Cyprus

Licensing, Authorisation & Market Access

Cyprus's payment-institution and electronic-money-institution licensing framework is governed by Law 31(I)/2018, the national transposition of the second Payment Services Directive, with the Central Bank of Cyprus as the competent authority for authorisation and supervision. This baseline governing structure is unchanged this cycle, but the practical licensing landscape around it has shifted materially. From March 2026, Cyprus crypto-asset service providers that offer payment services related to electronic money tokens must hold Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or partner with an already-authorised payment service provider, in addition to the CySEC CASP authorisation those firms already carry. This dual-licensing convergence, layering a payments-regulatory requirement onto an existing crypto-authorisation track, is assessed as the most commercially significant Cyprus licensing development across 2025 and 2026, because it collapses what were previously two largely separate authorisation tracks — crypto-asset supervision under CySEC and payment-institution supervision under the Central Bank of Cyprus — into a single compliance obligation for a specific, commercially active category of firm.

Looking further out, the EU's proposed Payment Services Directive 3 and accompanying Payment Services Regulation are expected to merge the existing electronic-money-institution and payment-institution licensing categories into a single, unified Payment Institution framework, with the second Electronic Money Directive repealed entirely. Entry into force is expected in late 2027, with a twenty-four-month grandfathering period anticipated for firms already licensed under the current dual-category structure. For Cyprus payment and e-money institutions, this means the current CBC authorisation landscape, and the new EMT-related dual-licensing requirement layered onto it this cycle, should both be understood as transitional rather than final: firms licensed today will need to plan for a further consolidation once PSD3 takes effect, on top of adapting to the March 2026 EMT-related convergence requirement in the near term.

Both developments concern non-bank payment institutions and electronic-money institutions specifically — the CBC-authorised entity class distinct from Cyprus's licensed banks, which access payment services through a separate prudential authorisation channel — and both tighten, rather than loosen, the market-access bar for that non-bank category over the near-to-medium term. The licensing convergence also has direct bank-versus-nonbank significance for market structure: because the requirement specifically targets non-bank crypto-asset service providers seeking to offer EMT-related payment services, it does not alter the position of Cyprus-licensed banks, which already operate under full banking-licence prudential supervision and would not need a separate PI/EMI authorisation to offer equivalent services. The practical effect is to narrow the competitive gap between bank-affiliated and non-bank payment-services providers specifically in the EMT-related payments space, by requiring non-bank CASPs to meet a payments-specific authorisation bar that banks already satisfy through their existing licence.

For market entrants evaluating Cyprus as a base for EMT-related payment services, the practical entry pathway is now twofold rather than singular: securing CySEC CASP authorisation alone is no longer sufficient if the underlying activity involves EMT-related payment services, and the additional PI/EMI authorisation, or a qualifying PSP partnership, must be secured before commercial launch. This raises both the compliance cost and the licensing timeline for prospective entrants relative to the pre-March-2026 baseline. The underlying CBC authorisation framework itself, Law 31(I)/2018, remains the baseline governing instrument for Cyprus PI/EMI authorisation and supervision, and no change to that baseline framework was identified this cycle; the developments described above sit on top of it rather than replacing it, layering a crypto-specific dual-authorisation requirement, and a forthcoming PSD3-driven unification, onto a stable existing statutory base.

Outlook

Watch for the first published PSD3/PSR legislative text, which would clarify the precise mechanics of the unified Payment Institution framework and the terms of its twenty-four-month grandfathering period for firms already licensed under Cyprus's current dual CBC/CySEC structure. Nearer term, watch for how many Cyprus CASPs providing EMT-related payment services have secured CBC PI/EMI authorisation, or a qualifying PSP partnership, ahead of and following the March 2026 convergence requirement, since this cycle's sourcing established the requirement's existence but not its population-level compliance status. Also worth tracking is whether the Central Bank of Cyprus issues any implementing guidance specific to the March 2026 EMT-related convergence requirement, since this cycle's sourcing captured the requirement itself but not any CBC-specific implementing detail beyond the CySEC CASP authorisation dimension.

