Cyprus Implements New Foreign Direct Investment Screening Law Affecting Non-EU Investment into Cyprus: Key Considerations

Cyprus has adopted Law 194(I)/2025 on the Establishment of a Framework for the Screening of Foreign Direct Investments (the “Cyprus FDI Law”), creating for the first time a mandatory approval regime for certain foreign investments that may affect national security or public order.

The Cyprus FDI Law aligns the national framework with the EU-wide mechanism established under Regulation (EU) 2019/452 (the “Regulation”). The screening regime in Cyprus becomes operational on 2 April 2026.

This new framework is particularly relevant for M&A transactions, restructurings, joint ventures, and equity investments into Cyprus involving non-EU/EEA investors.

1. What is the Cyprus FDI Law?

The Cyprus FDI Law establishes a national screening mechanism for assessing whether a foreign direct investment (“FDI”) may pose risks to the security or public order of the Republic of Cyprus. It also integrates Cyprus into the EU-level cooperation mechanism under the Regulation, enabling exchange of information with other Member States and the European Commission.

2. Sectors and Industries Covered by the Screening Regime

The screening regime applies to foreign direct investments in undertakings operating in strategic or particularly sensitive sectors, as identified in Article 4 of Regulation (EU) 2019/452 and further specified and expanded in the Annex to Law 194(I)/2025. At EU level, particular consideration is given to investments that may affect critical infrastructure, whether physical or virtual, including infrastructure relating to energy, transport, water, health, communications, media, data processing or storage, aerospace, defence, electoral infrastructure and financial infrastructure. The Regulation also highlights investments involving critical technologies and dual-use items, such as artificial intelligence, robotics, semiconductors, cybersecurity, aerospace and defence technologies, energy storage, quantum and nuclear technologies, as well as nanotechnologies and biotechnologies.

In addition, the Regulation requires Member States to assess whether a foreign direct investment may affect the supply of critical inputs, including energy, raw materials and food security, whether it enables access to sensitive information (including personal data) or the ability to control such information, and whether it may impact the freedom and pluralism of the media.

Building on the EU framework, the Cyprus FDI Law further expands the scope of sensitive activities through its Annex, reflecting national security and public order considerations. In particular, it extends the screening regime to additional sectors such as education and tourism, to sensitive facilities, and to land and real estate that are critical for the operation of key infrastructure.

3. Who Is a “Foreign Investor”?

A foreign investor includes any natural person who is not an EU/EEA national, and any legal entity established outside the EU/EEA, or ultimately controlled by such persons or entities.

4. When Is Notification Required?

A foreign investor intending to proceed with an FDI must submit a written notification to the Competent Authority prior to completion of the investment. The Competent Authority in Cyprus is the Ministry of Finance.

The written notification must include a description of the investment, the information required under Article 4 of the Cyprus FDI Law, and any additional information requested by the Authority. No foreign direct investment falling within the scope of the Law may be completed without prior approval.

(a) The investment results in the acquisition of special participation. Under Section 3(3) of the Cyprus FDI Law, special participation means the direct or indirect acquisition, acting alone or in concert with other persons, of at least twenty-five percent (25%) of the share capital and/or voting rights, or the acquisition of a corresponding ability to exercise decisive influence over the activities of the undertaking. Under Section 3(4), notification is also required where the foreign investor increases its participation so that its holding moves from less than 25% to 25% or more, or from less than 50% to 50% or more.

(b) The value of the FDI equals or exceeds EUR 2,000,000, whether in isolation or aggregated with other transactions between the same parties occurring within the preceding twelve (12) months.

(c) The FDI concerns an enterprise of strategic importance. An enterprise of strategic importance refers to an undertaking operating in particularly sensitive sectors as defined in the Annex to the Cyprus FDI Law, including critical infrastructure and related real estate, critical technologies, sensitive data environments, media pluralism, essential inputs and food security, as well as other activities relevant to security or public order.

5. What Information Must Be Submitted?

The information required mirrors Article 9 of the Regulation and includes, among others, details on the ownership structure and beneficial ownership of the investor, the value and financing of the investment, the source of funds, the business activities of the investor and the target, the markets in which they operate, the Member States in which the investor is active, and the intended completion date of the investment.

6. Screening Process and Timeline

The Competent Authority must acknowledge receipt of the notification and indicate within 20 working days whether further screening will take place. Once the full screening is initiated, the Ministry of Finance may request additional information, consult the inter-ministerial Advisory Committee, and engage with other Member States and the European Commission under the Regulation

The Ministry of Finance may approve the investment, approve it subject to conditions or mitigating measures, or prohibit it where necessary to safeguard national security or public order.

7. Penalties for Non-Compliance

The Cyprus FDI Law provides for substantial penalties, including administrative fines of up to EUR 100,000 for failure to notify, up to EUR 500,000 for providing false or misleading information, and up to EUR 1,000,000 for non-compliance with conditions imposed by the Competent Authority, as well as daily administrative fines until compliance is achieved.

8. Confidentiality and Data Protection

Information submitted as part of the screening process may be used only for assessing the FDI. Commercially sensitive information must be kept confidential, and personal data must be processed in accordance with GDPR.

More information

The Cyprus FDI Law represents a major development for foreign investment into Cyprus, particularly for non-EU investors and transactions in sensitive sectors such as technology, data, energy, infrastructure, defence-linked activities and financial services. For foreign investors, it introduces a mandatory pre-closing approval step, affects transaction timelines and long-stop dates, increases the need for transparency around ownership structures and control, and may result in conditional approvals or prohibitions.

Our firm assists clients with navigating the new FDI screening framework, assessing whether notification is required, and incorporating FDI considerations into transaction structuring and documentation.

For more details on the Cyprus FDI Law, how the new screening regime may affect proposed investments or acquisitions involving Cypriot companies, or assistance with preparing a notification under the Law, please contact us at info@aptuslegal.com.