Payment Institutions in Cyprus
By: BLegal - Panayiotou Shamma LLC
In today's digital age, the landscape of financial transactions is undergoing a significant transformation. As the demand for secure and efficient payment services grows, businesses are increasingly turning to payment institutions to meet the evolving needs of consumers and enterprises alike.
In order to provide payment services in or through Cyprus, a payment institution needs to be in a possession of a valid license (otherwise called an “authorisation”) issued either by the Central Bank of Cyprus or a competent authority of another member state of the European Union.
Payment services are defined in Annex 1 of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market (also known as PSD2), which was transposed into Cypriot legislation by the Payment Services and Access of Payment Systems Laws of 2018 to 2022, as:
- Services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account.
- Services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account.
- Execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider:
(a) execution of direct debits, including one-off direct debits;
(b) execution of payment transactions through a payment card or a similar device;
(c) execution of credit transfers, including standing orders. - Execution of payment transactions where the funds are covered by a credit line for a payment service user:
(a) execution of direct debits, including one-off direct debits;
(b) execution of payment transactions through a payment card or a similar device;
(c) execution of credit transfers, including standing orders. - Issuing of payment instruments and/or acquiring of payment transactions.
- Money remittance.
- Payment initiation services.
- Account information services.
The company applying for a payment institution authorisation shall have an initial capital of at least:
- €20,000 where it intends to provide the payment service in point 6 above
- €50,000 where it intends to provide the payment service in point 7 above
- €125,000 where it intends to provide the payment services in points 1-5 above.
Important operational requirements:
In addition to the initial capital requirements, applicant companies must fulfill several other key operational requirements. These include:
- Management and Governance: Payment institutions must have a robust management structure, including a Board of Directors with appropriate expertise and experience in payment services, as well as a clear organisational structure that ensures adequate oversight and risk management.
- Internal Policies and Procedures: Applicants must develop comprehensive internal policies and procedures, including risk management, anti-money laundering and combating the financing of terrorism measures, IT security, and data protection, in line with the relevant legal and regulatory requirements.
- Safeguarding Client Funds: applicants are required to implement appropriate measures for safeguarding client funds, such as segregating client accounts or obtaining adequate insurance coverage.
- Business Plan: A detailed business plan outlining the proposed payment services, target market, marketing strategy, and financial projections must be submitted as part of the application.
Documentation for CBC authorisation:
In more detail, for the purpose of obtaining an authorisation for providing payment services, applicants must submit to the Central Bank of Cyprus an application form, accompanied by the following information and documents:
- Certified copies of all corporate documents
- Copy of a recent utility bill of the applicant’s head office
- Non-bankruptcy certificate
- Completed Questionnaires for all shareholders holding a qualifying holding, members of the board, and key function holders
- Certificates of non-bankruptcy and clean criminal record for all directors, shareholders, and key function holders
- A program of operations
- A business plan including a forecast budget calculation for the first 3 financial years, which demonstrates that the applicant is able to employ such systems, resources and procedures so as to operate soundly
- Evidence that the applicant holds the required initial capital
- Organisational structure
- Measures to safeguard the funds of payment services users, with all requested information and documents
- Description of the governance arrangements and internal control mechanisms, with all requested information and documents
- Description of the procedures for monitoring, handling and following up on security incidents and security-related customer complaints
- Description of the processes for filing, monitoring, tracking and restricting access to sensitive payment data
- Business continuity plan
- Description of the principles and definitions applicable to the collection of statistical data on performance, transactions and fraud including supporting documentation
- Security policy document
- AML/CFT Manual
- Proposed Professional Indemnity Insurance or Comparable Guarantee (where relevant) for Account Information Services and Payment Initiation Services
- A description of the applicant's participation in a national/international payment system
- A description of the intended outsourcing arrangements and/or use of agents and branches
- Declaration signed by at least 2 members of the applicant’s management body
- The identity of the applicant’s statutory auditors.
- It is interesting to note that a payment institution authorised by the Central Bank is required to have its head office in the Republic and to carry out at least part of its payment service business in the Republic. Once authorised, a payment institution may offer payment services in the EU, based on the fundamental EU principle of freedom to provide services.
