Can Cyprus Become a True Fintech Banking Hub?
The Regulatory Road Ahead for EMIs, PIs and Digital Banks
7 September 2026
Recent discussions around the future of financial technology in Cyprus has raised an important question: has the country reached the point where it must move beyond attracting regulated fintech companies and start building the infrastructure of a genuine European fintech hub?
In a recent MoneyMatters interview, Ioannis Georgoulas, President of the Cyprus Association of Electronic Money and Payment Institutions (ACEMPI), argued that the traditional narrative of “fintech Vs banks” is becoming obsolete. The future, in his view, lies increasingly in cooperation between established banking institutions and technology-led financial businesses, while Cyprus must develop deeper banking, payments and investment infrastructure if it is to progress from a jurisdiction hosting licences to a genuine fintech ecosystem.
The timing of that discussion is particularly relevant.
According to the latest Central Bank of Cyprus (“CBC”) payment statistics, the number of Cyprus-licensed Payment Institutions (“PIs”) and Electronic Money Institutions (“EMIs”) increased from 34 at the end of 2024 to 38 at the end of 2025. Cyprus-based PIs and EMIs already play a particularly important role in electronic money payments, money remittance and acquiring services.
The question therefore is no longer simply whether Cyprus can attract fintech companies. It is whether Cyprus can provide the regulatory certainty, payment infrastructure, banking access, technology ecosystem and supervisory environment required for those companies to scale from Cyprus throughout the European Union.
Cyprus EMI and Payment Institution licensing enters a new phase
An important change has already occurred. With effect from 3 August 2026, the Central Bank of Cyprus introduced a new licensing procedure for prospective Cyprus PIs and EMIs. Anyone seeking a new Cyprus Payment Institution licence or Electronic Money Institution licence must now first go through a “pre-application exploratory stage” before filing the substantive licensing application.
The change is more significant than a procedural amendment.
Applicants must provide the CBC with information about their proposed business model at the pre-application stage and pay a non-refundable €5,000 fee. The CBC then carries out a preliminary assessment focusing in particular on the proposed ownership structure, the reputation of ultimate beneficial owners and the risk profile of the business model.
On a risk-based basis, the CBC may also require an independent Enhanced Due Diligence report concerning the applicant’s UBOs and connected entities. The preliminary assessment is expected to be completed within 30 working days, extended to 50 working days where such enhanced due diligence is required, after which the CBC may meet the applicant and identify concerns that should be addressed before the formal application is submitted.
For serious applicants, this may ultimately be a positive development.
It ensures regulatory engagement and gives founders and investors an opportunity to identify potential obstacles before committing the substantial time and resources required for a complete EMI or PI application. At the same time, however, it confirms an important point about the direction of Cyprus regulation: licensing is becoming more focused on quality, governance, ownership, substance and the credibility of the business model, not merely the preparation of an application file.
Fintech businesses considering Cyprus should therefore undertake a regulatory feasibility exercise before incorporation, investment and technology implementation decisions become difficult to reverse.
PSD3 and the Payment Services Regulation – Europe’s payments framework is being rebuilt
The proposed Third Payment Services Directive (“PSD3”) and new Payment Services Regulation (“PSR”) are intended to replace and modernise the PSD2 framework.
A provisional political agreement was reached between the European Parliament and Council on 27 November 2025. In May 2026, the European Parliament’s ECON Committee approved the negotiated text. As at August 2026, however, formal adoption remains outstanding, so businesses should distinguish carefully between the existing PSD2 requirements and the forthcoming framework.
Once finalised, the new framework is expected to bring significant changes for banks, PIs, EMIs and fintech providers.
Among other things, the agreed reforms seek to strengthen payment fraud prevention and reimbursement rules, improve transparency, remove obstacles to Open Banking, strengthen access by payment institutions to bank accounts and payment infrastructure, and simplify aspects of authorisation.
PSD3 will also bring payment institutions and electronic money institutions within a more unified regulatory framework, with electronic money institutions effectively becoming a category within the revised payment institution regime.
For Cyprus, that makes regulatory strategy particularly important. A company applying for a Cyprus EMI licence or PI licence in 2026 is not simply designing itself for today’s PSD2 environment; it should be building governance, compliance and operational systems capable of functioning under the next generation of European payments regulation.
