title: Cyprus Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/cyprus/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Cyprus CY schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 53 sourced findings · 103 sources in the cumulative register 14 Modules baseline.modules[] 53 Findings modules[].findings[] 22 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ** Law made at European Economic Area level** that applies in Cyprus is covered once, on the [European Economic Area](https://payments.gi/jurisdictions/european-economic-area/) page. This page covers Cyprus’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal Cyprus's fintech and payments sector produced a fresh commercial signal this cycle: DigitalFox, a Cyprus-incorporated QR-code table-payments and point-of-sale integration startup, raised a pre-seed funding round of 350,000 euro. The round is small in absolute terms but is illustrative of continued early-stage capital formation in Cyprus's payments-adjacent technology layer, occurring against a backdrop in which the island's fintech sector is reported to be approaching 200 companies, with around 55 percent of those involved in payments specifically. The funding event coincided with public positioning by President Christodoulides, who used the Forbes Next Gen Banking and Fintech Summit to set out Cyprus's ambition to expand its role in fintech, citing Standard and Poor's recent decision to raise Cyprus's sovereign credit rating from A- to A as supporting evidence for the jurisdiction's investment case. No regulatory movement accompanies this commercial narrative this cycle; the developments are confined to commercial activity and sector-promotion messaging rather than any licensing, conduct, or scheme-compliance change. #### Other Developments **Fintech sector scale.** Cyprus's fintech sector is reported to be approaching 200 companies in total, with roughly 55 percent of those companies involved in payments specifically. This concentration underscores payments as the dominant vertical within Cyprus's broader fintech base, though the underlying count is a sector estimate reported via press coverage of an industry summit rather than a regulator-published figure. **Sovereign credit rating upgrade cited in fintech positioning.** President Christodoulides referenced Standard and Poor's upgrade of Cyprus's sovereign credit rating from A- to A, with a positive outlook, as part of the government's pitch for Cyprus as a European Union payments and fintech gateway. The rating upgrade itself is a sovereign-level commercial development rather than a payments-sector regulatory development, but it was explicitly deployed by the government this cycle as context for fintech-sector investment promotion. #### Cross-Monitor Connections The DigitalFox funding round and the broader fintech-sector growth narrative in Cyprus have a natural adjacency to crypto-asset and digital-innovation tracking in the jurisdiction, where separate licensing and enforcement developments are being monitored; however, no evidence this cycle ties the DigitalFox round or the sector-scale estimate to any crypto-specific activity, and the connection here is thematic rather than evidenced. No overlap with financial-integrity or illicit-finance findings is indicated in this cycle's commercial-intelligence evidence base. #### Outlook No regulatory development accompanies the commercial growth signal this cycle, and none is flagged as imminent in the evidence base. The near-term trajectory to watch is whether Cyprus's fintech-sector scale, approaching 200 companies with a payments-majority composition, converts into further funding events of the kind seen with DigitalFox, and whether government positioning around the sovereign credit upgrade translates into concrete policy or licensing initiatives in subsequent cycles. _4 earlier updates not shown here._ ###### Standing brief · as of 6 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Cyprus's crypto-asset regime reached a structural turning point on 1 July 2026, when the national grandfathering pathway that had let Cyprus-based crypto-asset service providers operate under legacy AML-only registration formally closed. The closure followed the Markets in Crypto-Assets Regulation Article 143(3) transition, after a 27 February 2026 application deadline; providers that did not secure full MiCA authorisation by that point now face a mandated wind-down rather than continued market access. This is assessed as the single most structurally significant Cyprus payments-adjacent development this cycle, retiring the last national-registration route for Cyprus crypto firms and materially raising the compliance bar for CY-domiciled CASPs. The closure did not arrive in isolation. Since March 2026, Cyprus CASPs providing EMT-related payment services have also been required to hold Central Bank of Cyprus (CBC) PI/EMI authorisation, or to partner with an already-authorised payment service provider, alongside their CySEC CASP authorisation. That dual-track requirement is assessed as the most commercially significant Cyprus licensing development of the 2025-2026 period, positioning Cyprus as an emerging hub at the intersection of crypto and payment-institution regulation ahead of further consolidation expected under PSD3. #### Other Developments Cyprus's conduct and safeguarding architecture has tightened on two fronts that bind PSPs and EMIs directly. Since January 2025, every EMI application to the CBC must include a full ICT Risk Management framework under the Digital Operational Resilience Act (DORA). Separately, an October 2025 mandate requires Cyprus PSPs to run real-time IBAN-name matching, or Verification of Payee, as an anti-fraud backstop applying to both bank and non-bank payment-service providers. On payment rails, Cyprus has moved from limited instant-payments availability to a rail-modernisation success story. The Bank of Cyprus, under CBC oversight, implemented full SEPA Instant Credit Transfer sending capability on 9 October 2025 under the EU Instant Payments Regulation. SCT Inst's share of SEPA credit transfers has grown from under 1% to approximately 32% by volume, and roughly 9% by value, a volume share that now surpasses the euro-area average. On the commercial side, CySEC's supervised population expanded through 2025, with 47 new Cyprus Investment Firm licences approved and the total supervised-entity count reaching 808; assets under management in CySEC-regulated collective investment schemes reached EUR 11.4 billion. Further out on the horizon, the Eurosystem continues to prepare for a digital euro introduction targeted for 2029, contingent on legislation expected to be adopted in 2026. #### Cross-Monitor Connections No Sentinel-fed AML/CFT feed data for Cyprus was available this cycle, and consistent with WPM's scope guardrail, no original illicit-finance analysis has been performed in its place. This gap has been flagged to the Financial Integrity Monitor for its own AML/CFT coverage of Cyprus; any illicit-finance use of the instruments discussed above remains a FIM cross-reference rather than a WPM conclusion. #### Outlook Three items merit continued tracking into the next cycle. The AMLA direct-supervision onset date requires reconciliation, as it has been reported variably as 2027 or 2028. The PSD3/PSR unified Payment Institution framework, which would merge EMI and PI licensing and repeal EMD2, remains on a proposed timeline of late 2027, with an expected 24-month grandfathering period for existing licences. The digital euro's legislative adoption, expected in 2026 ahead of a targeted 2029 introduction, is a Eurosystem-wide development with no Cyprus-specific variant yet visible. Cyprus's overall regulatory direction across licensing, conduct, and crypto-asset supervision is assessed as tightening, driven jointly by the convergent CBC/CySEC licensing tracks, the DORA and Verification-of-Payee conduct obligations, and the MiCA CASP transition described above. This tightening trajectory sits alongside continuing gaps in this cycle's coverage: no correspondent-banking or access-related events, no merchant-acquiring or high-risk-MCC developments, and no private-company PSP or fintech funding signals specific to Cyprus were located this cycle, the last of which reflects a known under-indexed vector flagged for targeted search in the next research cycle. This cycle also marks Cyprus's first structured baseline capture in the World Payments Monitor's per-jurisdiction tracking mode. Ten structured claims spanning five modules, two forward-dated horizon items, and a first jurisdiction_risk_tracker entry have been logged this cycle, drawing on eight sources ranging from Tier 1 regulator material (CySEC, and ECB-level Instant Payments Regulation text) through Tier 3 domestic press to Tier 4 legal-commentary sources. Confidence across the resulting claim set ranges from Assessed to High, with the MiCA grandfathering expiry and the SEPA Instant Payments rollout carrying the strongest, most directly corroborated evidentiary basis. None of this activity touches illicit-finance analysis proper: the Sentinel-fed AML/CFT feed for Cyprus was unavailable this cycle, and the resulting gap has been passed to the Financial Integrity Monitor rather than filled with independent WPM analysis, consistent with the scope guardrail that treats illicit-finance use of any payment instrument as a cross-monitor matter rather than a World Payments Monitor conclusion. The next cycle should prioritise closing the W12, W8, and W6 coverage gaps for Cyprus, aligning the jurisdiction's coverage with the full 14-module spine used elsewhere in this monitor. _Standing brief, as of 29 June 2026._ #### Regulatory Status Cyprus operates a fully EU-harmonised, multi-pillar payments regime under a bifurcated CBC/CySEC supervisory architecture. The licensing spine is a dual PI/EMI authorisation regime under the CBC — PIs under Law 31(I)/2018 (PSD2), EMIs under Laws 81(I)/2012 & 2018 (EMD2) — with authorisation restricted to entities incorporated and headquartered in Cyprus and no small-institution route. EMI initial capital is EUR 350,000 and PI capital is tiered at EUR 20,000 / 50,000 / 125,000. The conduct layer is tightening, with the CBC's 2025/2026 governance and suitability directives moving EMI/PSP governance toward board-accountable obligations and safeguarding mandated per EBA/GL/2018/05. The crypto layer applies MiCA with the CBC as competent authority for EMTs and CySEC for ARTs, other crypto-assets and CASPs, EMT issuance restricted to credit institutions and EMIs, and a 1 July 2026 transitional hard deadline. DORA is directly applicable from 17 January 2025 under CySEC and CBC supervision, with CySEC Circular C751 issued in early 2026. Card economics run under the IFR via Law N.77(I)/2018 (0.2%/0.3% caps), and SCT Inst with mandatory VoP operates via TIPS. Domestic acquiring is concentrated in the bank-owned JCC consortium, with high-risk MCCs refused domestically. Enforcement is active — CySEC reported approximately EUR 2.3 million in fines and around 600 inspections in 2025 — and a 2025 sanctions-criminalisation law adds turnover-based penalties, though the exact ceiling is contested. The AML/CFT surface is Sentinel-fed (AML/CFT Law 2007, Sanctions Law 2016, MOKAS FIU). Settlement runs through T2-CY with non-euro flows exposed to de-risking. Two challenger-identified figures — the supervised PI/EMI count (26/11 versus official 29/10) and the sanctions-penalty ceiling — remain at Assessed pending reconciliation. #### Outlook The jurisdiction risk level is moderate with a stable-with-tightening-conduct trajectory and a tightening regulatory direction. The near-term marker is the 1 July 2026 MiCA transitional cliff-edge; the medium-term marker is digital-euro readiness targeted for 2029, conditional on 2026 EU legislation. Commercially, MiCA-driven crypto re-domiciliation inflow (Revolut) and incumbent-bank fintech M&A appetite point to consolidation pressure, against a new 8% crypto-disposal tax effective 1 January 2026. This is an AI-unverified baseline pending lawyer-diff verification. trust tier: ai_unverified ###### Latest update · 5 October 2026 #### Regulatory Status Cyprus's payment-institution and electronic-money-institution licensing pathway tightened procedurally this cycle with the Central Bank of Cyprus's introduction of a mandatory Pre-Application Exploratory Stage, effective 3 August 2026. Prospective applicants must now submit a Pre-Application Document and pay a non-refundable EUR 5,000 fee before the Central Bank accepts a formal application, with a preliminary assessment period of thirty to fifty working days following, and potential additional cost where enhanced due diligence is triggered. The underlying minimum capital tiers, EUR 