Fintech & digital payments rules in Cyprus (2026)

The CBC is the sole competent authority for authorising and supervising Payment Institutions and Electronic Money Institutions in Cyprus. Applications are assessed under the Provision and Use of Payment Services and Access to Payment Systems Laws of 2018–2025; authorisation typically takes 9–12 months. EMIs must maintain paid-up initial capital of €350,000.

Cyprus transposed PSD2 through the Provision and Use of Payment Services and Access to Payment Systems Laws of 2018–2025, establishing rights and obligations for payment service users and providers, covering account information service providers (AISPs) and enabling EU/EEA passporting for licensed firms.

The CBC issued guidance requiring Crypto-Asset Service Providers (CASPs) offering payment services related to e-money tokens (EMTs) to obtain PSD2 authorisation. CASPs already active in such services were required to submit applications by 20 February 2026, reflecting Cyprus's dual MiCA+PSD2 compliance framework.

Under EU Instant Payments Regulation (EU) 2024/886, Cypriot banks were required to receive instant SEPA payments by January 9, 2025, and to send them by October 9, 2025 — at the same fee as standard credit transfers. The Verification of Payee (VoP) mechanism was activated by October 2025 to match beneficiary name to IBAN before transfer.

Since January 2025, all new EMI licence applications to the CBC must include a full ICT Risk Management framework compliant with the EU Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554), adding a new mandatory layer to the licensing process.

The EU reached a provisional political agreement on PSD3 and the Payment Services Regulation (PSR) on 27 November 2025; OJ publication is anticipated for Q2–Q3 2026. Cyprus will be required to transpose PSD3 within 18 months of entry into force. Until then, firms continue operating under PSD2, and the CBC and CySEC have not yet issued joint post-2026 transition guidance.