through TFA without logging in. It must attach the signed Form T.D. 2008-S and the bank’s IBAN certificate.

The announcement then closes the obvious gap: the exception does not apply to entities that simply have not yet obtained CY Login.

So “we never set it up” is not a route. A Cyprus company that has no CY Login today and needs to change its payment account after 5 October has to get its CY Login first.

How does a company get CY Login?

It is not something the accountant can switch on from a desk.

A company’s CY Login profile has to be verified in person, at a Citizen Service Centre or a Cyprus Post Citizen Centre (KEPO), by appointment, with the relevant corporate documents and a person authorised to act for the company. Appointments are booked through the government call centre.

This is not the first time the Tax Department has tied a process to the company’s own CY Login. Since 1 July 2026, companies (registration prefix HE), foreign companies (AE) and registered partnerships (S) can only register with the Tax Department through TFA using the entity’s CY Login. Companies that registered earlier may never have needed one. If you are setting up a company now, see company formation in Cyprus.

What should a business do before 5 October?

Five checks, in this order.

1. Find out whether the company has a verified CY Login. If it does not, book the verification appointment now. It is the only step with a waiting time you do not control.
2. Decide which account payments should go to. Confirm it is open and in the company’s own name. If it is not the account you gave the Tax Department in the past, it needs registering.
3. List any refund you expect in the next twelve months: provisional tax you may overpay after the December revision, earlier-year corporate tax, VAT repayments.
4. If you have changed bank, plan to register the new IBAN through TFA. Do not rely on an email to the Tax Department.
5. Ask your bank for an IBAN certificate in the company’s name, so it is ready when you submit Form T.D. 2008.

Our corporate tax and compliance team and our accounting and VAT team can help with the Tax For All side of this.

Is this part of a wider move to Tax For All?

Yes. VAT returns and monthly PAYE returns already run through TFA, tax registration of companies moved there on 1 July 2026, and now the account the Tax Department pays into follows.

The direction is consistent: the Tax Department is moving its dealings with taxpayers onto a verified digital identity. The practical consequence for businesses is that a company’s CY Login is no longer optional housekeeping. It is the key to its own tax record.

The short version

From 5 October 2026 the bank account the Cyprus Tax Department pays into can only be registered or changed through Tax For All, logged in with CY Login, using Form T.D. 2008 and a bank IBAN certificate. Email requests will be rejected. The account must be in the taxpayer’s own name. A company that has not set up CY Login cannot use the exception, so if yours has not, start there.