Directors and Officers Liability Insurance in Cyprus

Why a Cyprus company director is personally on the hook

In Cyprus the person sued is often the director, not the company. The Companies Law, Cap. 113 draws no line between an executive and a non-executive director, and it puts no ceiling on what a director can be ordered to pay. Sit on the board and the duties attach to you personally.

Those duties are specific:

Some of that sits in the statute itself, some in case law Cyprus inherited from English common law, which is why the exposure has no natural limit. The filing duties are set by the Department of Registrar of Companies and Intellectual Property.

Trading on when the company has no realistic prospect of avoiding insolvent liquidation carries its own exposure. Cyprus courts reach it through Part V of Cap. 113, and where business was carried on with intent to defraud creditors, section 311 makes an officer personally liable without limit and it is also a criminal offence. Unpaid corporate tax, VAT, social insurance and GHS contributions can also land on a director personally.

Clients ask us most weeks whether a nominee arrangement solves this. It does not. Shadow directors and de facto directors carry the same duties as appointed ones, so a founder running a Cyprus company through a nominee is exposed in the same way.

Is D&O insurance compulsory in Cyprus?

No. D&O insurance is not required by Cyprus law. Employers' liability insurance is compulsory under Law 174(I)/1989 at a minimum of €160,000 per employee, and motor third-party liability under Law 96(I)/2000. Those two are the only general compulsory classes for a Cyprus business.

Here is the full picture, because the "no" only means something next to the "yes".

Compulsory for a Cyprus business	Not compulsory
Employers' liability, Law 174(I)/1989, minimum €160,000 per employee	D&O liability insurance
Motor third-party liability, Law 96(I)/2000, €38.6m bodily injury and €1.3m property damage	Professional indemnity, except where a regulator requires it

Figures in the table are the statutory minimums, not our prices.

That contrast is what makes the answer worth trusting. Employers' liability insurance is compulsory in Cyprus from the day you hire your first employee. D&O never becomes compulsory, at any size.

So why do Cyprus boards buy a policy no law demands? Because of what section 197 takes away. It voids an advance exemption and an advance indemnity for breach of duty. The one indemnity Cap. 113 does allow is retrospective and conditional on winning: the company may cover your defence costs where judgment goes in your favour, where you are acquitted, or where the Court grants you relief under section 383. Lose the case, or settle it, and the company cannot lawfully reimburse you.

That is the whole commercial logic of this product: the policy covers the outcome where you do not win, which is exactly the outcome Cap. 113 leaves you holding.

One timing point carries through the rest of this page. A D&O policy answers claims made against you while it is in force, so when you buy matters as much as how much cover you buy. Full detail is in the claims section below.

On regulated firms: CySEC does not require D&O as a condition of a CIF licence. What CySEC-regulated firms carry is professional indemnity. Their boards add D&O on top because a regulatory investigation reaches the individual, not just the firm.

How much does D&O insurance cost in Cyprus?

No Cyprus insurer publishes a D&O rate card, so every policy here is individually quoted. Cyprus advisory firm Nexora Cyprus publishes €1,500 to €8,000 a year for a €1,000,000 limit on a small private company (April 2026). Entry-level cover sits at the bottom of that range.

That is the honest answer, and no competing Cyprus page gives it.

Why no rate card exists

D&O is not even a separately reported class in Cyprus. The Insurance Association of Cyprus publishes one combined liability line, worth €73,224,972 in 2024 out of €614,182,887 of total non-life premium, so about 11.9% of the market. The finest unit published under Solvency II is "general liability insurance", which EIOPA puts at 5.7% of Cyprus non-life gross written premium in 2024. The Insurance Companies Control Service publishes no class-level premium breakdown at all. With no published Cyprus D&O data in existence, every policy is individually underwritten.

What exists instead are two euro anchors: the limit your turnover points to, and a published range for the limit most small Cyprus companies end up buying.

How Cyprus insurers commonly set the limit

Market practice, not a rule.

Annual turnover	Limit of indemnity commonly recommended
Up to €500,000	€500,000
€500,000 to €5mReference limit	€1,000,000
€5m to €10m	€2,000,000
€10m to €50m	€3,000,000
Over €50m	€5,000,000

The guidance is a spread, not a single ladder

Three published sources disagree at the edges, and pretending otherwise would be tidier than it is true.