Conduct, Safeguarding & Financial Promotions

Two conduct-and-safeguarding obligations now bind Cyprus payment institutions and electronic-money institutions as a matter of settled requirement rather than pending reform. Since January 2025, every electronic-money-institution application submitted in Cyprus must include a full ICT risk-management framework under the Digital Operational Resilience Act, embedding operational-resilience requirements directly into the authorisation stage rather than leaving them to post-licensing supervision alone. Since October 2025, Cyprus payment service providers have also operated under a Verification of Payee mandate, requiring real-time matching of the payee's IBAN against the payee's name before a transfer completes, as an anti-fraud backstop applicable across the licensed payment-services population.

Both obligations are assessed as elevated-impact developments, and both apply across the bank and non-bank payment-services population differently: the DORA-linked ICT risk-management requirement is scoped specifically to electronic-money-institution applications, meaning it binds the non-bank e-money authorisation track directly, while the Verification of Payee mandate applies more broadly across both bank and non-bank payment service providers offering payee-facing transfer services, since anti-fraud payee verification is a transaction-level control rather than an entity-type-specific one.

Together, the two obligations represent a tightening of the conduct and operational-resilience bar for Cyprus payment institutions at both the pre-licensing and in-life stages: DORA-linked ICT risk management is assessed at the point of application, embedding resilience expectations before a firm is even authorised, while Verification of Payee is a continuous, transaction-level control that must operate correctly for the life of the licence. Neither obligation is Cyprus-specific in origin — both flow from EU-level instruments, DORA and the Instant Payments Regulation's payee-verification requirement respectively — but both now form part of the settled compliance baseline that any Cyprus payment institution or electronic-money institution must satisfy.

The Verification of Payee mandate in particular should be read alongside Cyprus's parallel instant-payments rail development this cycle: as SEPA Instant Credit Transfer volumes grow toward and past the roughly thirty-two-percent-by-volume share reported for Cyprus, the anti-fraud stakes of real-time payee verification rise correspondingly, since a growing share of Cyprus payment volume now moves through rails where a mismatched or fraudulent payee could complete a transfer within seconds rather than the settlement window associated with slower payment rails. For new market entrants, the practical implication of the DORA-linked requirement is that ICT risk-management documentation is now a gating item at the application stage rather than a post-authorisation deliverable, meaning prospective Cyprus electronic-money-institution applicants must have a complete ICT risk-management framework ready before submission, not merely a plan to develop one after authorisation is granted.

Both obligations also carry a documentation and audit-trail dimension: DORA-linked ICT risk-management frameworks and Verification of Payee controls must both be demonstrable to the Central Bank of Cyprus on supervisory request, meaning Cyprus payment institutions should expect both to form part of ordinary supervisory review going forward, rather than being one-off compliance exercises assessed only at authorisation or launch. It is also worth noting that neither obligation was identified as introducing a new financial-promotions or marketing-restriction rule specifically; the conduct tightening identified this cycle is safeguarding- and resilience-focused rather than promotions-focused, and no Cyprus-specific financial-promotions development was located within this module's scope this cycle. Cyprus payment institutions preparing for supervisory review under either obligation should treat the absence of a located enforcement precedent as a reason for caution rather than complacency: both obligations are recent enough, DORA-linked ICT risk management dating to January 2025 and Verification of Payee to October 2025, that a first enforcement or supervisory-finding precedent may simply not yet exist rather than compliance being confirmed adequate across the licensed population.

Outlook

Watch for the first enforcement or supervisory findings under either obligation, since this cycle's sourcing established the existence and effective dates of both requirements but did not surface any Cyprus-specific compliance-testing or enforcement outcome yet. Also worth tracking is whether the Central Bank of Cyprus issues Cyprus-specific implementing guidance on either the DORA-linked ICT risk-management expectations or the Verification of Payee mandate, beyond the EU-level instruments from which both obligations originate. Given both obligations are recent, the coming cycles are likely to be where supervisory testing first surfaces, making this an area to monitor closely rather than treat as settled.