Open Banking must become infrastructure, not simply compliance
One of the most important opportunities lies in Open Banking. The agreed EU framework is intended to prohibit certain obstacles to data access, improve access for authorised Open Banking providers and give users greater control over permissions through dedicated dashboards.
This matters because the next phase of fintech development is unlikely to be based on isolated institutions trying to recreate the entire banking infrastructure themselves. Instead, the emerging model involves interconnected banks, EMIs, PIs, technology providers, card schemes, payment processors, finance providers and regulated crypto businesses communicating through increasingly sophisticated APIs.
A successful Cyprus fintech ecosystem therefore requires more than licences. It requires an environment in which regulated businesses can interconnect efficiently and lawfully.
The existing problem, regulation can improve access but cannot change risk appetite
Perhaps the most commercially important issue for many fintech businesses remains banking access.
A regulated EMI or PI may have a perfectly valid licence and still face significant operational difficulty if it cannot establish reliable banking, safeguarding, settlement or correspondent relationships.
Importantly, the law already recognises this problem.
Under the current PSD2 framework, payment institutions must be given access to credit institutions’ payment-account services on an objective, non-discriminatory and proportionate basis, sufficiently extensive to enable them to provide payment services efficiently. A bank rejecting such access must provide the competent authority with reasons.
The forthcoming PSD3/PSR framework seeks to reinforce the position further.
But regulation should not be misunderstood as guaranteeing every fintech company a bank account. Banks remain responsible for their own AML, sanctions, financial-crime and risk-management obligations.
The better long-term answer to providing solution to this matter is therefore not simply more legislation. It is the development of fintech firms with credible governance, transparent ownership, strong AML systems, defensible customer-risk profiles and mature compliance functions, combined with banks capability of assessing fintech risk on its individual merits rather than through broad sector exclusions.
That is one of the areas in which closer cooperation between banks and fintech companies can materially strengthen Cyprus’s position.
Instant payments and TIPS could materially change the infrastructure equation
Another development receives less public attention but may ultimately be transformational.
The EU’s Instant Payments Regulation has progressively changed both the provision of instant euro transfers and access to European payment infrastructure.
The Eurosystem now permits qualifying non-bank payment service providers, including PIs and EMIs, to access TARGET Services. Since October 2025, eligible non-bank PSPs satisfying the applicable requirements have been able to access T2 and TARGET Instant Payment Settlement (“TIPS”), which settles instant euro payments in central bank money.
Furthermore, euro-area PIs and EMIs are required under the Instant Payments Regulation to be able to send and receive instant euro credit transfers by 9 April 2027.
This represents a major structural development. Historically, non-bank payment providers frequently depended heavily on commercial banks for access to parts of the payments infrastructure. Greater direct access potentially allows the relationship between banks and fintech companies to evolve from dependency towards partnership.
For Cyprus, that creates an opportunity to position locally regulated institutions not merely as licence holders but as participants in Europe’s developing real-time payment architecture.
DORA means that technology itself is now a regulatory issue
A fintech company is defined commercially by its technology. Increasingly, however, that technology stack is also part of its regulatory architecture.
The Digital Operational Resilience Act (“DORA”) has applied since 17 January 2025 and expressly captures payment institutions and electronic money institutions within its framework, subject to proportionality arrangements applicable to certain exempted institutions.
DORA requires regulated financial entities to maintain structured ICT risk-management arrangements, manage and report significant ICT incidents, conduct resilience testing and exercise appropriate oversight over third-party ICT providers. Importantly, outsourcing technology does not outsource regulatory responsibility: financial entities remain responsible for compliance when critical functions are provided by external technology or cloud providers.
For a modern EMI, PI or digital finance business, cybersecurity, cloud contracts, outsourcing arrangements, disaster recovery, data architecture and vendor concentration are therefore no longer merely IT matters.
They are board-level regulatory matters. This also means that applicants for Cyprus fintech licences should begin designing their DORA framework before licensing, rather than attempting to retrofit operational resilience after authorisation. For more information on DORA, please refer to our publications DORA Compliance for EU Financial Institutions and IT Providers and Would your firm pass a CySEC DORA Inspection Today?
MiCA and stablecoins are increasingly converging with payments regulation
The boundary between fintech, payments and crypto-assets is also narrowing. The EU Markets in Crypto-Assets Regulation (“MiCA”) is now fully applicable, with its rules concerning asset-referenced tokens and e-money tokens having applied since June 2024 and the broader regime since December 2024.
