Every e-money institution and payment institution licensed by the Central Bank of Cyprus (CBC) will need to evidence PSD3 compliance within 27 months of entry into force. Since 2025 the CBC has issued fit and proper directives, governance directives and a new licensing process. A Cypriot PSD3 file should be built on all three. The EU-wide process is in our PSD3 re-authorisation guide.
The Cypriot market
At 30 October 2026 the EBA Central Register listed 30 authorised EMIs and 10 payment institutions with a Cypriot home licence, 36 of them passporting.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
Cyprus will transpose PSD3 by replacing its payment services laws of 2018 to 2025 and its electronic money laws of 2012 and 2018.
The CBC framework mapped to PSD3
| CBC instrument | PSD3 file section |
|---|---|
| Fit and proper directives (2025) | Directors, managers and qualifying holders |
| Governance directives for EMIs and payment institutions (May 2026) | Governance, internal control, AML controls, ICT, outsourcing |
| New licensing process (August 2026) | Good repute; completeness and timely responses |
| E-money token guidance for crypto-asset service providers (2026) | Services list; group structure |
Checklist 1: suitability
- Refresh suitability assessments for every board member, key function holder and EMI adviser against the fit and proper directives.
- Confirm ownership records, including ultimate beneficial owners, and that every change was notified.
- Prepare evidence of reputation, knowledge and experience for each person named in the file.
Checklist 2: governance and internal control
- Map the governance framework to the 2026 directive: responsibilities, internal controls, risk management, compliance, AML controls and ICT risk.
- Confirm whether a separate ICT risk function is required.
- For payment institutions, cover management body roles, outsourcing, complaints, whistleblowing and CBC reporting.
- Confirm head office and part of the payment business are in Cyprus, with decisions taken there.
Checklist 3: safeguarding
- Move e-money safeguarding to the end of the business day after receipt.
- Assess concentration and open a second safeguarding account where funds sit with one bank.
- Where safeguarding banks are in other member states, confirm account letters and the insolvency position.
- Prepare user information on the method and applicable insolvency law.
- Keep daily reconciliations with breaks explained.
Our PSD3 safeguarding checklist has the full controls, and our safeguarding team reviews Cypriot arrangements.
Checklist 4: crypto and e-money tokens
- Map which group entity provides e-money issuance, e-money token services, crypto custody and transfer, and payment services.
- Confirm CASPs transferring or holding e-money tokens for clients hold payment authorisation or partner with an authorised provider, as the CBC requires.
- Reuse MiCA information in the PSD3 file where it is still current, and identify changes.
Checklist 5: AML
- Refresh the business-wide risk assessment for business clients and higher-risk sectors.
- Align with the EU AML Regulation from 10 July 2027; see our EU AML Regulation readiness plan.
- Implement PSR fraud controls, including verification of payee.
Our financial crime team supports Cypriot institutions on AML.
Checklist 6: capital and the winding-up plan
- Recalculate initial capital by service: EUR 250,000 for e-money, EUR 150,000 for core payment services, added together; see our own funds calculation guide.
- Project own funds three years ahead.
- Draft a winding-up plan for return of safeguarded funds, covering cross-border clients, currencies and sanctions screening; see our winding-up plan guide.
Substance and decision-making
PSD3 requires the head office in Cyprus and at least part of the payment business carried out there. Part can be less than the majority, but it must be real. For each Cypriot institution, record where the board meets, where executive directors and control function holders are based, which payment operations are performed in Cyprus, and how outsourced group functions are overseen locally. The CBC's governance directives already expect a sound local framework, so this evidence should exist. Where it does not, decide now whether to add people and functions in Cyprus or restructure.
Running the suitability refresh
Treat the fit and proper refresh as a project. List every person who needs an assessment: board members, executive and non-executive directors, key function holders, EMI advisers and qualifying shareholders. For each, collect a current CV, evidence of relevant experience, a declaration on reputation, and confirmation of time commitment and conflicts. Have the nominations or board committee review each file and minute its conclusion. Where a gap appears, such as a director without payments or AML experience, plan training or a change in board composition. A complete set of files is strong evidence for the PSD3 governance section and for any CBC questions on good repute.
Business clients and cross-border flows
Many Cypriot EMIs serve business clients in several countries and currencies. The safeguarding and winding-up workstreams should reflect that. Map safeguarding by currency and by bank. In the winding-up plan, explain how the institution would verify where each business client's funds should go, how sanctions screening would continue during repayment, and how long cross-border repayments would take. Include clients whose accounts are restricted or under review, since they are often the slowest to repay.
A practical timeline
| Period | Focus |
|---|---|
| Next 3 months | Gap analysis against PSD3 and the CBC directives; suitability refresh |
| Months 4 to 9 | Safeguarding changes, capital plan, MiCA and PSD3 alignment |
| Months 10 to 15 | Winding-up plan, AML alignment, file assembly |
| Then | Track the Cypriot transposing law and CBC process; file early |
Questions for the board
A Cypriot board should be able to answer: have we implemented the 2026 governance directive in full; is every director and key function holder assessed under the fit and proper directives; does e-money safeguarding meet next business day timing with more than one bank; are MiCA and PSD3 services aligned across the group; what is our PSD3 capital requirement over three years; and who owns CBC correspondence and the file. Minute the answers and update them as actions close.
Responding to the CBC
The CBC's new licensing process treats unanswered applications as withdrawn after a set period. Existing institutions should expect firm handling in re-authorisation too. Assign one owner for CBC correspondence, keep a log of questions and answers, and agree internal turnaround times. Our compliance support team prepares PSD3 files for Cypriot institutions. See also our Cyprus EMI and Cyprus payment institutions pages.