Cyprus Moves Bank Account Changes for Tax Refunds to the Tax for All (TFA) Portal From 5 October 2026

Cyprus moves bank account changes tax procedures firmly online from 5 October 2026, when the Cyprus Tax Department begins requiring every IBAN registration or change request for tax refunds and other departmental payments to pass through the Tax For All (TFA) portal using CY Login authentication. This is a narrow but operationally significant procedural shift: email requests and unauthenticated submissions will no longer be accepted. The change affects companies, trusts, fiduciary service providers, trustees, individuals awaiting VAT or other refunds, and the advisers who act for them. Anyone expecting a refund payment into a new or corrected bank account needs to understand how to comply before submitting a request.

This guide sets out what changed, who is affected, the steps to follow, the documentary requirements, timing considerations and how Cyprus compares with other EU tax administrations.

What changed on 5 October 2026

As Cyprus moves bank account changes tax requests onto a single digital channel, the headline is simple: the Tax Department will process IBAN registration and amendment requests submitted through the Tax For All portal after authenticating the user through CY Login. The previous practice of emailing the Tax Department or sending unauthenticated paper or electronic instructions is being retired.

Core requirement, Tax For All plus CY Login

The core rule is that any request to add or change the IBAN used by the Tax Department to make payments should be lodged inside the Tax For All portal while logged in with CY Login. This means the person submitting the request has already been identified and authenticated through the government’s electronic identity system. Requests sent by email, or submitted without first logging in through CY Login, will generally be rejected. There is no parallel email route intended to remain open for ordinary taxpayers.

Narrow exception for entities that cannot obtain CY Login

The Tax Department has recognised that a small category of entities cannot be identified within the system and therefore cannot obtain CY Login credentials. For those cases, a narrow exception route is expected to exist so that the IBAN change can still be submitted without CY Login authentication. It is important to read the scope of this exception precisely. It is designed for entities that are objectively unable to register for CY Login, not as a general fallback for eligible taxpayers who have simply not yet registered. If an entity is capable of obtaining CY Login and is required to use the portal, the exception will not apply, and the request must be made through TFA in the normal way.

Taxpayers and advisers should not assume the exception covers them; where there is doubt, the correct starting point is to attempt CY Login registration and only rely on the exception where registration is genuinely not available. This distinction is a common source of confusion as Cyprus moves bank account changes tax processes to a verified, identity-led model.

Who is affected, a practical list

The requirement reaches a broad range of taxpayers and their representatives. Because the Tax Department pays refunds and other amounts directly to a registered IBAN, everyone who might receive such a payment has an interest in ensuring their bank details are current and correctly registered through the portal.

Companies and corporate taxpayers

Companies registered with the Tax Department that expect refunds, whether of corporate income tax, VAT or other overpaid amounts, must ensure the IBAN on file is accurate and registered through TFA. Where a company has changed its banking arrangements, closed an account, or set up a new treasury account, the change must now be submitted inside the portal under CY Login. Corporate taxpayers should confirm who within the organisation holds CY Login access with authority to act for the company before a refund is due.

Trusts, fiduciary service providers and trustees

Trusts, fiduciary service providers and trustees frequently manage payments on behalf of underlying structures and beneficiaries. For these parties the identity-led model requires particular care: the person logging in through CY Login must have the authority to submit an IBAN change for the relevant entity, and the IBAN must belong to the party entitled to receive the payment. Fiduciaries administering multiple entities should map, well ahead of any expected refund, which entities they can act for through the portal and what documentary authority they hold.

Individuals expecting refunds

Individuals awaiting VAT refunds or other repayments are equally caught. If your bank account has changed, you must register the new IBAN through TFA using your own CY Login before the Tax Department can pay the refund to it.

How Cyprus moves bank account changes tax requests through Tax For All, step-by-step

The practical process is straightforward once CY Login access is in place. The following sequence sets out the steps most taxpayers and advisers will follow when they submit an IBAN change through the Tax For All portal.

Confirming CY Login access

Before you attempt an IBAN change, confirm that you, or the person who will submit on behalf of an entity, have a valid CY Login account and the appropriate authorisation to act for the relevant taxpayer. CY Login is the Republic of Cyprus’s electronic identity and authentication system, and it is the gateway to the Tax For All portal. If you do not yet have CY Login credentials, register for them early: registration can take time to complete, and leaving it until a refund is imminent risks delay. If you are acting for a company, trust or other entity, check that your access permits you to submit filings and account changes for that specific taxpayer rather than only for yourself.

Where access is missing or does not extend to the entity concerned, resolve this before proceeding.