20,000 for money-remittance-only firms, EUR 50,000 for payment-initiation-service providers, EUR 125,000 for full payment institutions, and EUR 350,000 for electronic money institutions (plus an ongoing own-funds requirement of at least two percent of average outstanding e-money), are unchanged. Separately, commentary this cycle describes a dual-licensing hub structure in Cyprus, whereby crypto-asset service providers whose e-money-token-related transfer or custody services qualify as payment services under the EU's second Payment Services Directive must separately hold a Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or partner with an authorised payment service provider, alongside their CySEC Markets in Crypto-Assets Regulation authorisation. This finding carries an uncertain confidence rating pending primary-source confirmation from the Central Bank of Cyprus or CySEC. #### Outlook The Pre-Application Exploratory Stage should be treated as the standing market-entry pathway for Cyprus payment institutions and electronic money institutions going forward, adding measurable time and cost to market entry without altering substantive capital or authorisation thresholds. The crypto-asset service provider dual-licensing interface question remains open pending primary regulatory clarification. _2 earlier updates not shown here._ ###### Standing brief · as of 6 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Cyprus payment and e-money regulation continues to run under the national transposition of PSD2 (Law 31(I)/2018) and the EMI law, both supervised by the Central Bank of Cyprus (CBC), which is the competent authority for PI/EMI authorisation and supervision. That baseline framework has been overlaid, since March 2026, by a dual-licensing requirement for CASPs providing EMT-related payment services: such firms must now hold CBC PI/EMI authorisation, or partner with an authorised PSP, in addition to their existing CySEC CASP authorisation — a convergence assessed as the most commercially significant Cyprus licensing development of the 2025-2026 period. On the conduct and safeguarding side, two further obligations now bind Cyprus PSPs and EMIs: since January 2025, every EMI application must include a full ICT Risk Management framework under DORA, and since October 2025, a mandate requires real-time IBAN-name matching (Verification of Payee) as an anti-fraud backstop applying to both bank and non-bank payment-service providers. On payment rails, the Bank of Cyprus, operating under CBC oversight, implemented full SEPA Instant Credit Transfer sending capability on 9 October 2025 under the EU Instant Payments Regulation. Usage of the instant rail has grown from under 1% to approximately 32% of SEPA credit transfers by volume, and roughly 9% by value, a volume share that now surpasses the euro-area average. On crypto-asset regulation, Cyprus's MiCA national CASP grandfathering window (Article 143(3)) closed on 1 July 2026, following a 27 February 2026 application deadline; CASPs that did not secure full MiCA authorisation by that point must now wind down rather than continue operating under the legacy national registration. This is the single most structurally significant Cyprus payments-adjacent development this cycle, closing the last national-registration crypto pathway available in Cyprus. On the commercial side, CySEC's supervised population reached 808 entities in 2025 (47 new CIF licences), with assets under management in CySEC-regulated collective investment schemes reaching EUR 11.4 billion, alongside a multi-year licensing-automation project at the regulator. #### Outlook Cyprus's regulatory direction across licensing, conduct, and crypto-asset supervision is assessed as tightening, driven jointly by the convergent CBC/CySEC licensing tracks, DORA and Verification-of-Payee conduct obligations, and the MiCA CASP transition. Two forward-dated EU instruments bear watching for their Cyprus effect: the PSD3/PSR unified Payment Institution framework, expected to enter into force in late 2027 with a 24-month grandfathering period for existing licences, which would further merge the EMI and PI licensing tracks now converging under the March 2026 dual-licensing requirement; and the digital euro, whose necessary legislation is expected to be adopted in 2026 ahead of the Eurosystem's targeted 2029 introduction, a general Eurosystem timeline with no Cyprus-specific variant yet visible. No correspondent-banking, merchant-acquiring, or private-company funding signals specific to Cyprus were located this cycle, and no Sentinel-fed AML/CFT feed data was available; these remain open coverage gaps for the next research cycle. This tightening assessment draws on a cold-start baseline evidence set of ten structured claims across five modules, corroborated by sources ranging from Tier 1 regulator material — CySEC's own press release on the MiCA transition, and ECB-level Instant Payments Regulation text — through Tier 3 domestic press to Tier 4 legal-commentary sources, giving the MiCA grandfathering expiry and the SEPA Instant rollout the strongest evidentiary basis of the claims logged this cycle. The jurisdiction_risk_tracker accordingly records Cyprus's regulatory direction as tightening, with W1a, W1b, and W9 identified as the primary domains driving that assessment. No Sentinel-fed AML/CFT feed data for Cyprus was available this cycle; any illicit-finance dimension of the instruments discussed above remains a Financial Integrity Monitor cross-reference rather than a World Payments Monitor conclusion. Two further items remain on watch. The PSD3/PSR unified Payment Institution framework, which would merge EMI and PI licensing while repealing EMD2, is expected to enter into force in late 2027 with a 24-month grandfathering period for existing licences — a timeline that should be read against the precedent just set by the MiCA transition. Separately, the AMLA direct-supervision onset date requires reconciliation, having been reported variably as 2027 or 2028 across sources; its resolution will bear on how quickly EU-level AML supervision converges with the national licensing changes already under way in Cyprus. These gaps — spanning correspondent banking, merchant acquiring, and private-company funding signals — are flagged for targeted research attention in the next cycle, consistent with this monitor's cold-start coverage-building approach for newly onboarded jurisdictions. This baseline sub-brief will be extended in subsequent cycles as further Cyprus-specific developments across the fourteen-module spine are identified. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access limited signal Confirmed confirmed 2026-06-27 The Central Bank of Cyprus (CBC) is the competent authority for Payment Institutions and Electronic Money Institutions. Effective 3 August 2026, the CBC introduced a revised licensing process adding a pre-application 'exploratory stage' ahead of formal submission, under its comprehensive EMI/PI licensing and supervisory strategy, including a new Governance Directive (K.D.P. 245/2026, 29 May 2026) and a dedicated supervisory Directorate. Standing sub-brief · as of 29 June 2026 256 words · last cycle 2026-10-11 #### Licensing, Authorisation & Market Access Cyprus operates an EU-harmonised dual PI/EMI authorisation regime supervised by the Central Bank of Cyprus. Payment institutions are authorised under Law 31(I)/2018 (transposing PSD2) and electronic money institutions under Laws 81(I)/2012 & 2018 (transposing EMD2). Authorisation is granted only to legal persons incorporated and headquartered in Cyprus, with at least part of the payment-service business carried out there; account information service providers register under section 34. This is a non-bank PI/EMI authorisation track, distinct from the bank-PSP route, and the incorporation and head-office requirement directly constrains shell-only structures. Capital tiering defines the cost of entry. EMI initial capital is EUR 350,000; PI initial capital is tiered — EUR 20,000 for money remittance only, EUR 50,000 for PIS only, and EUR 125,000 for full services under Annex I points 1-5. No small-institution regime exists, and the CBC may prevent the multiple use of own-funds elements within a group. The absence of a de-minimis PI route raises the floor relative to jurisdictions offering one, a direct cost-of-entry signal for non-bank operators weighing Cyprus as a passporting base across the EEA. CASP and MiCA competence sits with CySEC rather than within this licensing track. #### Outlook The W1a standing position is established and Confirmed on two Tier-1 CBC anchors. No near-term change to the core authorisation architecture is signalled; the live pressure is at the conduct and governance layer (W1b) rather than in licensing thresholds. Watch for any movement on a small-institution route, the absence of which remains the distinguishing competitive feature of the regime. Periodic update · new data 2026-10-11 #### Licensing, Authorisation & Market Access The Central Bank of Cyprus has made a structural investment in its electronic-money and payment-institution licensing regime this cycle. On 3 August 2026, a revised EMI/PI licensing process took effect, introducing a pre-application exploratory stage that precedes formal licence submission. This is a procedural innovation of some significance: rather than receiving applications cold and assessing them solely against a static checklist, the CBC now engages prospective applicants earlier, which can surface structural or governance deficiencies before a formal application is lodged and potentially reduce rejection rates or protracted back-and-forth during formal review. This licensing-process change did not arrive in isolation. The CBC has also established a dedicated Directorate for the Supervision of EMIs and PIs, a structural organisational commitment that separates EMI/PI supervision from other prudential functions within the central bank and signals an intention to build specialised supervisory capacity for this sector rather than treating it as an adjunct to broader banking supervision. Taken together with the new pre-application stage, this represents a coherent strategy: Cyprus is positioning itself to process EMI/PI licence applications more rigorously and with dedicated resources, rather than simply tightening substantive licensing criteria. Complementing the process change, the CBC published the Internal Organisation and Governance of Electronic Money Institutions Directive of 2026 (K.D.P. 245/2026) in the Official Gazette on 29 May 2026, with immediate effect. The directive's governance requirements are extended by analogy to payment institutions, meaning the same internal-organisation and governance standard now applies across both EMI and PI licence categories despite being formally titled for EMIs alone. This drafting approach, extension by analogy rather than a parallel instrument, is a notable legislative choice: it achieves regulatory parity between the two licence types without requiring a second full directive, but it also means that payment institutions must look to an EMI-titled instrument to find their own governance obligations, a point worth flagging for any firm conducting a Cyprus PI governance gap-analysis. The combined effect of these three measures, the pre-application exploratory stage, the dedicated supervisory directorate, and the governance directive, is a licensing environment that has moved from a comparatively lighter-touch posture toward a more structured, resource-intensive model. For prospective EMI/PI applicants, this likely means a longer and more engaged path to authorisation, but potentially a higher-quality and more predictable one, since issues can be identified and addressed during the exploratory stage rather than only surfacing during formal review. For existing licensees, the governance directive's immediate effect means compliance with its internal-organisation standards is not phased in but already binding. #### Outlook The practical effects of the CBC's new licensing architecture will become visible as the first cohort of applicants moves through the pre-application exploratory stage introduced in August 2026; whether this lengthens or shortens overall time-to-licence relative to the prior process is not yet observable. The dedicated EMI/PI supervisory directorate's capacity and resourcing will likely determine how consistently the new governance directive's standards are enforced across the existing licensee population. Firms considering Cyprus as an EMI/PI licensing jurisdiction should factor the exploratory stage into their planning timelines, and existing licensees should confirm their internal-organisation arrangements already meet K.D.P. 245/2026's immediate-effect governance standard. **3 