All three agree on one point: €1,000,000 is the reference limit for a small Cyprus private company, and that is the limit the price above is quoted against.

Ten things that move your premium:

These are Cyprus euros, under Cyprus law

Every figure on this page is priced for a policy written in Cyprus, in euros. US and UK D&O pricing does not transfer here: different legal regime, different limits convention, different currency. If you have been reading dollar figures elsewhere in your search results, none of them are quotes you can buy in Limassol or Nicosia.

Professional indemnity vs public liability vs D&O: which does a Cyprus director need?

Professional indemnity covers mistakes in the work you sell. Public liability covers physical harm you cause to other people or their property. D&O covers the decisions you make running the company. Only D&O protects the director personally, and only professional indemnity is compulsory for some regulated Cyprus professions.

That one-line split settles most of the confusion, and it is a question people ask us far more often than they ask about D&O by name.

Where they overlap is at regulated firms. A CIF, a fund manager, an EMI or an administrative service provider routinely carries professional indemnity insurance and D&O at the same time. The professional indemnity policy answers a client's complaint about the service. The D&O policy answers a regulator's investigation into the people who signed off the decision. One does not stand in for the other, and a firm that carries only professional indemnity has left its directors uncovered.

Public liability insurance is the third leg, and it is the one D&O most clearly does not do. Bodily injury and property damage are excluded from a D&O policy by design, because that is what public liability is for.

If you want the two-way version of that comparison on its own, we set out how professional indemnity and public liability differ separately.

What a Cyprus D&O policy covers, who it covers, and the five things it does not

A D&O policy pays legal defence costs, the cost of responding to an investigation, out-of-court settlements and court-awarded compensation. Side A protects the director personally when the company cannot indemnify them. It excludes deliberate fraud, unpaid tax, bodily injury, professional errors and anything already in dispute.

The three sections have names you will meet in every wording, and they are simpler than they sound.

Who is actually insured

Competing pages stop at "directors and officers". A real insured-persons definition reaches further, and at a regulated Cyprus firm the extra names are the ones that matter: executive and non-executive directors, the company secretary, senior managers, the persons who effectively direct the business, the AML compliance officer (AMLCO), the regulatory compliance officer, and the risk management and internal audit functions. Shadow and de facto directors are in scope too, which counts for more in Cyprus than in most markets.

Under the Investment Services and Activities and Regulated Markets Law of 2017 (Law 87(I)/2017, as amended), a Cyprus Investment Firm notifies CySEC of every board member and every change, and CySEC may refuse a person on repute, knowledge, skills, experience or time commitment. So these people are notified to and assessed by CySEC rather than pre-approved by it, and at least two of them must effectively direct the business.

The Data Protection Officer belongs on the list for a different reason. That role comes from Article 37 of the GDPR and Law 125(I)/2018, and it is notified to the Commissioner for Personal Data Protection rather than to CySEC.

Why the insured-persons list decides whether the cover works

CySEC can sanction an individual in their own name. Under section 71(6) it may impose administrative fines on a responsible natural person running to millions of euro, plus a ban from exercising management functions in a Cyprus Investment Firm, temporary or permanent for repeated serious infringements. Under section 72(1) it publishes its decisions naming the persons responsible, and its register of board decisions carries named individual fines alongside 5-year and 10-year management bans. The company pays the premium. The people named in those decisions are the ones who have to be inside the insured-persons definition, so the policy funds their defence.

Investigations, internal reports and self-reporting

The policy responds to a regulator's investigation into an individual and funds their legal representation, including where the allegation reached the regulator through an internal report rather than an outside complaint. That trigger is missing from every other Cyprus D&O page, and for a regulated firm it is the one that actually fires.

Cyprus has a statute behind it: the Protection of Persons Reporting Breaches of Union and National Law, Law 6(I)/2022, as amended by Law 13(I)/2024. What it does to an individual:

The Ministry of Justice and Public Order publishes a guide for employees setting out how a report is made.

Read that next to how D&O works. Because Article 39 liability is criminal, what the policy does here is fund your legal defence and representation. Criminal fines are not insurable as a matter of public policy, so a D&O policy does not pay an Article 39 fine. It pays for the lawyer who defends you against the allegation.

The five things it does not cover:

Claims by one insured against another are also commonly excluded, with a carve-back for claims brought by a liquidator. Check that carve-back, because it is what makes the cover respond at all in an insolvency.