Completing the online request and uploading the IBAN certificate

Log in to Tax For All through CY Login and navigate to the section for registering or amending bank details. Enter the IBAN carefully, checking each character, since a transposed digit can lead to rejection or misdirected payment. The portal will require supporting documentary proof in the form of a bank-issued IBAN certificate. The certificate should show the IBAN and the name of the account holder, and the account should belong to the person or entity entitled to receive the payment, the Tax Department will generally not register an account held in an unrelated name. Upload the certificate in the format the portal accepts, giving the file a clear, descriptive name so that the submission is easy to track.

A recommended naming convention is to combine the taxpayer’s name or registration reference with the words “IBAN certificate” and the date, for example CompanyName-IBAN-certificate-2026-10. pdf. Review all entries, confirm the submission, and retain confirmation that the request was lodged.

Special submission route for non-identifiable entities

Where an entity genuinely cannot be identified in the system and cannot obtain CY Login, the narrow exception route may apply. In these limited cases the IBAN change may be submitted without CY Login authentication, following the specific route the Tax Department provides. Expect this path to be the exception rather than the norm; it is reserved for entities that cannot register, and it does not remove the documentary requirement to prove that the IBAN belongs to the entitled payee. If you believe you fall within this exception, confirm the position with the Tax Department before relying on it.

The following condensed checklist captures the operational essentials for a routine submission:

• Confirm valid CY Login access, extended to the relevant taxpayer where acting for an entity.
• Obtain a current, bank-issued IBAN certificate showing the IBAN and the named account holder.
• Verify the account holder name matches the entity entitled to the payment.
• Log in to Tax For All through CY Login and open the bank details section.
• Enter the IBAN carefully and double-check every character.
• Upload the certificate with a clear filename (taxpayer reference + “IBAN certificate” + date).
• Review, submit and save confirmation of the lodged request.
• If the entity cannot obtain CY Login, confirm eligibility for the narrow exception before using it.

Acting for clients, advisers and representation

Advisers and consultants who submit IBAN changes on behalf of clients need to be clear about authority and recordkeeping. Because the process is identity-led, the question of who logs in and on whose behalf matters more than it did under the old email practice.

When an adviser can use their own CY Login versus the client’s CY Login

An adviser may submit an IBAN change using their own CY Login where they hold a valid registration permitting them to act for that client within the system. In other situations the change may need to be submitted using the client’s own CY Login, for example where the adviser’s access does not extend to the entity concerned, or where the client prefers to lodge the request directly. The practical test is whether the adviser’s CY Login authorisation covers the specific taxpayer. Advisers should map their client portfolios against their portal access well in advance, rather than discovering a gap when a refund is pending. Good recordkeeping of which account was used and on whose authority protects both adviser and client.

Practical evidence advisers should retain

Advisers should retain clear documentary evidence of their authority to act before submitting on a client’s behalf. In practice this includes:

• A written mandate, engagement letter or power of attorney authorising the adviser to deal with the Tax Department on the client’s behalf.
• A specific, dated client instruction authorising the particular IBAN change, ideally identifying the new account.
• A copy of the IBAN certificate submitted, together with the portal confirmation of lodgement.

Keeping these records is consistent with the general professional-conduct and recordkeeping expectations that apply to advisers acting for clients, and it allows a clear audit trail if a submission is later queried.

What to do if you previously submitted by email

If you or your client previously sent an IBAN change by email, be aware that email submissions are expected to be rejected after 5 October 2026. Re-submit the request through Tax For All with CY Login, or use the narrow exception route if the entity genuinely cannot obtain CY Login. Keep proof of the original submission and any correspondence in case the history is relevant.

Documentary requirements and tips for the IBAN bank certificate

The documentary side of the process is where many rejections originate. As Cyprus moves bank account changes tax verification to an upload-and-match model, the IBAN certificate is the central document, and getting it right first time saves considerable delay.

Correct payee name and entity matching

The most important principle is that the IBAN must belong to the person or entity entitled to receive the payment, and the name on the bank certificate should match the taxpayer on the Tax Department’s records. A company refund should be paid to an account in the company’s name; an individual’s refund to an account in that individual’s name. Problems commonly arise where the account is held by a related entity, a group treasury company, a director personally, or a former trading name. If the names do not match, expect the request to be rejected.

Where there is a legitimate reason the account is held in a different name, which should be approached cautiously, confirm the Tax Department’s position before submitting, rather than assuming the mismatch will be accepted.