earlier distinct update(s)** Periodic update · new data 2026-10-05 #### Licensing, Authorisation & Market Access The Central Bank of Cyprus has introduced a mandatory Pre-Application Exploratory Stage for prospective payment institutions and electronic money institutions, effective 3 August 2026. Under the new process, applicants must submit a Pre-Application Document and pay a non-refundable EUR 5,000 fee before the Central Bank will accept a formal licence application. The preliminary assessment period that follows runs thirty to fifty working days, and applicants that trigger enhanced due diligence requirements face potential additional costs layered on top of the base fee and timeline. Together, these changes materially extend the overall time-to-licence for new market entrants into the Cyprus payment-institution and electronic-money-institution space. It is important to separate what has changed from what has not. The substantive authorisation thresholds, the minimum capital tiers that a prospective payment institution or electronic money institution must meet, remain unaltered by this development. Those tiers stand at EUR 20,000 for money-remittance-only firms, EUR 50,000 for payment-initiation-service providers, EUR 125,000 for full payment institutions, and EUR 350,000 for electronic money institutions, with electronic money institutions additionally required to maintain ongoing own funds of at least two percent of average outstanding e-money. The Pre-Application Exploratory Stage sits upstream of these thresholds, functioning as a screening gate rather than a change to the bar a firm must ultimately clear. The practical consequence for market access is best understood as a front-loading of cost and time. Previously, a prospective applicant's first formal interaction with the Central Bank of Cyprus would have been the licence application itself. Now, that applicant must first commit a non-refundable EUR 5,000 fee and wait out a preliminary assessment window of thirty to fifty working days, with the possibility of further delay and cost should the Central Bank determine that enhanced due diligence is warranted. For firms that pass this preliminary stage, the formal application and the underlying capital and governance requirements proceed largely as before, but the net effect across the market is a longer and more expensive runway to market entry than existed prior to 3 August 2026. This development should be read as a procedural tightening rather than a substantive one. The Central Bank of Cyprus has not raised capital thresholds, has not introduced new categories of regulated activity, and has not altered the underlying licence types available to payment institutions and electronic money institutions. What it has done is insert a formal pre-screening mechanism that gives the Central Bank visibility into, and a cost-bearing filter against, prospective applicants before they commit to the full formal application process. For firms assessing Cyprus as a licensing jurisdiction within the European Union's payment-services framework, this changes the practical calculus around timeline and budget for market entry without changing the destination requirements themselves. A related but distinct development concerns the interface between Cyprus's national payment-institution and electronic-money-institution regime and the Markets in Crypto-Assets Regulation authorisation track. Commentary indicates that crypto-asset service providers whose e-money-token-related transfer or custody activities qualify as payment services under the EU's second Payment Services Directive may need to separately hold a Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or to partner with an already-authorised payment service provider, in addition to their CySEC Markets in Crypto-Assets Regulation authorisation. This has been characterised in commentary as producing a dual-licensing hub structure within Cyprus, where a single crypto-asset business may need to satisfy two separate Cyprus regulators' authorisation regimes depending on the precise service mix it offers. This finding carries an uncertain confidence rating because no primary notice from either the Central Bank of Cyprus or CySEC confirming the exact interface rule was retrieved this cycle; it should be treated as an area requiring primary-source confirmation rather than an established regulatory position. For firms actively planning Cyprus market entry, the combined picture this cycle is one of increased friction at the threshold of market access, via the new Pre-Application Exploratory Stage, layered onto a pre-existing structural question about how crypto-asset service providers' payment-adjacent activities interact with the separate national payment-institution licensing track. #### Outlook The Pre-Application Exploratory Stage is now in force and should be treated as a standing feature of the Cyprus payment-institution and electronic-money-institution market-entry pathway; no sunset or review date was identified this cycle. Prospective applicants should budget for the non-refundable EUR 5,000 fee and the thirty-to-fifty-working-day preliminary assessment window as a baseline addition to their market-entry timeline, with further delay possible where enhanced due diligence is triggered. The dual-licensing interface question for crypto-asset service providers offering payment-service-adjacent e-money-token functions remains open pending a primary regulatory notice from the Central Bank of Cyprus or CySEC clarifying the precise boundary between Markets in Crypto-Assets Regulation authorisation and any separate payment-institution licensing requirement; firms in this segment should expect continued uncertainty on this point until such clarification emerges. Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access The Central Bank of Cyprus introduced a revised payment-institution and electronic-money-institution licensing process effective 3 August 2026, the centrepiece of which is a new mandatory Pre-Application Exploratory Stage sitting before formal authorisation. The intent, per reporting, is to give the CBC early visibility into a prospective applicant's business model, ownership structure and group structure before that applicant commits to a formal application, effectively front-loading the scrutiny that previously arrived only at the formal-application stage. This finding rests on law-firm commentary describing the process change; the CBC's own licensing pages were not independently cross-checked for the procedural detail this cycle, so the finding is held at probable rather than confirmed. This sits alongside the CBC's Electronic Money Institutions Directive of 2025, a directly published Central Bank of Cyprus instrument governing internal organisation, governance and prudential supervision of electronic money institutions. The Directive is a confirmed, T1-sourced instrument and represents the settled governance backbone against which the new Pre-Application Exploratory Stage now operates. Taken together, these two developments describe a market-access environment that is becoming procedurally more demanding for both payment institutions and electronic money institutions seeking authorisation in Cyprus, whether they operate as non-bank payment institutions/EMIs under the CBC's dedicated licensing track. The addition of an exploratory pre-application step is consistent with regulators elsewhere front-loading ownership and business-model scrutiny, and it raises the effective bar for market entry even though the underlying licence categories themselves are unchanged. #### Outlook Watch for the Central Bank of Cyprus's own published procedural guidance on the Pre-Application Exploratory Stage to confirm the scope and duration of the new stage, since the current finding rests on secondary law-firm commentary rather than a directly retrieved CBC document. Confirmation of processing-time impact on pending applications would also sharpen the market-access read for prospective entrants. Periodic update · new data 2026-08-25 #### Licensing, Authorisation & Market Access Cyprus's payment-institution and electronic-money-institution licensing framework is governed by Law 31(I)/2018, the national transposition of the second Payment Services Directive, with the Central Bank of Cyprus as the competent authority for authorisation and supervision. This baseline governing structure is unchanged this cycle, but the practical licensing landscape around it has shifted materially. From March 2026, Cyprus crypto-asset service providers that offer payment services related to electronic money tokens must hold Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or partner with an already-authorised payment service provider, in addition to the CySEC CASP authorisation those firms already carry. This dual-licensing convergence, layering a payments-regulatory requirement onto an existing crypto-authorisation track, is assessed as the most commercially significant Cyprus licensing development across 2025 and 2026, because it collapses what were previously two largely separate authorisation tracks — crypto-asset supervision under CySEC and payment-institution supervision under the Central Bank of Cyprus — into a single compliance obligation for a specific, commercially active category of firm. Looking further out, the EU's proposed Payment Services Directive 3 and accompanying Payment Services Regulation are expected to merge the existing electronic-money-institution and payment-institution licensing categories into a single, unified Payment Institution framework, with the second Electronic Money Directive repealed entirely. Entry into force is expected in late 2027, with a twenty-four-month grandfathering period anticipated for firms already licensed under the current dual-category structure. For Cyprus payment and e-money institutions, this means the current CBC authorisation landscape, and the new EMT-related dual-licensing requirement layered onto it this cycle, should both be understood as transitional rather than final: firms licensed today will need to plan for a further consolidation once PSD3 takes effect, on top of adapting to the March 2026 EMT-related convergence requirement in the near term. Both developments concern non-bank payment institutions and electronic-money institutions specifically — the CBC-authorised entity class distinct from Cyprus's licensed banks, which access payment services through a separate prudential authorisation channel — and both tighten, rather than loosen, the market-access bar for that non-bank category over the near-to-medium term. The licensing convergence also has direct bank-versus-nonbank significance for market structure: because the requirement specifically targets non-bank crypto-asset service providers seeking to offer EMT-related payment services, it does not alter the position of Cyprus-licensed banks, which already operate under full banking-licence prudential supervision and would not need a separate PI/EMI authorisation to offer equivalent services. The practical effect is to narrow the competitive gap between bank-affiliated and non-bank payment-services providers specifically in the EMT-related payments space, by requiring non-bank CASPs to meet a payments-specific authorisation bar that banks already satisfy through their existing licence. For market entrants evaluating Cyprus as a base for EMT-related payment services, the practical entry pathway is now twofold rather than singular: securing CySEC CASP authorisation alone is no longer sufficient if the underlying activity involves EMT-related payment services, and the additional PI/EMI authorisation, or a qualifying PSP partnership, must be secured before commercial launch. This raises both the compliance cost and the licensing timeline for prospective entrants relative to the pre-March-2026 baseline. The underlying CBC authorisation framework itself, Law 31(I)/2018, remains the baseline governing instrument for Cyprus PI/EMI authorisation and supervision, and no change to that baseline framework was identified this cycle; the developments described above sit on top of it rather than replacing it, layering a crypto-specific dual-authorisation requirement, and a forthcoming PSD3-driven unification, onto a stable existing statutory base. #### Outlook Watch for the first published PSD3/PSR legislative text, which would clarify the precise mechanics of the unified Payment Institution framework and the terms of its twenty-four-month grandfathering period for firms already licensed under Cyprus's current dual CBC/CySEC structure. Nearer term, watch for how many Cyprus CASPs providing EMT-related payment services have secured CBC PI/EMI authorisation, or a qualifying PSP partnership, ahead of and following the March 2026 convergence