DAC7 in Cyprus: Digital Platform Reporting Rules for Operators

Most generic explainers restate the directive and leave you no wiser about the one question that matters: does my platform actually have to register in Cyprus, and by when? This guide answers that directly, maps each exclusion to a worked example, gives the exact Cyprus law and portal steps, and flags where a lawyer must confirm your penalty exposure.

What is DAC7 and why does it matter for Cyprus platforms?

DAC7 is the seventh amendment to the EU's Directive on Administrative Cooperation, formally Council Directive (EU) 2021/514, which amended Directive 2011/16/EU. It brings the digital and gig economy inside the automatic exchange of information (AEOI) that already covers bank accounts and cross-border rulings. In short, it makes marketplaces report what their sellers earn so that tax authorities across the EU can match declared income against platform data.

The EU aim: visibility over the digital and gig economy

For years, tax authorities struggled to see income earned through apps and websites: a host letting a flat on a booking site, a freelancer selling services, a trader shifting goods through an online marketplace. DAC7 closes that gap. From 1 January 2023 the rules applied across the EU, with the first exchange of information required by 31 January 2024. The logic is simple: if a platform already knows what a seller was paid, the tax authority should know too.

How DAC7 fits alongside DAC6 and DAC8

DAC7 is one strand in a growing family of reporting regimes, and confusing them is a common mistake. DAC6 targets intermediaries who must disclose certain reportable cross-border tax arrangements. DAC7 targets digital platform operators reporting seller income. DAC8 extends automatic exchange to crypto-asset service providers under the OECD's CARF framework. They share the same DAC lineage but impose separate obligations on different actors. If you run a marketplace and a crypto service, you may fall under more than one. See our guides to DAC6 reporting of cross-border arrangements and DAC8 and crypto-asset reporting in Cyprus for the neighbouring regimes.

How did Cyprus transpose DAC7 into national law?

Cyprus brought DAC7 into national law through the Administrative Cooperation in the Field of Taxation (Amending) Law of 2023, N.105(I)/2023, gazetted on 3 November 2023. That law implements Council Directive (EU) 2021/514, which itself amends the parent Directive 2011/16/EU. The Cyprus Tax Department administers it.

Law 105(I)/2023 and Directive 2011/16/EU as amended by 2021/514

The Cyprus statute reproduces the directive's architecture: the definitions of Reporting Platform Operator, Reportable Seller and Excluded Seller, the four relevant activities, the due diligence procedures, and the reporting and exchange mechanics. Because it is a faithful transposition, the OECD Model Reporting Rules for Digital Platform Operators are a useful interpretive backdrop, but the operative text for a Cyprus platform is the Cyprus law itself.

When the rules started applying

The reporting obligation applies from the 2023 calendar year onwards. That means the first reporting period covered 2023, with the first report due in early 2024, and each subsequent calendar year generating its own report the following January. For the 2025 reporting period, the report is due by 31 January 2026. Operators should always confirm the live cycle with the Tax Department rather than assume a fixed date, because extensions have been granted.

Who is a Reporting Platform Operator under DAC7?

You are a Reporting Platform Operator if you operate a platform (software, a website or an app that connects sellers with users) that facilitates a relevant activity, and you have an EU nexus. In Cyprus, that nexus exists where the operator is tax resident here, is incorporated here, has its place of management here, or maintains a permanent establishment here.

The connection tests: tax residence, incorporation, management or permanent establishment

Any one of these four connecting factors is enough. A company incorporated in Cyprus that runs a marketplace is caught even if managed from abroad. Equally, a foreign company managed from Cyprus, or one operating through a Cyprus permanent establishment, can be caught. Because the tests are alternatives rather than cumulative, many operators are surprised to find themselves in scope. This is where the beneficial ownership picture matters too, so review the Cyprus UBO register and beneficial ownership compliance alongside your DAC7 assessment.

When a non-EU platform must still register in Cyprus

A platform with no EU nexus is not off the hook. If it facilitates a relevant activity by an EU-resident seller, or the rental of immovable property located in the EU, it must register in a single EU Member State of its choice, and that Member State can be Cyprus. The only relief is where the operator's home jurisdiction has a qualifying exchange agreement that transmits equivalent information to the EU. If no such agreement applies, a non-EU platform choosing Cyprus registers and reports here just like a resident operator.

Which activities are reportable (the four relevant activities)?

DAC7 covers exactly four relevant activities carried out for consideration. If your platform facilitates any of them, it is in scope; if it facilitates none, it is not a reporting platform for DAC7 purposes.

• Rental of immovable property, including residential and commercial property and parking spaces.
• Provision of personal services, meaning work on a time or task basis performed at the user's request.
• Sale of goods.
• Rental of any mode of transport.

Rental of immovable property

This is the activity that catches short-term rental marketplaces. A platform that lets Cyprus hosts advertise and rent out apartments, villas, commercial units or parking is facilitating a relevant activity, and the host's rental income becomes reportable. Hosts should make sure the figures they declare align with what the platform reports; our guide to how rental income is taxed in Cyprus and the practical short-term rental rules for Cyprus hosts set out the underlying tax position.

