There is a version of this story that ends badly.
A Greek tax resident — compliant, organised, nothing to hide — receives a notification through myAADE. The tax authorities have selected a number of high-value real estate transactions in specific areas of Greece for audit. Hers is one of them.
The letter is procedural. It requests documentation supporting the transaction. It also lists, with precision, the bank accounts she holds in Cyprus and Switzerland. It requests bank statements for the year under investigation. Every incoming amount of significance — every dividend received, every loan repayment, every capital movement — requires documentary substantiation.
She is not being accused of anything. She simply fell into the sample.
What follows is months of reconstructing a financial history. Documents no longer available. Decisions made years earlier with no paper trail. Transfers that made perfect sense at the time and are almost impossible to explain now. The entire exercise costs significant time, legal fees and stress. For a client who did nothing wrong.
This is CRS in practice. Not as a compliance concept. As an operational reality.
The case closed satisfactorily. But one detail is worth noting: the audit never went as far as examining substance, management and control of the Cyprus structure. There was not much to show. But there was not much being looked for either. That is no longer the environment we are in.
What changed, and when
CRS — the OECD Common Reporting Standard — has been exchanging financial account information between Cyprus and Greece since 2017. AADE now holds multiple years of structured data on accounts held by Greek tax residents in Cyprus: balances, income credited, transactions. This data is integrated with Greece's domestic digital tax infrastructure, and AADE has launched systematic cross-checks on deposits and transfers to and from abroad, processing data from foreign payment institutions to identify movements that cannot be reconciled with declared income.
The infrastructure for large-scale, data-driven cross-border audit is not being built. It has been built.
The Cyprus structures set up for Greek clients in the years before all of this existed were designed for a different environment. Nominee directors. No board minutes. No management trail. Ownership structured for opacity rather than substance. At the time, this was common practice across the market. Many advisors continue to maintain these structures today without material change.
The problem is not that these structures were set up. The problem is that the regulatory environment surrounding them has been transformed. Most of them have not been.
What the structure is now tested against
The test begins with a simple question: where is the company actually managed?
Under both Greek domestic law and the OECD Model Convention, a company is tax resident where its effective management takes place, not where it is registered. If decisions are made in Athens, if the director is a nominee who signs what they are told, if there are no board meetings and no strategic decisions documented in Cyprus, the company may not be a Cyprus tax resident for Greek purposes at all. The structure exists on paper. The substance does not.
But tax residency is only the first consequence. Even where a company is accepted as Cyprus-resident, the analysis does not stop there. It moves immediately to the CFC question.
Greece's CFC rules under Article 66 of Law 4172/2013, as amended by Law 4607/2019, apply where three conditions are met simultaneously: the Greek shareholder controls more than 50% of the entity; the entity pays an effective tax rate below 11% (being 50% of Greece's 22% corporate rate); and more than 30% of the entity's income is passive, covering interest, royalties, financial asset income, or income from intra-group transactions that add no real economic value. If any one of the three conditions is not met, the rules do not apply.
Cyprus is EU-resident, so there is an exemption from the CFC rules — but it is not automatic. It applies only where the entity carries on genuine economic activity supported by staff, equipment, assets and premises. A nominee structure with no real operations loses the exemption entirely. And here is the point that most advisors miss: even where some substance exists, the CFC test is not about Cyprus's headline tax rate. It is about the effective rate actually paid.
Cyprus's corporate tax rate is 15% from 2026, nominally above the 11% threshold. Many advisors stop the analysis there. They should not. Cyprus retains its Notional Interest Deduction, which allows a deduction of up to 80% of taxable income on new equity introduced into the company. Applied to a well-capitalised structure, this brings the effective rate to 3% — well below the CFC threshold. A company paying 3% effective tax satisfies the low-taxation condition and, where the other two conditions are also met, the undistributed income is attributed directly to the Greek beneficial owner and taxed in Greece.
The test is not the rate on the tin. It is the rate in the return.
Then the dividend. Where CFC rules do not apply, or have been correctly managed, dividends from a Cyprus company to a Greek individual are taxed at 5% in Greece. Against this, the Cyprus corporate tax already paid can be credited under Article 21(2) of the Cyprus-Greece Double Tax Treaty. At 15% effective rate, the credit extinguishes the Greek liability entirely. At 3% effective rate, the credit leaves a 2% residual. Either way, the mechanism reduces the burden materially. But it is consistently misapplied: the argument that the corporate tax is the company's obligation and the dividend tax is the individual's, and that the two cannot be netted, is a misreading of a treaty that has been in force since 1968.
What this means for advisors
If you advise Greek clients who hold Cyprus structures, or refer such clients to Cyprus-based practitioners, the relevant question is not whether the structure was properly set up. It is whether it has been maintained in a way that would withstand the scrutiny now being applied systematically.
Nominee arrangements with no substance. No documented management decisions. Effective tax rates that breach the CFC threshold without a corresponding analysis having been performed. DTT credits unclaimed or incorrectly refused. These are not theoretical risks. They are live exposures in client files that are being serviced today.
The clients who will face the most difficult conversations are not those who set out to do anything improper. They are the ones who trusted that what was arranged for them remained appropriate. In many cases, and through no fault of their own, it no longer does.