requirement, since this cycle's sourcing established the requirement's existence but not its population-level compliance status. Also worth tracking is whether the Central Bank of Cyprus issues any implementing guidance specific to the March 2026 EMT-related convergence requirement, since this cycle's sourcing captured the requirement itself but not any CBC-specific implementing detail beyond the CySEC CASP authorisation dimension. **Sources and findings (5)** 1. T1 [https://www.centralbank.cy/en/licensing-supervision/payment-institutions/licensing-and-supervision-of-payment-institutions](https://www.centralbank.cy/en/licensing-supervision/payment-institutions/licensing-and-supervision-of-payment-institutions) retrieved 2026-06-27 2. T1 [https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions](https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions) retrieved 2026-06-27 3. T3 [https://www.sovereigngroup.com/cyprus/corporate-services/payment-institutions-and-electronic-money-institutions/](https://www.sovereigngroup.com/cyprus/corporate-services/payment-institutions-and-electronic-money-institutions/) retrieved 2026-06-27 4. T3 [https://obtained.com/blog/emi-pi-application-cyprus-mica-casp](https://obtained.com/blog/emi-pi-application-cyprus-mica-casp) retrieved 2026-06-27 5. T3 [https://thebanks.eu/emis/jcc-payment-systems-355373](https://thebanks.eu/emis/jcc-payment-systems-355373) retrieved 2026-06-27 ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-06-27 Safeguarding of user funds (segregation or insurance/guarantee) is mandated under the EMI/PI laws, with CBC adopting EBA safeguarding guidance (EBA/GL/2018/05). In 2025-2026 the CBC issued new directives strengthening EMI/PSP governance, capital and suitability, and the Internal Organisation and Governance of EMIs Directive (incorporating by analogy the Internal Organisation and Governance of Payment Institutions Directive of 2026) moved governance to a structured, board-accountable obligation. Suitability of management body members is assessed under the 2025 Suitability Directive. Standing sub-brief · as of 29 June 2026 227 words · last cycle 2026-08-05 #### Conduct, Safeguarding & Promotions Safeguarding of user funds — through segregation or insurance/guarantee cover — is mandated under the EMI/PI laws, with the CBC adopting EBA safeguarding guidance (EBA/GL/2018/05) and EBA authorisation guidance (EBA/GL/2017/09) for both application and ongoing supervision. The mechanism applies to non-bank PIs and EMIs, for which deposit protection does not apply; the segregation-versus-insurance choice directly affects operating-account structure and client-trust positioning. This is the bank-PSP versus non-bank PI/EMI distinction in operational form: customer-fund protection here is a prudential and conduct obligation, not a depositor-guarantee backstop. The conduct layer is tightening. The CBC introduced new directives effective from 2025 strengthening the EMI/PSP framework across capital adequacy, governance and risk-management oversight — covering fund safeguarding and AML — including the Internal Organisation and Governance of EMIs Directive (incorporating by analogy the Internal Organisation and Governance of Payment Institutions Directive of 2026: management body, internal controls, ICT/DORA-aligned obligations, outsourcing, complaints and whistleblowing) and the 2025 Suitability Directive assessed via CBC e-platform personal questionnaires. Board-level accountability and suitability assessment raise the compliance and governance overhead for EMIs and PIs domiciling in Cyprus. #### Outlook The W1b trajectory is tightening, held at High. Governance and suitability obligations are moving toward board-accountable standards, and challenger reporting of further May-2026 governance-rule tightening is consistent with this direction. Expect continued upward pressure on conduct and governance compliance for non-bank PIs and EMIs. Periodic update · new data 2026-08-25 #### Conduct, Safeguarding & Financial Promotions Two conduct-and-safeguarding obligations now bind Cyprus payment institutions and electronic-money institutions as a matter of settled requirement rather than pending reform. Since January 2025, every electronic-money-institution application submitted in Cyprus must include a full ICT risk-management framework under the Digital Operational Resilience Act, embedding operational-resilience requirements directly into the authorisation stage rather than leaving them to post-licensing supervision alone. Since October 2025, Cyprus payment service providers have also operated under a Verification of Payee mandate, requiring real-time matching of the payee's IBAN against the payee's name before a transfer completes, as an anti-fraud backstop applicable across the licensed payment-services population. Both obligations are assessed as elevated-impact developments, and both apply across the bank and non-bank payment-services population differently: the DORA-linked ICT risk-management requirement is scoped specifically to electronic-money-institution applications, meaning it binds the non-bank e-money authorisation track directly, while the Verification of Payee mandate applies more broadly across both bank and non-bank payment service providers offering payee-facing transfer services, since anti-fraud payee verification is a transaction-level control rather than an entity-type-specific one. Together, the two obligations represent a tightening of the conduct and operational-resilience bar for Cyprus payment institutions at both the pre-licensing and in-life stages: DORA-linked ICT risk management is assessed at the point of application, embedding resilience expectations before a firm is even authorised, while Verification of Payee is a continuous, transaction-level control that must operate correctly for the life of the licence. Neither obligation is Cyprus-specific in origin — both flow from EU-level instruments, DORA and the Instant Payments Regulation's payee-verification requirement respectively — but both now form part of the settled compliance baseline that any Cyprus payment institution or electronic-money institution must satisfy. The Verification of Payee mandate in particular should be read alongside Cyprus's parallel instant-payments rail development this cycle: as SEPA Instant Credit Transfer volumes grow toward and past the roughly thirty-two-percent-by-volume share reported for Cyprus, the anti-fraud stakes of real-time payee verification rise correspondingly, since a growing share of Cyprus payment volume now moves through rails where a mismatched or fraudulent payee could complete a transfer within seconds rather than the settlement window associated with slower payment rails. For new market entrants, the practical implication of the DORA-linked requirement is that ICT risk-management documentation is now a gating item at the application stage rather than a post-authorisation deliverable, meaning prospective Cyprus electronic-money-institution applicants must have a complete ICT risk-management framework ready before submission, not merely a plan to develop one after authorisation is granted. Both obligations also carry a documentation and audit-trail dimension: DORA-linked ICT risk-management frameworks and Verification of Payee controls must both be demonstrable to the Central Bank of Cyprus on supervisory request, meaning Cyprus payment institutions should expect both to form part of ordinary supervisory review going forward, rather than being one-off compliance exercises assessed only at authorisation or launch. It is also worth noting that neither obligation was identified as introducing a new financial-promotions or marketing-restriction rule specifically; the conduct tightening identified this cycle is safeguarding- and resilience-focused rather than promotions-focused, and no Cyprus-specific financial-promotions development was located within this module's scope this cycle. Cyprus payment institutions preparing for supervisory review under either obligation should treat the absence of a located enforcement precedent as a reason for caution rather than complacency: both obligations are recent enough, DORA-linked ICT risk management dating to January 2025 and Verification of Payee to October 2025, that a first enforcement or supervisory-finding precedent may simply not yet exist rather than compliance being confirmed adequate across the licensed population. #### Outlook Watch for the first enforcement or supervisory findings under either obligation, since this cycle's sourcing established the existence and effective dates of both requirements but did not surface any Cyprus-specific compliance-testing or enforcement outcome yet. Also worth tracking is whether the Central Bank of Cyprus issues Cyprus-specific implementing guidance on either the DORA-linked ICT risk-management expectations or the Verification of Payee mandate, beyond the EU-level instruments from which both obligations originate. Given both obligations are recent, the coming cycles are likely to be where supervisory testing first surfaces, making this an area to monitor closely rather than treat as settled. **Sources and findings (4)** 1. T3 [https://cxfinancia.com/what-is-a-payment-services-licence-in-cyprus/](https://cxfinancia.com/what-is-a-payment-services-licence-in-cyprus/) retrieved 2026-06-27 2. T3 [https://www.harneys.com/our-blogs/regulatory/the-central-bank-of-cyprus-introduces-new-directives-for-emis-and-psps/](https://www.harneys.com/our-blogs/regulatory/the-central-bank-of-cyprus-introduces-new-directives-for-emis-and-psps/) retrieved 2026-06-27 3. T3 [https://mnkriskconsulting.com/regulatory-developments/central-bank-of-cyprus-directive-on-the-internal-organisation-and-governance-of-electronic-money-institutions/](https://mnkriskconsulting.com/regulatory-developments/central-bank-of-cyprus-directive-on-the-internal-organisation-and-governance-of-electronic-money-institutions/) retrieved 2026-06-27 4. T1 [https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions](https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions) retrieved 2026-06-27 ### W2 Stablecoins & Digital Money limited signal Confirmed confirmed 2026-06-27 Cyprus applies MiCA directly as an EU member state; CySEC is the designated competent authority for CASPs and ART issuers, with the Central Bank of Cyprus handling e-money-token issuers. The Article 143(3) national transitional regime for pre-MiCA registered CASPs expired 1 July 2026, after which CySEC issued post-expiry warnings to firms and investors. Horizon · 2026-07 (±quarter) MiCA hard enforcement deadline for Cyprus CASPs (transitional window ends)_in_force_pending · T2_ Standing sub-brief · as of 29 June 2026 246 words · last cycle 2026-10-11 #### Stablecoins & Digital Money Cyprus applies MiCA (Reg (EU) 2023/1114) with a defined competent-authority split. EMTs (Title IV) are economically assimilated to e-money and excluded from CySEC's mandate, leaving the CBC as the competent authority for EMTs; CySEC supervises ARTs (Title III), other crypto-assets (Title II) and CASPs (Title V), with significant ARTs and EMTs drawing additional EBA supervision. EMT issuance is restricted to credit institutions and EMIs. The practical consequence is structural: a MiCA CASP licence alone is insufficient to launch a stablecoin from Cyprus — an issuer must hold credit-institution or EMI status, a gating constraint that separates crypto-service activity from stablecoin issuance. This carries the bank-versus-non-bank distinction directly into the digital-money layer. A transitional window is closing. CySEC transitional guidance under MiCA Art.143 allows CASPs compliant with national rules before 30 December 2024 to continue until 1 July 2026 — the hard enforcement deadline — or until granted or denied MiCA authorisation, whichever is first. Research cites a 10 January 2025 compliance-evidence submission deadline, but a 2026 source reports the existing-CASP application lodgement deadline as 27 February 2026; this procedural milestone is carried at Assessed pending reconciliation, while the 1 July 2026 hard deadline is robust. #### Outlook The W2 standing position is established and Confirmed on the competent-authority split and issuance restriction. The dominant forward event is the 1 July 2026 transitional cliff-edge, forcing incumbent CASPs to obtain full MiCA authorisation or exit. The distinct application-lodgement milestones should be disambiguated before publication-level reliance. Periodic update · new data 2026-10-11 #### Stablecoins & Digital Money The defining Cyprus development in this module this cycle is the complete closure of the MiCA Article 143(3) national transitional regime for crypto-asset service providers, effective 1 July 2026. Under the transitional