Cyprus Central Bank EMI + Payment Institution Authorisation 2026 — PSD2 + EMD2 Framework

1. EMI vs PI — substantive difference

• EMI — can ISSUE electronic money (a stored-value claim against the EMI). Customer balances are e-money, not deposits. Examples: Wise Business, Revolut Business (pre-2021 banking licence), pre-paid cards, multi-currency wallets.
• PI — can only PROCESS payments. Cannot issue e-money. Examples: gateway / acquiring services, money-remittance services, account-information services (PSD2 AIS), payment-initiation services (PSD2 PIS).

2. Legal framework

• Payment Services Law 31(I)/2018 transposing EU PSD2 (Directive 2015/2366).
• E-Money Law 81(I)/2011 transposing EU EMD2 (Directive 2009/110/EC).
• Cyprus's Central Bank (CBC) is the competent authority — NOT CySEC (CySEC handles MiFID II + CASP; CBC handles EMI / PI / traditional banking).

3. Capital requirements

4. The application file

• Programme of operations — services offered, target client segments.
• Business plan with 3-year financial projections + capital adequacy.
• Governance + organisation — fit-and-proper for directors + senior managers + qualifying shareholders.
• AML/CFT manual aligned with Cyprus Law 188(I)/2007 + EU AMLD6.
• Safeguarding policy (EMI) — segregated custody of customer funds at top-tier custodian banks.
• ICT + cybersecurity framework (NIS2 + DORA-aligned).
• Operational risk + business-continuity plan.
• Customer onboarding + KYC procedures.
• Outsourcing policy.
• Insurance / professional-indemnity arrangements.

5. Safeguarding of customer funds (EMI critical)

EMIs MUST safeguard customer funds — either by (a) segregation at a regulated credit institution + investing only in qualifying low-risk assets, or (b) insurance/guarantee from a regulated insurer. Customer funds CANNOT be on the EMI's own balance sheet. CBC supervises safeguarding compliance via quarterly + annual reporting.

This is the structural reason Wise / Revolut Business / similar EMIs are still considered safe even though they don't operate under the €100k Deposit Guarantee Scheme — segregation ensures customer funds are returnable on EMI failure.

6. Timeline + EU passporting

• CBC review window: 3 months for complete files (under PSD2 + EMD2 statutory).
• In practice: 6-9 months for EMI; 4-6 months for PI.
• Once authorised: passport to all 30 EEA states via notification procedure (PSD2 Article 28 / EMD2 Article 8).
• Ongoing: quarterly + annual CBC reporting, transaction-monitoring obligations, AML reporting to MOKAS.

Official verification starting points

Cyprus Securities and Exchange Commission and Central Bank of Cyprus publish the controlling material for this topic. Check the current law, form, circular or portal instructions before acting; this article is general information and the live official material prevails.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.