Acceptable formats and bank-issued confirmation

The certificate should be issued by the bank and clearly show both the IBAN and the named account holder. A document generated and confirmed by the bank carries more weight than an informal screenshot, so request a formal IBAN certificate or bank confirmation letter rather than relying on an unauthenticated printout. Upload it in a legible format that the portal accepts, and ensure the whole document is captured, not a cropped section.

Avoiding common rejection reasons

Most rejections stem from a handful of avoidable errors: a name mismatch between the account and the taxpayer, an IBAN typed incorrectly, an illegible or partial upload, or a document that is not a genuine bank-issued confirmation. Checking each of these before submission dramatically reduces the risk of having to start again.

Timing, when will refunds be affected?

Where the Tax Department has not fixed a precise processing time for IBAN change requests, the sensible approach is to build in a buffer. If a refund is expected, submit the IBAN change well in advance rather than waiting until the payment is imminent. An incorrect or unregistered account can hold up a refund that would otherwise be ready, and a rejected submission will need to be corrected and re-lodged, consuming further time. Advisers managing multiple clients should treat the start of the new refund cycle as a prompt to review every client’s registered IBAN and update any that have changed.

After submitting, monitor the status of the request through the Tax For All portal and keep the confirmation of lodgement. Where a refund is time-sensitive, for example a VAT repayment central to cash flow, the lead-time matters most, and early action is the best protection against delay. The transition period around 5 October 2026, as Cyprus moves bank account changes tax requests to the portal, is a particularly good moment to confirm details are correct.

How this change fits Cyprus’s move to digital tax administration

The shift to a verified, portal-based process is part of a wider modernisation of tax administration in Cyprus and across the EU. Routing IBAN changes through CY Login means that every request is tied to an authenticated identity, which strengthens security and reduces the risk of fraudulent diversion of refunds, a well-documented risk wherever payment details can be changed through unauthenticated channels. International bodies that study tax administration have consistently highlighted the benefits of digitalisation and identity-linked processes, including lower error rates, better audit trails and reduced opportunities for fraud. The approach also aligns with the EU framework for electronic identification and trust services (eIDAS), which supports the interoperability of national electronic identity schemes across member states.

CY Login sits within that broader direction of travel: a national eID gateway used to authenticate taxpayers before they interact with government services. Viewed in that context, the requirement is less an isolated administrative rule and more a logical step in making Cyprus’s tax administration more secure and more digital.

Quick comparison, how other EU tax administrations authenticate refund-account changes

Cyprus is far from alone in requiring electronic authentication before taxpayers can change the bank account used for refunds. The table below sets out, in general terms, how several EU tax administrations approach the same problem. Specific requirements vary and should be confirmed with each administration.

The common thread is clear: authenticated access and documentary proof that the account belongs to the entitled payee. Ireland’s ROS and Germany’s ELSTER both rely on certificate or eID-based authentication, and both expect bank confirmation of the account details. Seen alongside these systems, the Cyprus requirement is consistent with established EU practice rather than an outlier. For taxpayers operating across borders, the practical lesson is that each administration has its own portal and its own authentication credentials, so the steps and documents required differ even where the underlying principle is the same.

Practical checklist for taxpayers and advisers

Use the following condensed list to prepare before submitting an IBAN change through Tax For All:

1. Confirm you have an active CY Login account.
2. If acting for an entity, confirm your access extends to that taxpayer.
3. Request a formal, bank-issued IBAN certificate from your bank.
4. Check that the account holder name matches the taxpayer entitled to the payment.
5. Verify the IBAN character by character before entry.
6. Log in to Tax For All through CY Login and open the bank details section.
7. Complete the request and upload the certificate with a clear filename.
8. Review every field, then submit and save the confirmation.
9. If you previously emailed a request, re-submit through the portal.
10. If the entity cannot obtain CY Login, confirm eligibility for the narrow exception before relying on it.

Conclusion

As Cyprus moves bank account changes tax requests to the Tax For All portal with CY Login from 5 October 2026, the practical priorities are to secure CY Login access early, obtain a correctly named bank-issued IBAN certificate, submit through the portal rather than by email, and allow enough lead-time before any expected refund. Advisers should confirm their authority and recordkeeping for each client. For the authoritative position, consult the Cyprus Tax Department and CY Login guidance, and speak to a qualified tax adviser if your situation is unclear.

Sources

1. Ministry of Finance, Republic of Cyprus (Tax Department)
2. Government of the Republic of Cyprus (CY Login)
3. European Commission, eID / digital identity (eIDAS)
4. OECD, Tax Administration and digitalisation
5. Ireland Revenue, Revenue Online Service (ROS)
6. Germany, ELSTER tax portal
7. Cyprus Bar Association