Cyprus Business Bank Account 2026: EMI vs Bank and the Second Account That Keeps You Free

Status as of 23 October 2026: based on the EU Electronic Money Directive 2009/110/EC (Articles 6, 7 and 12), the EU deposit protection Directive 2014/49/EU as implemented in Cyprus by Law 5(I)/2016 (section 3(2) excludes electronic money), the regulations and information published by the Cyprus central bank on its deposit protection scheme, the SEPA Regulation (EU) 260/2012 (Article 9), Directive (EU) 2024/1619 (CRD VI, Article 21c), the Cyprus Income Tax Law as amended by Law 244(I)/2025, the German Fiscal Code (§ 10 and § 138 AO), the German Foreign Trade and Payments Ordinance (§ 67 AWV), the German Foreign Tax Act (§§ 6 to 8 AStG) and the Romanian Fiscal Code. We will update this guide when the law or official practice changes.

A bank account is not a right. It is a permission, granted by a private company that has been deputised by the state to watch you, and it can be withdrawn with a short letter that gives no reason. Every entrepreneur who has had an account frozen for three weeks while a compliance team "reviews the relationship" has learned this the hard way. Payroll stops. Suppliers stop. Clients ask questions. And the person who built the business discovers that his freedom to trade was hanging by a single thread he did not control.

The wealthy solved this problem a long time ago. They never had one bank. They had an operating bank, a reserve bank in a second jurisdiction, a private bank for capital, and a relationship manager in each who knew their file before the first question was asked. Until now, that kind of banking architecture was built by family offices for families with nine-figure balance sheets. Today you can have the same logic for a Cyprus company, at a scale that fits your business, through Bogdan and the ENCC team.

This guide is about that architecture. It is not a list of banks. We deliberately do not name or recommend individual banks in Cyprus or anywhere else, because the right institution depends on your file, your flows and your countries, and because a recommendation in a blog post ages faster than milk. What we give you instead is the method: the legal difference between an electronic money institution and a bank, what each one is good for, why the second account belongs in another jurisdiction, what banks actually ask for in 2026, the German and Romanian rules that follow your money, and the sequence in which we build it.

The key points

• A Cyprus company needs a banking stack, not a bank. One account for operations, one for reserves, ideally in two different institutions and two different jurisdictions.
• An EMI is not a bank. Under the Electronic Money Directive an electronic money institution may not take deposits, and funds it receives are not deposits. Your money is safeguarded, not covered by deposit protection.
• Bank deposits are protected up to EUR 100,000 per depositor per credit institution under the EU deposit protection framework; in Cyprus, electronic money is excluded from that scheme by law.
• A EUR account in another EU country works for EU payments. The SEPA Regulation forbids a payer or payee from requiring that an account be located in a particular member state.
• Banks buy a story, not a form. The file that opens accounts shows who owns the company, where it is managed, what it sells, to whom, and where the founder's money came from.
• Where your company is managed decides more than your bank. A Cyprus company whose decisions are made in Germany is managed in Germany under § 10 AO, and the bank mandate is part of that evidence.

Key terms defined

Credit institution. A bank licensed to take deposits from the public and grant credit. In the EU, deposits at credit institutions fall under a national deposit protection scheme.

Electronic money institution (EMI). A licensed firm that issues electronic money and provides payment services. It can give you an IBAN, cards and fast transfers, but it may not take deposits or lend from your funds, and it may not pay interest linked to how long you hold the money.

Safeguarding. The legal duty of an EMI to keep customer funds separate from its own money, either in a segregated account at a bank or central bank or in secure low-risk assets, or to cover them with insurance or a comparable arrangement. Safeguarding protects your funds from the EMI's other creditors. It is not a compensation scheme.

Deposit protection. A statutory scheme that repays eligible depositors of a failed credit institution up to EUR 100,000 per depositor per institution. In Cyprus it is run under Law 5(I)/2016, and the Cyprus central bank states a reimbursement period of seven working days.

KYC and source of wealth. Know-your-customer checks identify you and the company. Source of funds asks where a specific payment comes from; source of wealth asks how you built your assets in the first place. Banks in 2026 ask both.

UBO. The ultimate beneficial owner: the natural person who owns or controls the company. Cyprus keeps a register of beneficial owners, and every institution will ask for yours.

Why one account is a single point of failure

Freedom starts with redundancy. A company with one account has handed a veto over its existence to one compliance department. That department is not your enemy, but it is not your friend either. It works for its regulator, and its regulator rewards it for closing accounts that create questions, not for keeping clients happy. This is the quiet way the modern state governs money: it does not seize your account, it makes your bank afraid of you.