arrangement, CASPs that had been operating under Cyprus's prior national registration framework were permitted to continue doing so only if they had submitted a complete MiCA authorisation application to CySEC by 27 February 2026; thereafter, continued operation under national rules was permitted only until the application was approved or refused, or until 1 July 2026, whichever came first. That cutoff has now passed, meaning that registration under the prior national framework is no longer, by itself, a sufficient basis for a Cyprus CASP to continue operating. This is a structural tightening event rather than an incremental one: it does not add a new disclosure requirement or amend a conduct rule, it eliminates an entire category of lawful operating basis. A CASP that had been operating in reliance on the transitional window and did not secure either full MiCA authorisation or an Article 60 cross-border notification by the deadline has, as of 1 July 2026, no remaining lawful basis to continue providing crypto-asset services in Cyprus under the prior regime. The practical consequence is a narrowing of the Cyprus-domiciled CASP population to those that cleared the full MiCA bar, which is a materially higher threshold than the prior national registration standard. This development is directly relevant to stablecoin issuance and digital-money infrastructure in Cyprus, since CASPs providing services related to asset-referenced tokens and e-money tokens fall within the same authorisation perimeter that the transitional regime's expiry now closes off. Any Cyprus-based entity involved in facilitating stablecoin trading, custody, or transfer services needed to have secured full MiCA authorisation by the same deadline as any other CASP activity; there is no separate or more lenient transitional allowance carved out specifically for stablecoin-related service providers. #### Outlook With the transitional window now closed, the Cyprus CASP population, including any entities engaged in stablecoin-related services, is fully subject to MiCA's EU-wide authorisation regime going forward, with no further national grace period available. The practical test of this cycle's development will be whether any enforcement action follows against entities that continued operating past 1 July 2026 without securing authorisation; no such enforcement action has been identified within this cycle's research. Firms assessing Cyprus as a base for stablecoin or digital-money services should treat full MiCA authorisation, rather than any form of national registration, as the only available lawful pathway from this point forward. **Sources and findings (4)** 1. T1 [https://www.cysec.gov.cy/en-GB/mica-regulation-overview/](https://www.cysec.gov.cy/en-GB/mica-regulation-overview/) retrieved 2026-06-27 2. T3 [https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/](https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/) retrieved 2026-06-27 3. T3 [https://finance.yahoo.com/news/revolut-secures-mica-license-cyprus-160103192.html](https://finance.yahoo.com/news/revolut-secures-mica-license-cyprus-160103192.html) retrieved 2026-06-27 4. T2 [https://www.financemagnates.com/cryptocurrency/cysec-outlines-transitional-rules-for-crypto-asset-service-providers-under-mica/](https://www.financemagnates.com/cryptocurrency/cysec-outlines-transitional-rules-for-crypto-asset-service-providers-under-mica/) retrieved 2026-06-27 ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-06-27 Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable from 17 January 2025, with CySEC and CBC as the supervising authorities for in-scope entities (banks, PIs, EMIs, investment firms, CASPs). DORA mandates ICT risk-management frameworks, incident classification/reporting, digital operational resilience testing (TLPT every three years for significant entities, with proportionality exemptions for smaller PIs/EMIs) and ICT third-party/outsourcing oversight. CySEC issued implementing guidance, including Circular C751 in early 2026. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/cyprus/) Standing sub-brief · as of 29 June 2026 153 words · last cycle 2026-09-28 #### Operational Resilience & Critical Infra DORA (Reg (EU) 2022/2554) is directly applicable from 17 January 2025, with CySEC and the CBC supervising in-scope entities including banks, PIs, EMIs, investment firms, CASPs and critical ICT third parties. Non-microenterprise entities must run a digital operational resilience testing programme, with advanced threat-led penetration testing every three years for those carrying significant ICT risk, and exemptions available for PSD2/EMD-exempt PIs and EMIs. CySEC issued Circular C751 in early 2026. The regime applies across both bank-PSP and non-bank PI/EMI populations, imposing a fixed resilience compliance baseline on all Cyprus payments entities while preserving TLPT proportionality relief for smaller PIs and EMIs. #### Outlook The W3 trajectory is established and Confirmed: the direct-applicability date is a supranational fact, and multiple Cyprus-specific sources plus the named CySEC circular support the standing position. ICT-risk, incident-reporting and third-party oversight obligations are now embedded; the operational focus shifts to supervisory implementation under Circular C751. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure Since January 2025, the Digital Operational Resilience Act's ICT risk-management framework requirement has been folded into the Central Bank of Cyprus's authorisation review for payment institutions and electronic money institutions. In practice this means every EMI application to the CBC must now include a full ICT risk-management framework as a mandatory component of the authorisation package, rather than resilience compliance being addressed as a separate, later-stage supervisory exercise once a licence has already been granted. This integration links directly to the licensing-tightening development reported this cycle under Licensing, Authorisation & Market Access: the same authorisation gate that now includes a Pre-Application Exploratory Stage also requires a complete ICT risk-management framework, meaning market access and operational-resilience compliance have become a single combined authorisation hurdle for a prospective Cyprus payment institution or e-money institution rather than two sequential ones. The finding is sourced to commentary discussing DORA and EMI authorisation requirements together, and is held at probable confidence pending independent confirmation against the CBC's own authorisation guidance. For firms already licensed in Cyprus, this development signals that ICT risk-management documentation is likely to be a live component of ongoing supervisory expectations, not only a one-off authorisation-stage requirement, consistent with DORA's broader EU-wide operational-resilience supervisory design. #### Outlook Watch for CBC publication of specific ICT risk-management framework content or format requirements for EMI/PI applicants, and for any indication of how the DORA-integrated review affects processing timelines for applications currently in the CBC's pipeline. **Sources and findings (3)** 1. T3 [https://www.kyprianou.com/digital-operational-resilience-act-dora-key-compliance-considerations-for-cyprus-financial-entities/](https://www.kyprianou.com/digital-operational-resilience-act-dora-key-compliance-considerations-for-cyprus-financial-entities/) retrieved 2026-06-27 2. T3 [https://www.harneys.com/our-blogs/regulatory/cysec-publishes-the-main-aspects-of-the-implementation-of-the-digital-operational-resilience-framework-dora/](https://www.harneys.com/our-blogs/regulatory/cysec-publishes-the-main-aspects-of-the-implementation-of-the-digital-operational-resilience-framework-dora/) retrieved 2026-06-27 3. T3 [https://www.cyprus-insider.com/cysec-accelerates-dora-implementation-strengthening-cypruss-digital-operational-resilience/](https://www.cyprus-insider.com/cysec-accelerates-dora-implementation-strengthening-cypruss-digital-operational-resilience/) retrieved 2026-06-27 ### W4 Scheme & Network Compliance Confirmed confirmed 2026-06-27 Card-scheme economics are governed by the EU Interchange Fee Regulation (EU 2015/751) implemented domestically by Cyprus Law N.77(I)/2018, with the CBC, the Commission for the Protection of Competition and the Consumer Protection Service as joint competent authorities. Caps are 0.2% (debit) and 0.3% (credit). Visa, Mastercard, Diners and China UnionPay schemes run through JCC, the domestic acquirer/processor. PCI DSS and 3-D Secure apply at the acquiring layer. SEPA SCT Inst rails operate under the EU Instant Payments Regulation with mandatory Verification of Payee. Standing sub-brief · as of 29 June 2026 201 words · last cycle 2026-06-27 #### Scheme & Network Compliance Card-scheme economics are governed by the EU Interchange Fee Regulation (EU 2015/751), implemented in Cyprus by Law N.77(I)/2018, with caps of 0.2% on debit and 0.3% on credit. The CBC, the Commission for the Protection of Competition and the Consumer Protection Service are joint competent authorities. Acquirers must individually specify merchant service charges by card category and brand unless blended charging is requested in writing — an unblending requirement that shapes MSC transparency for Cyprus merchants and fixes the acquiring-side cost floor. On the account-to-account side, SEPA SCT Inst rails operate under the EU Instant Payments Regulation with mandatory Verification of Payee; the CBC acts as lead operator facilitating access to the Eurosystem TIPS service, with wide SCT Inst adoption around 9 January 2025. Mandatory VoP and universal SCT Inst availability at standard-transfer pricing reshape A2A competitiveness against cards for Cyprus PSPs across both bank and non-bank populations. #### Outlook The W4 standing position is established, with the IFR layer Confirmed on two Tier-1 anchors and the instant-payments layer held at High. No scheme-rule change is signalled near term; the structural watch is the competitive shift from cards toward instant A2A as VoP and SCT Inst pricing mature. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.centralbank.cy/en/financial-market-infrastructures-payments/interchange-fee-regulation](https://www.centralbank.cy/en/financial-market-infrastructures-payments/interchange-fee-regulation) retrieved 2026-06-27 2. T1 [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) retrieved 2026-06-27 3. T3 [https://www.lightspark.com/knowledge/cyprus-instant-payments](https://www.lightspark.com/knowledge/cyprus-instant-payments) retrieved 2026-06-27 4. T3 [https://www.ecommerce-payments.com/en/english-jcc-payment-system.html](https://www.ecommerce-payments.com/en/english-jcc-payment-system.html) retrieved 2026-06-27 ### W5 Payment Corridor Dynamics Probable confirmed 2026-06-27 As a euro-area member, Cyprus's principal corridors are euro-denominated SEPA flows (SCT, SCT Inst, SDD) settled in T2-CY, with non-euro cross-border flows reliant on correspondent networks. The Cyprus SEPA Direct Debit system (CY-SDD) has operated since 2014, settling in T2-CY; TIPS access provides pan-European instant reach across the 36-country SEPA zone. The CBC operates TARGET-CY and stands ready to support local credit institutions accessing TIPS. Standing sub-brief · as of 29 June 2026 122 words · last cycle 2026-08-05 #### Payment Corridor Dynamics As a euro-area member, Cyprus's principal corridors are euro-denominated SEPA flows — SCT, SCT Inst and SDD — settled in T2-CY, with CY-SDD having operated since 2014. TIPS access provides pan-European instant reach across the 36-country SEPA zone. Non-euro cross-border flows, by contrast, rely on correspondent networks. The structural corridor-risk axis for Cyprus operators is the contrast between euro-corridor strength via SEPA and TIPS and the dependence on correspondent banking for non-euro flows. #### Outlook The W5 trajectory is stable, held at High, with the SEPA and CY-SDD anchors on a Tier-1 CBC page and cross-border correspondent reliance on lower-tier sourcing. The euro-corridor position is settled; the live risk lies in the non-euro correspondent dimension, treated more fully under W12. Periodic update · new data 2026-08-25 #### Payment Corridor Dynamics Cyprus implemented full SEPA Instant Credit Transfer sending capability on 9 October 2025, under the EU Instant Payments Regulation, completing the domestic instant-payments rail buildout for the Cyprus banking sector. This is a High-confidence finding, corroborated by the underlying EU Instant Payments Regulation text itself alongside Cyprus Mail's reporting on the domestic implementation date, and it carries a High impact rating for Cyprus payment-corridor dynamics specifically. The usage data accompanying the implementation is itself