Payment Corridor Dynamics

Cyprus implemented full SEPA Instant Credit Transfer sending capability on 9 October 2025, under the EU Instant Payments Regulation, completing the domestic instant-payments rail buildout for the Cyprus banking sector. This is a High-confidence finding, corroborated by the underlying EU Instant Payments Regulation text itself alongside Cyprus Mail's reporting on the domestic implementation date, and it carries a High impact rating for Cyprus payment-corridor dynamics specifically.

The usage data accompanying the implementation is itself a significant corridor-dynamics finding: instant-payments volume share in Cyprus has grown from under one percent to approximately thirty-two percent of SEPA credit transfers by volume, and approximately nine percent by value, a growth trajectory attributed to the Central Bank of Cyprus, and one that places Cyprus above the euro-area average for instant-payments adoption. The gap between the thirty-two-percent volume share and the nine-percent value share is itself informative about corridor composition: it suggests that instant rails in Cyprus are being used disproportionately for a high number of lower-value transfers relative to the overall SEPA credit-transfer population, rather than uniformly across transfer sizes, consistent with instant rails displacing everyday, lower-value payment activity ahead of higher-value transfers that may still favour other settlement channels.

This corridor development sits within the bank-led payments-infrastructure category specifically: the SCT Inst sending-capability implementation and the usage-growth finding both concern Cyprus's banking-sector payment-corridor infrastructure, as distinct from the non-bank payment-institution and electronic-money-institution licensing developments tracked elsewhere this cycle. The euro-area-average-beating adoption rate is a genuinely distinguishing finding for Cyprus specifically, rather than a generic EU-wide instant-payments development, and should be weighted accordingly as a jurisdiction-specific corridor-dynamics signal.

The full SCT Inst sending-capability milestone also has a direct connection to the Verification of Payee mandate tracked separately this cycle: as an increasing share of Cyprus payment volume shifts onto instant rails, the anti-fraud value of real-time payee verification rises correspondingly, since instant transfers settle within seconds and leave a correspondingly shorter window for post-transfer fraud remediation relative to slower payment rails. For Cyprus banks specifically, the completion of full SCT Inst sending capability represents the closing of what had been an open infrastructure item under the EU Instant Payments Regulation's phased implementation timeline; Cyprus's banking sector has now moved from partial to full sending-side compliance, a distinct and more advanced position than a bank that has implemented receiving capability alone without full sending-side rollout.

The thirty-two-percent volume share is also notable in comparative terms: because the reported figure explicitly surpasses the euro-area average, Cyprus's instant-payments adoption trajectory should be read as a genuine outperformance finding specifically, rather than simply tracking the broader EU-wide adoption curve that the Instant Payments Regulation's implementation timeline is driving across all member states uniformly. This corridor-dynamics finding has no identified read-through to correspondent-banking access or cross-border settlement arrangements specifically this cycle; the growth described here is a domestic SEPA-area instant-payments adoption finding, distinct from any correspondent-banking-access development. Taken together, the full sending-capability milestone and the above-average usage growth position Cyprus as a comparatively advanced SEPA market for instant-payments adoption specifically.

Outlook

Watch for continued volume and value share growth in coming cycles, and for whether the gap between Cyprus's volume-share and value-share growth trajectories narrows or persists, since a persistent gap would reinforce the reading that instant rails in Cyprus remain concentrated in lower-value transfer activity relative to the broader SEPA credit-transfer population. Also worth tracking is whether Cyprus's above-euro-area-average adoption rate continues to outpace the euro-area average as SCT Inst receiving-capability obligations and further Instant Payments Regulation milestones come into force across the wider SEPA area. Comparative benchmarking against other above-average euro-area adopters would also help contextualise whether Cyprus's specific growth trajectory is converging toward a plateau or continuing to accelerate.

Product Innovation & Market Development

The formal close of the Markets in Crypto-Assets Regulation's national grandfathering window for Cyprus crypto-asset service providers, on 1 July 2026 following a 27 February 2026 application deadline, is this cycle's defining product-innovation-and-market-development finding for Cyprus. This is a High-confidence, Critical-impact finding, anchored by a Tier 1 CySEC press release and corroborated across the source base on both the application-deadline and expiry dates. Unauthorised crypto-asset service providers are required to wind down their Cyprus operations; the prior national AML-only registration pathway, which had functioned as an alternative, lighter-touch route to market for crypto-asset activity, is retired in favour of full MiCA authorisation as the only lawful route to market from this point forward.