Three things trigger most freezes we see. The first is a change in the pattern of payments, such as a large incoming transfer from a new client in a new country. The second is a periodic KYC refresh that the company answers late or incompletely. The third is de-risking: the institution decides that a whole category of client, a country, a business model, a nationality, no longer fits its appetite, and exits everyone in it. None of these has anything to do with whether you did something wrong.

The answer is not to hope. The answer is to design. A company with an operating account at one institution and a reserve account at another, preferably in a different jurisdiction, can absorb a freeze at either one. Payroll still runs. Taxes are still paid on time. The founder answers the bank's questions calmly, from a position of strength, because the business does not depend on the answer.

This is the first thing we map in a consultation: what happens to your company on the day one account stops. Tell us how your money flows today.

EMI vs bank: the legal difference that matters

Knowing what you hold is power. On the screen, an EMI account and a bank account look the same: an IBAN, a card, a balance, an app. In law, they are different animals, and the difference matters exactly on the day something goes wrong.

The Electronic Money Directive 2009/110/EC is blunt. Article 6(2) says electronic money institutions shall not take deposits or other repayable funds from the public. Article 6(3) says that funds received by an EMI from the holder of electronic money are not deposits. Article 7 requires the EMI to safeguard the funds it receives in exchange for electronic money, by no later than five business days after issuance. Article 12 forbids it to pay interest or any other benefit related to the length of time you hold the electronic money.

Deposit protection works the other way. The EU deposit protection Directive 2014/49/EU covers deposits at credit institutions. Cyprus implemented it through Law 5(I)/2016, and section 3(2) of that law states that sums defined as electronic money fall outside its scope. The Cyprus central bank describes the cover as a maximum of EUR 100,000 per depositor per credit institution, including accrued interest, with all deposits at the same institution added together. The German Deposit Protection Act works on the same EUR 100,000 per customer per bank logic, and BaFin states that payment and e-money institutions must instead protect client money by insolvency-proof safeguarding under §§ 17 and 18 of the German Payment Services Supervision Act.

What this means in practice:

Neither one is better. They do different jobs. The mistake is to make an EMI carry the company's reserves, or to make a slow bank carry the company's daily payments, and then to discover the weakness at the worst moment.

The right question is not "bank or EMI". It is "which account carries which job". We design that split with you.

The banking stack for a Cyprus company

Structure your money the way the wealthy do. For most owner-managed Cyprus companies we work with, the stack has three layers.

Layer one, operations. An account that receives client payments, pays suppliers, payroll and taxes, and issues cards. This is often an EMI account or a bank account with strong digital tools. It holds working capital for one to three months, not the company's savings.

Layer two, reserves. An account at a credit institution, ideally in a jurisdiction other than the operating account's, that holds the tax reserve, the buffer and the retained profit until it is distributed or invested. This account is protected by deposit protection up to the statutory limit and is far less exposed to the daily noise that triggers reviews.

Layer three, capital. Once the company and the founder have built real surplus, a private banking or custody relationship for investments, often in a jurisdiction with a long tradition of wealth management. Our guide to banking after a move abroad explains how this layer works for private individuals.

The SEPA Regulation is what makes this possible inside the EU. Article 9 of Regulation (EU) 260/2012 forbids a payer who makes a credit transfer, and a payee who accepts one or collects a direct debit, from specifying the member state in which the other side's account must be located, provided the account is reachable. In plain words: a Cyprus company can hold its euro operating account in another EU country, and the Cyprus tax authority, its suppliers and its clients must accept that IBAN. The European Central Bank calls the refusal "IBAN discrimination", and it is a breach that national authorities can act on.

Outside the EU, the picture changes from 2027. Under Directive (EU) 2024/1619, from 11 January 2027 banks outside the EU generally need an authorised EU branch to provide core banking services, such as deposits and lending, to EU residents. Contracts concluded before 11 July 2026 stay protected unless materially changed. Reverse solicitation remains, but only where you approach the bank on your own exclusive initiative, and it is read narrowly. Transposition is uneven across member states. We explain the consequences in our guide to CRD VI and non-EU banks.

A second jurisdiction is not a luxury. It is insurance against one regulator's mood. Build your stack with us.

What banks actually ask for in 2026

The file is your negotiating power. Banks rarely refuse a company because it is from Cyprus. They refuse because the file does not let a compliance officer explain the client to his own supervisor. Write the file for that person, and most doors open.

The company. Certificate of incorporation, memorandum and articles, register of directors and shareholders, registered office, and the entry in the register of beneficial owners. If there is a holding company or a trust above it, the full chain to the natural person.