The interaction between MiCA and PSD2 has become particularly important for e-money tokens (“EMTs”).
The European Banking Authority has clarified that certain services involving EMTs may also constitute regulated payment services. The transitional “No Action Letter” approach adopted by the EBA ended on 2 March 2026.
The Central Bank of Cyprus has consequently issued specific guidance for Cyprus CASPs, recognising that a CASP authorised or registered through CySEC may also require authorisation from the CBC as a Payment Institution where its activities involving EMTs amount to payment services under PSD2. Cross-border provision then engages the relevant payment-services passporting framework as well.
This is a good illustration of where the market is heading.
The future fintech group may simultaneously operate across payments, crypto-assets, investment services, technology and traditional banking infrastructure. Regulatory perimeter analysis therefore becomes fundamental at group level, rather than licence by licence.
And what exactly is a “digital bank”?
There is also an important distinction that businesses and investors frequently overlook.
A “digital bank” or “fintech bank” is not, by itself, a separate category of Cyprus financial-services licence.
A company may provide a bank-like digital interface while legally operating as an EMI or PI. That does not make it a bank.
Where the proposed business constitutes the business of a credit institution, banking authorisation is required. Within the Single Supervisory Mechanism, the European Central Bank has exclusive competence to authorise credit institutions established in participating Member States, including Cyprus, acting within the SSM framework and in cooperation with the relevant national authority.
This distinction is particularly important when developing proposals for specialised “fintech banks”.
The technology may be new. The interface may be entirely digital. The institution may specialise in serving payment companies or technology businesses. But if it is legally a bank, the prudential framework applicable to credit institutions remains relevant.
The challenge is therefore not to create lighter regulation simply because a business is technologically sophisticated. It is to develop proportionate and commercially viable structures within the appropriate regulatory perimeter.
What Cyprus needs next
Cyprus already possesses several components of a successful fintech jurisdiction: an established regulatory framework, EU market access, a growing community of payment and electronic-money institutions and increasing expertise across payments, investment services and crypto-assets.
But the next stage cannot be measured simply by the number of licences issued.
A genuine fintech hub requires deeper infrastructure: reliable banking relationships, direct and indirect access to payment systems, effective Open Banking, sophisticated regulatory and compliance expertise, technology talent, investment capital and a supervisory environment capable of distinguishing innovative business models from unacceptable financial risk.
Most importantly, banks and fintech companies should increasingly be regarded as parts of the same financial ecosystem rather than opposing industries.
Banks possess balance sheets, prudential infrastructure, established compliance systems and access to financial-market infrastructure. Fintech companies bring technology, specialist products, speed and user experience.
The jurisdictions that successfully connect those strengths are likely to capture the next generation of European financial services.
Cyprus now has a credible opportunity to be one of them.
The regulatory foundations are increasingly in place. The challenge for the next phase is to build the infrastructure, institutions and commercial relationships around them.
How AGPLAW can assist
AGPLAW advises fintech businesses, financial institutions, investors and international groups on the establishment and operation of regulated financial-services businesses in Cyprus and across the European regulatory framework.
Our Financial Services Regulatory team can assist with:
- Cyprus Electronic Money Institution (EMI) and Payment Institution (PI) licensing, including the new CBC pre-application exploratory process
- regulatory feasibility and licensing-perimeter analysis before establishment or investment
- preparation and review of governance, ownership, substance, safeguarding, outsourcing and compliance structures
- PSD2, PSD3 and Payment Services Regulation readiness
- Open Banking, payment-services and technology arrangements
- DORA compliance, ICT outsourcing and operational-resilience frameworks
- MiCA and PSD2 dual-regulatory analysis, including payment services involving e-money tokens
- regulatory passporting and cross-border EU expansion
- acquisitions, disposals and changes in qualifying holdings in regulated institutions
- banking, safeguarding, payment-processing and commercial arrangements, and
- ongoing regulatory advice following authorisation.
For businesses evaluating Cyprus as a European base for payments, electronic money, digital banking or fintech operations, we shall be happy to assist you with early regulatory structuring, licensing risk, evaluation on costs and, implementation.
Disclaimer: This publication is provided for general information purposes only and does not constitute legal or regulatory advice. Specific advice should be obtained in relation to the particular circumstances of any proposed activity or transaction.