Cyprus boards that need a specialist D&O placement

Most Cyprus companies buy a standard private-company D&O policy. Three do not: boards whose directors also sit on the management committee of the company provident fund, crypto and digital-asset businesses, and CySEC-licensed firms. Each is underwritten as its own class, with its own appetite and its own capacity.

For CySEC-licensed firms, the placement sits alongside professional indemnity for financial services firms. We set out the rest of the insurance a CySEC-licensed firm has to carry separately.

Where the provident fund rules trip boards up

Law 10(I)/2020 is the current statute, and it brought Cyprus into line with IORP II, Directive (EU) 2016/2341. It repealed the earlier series of provident-fund laws outright at Article 94, so anything you are holding that is numbered 208(I)/2012 no longer applies. And the supervisor is not CySEC: it is the Commissioner of Institutions for Occupational Retirement Provision, a public officer within the Ministry of Labour and Social Insurance. A committee has at least three members, and Article 20(1) names the provident fund itself, so there is no argument about which vehicle the Law governs.

Cyprus holding companies with foreign subsidiaries

The usual structure is a master policy at the Cyprus parent, with local policies underneath in any territory that requires admitted cover. It is the most common Cyprus group shape and the most common gap: a master policy alone can leave a subsidiary's local directors unprotected on a local claim. Tell us where the subsidiaries sit and we will scope it.

Fund managers, whether AIF, AIFM, RAIF, private equity or venture capital, sit alongside the CySEC row above rather than needing their own treatment.

Raising capital and stepping down each add their own exposure. If your company raises capital by inviting people to subscribe for shares, section 43 of Cap. 113 lets a subscriber who relied on the prospectus sue every person who was a director when it was issued, personally, for loss caused by an untrue statement in it. The Law does give you statutory defences, chiefly that you had reasonable grounds to believe the statement was true, but establishing a defence means litigating, and litigation is the cost D&O is bought to carry. And a director selling out or stepping down on a share sale needs run-off cover, because the exposure survives the exit even though the board seat does not.

Public-company and listed D&O is a different product from private-company D&O, and both differ again from a regulated-firm placement. What decides which one you need is your licence and your ownership structure, not your turnover.

What a real D&O claim looks like in Cyprus

D&O is written on a claims-made basis. The policy responds to claims first made against you and notified during the policy period, subject to a retroactive date. The realistic Cyprus claims are a regulatory investigation, a liquidator's action, an employment claim naming a director, and a shareholder dispute.

Start with claims-made, because it decides everything that follows. Cover is not triggered by when you made the decision. It is triggered by when the claim arrives. Acts before the retroactive date fall outside the policy, so check that date at every renewal and never let it reset when you switch insurer.

What to do when a claim arrives

One thing D&O will not pay: the late-filing fine on your annual return. Under Law N.18(I)/2024 the HE32 fine is €50 on the first day plus €1 a day, capped at €150, and the Registrar of Companies collects it either way.

Finally, run-off

A resigned or retired director stays exposed for acts during their tenure, and because the cover is claims-made, run-off is the only mechanism that keeps them protected after the policy ends. Ask for it on a resignation, a share sale, a merger or a dissolution.

Getting D&O cover in place, and what else your Cyprus company needs

An insurer underwrites this one by hand, so the questions are specific: the last three years' turnover and accounts, the number of directors and shareholders, any subsidiaries and where they sit, your sector, your trading history, and any claim, investigation or circumstance you already know about. Expect a quote in about two working days. The policy runs 12 months and renews annually, and the retroactive date carries across if you keep the chain unbroken.

D&O is one part of a Cyprus company's programme. Employers' liability insurance is the compulsory one, from the day you hire your first employee. Professional indemnity insurance is the one regulated firms need for licensing. Cyber insurance pairs with D&O on a data-breach event, because the breach response and the directors' exposure are two separate bills. If you are working out the whole programme rather than one policy, start with business insurance for Cyprus companies.

We are an independent Cyprus insurance agency, so we compare wordings across the licensed Cyprus insurers we place, and where a risk needs international specialist markets we go there. Our team works in English, Greek and Russian, which matches how Cyprus boards are actually made up.

Sector is a rating factor listed in the cost section above, so the form has to ask for it. Without it we cannot price the risk.