Personal services, sale of goods and transport rental

The other three activities capture the gig and marketplace economy: freelancing and task platforms (personal services), online marketplaces (sale of goods), and vehicle, boat or equipment rental marketplaces (transport rental). A goods marketplace should read this alongside the VAT OSS scheme for cross-border B2C sales, because DAC7 income reporting and VAT registration are separate obligations that often arise together.

Who counts as a Reportable Seller, and who is excluded?

A Reportable Seller is any seller (an individual or entity) registered on the platform, resident in an EU Member State or renting out EU immovable property, who performs a relevant activity, unless they fall within a defined exclusion. The exclusions are precise, and applying them correctly is where the real compliance work sits.

Government and publicly traded entities

These are excluded because their income is already visible through other channels. A listed company or a state body does not need platform-level reporting to be transparent to the tax authority.

Large property operators (over 2,000 rentals)

A property operator with more than 2,000 relevant rental activities for a single listed property in the reporting period is excluded. The rationale is that such an operator is effectively a hotel-scale business, already on the tax authority's radar, and the platform need not report it. Note the threshold is per listed property, not per operator overall.

Casual goods sellers (under 30 sales and EUR 2,000)

A goods seller is excluded where the platform facilitated fewer than 30 sales for that seller and the total consideration did not exceed EUR 2,000 during the period. Both limbs must be satisfied. Cross either threshold (a 30th sale, or a euro over EUR 2,000) and the seller becomes reportable for the whole year. This exclusion applies only to the sale of goods; there is no equivalent de minimis for rentals, services or transport.

Which platform operators are excluded from DAC7?

Not every business that looks like an intermediary is a Reporting Platform Operator. DAC7 carves out operators whose function does not amount to facilitating a relevant activity for a known consideration.

Payment processors, listing-only and ad-only platforms

Three functions typically fall outside the definition of a platform for DAC7. First, businesses whose sole activity is processing payments in relation to a relevant activity (payment processors) are not reporting platforms on that basis alone. Second, platforms that only list or advertise a relevant activity, without any onward step toward a transaction, are excluded. Third, platforms that merely redirect or transfer users to another platform are excluded. The dividing line is whether you facilitate the transaction and see the consideration, or simply advertise or process a payment. Because these carve-outs are worded narrowly, confirm your exact classification against Law 105(I)/2023 before concluding you are out of scope.

Operators with no reportable sellers

A platform can also qualify as an Excluded Platform Operator where, by the nature of its business model, it never has Reportable Sellers, for example because all its sellers fall within an excluded category. Such an operator can be relieved of the reporting obligation, but it must be able to demonstrate the position to the Tax Department, so the analysis should be documented rather than assumed.

What information must a platform collect and report?

A reporting platform must collect and report a defined dataset for each Reportable Seller. The data splits into seller identification, financial and consideration figures broken down by quarter, and additional details for property rentals.

Seller identification data (TIN, VAT, address)

For each seller the platform reports the name, primary address, Tax Identification Number (TIN) and the jurisdiction that issued it, the VAT number where available, and the date of birth for individuals or the business registration number for entities. Getting the TIN right is central, because the whole regime works by matching platform data to a taxpayer record.

Financial and consideration data per quarter

The platform reports, for each quarter of the reporting period, the total consideration paid or credited to the seller, the number of relevant activities the consideration relates to, the financial account identifier used for payment, and any fees, commissions or taxes the platform withheld or charged. Quarterly granularity lets tax authorities test the figures against periodic filings.

Extra data for immovable property

Where the relevant activity is the rental of immovable property, the platform reports additional information for each listed property: the address, the land registry number or its equivalent where available, and the number of days the property was rented during the period, together with the type of listing. This is what lets an authority reconcile a host's declared rental income against actual occupancy.

What due diligence must platforms perform, and by when?

DAC7 does not let platforms report whatever data happens to be on file. Operators must run due diligence to collect the required seller information and satisfy themselves it is reliable, completing that exercise by 31 December of the reporting period.

Verifying seller data and reasonableness checks

The platform must gather the identification data above and then apply reasonableness checks, using the records available to it (including from other AEOI or AML processes) to confirm the information is plausible and consistent. Where a seller fails to provide required data after two reminders, the platform must, following a defined waiting period, either close the seller's account or withhold payment until the information is supplied. Due diligence is therefore not a one-off form but an enforceable process with consequences for the seller.

The 31 December due diligence cut-off

Due diligence on sellers must be completed by 31 December of the reporting period, ahead of the January reporting deadline. For sellers already on the platform, operators may rely on due diligence completed in earlier periods within the limits the law allows, but new sellers must be diligenced within the period they join.

When are DAC7 reports due in Cyprus?

Reports are due by 31 January of the year following the reporting period, and the reporting period is the calendar year. So the 2025 period is reported by 31 January 2026, the 2026 period by 31 January 2027, and so on. Diarise this alongside your other filings using the 2026 Cyprus company compliance calendar.