The business. A short, honest business description: what you sell, to whom, in which countries, through which channels, with expected monthly volumes in and out. Contracts or letters of intent from the first clients and suppliers. A website that matches the description. Banks compare what you say with what they see, and inconsistency is the most common reason for a refusal.

The substance. Where the company is managed, who the directors are, where they live, where the board meets, whether there is an office and staff in Cyprus. This is not decoration. It feeds directly into the bank's assessment of tax risk, and it is the same evidence a tax authority uses. Our guide to the place of effective management in Cyprus explains why.

The founder. Passport, proof of address, CV or professional profile, tax residence self-certification for CRS, and a source of wealth narrative with evidence: employment contracts and payslips, sale of a previous company, inheritance, investment gains. The narrative should explain, in one page, how the founder's assets were built.

The tax residence of the company. Every institution asks for the company's tax residence and tax identification number for the automatic exchange of information under the Common Reporting Standard. If the company is managed outside Cyprus, it may be tax resident outside Cyprus, and the bank will ask why.

Banks say yes to files they can defend. We prepare that file with you before the first application.

Where the company is managed decides the risk

Your bank mandate tells a story about where you decide. A Cyprus company is taxed in Cyprus at the corporate rate of 15% from 1 January 2026 if it is resident there. For a Cyprus tax resident Non-Dom shareholder, dividends then carry no SDC on dividends. That combination only holds if the company is actually managed in Cyprus.

Cyprus treats a company as resident if it is managed and controlled in Cyprus, and since 1 January 2026 also if it is incorporated or registered in Cyprus, unless a double tax treaty provides otherwise. The other state asks its own question, and a Cyprus company run from abroad can end up resident in both, relying on the treaty. For Germany, § 10 AO places a company's management where the decisive will of its leadership is formed. A Cyprus company whose owner lives in Germany and runs it from his desk in Germany is managed in Germany, with German corporation tax and trade tax. For Romania, the Fiscal Code treats a foreign legal person as Romanian resident if its place of effective management is in Romania.

The bank account sits right in the middle of this evidence. Who holds the signing rights? From which IP addresses are payments approved? Which phone number receives the security codes? Where are the board decisions that approve large payments taken? A tax auditor in Germany who sees that every payment of a Cyprus company was approved from a German address has half his case before he has read the minutes.

So we design the mandate together with the governance. Directors who live in Cyprus, decide in Cyprus and approve payments in Cyprus. The founder who moves to Cyprus as a resident takes his decisions there. And where the founder still lives in Germany, we say clearly that the company will be managed in Germany unless the structure is built differently, and we show the alternatives before the company is formed, not after the audit.

First we show you how to make Cyprus work; then, if your life does not fit it, the alternative that does. Talk to us before you form the company.

The German rules that follow your money

Know the reports before the authority asks. A German resident who owns a Cyprus company, or who receives money from it, meets several German duties that have nothing to do with the bank and everything to do with the account.

§ 67 AWV, payment reports. Residents in Germany must report incoming and outgoing payments to and from foreigners to the Bundesbank. Payments of up to EUR 50,000 are exempt. A single capital injection into a new Cyprus company above that amount is reportable.

§ 138 AO, notification of foreign holdings. A German taxpayer must notify the tax office of the formation or acquisition of a foreign business or permanent establishment, and of a participation in a foreign company that reaches at least 10% or whose total acquisition costs exceed EUR 150,000. The notification goes with the tax return for the year.

§§ 7 and 8 AStG, controlled foreign company rules. German CFC rules can attribute passive income of a foreign company to German shareholders if that income is low-taxed. Under § 8(5) AStG, low taxation means a rate below 15%. With the Cyprus corporate rate at 15% since 2026, a Cyprus company is generally not low-taxed on that measure, but the test looks at the effective burden on the specific income under German computation rules. Your German adviser runs that calculation.

§ 6 AStG, exit tax. A German resident who leaves Germany while holding at least 1% of a company, and who was unlimited taxable in Germany for seven of the last twelve years, faces tax on the unrealised gain in those shares. Plan the move and the company in the right order. Our guide to Cyprus as an EU base covers the personal side.

Compliance at home is what lets the structure abroad stand. We coordinate your German adviser and the Cyprus side.

The Romanian rules that follow your money

Romania sees more than many founders think. A Romanian tax resident who owns a Cyprus company must declare foreign income in the annual single tax return, and Romanian banks and foreign institutions exchange account information under the Common Reporting Standard. The Fiscal Code treats a foreign company whose place of effective management is in Romania as a Romanian resident legal person, and it contains controlled foreign company rules for Romanian corporate shareholders. A Romanian who moves to Cyprus and becomes tax resident there changes this picture, but the move has to be real: home, life and decisions in Cyprus, documented from the first day.

