One mandate turns a holding company into a reporting institution.

Most Cyprus holding companies are classified for Common Reporting Standard purposes once, by whoever opened the bank account, and then never again. The box ticked is usually one of the two non-financial ones on the bank's form, active or passive, and nobody revisits it. That is a mistake, because the thing that changes the answer is not the balance sheet. It is a clause in a portfolio management agreement.

Sign the wrong version of that clause and the company stops being a passive vehicle that a bank reports on. It becomes a reporting institution in its own right, with its own registration, its own obligation to identify and document, and its own annual return. Nothing about the company changes. Nothing about the assets changes. The classification changes, and everything else follows it.

The test is not the balance sheet

A company is treated as a financial institution, in the same category as a bank or a fund, when two things are true at the same time.

The first is that half or more of its income comes from holding financial assets rather than from trading, manufacturing or providing a service. Dividends, interest and gains on securities are exactly the income the rule looks for. A company that exists to hold a portfolio meets this without difficulty, and will usually have met it for years without anyone noticing.

The second is that the company is managed by somebody who is themselves a financial institution. This is where the question actually lives, because the first condition is satisfied by the entire population of holding companies and therefore tells you nothing about any particular one.

And the second condition has nothing to do with who does the administration, who signs the accounts, or who the company pays. It is about who is permitted to decide.

The test is not what the company owns. It is who is allowed to decide.

What managed by actually means

The Tax Department's guidance on automatic exchange is unusually direct here, and two statements in it do most of the work.

The first is that a company is not managed by a financial institution unless that institution holds discretionary authority over the company's assets, and that discretion over part of the portfolio is enough. There is no threshold. No proportion is small enough to be safely ignored.

The second is that where several people and entities are involved in running a company, it is sufficient that one of them is a financial institution. A single discretionary manager anywhere in the chain produces the result, and it makes no difference where that manager sits. The guidance works through an example in which the manager is in Germany rather than Cyprus, and the answer does not change.

The line that decides it

Discretionary is not the same as advisory, and that is the whole distinction. A bank that recommends and executes is not managing the company. A bank that decides is.

The guidance makes the point in the context of trusts and it reads across without difficulty: where the people responsible for the assets choose the investments themselves, the arrangement is not discretionary management, and that remains true even where they take advice from third parties and buy and sell through brokers.

The difference is not visible in how the relationship feels. Not in how often the client is consulted, not in how attentive the banker is, not in how the fees are described. It sits in the mandate, and the mandate is generally signed once and filed.

Ordinary corporate administration does not create the problem either. The guidance lists the services that do not, on their own, make a company managed by its provider: company secretarial work, registered office and registered agent services, preparation of financial statements, preparation of tax returns, bookkeeping, budgeting and cash flow forecasting, and the provision of nominee shareholders. Directors supplied by a service provider are treated the same way, on the reasoning that a director acts as the company rather than for it. The line being drawn throughout is between running the company and running the money.

Cyprus left no way out

Most countries implementing these rules built themselves some room. Cyprus did not, and that is the part which ought to change how the question is treated here.

The rules allow a country to designate its own categories of low risk institution that need not report. Cyprus designated none. Its guidance states that the only exempt categories available are the ones the international standard itself provides. There is no local door to walk through.

FATCA, the American regime, carries a concession built for precisely this population: small, well behaved passive vehicles that are caught only because a bank manages them, and for which full compliance is disproportionate. Cyprus does not extend that concession to the European regime. A family holding company relieved from the American rules can be fully caught by the European ones.

A country may also exclude low risk products from reporting altogether. Cyprus has excluded one, a dormant pre-existing account holding less than a thousand dollars. Three doors, all closed.

What it means to be caught

A company that is caught must register with the Tax Department through the Ariadni portal, be approved for the reporting service, run the full identification and documentation process on the people it deals with, file an annual return by the end of June following each reporting year, and keep the underlying records for at least five years.

But the accounts it reports are not its bank accounts, and this is the part worth being slow about. When a company is treated as a financial institution, the accounts it holds are the interests other people have in it. Its shares and its debt. Its reportable population is its own shareholders and its own lenders. A family holding company that crosses this line is required to identify, document and report the family.

Where it is least expected

There is a related trap in property structures. A building is not a financial asset, so a company that owns Cyprus real estate directly sits outside all of this, and the guidance confirms that this holds even where the property is professionally managed.

But a shareholding is a financial asset whatever sits underneath it. A company that owns the company that owns the building is holding financial assets, and what it earns from that holding is investment income of exactly the kind these rules are looking for. Add a second tier to a property structure and the question moves up a level with it. The property company is outside. The company above it may not be.

Our position

The Tax Department has been working through the population by category rather than auditing at random. In December 2024 it required every Cyprus resident trust to file a classification questionnaire whether or not it had anything to report, and signalled that it would look back as far as 2016. In July 2026 it wrote to administrative service providers about their own classification. Ordinary companies are the obvious remaining category.

Detection is becoming mechanical as well. From 2026 a reporting institution has to state, for every account, whether it holds a valid self-certification from the account holder, the capacity in which the account is held, and the role of each controlling person. A company that has told its bank it is passive, while that same bank runs a discretionary mandate over its portfolio, now generates a contradiction inside the bank's own filing.

Our position is that this is a structuring question and not a compliance question, and that it should be answered when the structure is designed rather than when a bank sends a form. The document that decides it is the investment management agreement. If you do not know whether yours confers discretion, that is the document to read first, and the balance sheet second.