The 31 January annual deadline

The 31 January date is the fixed statutory deadline, running in parallel with the EU-wide requirement that the first exchange occur by 31 January 2024. A submission made after the deadline is treated as overdue and may attract administrative penalties under N.105(I)/2023.

Reporting periods and historic extensions

Cyprus has shown willingness to extend the deadline in practice. For the first reporting year (the 2023 period), the Cyprus Tax Department pushed the deadline from 31 January 2024 to 16 February 2024. That was a one-off concession for the inaugural cycle, not a standing rule, so operators should never plan around an extension. Always confirm the current cycle's deadline with the Tax Department.

How do you register and file with the Cyprus Tax Department?

Registration and filing run through the Government Gateway Portal (CY Login). A Reporting Platform Operator first completes Platform Operator Registration, then submits its annual data as XML files in the OECD standard schema.

1. Confirm your status, that you are a Reporting Platform Operator with a Cyprus nexus, or a non-EU operator choosing Cyprus as your single Member State of registration.
2. Register through the Government Gateway Portal (CY Login) by completing Platform Operator Registration with the Cyprus Tax Department. If you are already registered in another EU Member State, you notify rather than double-register.
3. Run due diligence on all sellers and assemble the reportable dataset, closing off by 31 December.
4. Prepare the report as an XML file in the OECD standard schema and submit it through the portal by 31 January.
5. Retain your records and reasonableness-check evidence in case the Tax Department queries the filing.

Government Gateway Portal and Platform Operator Registration

The Tax Department publishes a DAC7 Registration and Data Submission User Guide setting out the portal steps. Registration is the gateway: without it you cannot submit, and an operator that should have registered but did not is exposed on both counts.

XML submission in the OECD schema

Data must be submitted in the OECD standard XML schema, not a free-form spreadsheet. Platforms with significant seller volumes usually automate schema generation from their internal systems. Budget time to validate the XML against the schema before the deadline, because rejected files that are corrected after 31 January count as late.

What are the penalties for DAC7 non-compliance?

Administrative penalties apply under Law 105(I)/2023 for failing to register, for late, incomplete or missing reporting, and for due diligence failures. The escalation mechanism and, ultimately, revocation of registration are set out in the law, but the precise euro figures should be confirmed for your situation rather than assumed from secondary summaries.

Administrative penalties under Law 105(I)/2023

The Administrative Cooperation in the Field of Taxation (Amending) Law of 2023, N.105(I)/2023, provides for administrative penalties across the range of breaches. Published secondary sources do not consistently state the exact amounts, so the specific figure applicable to a late or missing report should be verified against the law text or the relevant Tax Department decree with a Cyprus adviser before you rely on it.

Two reminders and revocation of registration

Beyond monetary penalties, the directive-based enforcement mechanism bites hardest here: where non-compliance continues after two reminders from the Member State of registration, the platform operator's DAC7 registration is permanently revoked. For a marketplace that depends on lawful EU operation, losing its registration is a materially more serious outcome than a fixed fine.

Consequences for sellers who withhold information

Sellers are not passive. A seller who ignores requests for required data faces account closure or the withholding of payments by the platform after the reminder process. That gives platforms a practical lever, but it also means sellers should respond promptly to a platform's DAC7 requests rather than treat them as optional.

DAC7 compliance checklist for Cyprus platform operators

Use this as a first-pass self-assessment, then take advice on the grey areas.

• Do you operate a platform that facilitates one of the four relevant activities for consideration? If not, DAC7 does not apply.
• Do you have a Cyprus or wider EU nexus (tax residence, incorporation, management or permanent establishment), or do you facilitate EU sellers or EU property as a non-EU operator? If yes, you likely must register somewhere.
• Have you identified your Reportable Sellers and correctly applied the exclusions (government, listed, large rental operators, casual goods sellers under 30 sales and EUR 2,000)?
• Have you confirmed you are not an Excluded Platform Operator (payment-only, listing-only, ad-only, or no reportable sellers)?
• Are you collecting the full dataset (identification, quarterly consideration, and property details where relevant)?
• Have you completed due diligence and reasonableness checks by 31 December?
• Are you registered through the Government Gateway Portal and ready to submit XML in the OECD schema by 31 January?
• Have you confirmed the current cycle's deadline and your penalty exposure with a Cyprus adviser?

How Philippou Law Firm can help

DAC7 rewards operators who get the classification right early and punishes those who guess. At Philippou Law Firm we assess whether your platform is a Reporting Platform Operator with a Cyprus nexus, apply the seller and operator exclusions to your actual business model, and confirm your registration, due diligence and reporting obligations under Law 105(I)/2023. We also verify the live deadline and your specific penalty exposure, coordinate the Government Gateway registration and XML submission, and align your DAC7 position with your wider VAT, corporate and beneficial ownership compliance. If you run a marketplace, a booking site or a gig-economy platform touching Cyprus or the EU, contact us for a scoped DAC7 review before the next reporting cycle.