Leave properly, and Romania has no claim to argue. Plan the move with us.

How we build it: the sequence

Order is what makes it work. This is the sequence we coordinate for a new Cyprus company. Each step is executed by licensed partners; we hold the plan together.

1. Map the flows. Which currencies come in, from which countries, from which kind of client; what goes out, to whom; what the peak month looks like. This decides what the operating account must handle.
2. Decide management and residence first. Where the directors live and decide, where the board meets, who signs. The bank file is built on this, not the other way round.
3. Prepare the file before applying. Corporate documents, business description, first contracts, substance evidence, founder's source of wealth narrative with evidence, CRS self-certifications. One coherent story, the same in every application.
4. Open the operating layer. Often the faster of the two, so the company can invoice and pay from the start.
5. Open the reserve layer in parallel. At a credit institution, in a second jurisdiction where your profile fits, so that the stack is complete before the first big contract.
6. Set the mandate rules. Signatories, approval limits, devices and security tokens aligned with where the company is managed.
7. Set the treasury rules. How much stays in operations, when it moves to reserves, how the tax reserve is held, when dividends are paid.
8. Diarise the refresh. KYC refreshes, annual accounts, changes of directors or address, sent to the bank before it asks.
9. Coordinate the home-country reports. § 67 AWV and § 138 AO in Germany, the annual return in Romania, or the exit if you are moving.

Nine steps, one plan, no improvisation. Start yours.

The most common errors

Avoid these, and most problems never start.

• Putting all reserves in one EMI. Safeguarding is real protection against the EMI's creditors, but it is not deposit protection and it can be slow to unwind.
• Applying everywhere at once with different stories. Compliance teams talk to databases, not to each other, but the inconsistencies show up anyway.
• A business description written for investors. Banks want flows, clients and countries, not vision.
• Founder signing every payment from home in a high-tax country. That is evidence of where the company is managed.
• No source of wealth file. The question will come. Answering it in a hurry, with half the documents, is how a routine review becomes a closure.
• Ignoring KYC refresh letters. A late answer is read as a risk.
• Cash. Large cash deposits into a new company account are the fastest way to the exit door.

Three illustrative cases

These cases are illustrations built from typical situations, not real clients, and the figures are examples.

The software consultancy from Hamburg. An engineer, 41, moves to Cyprus with his family and forms a Cyprus company that invoices German and Dutch clients. He keeps his German bank account for private matters and wants the company banked properly. The plan: he becomes tax resident in Cyprus, deregisters in Germany, sits on the board with a second director resident in Cyprus, and approves payments from Cyprus. The company uses a fast operating account for client payments in euro and a reserve account at a credit institution in another EU country for the tax reserve and retained profit. His German adviser handles the exit tax review of his previous shareholding and the § 138 AO notification of the year of formation.

The Romanian e-commerce founder in Cyprus. A founder, 34, sells household products in five EU countries through marketplaces and her own shop. Marketplace payouts arrive in euro and Polish zloty; suppliers are paid in US dollars. Her operating layer must be multi-currency with strong payment tools; her reserve layer sits at a credit institution. Because the business is high-volume and low-margin, the bank file explains the payment pattern in detail, with marketplace statements, so that the first big payout month does not look like an anomaly.

The holding company for an investor. A retired executive, 63, Cyprus resident and Non-Dom, uses a Cyprus company to hold investments and receive dividends. He has no need for cards or fast payments. His stack is a single credit institution for the company's current account and a custody relationship for the portfolio, plus a second account in another jurisdiction for liquidity. What matters for him is the source of wealth file, the company's board practice in Cyprus and the dividend policy, which brings no SDC on dividends at the level of the Non-Dom shareholder.

The circle you join

The people who bank like this think differently. They do not ask permission from one institution to exist. They do not panic when a compliance letter arrives, because the letter is answered from a file that was ready before the question. They know where their company is managed, and they can prove it. They pay what the law asks, in the country the law asks, and not a cent more to the country they left.

That is the circle ENCC builds around its clients: entrepreneurs and families from Germany, Romania and across Europe who chose to live in a place that treats them as adults, and who build their companies with the same discipline the wealthy have always used. You do not have to work it out alone. Bogdan and the ENCC team coordinate the people who do it right.

FAQ

Can a Cyprus company open its main account outside Cyprus?

Yes. A Cyprus company can hold accounts in other jurisdictions, and inside the EU the SEPA Regulation forbids payers and payees from refusing a reachable IBAN because of the member state where the account is held. What matters is that the institution accepts your profile and that the company's management and tax residence are clear.

