He came to us the day after a seminar.
He had attended a public presentation on the EU Unshell Directive, the framework then being developed to identify and report EU entities whose income was predominantly passive — dividends, royalties, interest and similar — whose activities were cross-border in character, and whose management had been outsourced. Three conditions, met simultaneously, would trigger a reporting obligation requiring the entity to demonstrate minimum economic substance: real premises, active bank accounts, qualifying directors or personnel genuinely exercising their functions. Entities that could not demonstrate substance would lose access to treaty benefits, EU directives and, in some cases, their certificate of tax residence.
He recognised his own structures in the description. Not a vague resemblance. A precise one.
He did not wait to see what would happen. He called the following day, we reviewed his Cyprus arrangements in full, remediated the substance gaps across all entities, and restructured how new investments would be made going forward. What started as a regulatory concern became a permanent advisory relationship. He did not review his structures because something had gone wrong. He reviewed them because he understood, clearly and early, that the world his structures had been built for had changed.
The Unshell Directive has since been withdrawn. But if you think that means the problem went away with it, read on.
A directive withdrawn is not a risk removed
In June 2025, the EU Council formally dropped the Unshell Directive. For anyone maintaining Cyprus structures that would have been captured by its substance requirements, the news might have felt like a reprieve.
It is not. Here is what actually happened.
The directive was withdrawn because Member States concluded that its objectives could be achieved more efficiently through existing and forthcoming instruments — specifically through targeted amendments to the EU's mandatory disclosure regime, DAC6, and through the forthcoming Tax Omnibus package expected in the second quarter of 2026, which will address substance requirements across ATAD, the Parent-Subsidiary Directive, the Interest and Royalties Directive and the Merger Directive simultaneously.
The substance question the Unshell Directive was built around is not going away. It is being absorbed into a broader and more comprehensive framework.
The test that already exists
Management and control. It is the thread that runs through everything.
A company is tax resident where its effective management takes place, not where it is registered. For a Cyprus company whose directors are nominees — who sign what they are told, attend no board meetings, make no decisions and have no genuine involvement in the company's affairs — the question of where effective management takes place has a clear answer. And it is not Cyprus.
This matters because management and control is not one test with one consequence. It is the same test, applied simultaneously across four separate frameworks, each with its own set of consequences.
Tax residency. A Greek tax authority that concludes effective management is exercised in Greece, not Cyprus, can treat the company as Greek-resident. Some authorities go further: they treat the entity as a disregarded entity, to be looked through entirely. When that happens, the income of the Cyprus company does not arrive in Greece as a dividend. It arrives as if the corporate layer never existed.
The treaty. The Cyprus-Greece Double Tax Treaty requires effective management and control to be exercised in Cyprus for a company to be treated as a Cyprus resident entitled to its benefits. A nominee structure where no genuine management takes place in Cyprus cannot access the treaty. The benefits the arrangement was built around are unavailable for the precise reason the arrangement lacks what the treaty requires.
The CFC rules. Greece's CFC framework under Article 66 of Law 4172/2013 carries an EU exemption, but only for entities that carry on genuine economic activity supported by staff, equipment, assets and premises. A hollow structure loses the exemption. Undistributed income is attributed directly to the Greek beneficial owner and taxed in Greece, regardless of what the Cyprus structure looks like on paper.
The Parent-Subsidiary Directive. The directive's anti-abuse rule requires arrangements to be genuine, reflecting valid commercial reasons and economic reality. A Cyprus holding company with no staff, no decisions, no real function cannot rely on the directive's withholding tax exemption on dividends flowing up from a Greek operating company.
Four frameworks, four separate consequences, one failure point. A structure without genuine substance in Cyprus does not fail one of these tests. It fails all of them.
The number nobody talks about
When a structure is properly maintained, dividends distributed from a Cyprus company to a Greek individual shareholder are taxed in Greece at a flat rate of 5%, against which the Cyprus corporate tax already paid can be credited under the DTT. With a Cyprus corporate income tax rate of 15%, the arithmetic is manageable. Where the company has applied Cyprus's Notional Interest Deduction, the effective rate can be as low as 3% and the credit against the 5% Greek dividend tax leaves only a 2% residual liability in Greece.
When the Greek tax authority decides to disregard the Cyprus entity entirely, the arithmetic changes completely.
The income does not arrive as a dividend. It arrives as the underlying income of the activity the Cyprus company was purporting to conduct: business income, flowing directly to a Greek tax resident individual. That income is taxed at progressive Greek personal income tax rates. Under the official scale published by AADE under Law 4172/2013, income above €40,000 is taxed at 44%.
The Cyprus corporate tax already paid does not disappear. It was paid by a company that the Greek authority has decided does not exist for tax purposes. There is no mechanism to credit it against a personal income tax liability on recharacterised income. It sits there as a sunk cost, while the full income is taxed again in Greece at rates of up to 44%.
The structure was designed to reduce the tax burden. Maintained improperly, it can produce a tax burden higher than if it had never existed.
What is coming, and when
DAC6 has been in force since 25 June 2018. It was implemented in Greece through Law 4714/2020 and in Cyprus through Law 41(I)/2021. Intermediaries — lawyers, accountants, tax advisors, corporate service providers — who design, advise on or manage the implementation of a reportable cross-border arrangement must report to the relevant tax authority within 30 days of the triggering event.
The forthcoming DAC6 revision, expected in the second quarter of 2026, is anticipated to introduce an explicit substance hallmark that targets arrangements involving entities without adequate resources for their purported economic activity, regardless of beneficial ownership disclosure. When it comes into effect, intermediaries who advise on or maintain such arrangements will have a clear and unambiguous reporting obligation.
The Tax Omnibus package expected in the same quarter will address substance requirements across multiple directives simultaneously. The combined effect of these two instruments will be to make the substance question explicit across the entire framework. The structures that are not ready for this will not only face the tax consequences already described. They will be disclosed.
The call that comes first
In practice, the first institution to act on a shift in the regulatory framework is rarely the tax authority. It is the bank.
Banks maintain their own compliance obligations independently of the tax framework. When DAC6 requires intermediaries to disclose arrangements involving entities without adequate substance, banks will be asking the same questions through their own review processes — not as agents of the tax authority but as institutions with their own risk to manage. A bank that maintains accounts for an entity that is being flagged as a potentially non-compliant arrangement has an exposure it will act on.
A client who receives a DAC6-triggered enquiry and a bank compliance review in the same period is managing two separate processes at two separate speeds, with two separate sets of advisors, under conditions of time pressure that make everything harder and more expensive. The first call may not come from a tax inspector. It may come from the relationship manager.
A review is not an admission
Cross-border structuring through Cyprus is legal, legitimate and, when properly maintained, highly effective. None of what is described in this article changes that. What it describes is the gap between a structure designed in a particular regulatory environment and the environment that now exists.
A review in this context looks at management and control: where decisions are genuinely being made, who is making them, whether there is a documentary record that reflects reality. It looks at substance: whether the economic activity the structure purports to perform is actually being performed in Cyprus with adequate resources. It looks at the treaty position: whether the DTT benefits being relied upon are actually available given how the structure is maintained.
The client in the opening story did not review his structures because he was in trouble. He attended a seminar, heard a description of a problem, recognised his own situation in it, and called the following day. He acted before anything had gone wrong, before any authority had asked any questions, before any bank had raised any concerns.
That is what a review looks like when it is done at the right time. The right time is now.