From a product-innovation and market-development standpoint specifically, this transition changes the competitive landscape for crypto-asset product development in Cyprus materially: firms building new crypto-asset products or services in or from Cyprus must now design for full MiCA compliance from the outset, rather than being able to rely on a lighter national registration during an initial go-to-market phase. This raises the compliance-design bar for new product launches and should be factored into any market-entry or product-development timeline for Cyprus-based crypto-asset innovation going forward. The transition also connects directly to the dual CBC/CySEC licensing convergence tracked separately this cycle for electronic-money-token-related payment services, since both developments push Cyprus crypto-asset firms toward a more integrated, cross-regulator compliance posture spanning CySEC's CASP authorisation and the Central Bank of Cyprus's payment-institution authorisation regime simultaneously.

The transition also has direct relevance for how Cyprus is positioned relative to other EU member states in the broader MiCA rollout: because the national grandfathering window operated on a standard, EU-wide transitional mechanism under Article 143(3) of the MiCA Regulation, Cyprus's 1 July 2026 expiry date reflects the general MiCA transition timeline rather than a Cyprus-specific acceleration or extension, meaning Cyprus's product-development environment is now converging with the same MiCA baseline applying across the wider European Union crypto-asset market. For product teams evaluating new crypto-asset offerings from a Cyprus base, the practical entry calculus has shifted meaningfully within this single cycle: the comparative advantage that a lighter national AML-only registration might previously have offered relative to full MiCA authorisation elsewhere in the EU no longer exists for Cyprus specifically, since that registration route has now been formally retired.

This should also be read alongside the broader Cyprus licensing-convergence story tracked this cycle: a crypto-asset product now routed through Cyprus for electronic-money-token-related payment functionality may require both full MiCA CASP authorisation and a Central Bank of Cyprus payment-institution or electronic-money-institution authorisation, or a qualifying payment-service-provider partnership, layering two separate compliance regimes onto a single product design rather than one. No merchant-acquiring, high-risk-MCC, or correspondent-banking-access development connects directly to this finding within the scope of this module this cycle; the transition described here is confined to the crypto-asset authorisation and product-development dimension specifically.

Outlook

The practical question for next cycle is the population-level compliance outcome of the transition: how many previously AML-only-registered Cyprus crypto-asset firms have secured full MiCA authorisation, wound down their Cyprus operations, or remain in an unresolved intermediate state past the formal 1 July 2026 deadline. Watch also for the first Cyprus-specific crypto-asset product launches conducted entirely under full MiCA authorisation, which would mark the point at which Cyprus's crypto-asset product-development environment has fully transitioned to the new regulatory baseline. A further open question is whether CySEC issued any Cyprus-specific transitional guidance to firms mid-conversion during the run-up to the 1 July 2026 deadline, which this cycle's sourcing did not surface directly. Overall, this cycle's finding should be treated as the single strongest-sourced Cyprus product-and-market development identified across this module, and subsequent cycles should prioritise closing the population-level compliance gap in the evidence base rather than revisiting the underlying regulatory milestone itself, which is now well established.

Commercial Intelligence & Fintech

CySEC approved 47 new Cyprus Investment Firm licences during 2025, bringing the total population of CySEC-supervised entities to 808, with assets under management held in collective investment schemes reaching EUR 11.4 billion. This is an assessed-confidence, dashboard-tier finding reflecting continued growth in Cyprus's CySEC-supervised commercial population rather than a discrete, named commercial event such as an M&A transaction or funding round; no specific deal, investment round, or product-launch event meeting this module's commercial-events threshold was identified for Cyprus this cycle.

Outlook

Watch for named commercial events specifically — mergers, acquisitions, investment rounds, or product launches — involving Cyprus-domiciled payment, e-money, or investment-firm entities in coming cycles, since this cycle's finding was limited to aggregate supervised-population growth rather than a discrete transaction-level development.