a significant corridor-dynamics finding: instant-payments volume share in Cyprus has grown from under one percent to approximately thirty-two percent of SEPA credit transfers by volume, and approximately nine percent by value, a growth trajectory attributed to the Central Bank of Cyprus, and one that places Cyprus above the euro-area average for instant-payments adoption. The gap between the thirty-two-percent volume share and the nine-percent value share is itself informative about corridor composition: it suggests that instant rails in Cyprus are being used disproportionately for a high number of lower-value transfers relative to the overall SEPA credit-transfer population, rather than uniformly across transfer sizes, consistent with instant rails displacing everyday, lower-value payment activity ahead of higher-value transfers that may still favour other settlement channels. This corridor development sits within the bank-led payments-infrastructure category specifically: the SCT Inst sending-capability implementation and the usage-growth finding both concern Cyprus's banking-sector payment-corridor infrastructure, as distinct from the non-bank payment-institution and electronic-money-institution licensing developments tracked elsewhere this cycle. The euro-area-average-beating adoption rate is a genuinely distinguishing finding for Cyprus specifically, rather than a generic EU-wide instant-payments development, and should be weighted accordingly as a jurisdiction-specific corridor-dynamics signal. The full SCT Inst sending-capability milestone also has a direct connection to the Verification of Payee mandate tracked separately this cycle: as an increasing share of Cyprus payment volume shifts onto instant rails, the anti-fraud value of real-time payee verification rises correspondingly, since instant transfers settle within seconds and leave a correspondingly shorter window for post-transfer fraud remediation relative to slower payment rails. For Cyprus banks specifically, the completion of full SCT Inst sending capability represents the closing of what had been an open infrastructure item under the EU Instant Payments Regulation's phased implementation timeline; Cyprus's banking sector has now moved from partial to full sending-side compliance, a distinct and more advanced position than a bank that has implemented receiving capability alone without full sending-side rollout. The thirty-two-percent volume share is also notable in comparative terms: because the reported figure explicitly surpasses the euro-area average, Cyprus's instant-payments adoption trajectory should be read as a genuine outperformance finding specifically, rather than simply tracking the broader EU-wide adoption curve that the Instant Payments Regulation's implementation timeline is driving across all member states uniformly. This corridor-dynamics finding has no identified read-through to correspondent-banking access or cross-border settlement arrangements specifically this cycle; the growth described here is a domestic SEPA-area instant-payments adoption finding, distinct from any correspondent-banking-access development. Taken together, the full sending-capability milestone and the above-average usage growth position Cyprus as a comparatively advanced SEPA market for instant-payments adoption specifically. #### Outlook Watch for continued volume and value share growth in coming cycles, and for whether the gap between Cyprus's volume-share and value-share growth trajectories narrows or persists, since a persistent gap would reinforce the reading that instant rails in Cyprus remain concentrated in lower-value transfer activity relative to the broader SEPA credit-transfer population. Also worth tracking is whether Cyprus's above-euro-area-average adoption rate continues to outpace the euro-area average as SCT Inst receiving-capability obligations and further Instant Payments Regulation milestones come into force across the wider SEPA area. Comparative benchmarking against other above-average euro-area adopters would also help contextualise whether Cyprus's specific growth trajectory is converging toward a plateau or continuing to accelerate. **Sources and findings (3)** 1. T1 [https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems](https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems) retrieved 2026-06-27 2. T3 [https://www.lightspark.com/knowledge/cyprus-instant-payments](https://www.lightspark.com/knowledge/cyprus-instant-payments) retrieved 2026-06-27 3. T3 [https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets](https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets) retrieved 2026-06-27 ### W6 Industry Structure & Commercial Confirmed confirmed 2026-06-27 The Cyprus payments market is bank-led at the acquiring layer, dominated by JCC Payment Systems Ltd — a bank-owned consortium (Bank of Cyprus holds a controlling/circa-75% interest; other shareholders include Hellenic Bank, Alpha Bank Cyprus, National Bank of Greece (Cyprus) and AstroBank) acting as the primary card processor. As of 2026 the CBC supervises around 26 EMIs and 11 PIs. Card payments accounted for ~74.5% of cashless transactions in H1 2025, above the euro-area average, and fintechs are emerging as a competitive challenge to incumbent banks. Standing sub-brief · as of 29 June 2026 241 words · last cycle 2026-06-27 #### Industry Structure & Commercial The Cyprus payments market is bank-led at the acquiring layer, dominated by JCC Payment Systems Ltd, a bank-owned consortium in which Bank of Cyprus holds a controlling interest alongside shareholders including Hellenic Bank, Alpha Bank Cyprus, National Bank of Greece (Cyprus) and AstroBank. JCC is the primary card processor and acquirer for Visa, Mastercard and Diners. The exact controlling percentage varies across sources — one cites approximately 75%, an older source cites a historic 45% pre-resolution — so the controlling-interest characterisation is held at High rather than Confirmed and the specific figure is reported, not asserted. This concentration of domestic card acquiring in a single bank-consortium entity defines the competitive structure and the entry challenge for cross-border acquirers. Research cites the CBC supervising 26 EMIs and 11 PIs as of 2026, though a challenger-identified May-2026 source citing an official CBC statement gives 29 EMIs and 10 PIs; the count is carried at Assessed pending reconciliation to the official figure. Card payments accounted for approximately 74.5% of cashless transactions in H1 2025, above the euro-area average, and the digital payments market is projected to grow from $2.76bn in 2025 to $6.70bn in 2030, with fintechs emerging as competition to incumbent banks. #### Outlook The W6 trajectory is established. The acquiring-concentration spine is durable; the supervised-population count must be reconciled to the CBC official statement before publication. The card-share and growth trajectory frame an intensifying competitive landscape for new entrants. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems](https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems) retrieved 2026-06-27 2. T3 [https://cy.linkedin.com/company/jcc-payment-systems](https://cy.linkedin.com/company/jcc-payment-systems) retrieved 2026-06-27 3. T3 [https://bankmycapital.com/cyprus-payment-agents-secure-banking-high-risk/](https://bankmycapital.com/cyprus-payment-agents-secure-banking-high-risk/) retrieved 2026-06-27 4. T3 [https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking](https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking) retrieved 2026-06-27 ### W7 Legal & Litigation Probable confirmed 2026-06-27 Enforcement in the payments-adjacent space is driven by CySEC (CIFs, CASPs, funds) and CBC (credit institutions, PIs, EMIs), plus the National Sanctions Implementation Unit (NSIU). In its 2025 review CySEC reported imposing €2.3 million in fines and ~600 inspections, with thematic inspections in retail FX/CFD and crypto-asset sectors producing administrative fines for sanctions-screening and prudential-reporting deficiencies. The Criminalisation of the Violation of Restrictive Measures Law (2025) empowers the NSIU to impose fines up to €5 million or 10% of annual turnover. CySEC lacks restitution powers; consumer redress runs through the Financial Ombudsman and the District Courts. Standing sub-brief · as of 29 June 2026 199 words · last cycle 2026-06-27 #### Legal & Litigation In its 2025 review CySEC reported imposing approximately EUR 2.3 million in fines and around 600 inspections across CIFs, asset managers, funds, issuers and market infrastructures, approving 47 new licences including 8 CASPs. Thematic inspections in retail FX/CFD and crypto produced administrative fines for sanctions-screening and prudential-reporting deficiencies. CySEC lacks restitution powers; redress runs via the Financial Ombudsman and District Courts. Separately, the Criminalisation of the Violation of Restrictive Measures Law (2025) empowers the National Sanctions Implementation Unit to impose fines. Research cites up to EUR 5 million or 10% of annual turnover with trading suspensions for reporting failures, but a divergent 2025 source reports legal-entity fines of up to 5% of global turnover or EUR 40 million (whichever higher), with individual imprisonment exposure and entry into force around 1 August 2025 implementing EU Directive 2024/1226. The penalty ceiling and entry-into-force date are carried at Assessed pending reconciliation. #### Outlook The W7 trajectory is stable, held at High on the enforcement figures (confirmed by challenger review) but with the sanctions-penalty ceiling contested. The compliance-risk signal is clear — intensifying sanctions-screening enforcement with no regulator restitution power — but the exact penalty exposure requires reconciliation to official sources. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T2 [https://cyprus-mail.com/2026/01/21/cysec-imposes-e2-3-million-in-fines-tightens-aml-and-sanctions-enforcement](https://cyprus-mail.com/2026/01/21/cysec-imposes-e2-3-million-in-fines-tightens-aml-and-sanctions-enforcement) retrieved 2026-06-27 2. T3 [https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments](https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments) retrieved 2026-06-27 3. T1 [https://www.cysec.gov.cy/en-GB/investor-protection/how-to-complain/](https://www.cysec.gov.cy/en-GB/investor-protection/how-to-complain/) retrieved 2026-06-27 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-27 Domestic merchant acquiring is dominated by JCC Payment Systems, the primary card processor and acquirer for Visa, Mastercard, Diners and China UnionPay, providing the JCC Gateway (online card capture and 3-D Secure), JCCsmart (public-sector/biller acceptance), POS terminals, fraud controls, tokenisation, rolling reserves and chargeback handling. Cross-border PSPs (Adyen, Stripe, Mollie, Worldline) compete for EU-footprint merchants. High-risk merchant onboarding is constrained by bank AML/KYC policies, with specialist high-risk providers and PayFac models filling the gap. Standing sub-brief · as of 29 June 2026 141 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk Domestic merchant acquiring is dominated by JCC, the primary acquirer for Visa, Mastercard, Diners and China UnionPay, providing JCC Gateway with online capture and 3-D Secure, JCCsmart, POS terminals, tokenisation, rolling reserves and chargeback handling, with 47-currency processing and PCI DSS / 3-D Secure compliance. High-risk merchant categories — online casinos, pharma, dating — are typically refused by the domestic bank-PSP acquirer; cross-border PSPs including Adyen, Stripe, Mollie and Worldline compete for EU-footprint merchants. The refusal of high-risk MCCs by the domestic acquirer creates a structural gap filled by specialist and PayFac providers — a recurring, under-indexed merchant-acquiring dynamic. #### Outlook The W8 trajectory is stable, held at High on three corroborating sources. The domestic-versus-cross-border split is durable; the analytical watch is the persistence of the high-risk MCC gap and the role of specialist PSPs in filling it. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T3 [https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets](https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets) retrieved 2026-06-27 2. T3 [https://payatlas.com/countries/cyprus-cy](https://payatlas.com/countries/cyprus-cy) retrieved 2026-06-27 3. T3 [https://www.ecommerce-payments.com/en/english-jcc-payment-system.html](https://www.ecommerce-payments.com/en/english-jcc-payment-system.html) retrieved 2026-06-27 ### W9 Product Innovation & Market Development Probable confirmed 2026-06-27 Cyprus's legacy AML-only national CASP registration regime has been fully retired: the MiCA grandfathering window (Article 143(3)) closed on 1 July 2026, after a 27 February 2026 application deadline, moving all CASPs onto full EU MiCA authorisation or a mandated wind-down. Horizon · 2029 (±multi_year) Digital euro — possible first issuance readiness_proposed · T3_ Standing sub-brief · as of 29 June 2026 151 words · last cycle 2026-08-05 #### Product Innovation & Market Development Cyprus runs dual innovation infrastructure: the CBC Innovation Hub covering payments and banking fintech and the EMT/stablecoin boundary, and the CySEC Innovation Hub operating since 2018 alongside a full CySEC Regulatory Sandbox launched in 2024 for supervised live testing, typically up to six months. Open-banking cash-flow analysis operates under PSD2; SCT Inst, request-to-pay and mobile wallets (Apple Pay, Google Wallet) are live. The CBC targets readiness for a possible first digital-euro issuance in 2029, subject to EU legislation in 2026. Sandbox and innovation-hub access, together with digital-euro readiness, signal regulatory openness and act as a market-development draw for fintech domiciliation across both bank and non-bank operators. #### Outlook The W9 trajectory is established, held at High. The thematic, regulatory product-access view here is distinct from discrete commercial launches carried under W13. The forward marker is the digital-euro readiness target of 2029, conditional on EU legislation during 2026. Periodic update · new data 2026-08-25 #### Product Innovation & Market Development The formal close of the Markets in Crypto-Assets Regulation's national grandfathering window for Cyprus crypto-asset service providers, on 1 July 2026 following a 27 February 2026 application deadline, is this cycle's defining product-innovation-and-market-development finding for Cyprus. This is a High-confidence, Critical-impact finding, anchored by a Tier 1 CySEC press release and corroborated across the source base on both the application-deadline and expiry dates. Unauthorised crypto-asset service providers are required to wind down their Cyprus operations; the prior national AML-only registration pathway, which had functioned as an alternative, lighter-touch route to market for crypto-asset activity, is retired in favour of full MiCA authorisation as the only lawful route to market from this point forward. From a product-innovation and market-development standpoint specifically, this transition changes the competitive landscape for crypto-asset product development in Cyprus materially: firms building new crypto-asset products or services in or from Cyprus must now design for full MiCA compliance from the outset, rather than being able to rely on a lighter national registration during an initial go-to-market phase. This raises the compliance-design bar for new product launches and should be factored into any market-entry or product-development timeline for Cyprus-based crypto-asset innovation going forward. The transition also connects directly to the dual CBC/CySEC licensing convergence tracked separately this cycle for electronic-money-token-related payment services, since both developments push Cyprus crypto-asset firms toward a more integrated, cross-regulator compliance posture spanning CySEC's CASP authorisation and the Central Bank of Cyprus's payment-institution authorisation regime simultaneously. The transition also has direct relevance for how Cyprus is positioned relative to other EU member states in the broader MiCA rollout: because the national grandfathering window operated on a standard, EU-wide transitional mechanism under Article 143(3) of the MiCA Regulation, Cyprus's 1 July 2026 expiry date reflects the general MiCA transition timeline rather than a Cyprus-specific acceleration or extension, meaning Cyprus's product-development environment is now converging with the same MiCA baseline applying across the wider European Union crypto-asset market. For product teams evaluating new crypto-asset offerings from a Cyprus base, the practical entry calculus has shifted meaningfully within this single cycle: the comparative advantage that a lighter national AML-only registration might previously have offered relative to full MiCA authorisation elsewhere in the EU no longer exists for Cyprus specifically, since that registration route has now been formally retired. This should also be read alongside the broader Cyprus licensing-convergence story tracked this cycle: a crypto-asset product now routed through Cyprus for electronic-money-token-related payment functionality may require both full MiCA CASP authorisation and a Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or a qualifying payment-service-provider partnership, layering two separate compliance regimes onto a single product design rather than one. No merchant-acquiring, high-risk-MCC, or correspondent-banking-access development connects directly to this finding within the scope of this module this cycle; the transition described here is confined to the crypto-asset authorisation and product-development dimension specifically. #### Outlook The practical question for next cycle is the population-level compliance outcome of the transition: how many previously AML-only-registered Cyprus crypto-asset firms have secured full MiCA authorisation, wound down their Cyprus operations, or remain in an unresolved intermediate state past the formal 1 July 2026 deadline. Watch also for the first Cyprus-specific crypto-asset product launches conducted entirely under full MiCA authorisation, which would mark the point at which Cyprus's crypto-asset product-development environment has fully transitioned to the new regulatory baseline. A further open question is whether CySEC issued any Cyprus-specific transitional guidance to firms mid-conversion during the run-up to the 1 July 2026 deadline, which this cycle's sourcing did not surface directly. Overall, this cycle's finding should be treated as the single strongest-sourced Cyprus product-and-market development identified across this module, and subsequent cycles should prioritise closing the population-level compliance gap in the evidence base rather than revisiting the underlying regulatory milestone itself, which is now well established. **Sources and findings (4)** 1. T3 [https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/](https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/) retrieved 2026-06-27 2. T3 [https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments](https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments) retrieved 2026-06-27 3. T3 [https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking](https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking) retrieved 2026-06-27 4. T3 [https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets](https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets) retrieved 2026-06-27 ### W10 Consumer Protection & APP Fraud Probable confirmed 2026-06-27 Consumer protection rests on PSD2-derived conduct rules, transparency/disclosure obligations, and EBA consumer-protection guidance adopted by the CBC. The Office of the Cyprus Financial Commissioner (Financial Ombudsman), established under Law 84(I)/2010, handles consumer complaints against banks, PIs/EMIs and other financial institutions up to €250,000 (€20 fee; decisions binding only if accepted by both parties). For instant-payment fraud, the EU Instant Payments Regulation's mandatory Verification of Payee (payee name/IBAN matching) is the principal APP/misdirection-fraud control; Cyprus does not have a UK-style mandatory APP-fraud reimbursement scheme. Standing sub-brief · as of 29 June 2026 141 words · last cycle 2026-06-27 #### Consumer Protection & APP Fraud Consumer protection rests on PSD2-derived conduct rules and EBA consumer-protection guidance adopted by the CBC. The Financial Ombudsman, under Law 84(I)/2010, handles complaints against banks, PIs/EMIs and other financial institutions up to EUR 250,000, with a EUR 20 fee and decisions binding only if accepted by both parties. For instant-payment fraud, the EU Instant Payments Regulation's mandatory Verification of Payee is the principal APP and misdirection control. Critically, Cyprus has no UK-style mandatory APP-fraud reimbursement scheme — a material differentiator in consumer-protection liability exposure for PSPs relative to the UK PSR model. #### Outlook The W10 trajectory is stable, held at High, with the redress mechanics on two Tier-1 Financial Ombudsman pages. The absence of a mandatory APP-reimbursement scheme is recorded as not applicable in the current regime and remains the key liability-exposure distinction for Cyprus PSPs. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T1 [https://financialombudsman.org.cy/en/services/complaints-service/](https://financialombudsman.org.cy/en/services/complaints-service/) retrieved 2026-06-27 2. T1 [https://financialombudsman.org.cy/en/complaints-submission-and-mediation-requests/submission-of-a-complaint-by-legal-entities/](https://financialombudsman.org.cy/en/complaints-submission-and-mediation-requests/submission-of-a-complaint-by-legal-entities/) retrieved 2026-06-27 3. T3 [https://www.lightspark.com/knowledge/cyprus-instant-payments](https://www.lightspark.com/knowledge/cyprus-instant-payments) retrieved 2026-06-27 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/cyprus/#sec-dom-D7) limited signal Probable confirmed 2026-06-27 [Sentinel-fed] Cyprus AML/CFT for the payments context is governed by the AML/CFT Law of 2007 and Sanctions Law of 2016, with sector supervisors CBC (credit institutions, PIs, EMIs), CySEC (CIFs, CASPs, funds), ICPAC and the Cyprus Bar Association; MOKAS is the FIU. CASPs are obliged entities registered with CySEC and subject to Travel Rule (Reg (EU) 2023/1113) obligations and CDD from €1,000. Sentinel.gi position carried; no original WPM illicit-finance analysis performed. Standing sub-brief · as of 29 June 2026 185 words · last cycle 2026-10-11 #### AML/CFT & Financial Crime This surface is sourced from the Sentinel feed (sentinel://cy/aml-cft/framework); the World Payments Monitor carries the framework as provenance and does not conduct original illicit-finance analysis. Per the Sentinel feed, Cyprus AML/CFT for payments is governed by the AML/CFT Law of 2007 and the Sanctions Law of 2016, with sector supervisors CBC (credit institutions, PIs, EMIs), CySEC (CIFs, CASPs, funds), ICPAC and the Cyprus Bar Association; MOKAS is the FIU. CASPs are obliged entities registered with CySEC, subject to the EBA Travel Rule (Reg (EU) 2023/1113) and CDD for occasional transactions of EUR 1,000 and above. Firm-wide sanctions risk assessment is treated as a non-negotiable compliance element. The bank-versus-CASP supervisory split and Travel Rule CDD thresholds frame the AML compliance perimeter for Cyprus payments and crypto operators. #### Outlook The W11 standing position rests at Assessed: the surface is entirely Sentinel-fed on lower-tier carriers, with no primary MOKAS/CBC/CySEC AML-circular anchors retrieved. Original AML and sanctions-evasion analysis — including CASP Travel Rule application, MOKAS reporting and the bank-versus-CASP supervision gap — is routed to the Financial Integrity Monitor via cross-monitor flag pending primary-source confirmation. Periodic update · new data 2026-10-11 #### AML/CFT & Financial Crime This module's Cyprus signal this cycle comes via the Sentinel.gi feed: CySEC Circular C800, issued 8 September 2026, notified Administrative Service Providers and Crowdfunding Service Providers of a public hearing convened by the Anti-Money Laundering Authority (AMLA) concerning draft Regulatory Technical Standards under Article 40(2) of Directive (EU) 2024/1640. The substance of the RTS under consultation concerns a harmonised risk-assessment methodology for non-financial sectors, a category that includes the Administrative Service Providers and Crowdfunding Service Providers that CySEC's circular specifically targeted. As this intelligence is sourced from the Sentinel.gi AML feed, it is reported here as a surface-level regulatory signal rather than analysed independently; the underlying illicit-finance analysis and typology assessment sits with the Sentinel feed and the financial-integrity monitor, not with this module. What is noted here, for payments-sector relevance, is simply that Cypriot non-financial obliged entities providing administrative and crowdfunding services are within scope of an AMLA consultation process that could eventually impose a new EU-harmonised risk-assessment standard on them. #### Outlook The AMLA RTS consultation remains at the draft stage with no finalisation date identified. Cypriot Administrative Service Providers and Crowdfunding Service Providers should monitor the consultation's progress as a forward-looking compliance consideration, recognising that the eventual standard, once finalised, will apply across the EU's non-financial obliged-entity population rather than being Cyprus-specific. **Sources and findings (7)** 1. T3 sentinel://cy/aml-cft/sanctions-supervision — centre8education.com/articles/aml-sanction-risk-assesment-cyprus 2. T? FIM (sentinel.gi) per-JID baseline profile — Cyprus — Cyprus applies the EU AML/CFT acquis via its AML/CFT Law, with MOKAS as FIU, CySEC as securities/CASP supervisor, and CBC as banking supervisor. Assessed by MONEYVAL under FATF standards, Cyprus remains in enhanced follow-up since its 2019 MER, rated partially compliant on non-profit organisations, correspondent banking, new technologies (crypto), and law-enforcement investigative powers. A national sanctions unit (NSIU/MEK), replacing a 2016 sanctions law, was legislated in 2025 after EU-deadline delays. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: sourcing-thinness 4. T1 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-003) — Enforcement: MONEYVAL/FATF — Cyprus national AML/CFT framework 5. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence 6. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004) — Enforcement: Nicosia Criminal Court — Demetris Syllouris (former Parliament President) and Christakis Giovanis (former MP) 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: regulatory-failure ### W12 Correspondent Banking, Settlement & Access Confirmed confirmed 2026-06-27 Settlement via T2-CY (replaced TARGET2 20 Mar 2023); Settlement Finality Law; TIPS + CCBM connectivity; non-euro flows exposed to de-risking. Standing sub-brief · as of 29 June 2026 178 words · last cycle 2026-06-27 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank-versus-non-bank settlement-access asymmetry. Settlement runs through T2-CY, the Cyprus component of the Eurosystem T2 RTGS, which replaced TARGET2 on 20 March 2023; participants are Cyprus credit institutions, the Cyprus Stock Exchange, CY-SDD, the Cyprus Clearing House, JCC Cards and the CBC. Settlement finality is provided by the Settlement Finality Law, and Cyprus is connected to TIPS and the CCBM for collateral mobilisation. Direct euro settlement finality is therefore a bank-PSP privilege. Non-euro flows, by contrast, depend on correspondent relationships exposed to global de-risking, with an approximately 25% reduction in correspondent relationships between 2011 and 2022. The result is a structural settlement-access constraint that falls hardest on smaller Cyprus institutions and on non-bank PIs and EMIs that lack direct access to the euro RTGS layer. #### Outlook The W12 standing position is Confirmed on three Tier-1 anchors. The euro settlement layer is stable; the live risk vector is the de-risking-driven fragility in non-euro correspondent access, which the corridor tracker records as closing for smaller institutions and PIs/EMIs. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T1 [https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/target-services](https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/target-services) retrieved 2026-06-27 2. T1 [https://www.ecb.europa.eu/pub/pdf/other/ccbm201405en.pdf](https://www.ecb.europa.eu/pub/pdf/other/ccbm201405en.pdf) retrieved 2026-06-27 3. T1 [https://www.ecb.europa.eu/pub/pdf/eurosystemoversight/eurosystemoversightreport2020~a1e4fce1d7.en.pdf](https://www.ecb.europa.eu/pub/pdf/eurosystemoversight/eurosystemoversightreport2020~a1e4fce1d7.en.pdf) retrieved 2026-06-27 ### W13 Commercial Intelligence (M&A, Investment & Product) limited signal Probable confirmed 2026-06-27 Trailing-12-month commercial activity is shaped by MiCA-driven crypto re-domiciliation into Cyprus and bank consolidation. Revolut secured a CySEC MiCA CASP licence (October 2025), making Cyprus its EEA crypto hub. Bank of Cyprus (CET1 ~21%) signalled openness to smaller, strategically targeted fintech/insurance acquisitions under its 2026-2028 plan. 2025 saw a significant rise in tech/fintech/financial-services M&A. Earlier CASP registrations included Revolut and eToro; Binance exited the market. Horizon · 2026-01 (±quarter) Cyprus crypto-asset disposal-gains tax (8% flat) takes effect_in_force · T3_ Standing sub-brief · as of 29 June 2026 242 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) Three discrete commercial events anchor this module. First, a completed product release: Revolut formally received a MiCA CASP licence from CySEC in October 2025, allowing regulated crypto services across all 30 EEA countries and making its Cyprus base the centre of its EEA crypto operations — a flagship fintech selecting Cyprus as its EEA MiCA crypto hub and a material market-access signal validating the jurisdiction's CASP regime. The deal value is not publicly disclosed. Second, a rumoured M&A signal: Bank of Cyprus, with CET1 of approximately 21%, said in March 2026 that it remains open to smaller, strategically targeted acquisitions in fintech and insurance under its 2026-2028 plan, identifying fintech companies as a greater competitive challenge than traditional banks. This is a stated appetite rather than an announced or closed deal, with no target named and the value not publicly disclosed. Third, a sector-level trend: during 2025 Cyprus saw a significant increase in M&A activity emphasising technology, fintech and financial services, alongside a new 8% flat tax on crypto-asset disposal gains effective 1 January 2026. Values across the sector trend are not publicly disclosed. #### Outlook The W13 trajectory is escalating, held at Assessed. The Major Product Launches and Major M&A trackers both advance on these events. Granular funding-round data is thin in this baseline — private-company and emerging-fintech financing signals are under-indexed relative to deal-announcement and launch signals — and should be deepened in subsequent cycles. Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech DigitalFox, a Cyprus-incorporated startup building QR-code table-payments and point-of-sale integration technology for the restaurant sector, raised a pre-seed round of 350,000 euro, reported as having closed earlier in the year and disclosed publicly this cycle as part of a roundup of Cyprus startup funding activity. The round amount is disclosed and relatively small in absolute terms, consistent with a pre-seed stage of financing, but it is a concrete, named commercial event in the payments-adjacent technology layer of Cyprus's economy, distinct from the broader structural market-size narrative also reported this cycle. That broader narrative places the DigitalFox round in context: Cyprus's fintech sector is reported to be approaching 200 companies in total, with approximately 55 percent of those companies involved in payments specifically. This was reported in connection with the Forbes Next Gen Banking and Fintech Summit, at which President Christodoulides set out Cyprus's ambition to expand its role in fintech, explicitly citing Standard and Poor's recent decision to raise Cyprus's sovereign credit rating from A- to A as supporting context for the jurisdiction's investment case. The juxtaposition of a specific, small early-stage funding event with a government-level sector-promotion narrative is itself the signal this cycle: Cyprus's payments and fintech ecosystem continues to generate discrete commercial activity at the startup level while the sovereign and government layer pursues a parallel positioning narrative aimed at larger-scale investment. No primary filing or regulatory disclosure was retrieved for the DigitalFox round; the figure and round stage are sourced from press reporting rather than a company or regulator filing, which should be read as a limitation on the precision of the reported amount and timing rather than as a reason to discount the event. #### Outlook The near-term question is whether the DigitalFox round is representative of a continuing flow of small payments-technology funding events in Cyprus or an isolated data point surfaced by this cycle's press coverage. The fintech-sector scale estimate, approaching 200 companies with a payments-majority composition, provides a backdrop against which further funding or product events in subsequent cycles can be assessed, and the government's sovereign-rating-linked positioning narrative suggests continued promotional activity aimed at attracting further fintech investment into Cyprus. **2 earlier distinct update(s)** Periodic update · new data 2026-10-11 #### Commercial Intelligence & Fintech Two discrete commercial events mark this cycle's Cyprus fintech activity, both tied to crypto-native firms building out regulated EU footprints through Cyprus entities. First, Gate.io's Cyprus-based MiFID entity, which it had acquired via its 2024 purchase of CFD broker Sheer Markets, was rebranded as Gate Securities (Cyprus) Ltd, with the rebrand announced in January 2026. The transaction's financial terms were not publicly disclosed. This rebrand is consistent with a broader pattern among crypto-native exchanges of acquiring and repositioning regulated European brokerage entities as part of a push toward offering brokerage services alongside core exchange activity, using an existing MiFID licence as the regulatory vehicle rather than seeking a licence from scratch. Second, crypto custodian Taurus SA was granted a MiFID II investment licence by CySEC, announced 6 May 2026, which enables Taurus to provide tokenised-instrument services to EU banks and asset managers. The transaction's financial terms were not publicly disclosed. Taurus is a Switzerland-domiciled custody specialist, and this Cyprus licence grant gives it a CySEC-supervised EU base specifically for serving institutional clients, banks and asset managers, in the tokenised-securities space. The regulatory review associated with this licence grant was conducted by CySEC under its standard sector-licensing process and was cleared. Both events illustrate the same underlying commercial pattern: crypto-native and crypto-adjacent firms are using Cyprus's CySEC-supervised MiFID licensing regime as an entry point into regulated EU financial-services activity, whether via acquisition and rebrand (Gate.io) or direct licence grant (Taurus). Neither transaction disclosed financial terms, which is typical for this category of regulatory-licensing-driven commercial event rather than a disclosed-value M&A transaction. #### Outlook Both the Gate.io rebrand and the Taurus licence grant suggest that Cyprus's CySEC-supervised MiFID regime continues to attract crypto-native firms seeking a regulated EU operating base, a trend likely to continue given Cyprus's established position as a licensing jurisdiction for investment firms. Whether either firm's Cyprus entity becomes a hub for further EU-wide passported activity is not yet observable from the available record. Periodic update · new data 2026-08-25 #### Commercial Intelligence & Fintech CySEC approved 47 new Cyprus Investment Firm licences during 2025, bringing the total population of CySEC-supervised entities to 808, with assets under management held in collective investment schemes reaching EUR 11.4 billion. This is an assessed-confidence, dashboard-tier finding reflecting continued growth in Cyprus's CySEC-supervised commercial population rather than a discrete, named commercial event such as an M&A transaction or funding round; no specific deal, investment round, or product-launch event meeting this module's commercial-events threshold was identified for Cyprus this cycle. #### Outlook Watch for named commercial events specifically — mergers, acquisitions, investment rounds, or product launches — involving Cyprus-domiciled payment, e-money, or investment-firm entities in coming cycles, since this cycle's finding was limited to aggregate supervised-population growth rather than a discrete transaction-level development. **Sources and findings (3)** 1. T3 [https://www.cryptopolitan.com/revolut-eu-mica-license-in-cyprus/](https://www.cryptopolitan.com/revolut-eu-mica-license-in-cyprus/) retrieved 2026-06-27 2. T3 [https://cyprus-mail.com/2026/03/05/bank-of-cyprus-targets-fintech-and-insurance-for-strategic-deals](https://cyprus-mail.com/2026/03/05/bank-of-cyprus-targets-fintech-and-insurance-for-strategic-deals) retrieved 2026-06-27 3. T3 [https://practiceguides.chambers.com/practice-guides/corporate-ma-2026/cyprus/trends-and-developments](https://practiceguides.chambers.com/practice-guides/corporate-ma-2026/cyprus/trends-and-developments) retrieved 2026-06-27 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Cyprus| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 53 finding(s), 103 source(s) in the cumulative register. **Audit trail** Machine check Challenged on 27 Sep 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).