Payment Institution License in Cyprus

Payment Services Regulation in Cyprus

Payment services in Cyprus are regulated under the Payment Services and Payment Systems Laws of 2018 (Laws 31(I)/2018 and 32(I)/2018), which transpose the EU’s Second Payment Services Directive (PSD2 – Directive (EU) 2015/2366) into Cyprus law. The Central Bank of Cyprus (CBC) is the competent authority responsible for the authorisation and supervision of Payment Institutions (PIs) operating in Cyprus.

A Payment Institution license allows the holder to provide a wide range of payment services within Cyprus and, through the EU passporting mechanism, across all EU and EEA member states. This makes Cyprus an attractive base for fintech companies and payment services providers seeking access to the European single market.

Types of Payment Services

Under PSD2, the following payment services require authorisation:

1. Services enabling cash to be placed on or withdrawn from a payment account (cash deposits and withdrawals).
2. Execution of payment transactions, including transfers of funds on a payment account with the payment service provider or with another provider:
   • Direct debits, including one-off direct debits.
   • Payment transactions through a payment card or similar device.
   • Credit transfers, including standing orders.
3. Execution of payment transactions where funds are covered by a credit line for a payment service user.
4. Issuing of payment instruments and/or acquiring of payment transactions.
5. Money remittance – services where funds are received from a payer without any payment accounts being created in the name of the payer or payee.
6. Payment initiation services (PIS) – initiating a payment order at the request of the payment service user with respect to a payment account held at another payment service provider.
7. Account information services (AIS) – providing consolidated information on payment accounts held by a payment service user with other payment service providers.

Types of Authorisation

Full Payment Institution License

A full PI license authorises the holder to provide any combination of the payment services listed above. This license is required for entities that process significant volumes or provide a broad range of payment services.

Small Payment Institution (SPI) Registration

An SPI registration is available for smaller operators whose monthly average of payment transactions over the preceding 12 months does not exceed €3 million. SPI registration involves a simplified process and reduced regulatory requirements but does not confer passporting rights. SPIs may only operate within Cyprus.

Account Information Service Provider (AISP)

Entities that only provide account information services may register as AISPs under a simplified registration procedure. AISPs are not required to hold client funds and have reduced capital requirements.

Capital Requirements

The minimum initial capital requirements for a Payment Institution depend on the type of services provided:

In addition to the minimum initial capital, Payment Institutions must maintain ongoing own funds calculated using one of three methods prescribed by PSD2 (Methods A, B, or C), ensuring that the institution always holds adequate capital relative to its business volumes.

Application Process

1. Pre-application engagement – Informal discussions with the CBC to clarify the proposed business model, applicable regulatory requirements, and the expected scope of the application.
2. Corporate setup – Establish a legal entity in Cyprus (or ensure an existing entity meets the requirements) with an appropriate corporate governance structure.
3. Preparation of the application dossier – Compile comprehensive documentation including:
   • Business plan covering three years of financial projections.
   • Description of the payment services to be provided.
   • Programme of operations and organisational structure.
   • Internal control, risk management, and AML/CFT policies and procedures.
   • IT systems architecture, security policies, and business continuity plans.
   • Client fund safeguarding arrangements.
   • Fit-and-proper documentation for all directors, qualifying shareholders, and key function holders.
4. Submission to the CBC – File the formal application with all supporting documentation and the application fee.
5. CBC assessment – The CBC reviews the application, which typically involves multiple rounds of questions, requests for additional information, and potentially interviews with key personnel. The statutory decision period is 3 months from receipt of a complete application, extendable by 3 additional months.
6. Authorisation – Upon approval, the CBC grants the Payment Institution license and the entity is entered into the CBC register of payment service providers.

Client Fund Safeguarding

A critical requirement for Payment Institutions is the safeguarding of client funds. PSD2 mandates that client funds received for the execution of payment transactions must be protected through one of two methods:

• Method 1 – Segregation: Client funds are deposited in a separate account with a credit institution or invested in secure, liquid, low-risk assets that are ring-fenced from the PI’s own funds.
• Method 2 – Insurance or guarantee: Client funds are covered by an insurance policy or a comparable guarantee from an authorised insurer or credit institution.

Passporting Rights

One of the most significant advantages of obtaining a PI license in Cyprus is the ability to passport services across the entire EU and EEA. A Cyprus-licensed Payment Institution may provide its authorised payment services in any other member state through:

• Freedom to provide services (FPS) – providing services on a cross-border basis without establishing a physical presence in the host member state.
• Freedom of establishment (FOE) – establishing branches or appointing agents in other member states.

The passporting process involves notifying the CBC, which then communicates with the host member state’s competent authority. The process typically takes 1 to 3 months depending on the host state.

Ongoing Compliance Obligations

Licensed Payment Institutions must comply with extensive ongoing obligations, including:

• Maintaining adequate own funds at all times.
• Filing periodic regulatory reports with the CBC (monthly, quarterly, and annual returns).
• Conducting annual audits and submitting audited financial statements.
• Maintaining robust AML/CFT compliance programmes.
• Adhering to PSD2 requirements on transparency, complaints handling, and strong customer authentication (SCA).
• Notifying the CBC of any material changes to the licensed activities or governance structure.