Is my money safe at an EMI?

An EMI must safeguard your funds, which keeps them separate from its own money and protects them from its other creditors. That is real protection, but it is not deposit protection. E-money is outside the deposit protection scheme in Cyprus by law, and if an EMI fails, safeguarded funds are returned through an insolvency process.

How much is protected at a bank?

Eligible deposits are protected up to EUR 100,000 per depositor per credit institution, with all your deposits at the same institution added together. For a company, the company is the depositor. Amounts above the limit are exposed to the bank's insolvency, which is one more reason to spread reserves.

Do I have to live in Cyprus to bank a Cyprus company?

No law requires the owner to live in Cyprus, but banks assess where the company is managed and why. If you live in Germany and run the company from there, it is managed in Germany under § 10 AO, and the bank will see that. We show you how Cyprus management works first, and then the alternatives if your life does not fit it.

Why do banks ask about the source of my wealth?

Anti-money laundering law requires them to understand not only where a payment comes from but how the owner built his assets. A clear one-page narrative with documents is the fastest way through.

Does ENCC recommend a specific bank?

No. We do not name or recommend individual banks in our guides. The right institution depends on your business, your countries and your file, and that answer belongs in a consultation, not in a blog post.

What does Germany require when I fund a Cyprus company?

A payment to the company above EUR 50,000 is reportable to the Bundesbank under § 67 AWV, and the participation must be notified to the tax office under § 138 AO if it reaches 10% or costs more than EUR 150,000. Your German adviser files both.

What changes in 2027 for banks outside the EU?

From 11 January 2027, banks outside the EU generally need an authorised EU branch to provide core banking services to EU residents, with transitional protection for contracts concluded before 11 July 2026 and a narrow exception for your own exclusive initiative.

Next steps

For the personal side of banking after a move, read banking after you move abroad. For the residence of your company, read place of effective management in Cyprus. For protecting what you build, read asset protection and privacy. Today's companion guide compares the strongest asset protection trusts: Cook Islands trust vs Nevis trust vs US DAPT. All our guides are on the English blog.

Sources

• Directive 2009/110/EC on electronic money institutions, Articles 6, 7 and 12 (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32009L0110
• Directive 2014/49/EU on deposit protection schemes (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0049
• Cyprus Law 5(I)/2016 on the deposit protection and resolution scheme, unofficial consolidation, section 3(2) (Cyprus central bank): https://www.centralbank.cy/images/media/pdf/CONS_LAW_2021_EN_30072021.pdf
• Cyprus deposit protection scheme regulations, unofficial consolidation, depositor information template (EUR 100,000 per depositor per credit institution, 7 working days): https://www.centralbank.cy/images/media/redirectfile/DGS/CONSOLIDATION_REGULATIONS_31072020_%CE%95%CE%9D.pdf
• German Payment Services Supervision Act, §§ 17 and 18 ZAG: https://www.gesetze-im-internet.de/zag_2018/__17.html
• BaFin, deposit protection and investor compensation: https://www.bafin.de/DE/verbraucherinnen-verbraucher/themen-finanzprodukte/geldanlage/einlagensicherung-anlegerentschaedigung/einlagensicherung-anlegerentschaedigung_node.html
• Regulation (EU) 260/2012 (SEPA), Article 9 (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2012/260/oj/eng
• European Central Bank, IBAN discrimination: https://www.ecb.europa.eu/paym/groups/pdf/efip/IBAN_discrimination_update.pdf
• Directive (EU) 2024/1619 (CRD VI), Article 21c (EUR-Lex): https://eur-lex.europa.eu/eli/dir/2024/1619/oj/eng
• Law 244(I)/2025 amending the Cyprus Income Tax Law (CyLaw, Greek): https://cylaw.org/nomoi/arith/2025_1_244.pdf
• German Fiscal Code, § 10 AO: https://www.gesetze-im-internet.de/ao_1977/__10.html
• German Fiscal Code, § 138 AO: https://www.gesetze-im-internet.de/ao_1977/__138.html
• German Foreign Trade and Payments Ordinance, § 67 AWV: https://www.gesetze-im-internet.de/awv_2013/__67.html
• German Foreign Tax Act, §§ 6, 7, 8 AStG: https://www.gesetze-im-internet.de/astg/
• Romanian Fiscal Code, Law 227/2015 (ANAF): https://static.anaf.ro/static/10/Anaf/legislatie/Cod_fiscal_norme_2023.htm

Verified on 23 October 2026.

Cover photo: Cape Greco, Cyprus. Photo: Diego Delso, Wikimedia Commons, CC BY-SA 4.0, cropped.