Cyprus Banking & Finance Law 2026: Lending, Security, EMI/PI

Cyprus enters 2026 with a fundamentally restructured banking sector. The 2025 merger of Hellenic Bank and Eurobank Cyprus into a single entity — Eurobank Limited — has consolidated the market into two systemic lenders alongside a second tier of specialist banks. At the same time, the fintech licensing track — Electronic Money Institutions and Payment Institutions under PSD2 — has matured into one of the most active in the EU. This article is a practitioner's guide to how lending, security, licensing, and enforcement actually work in Cyprus today.

The material covers (i) the regulatory architecture and who supervises whom, (ii) the credit-institution landscape after the Hellenic/Eurobank merger, (iii) how secured loans are structured and what a typical Cyprus security package looks like, (iv) EMI and PI licensing under PSD2 and the Electronic Money Law, (v) AML and ongoing compliance, and (vi) what happens when a borrower defaults — examinership, receivership, liquidation, and the reformed court system.

The 2026 banking landscape

Cyprus banking law sits at the intersection of EU-harmonised prudential regulation (the Capital Requirements Regulation and Directive — CRR/CRD — and the Bank Recovery and Resolution Directive), the Single Supervisory Mechanism under the ECB, and a domestic legal framework that has been substantially modernised since 2013. The principal domestic statutes are:

• The Business of Credit Institutions Law of 1997 (as amended), which authorises and supervises credit institutions.
• The Provision and Use of Payment Services and Access to Payment Systems Law of 2018, transposing PSD2.
• The Electronic Money Law of 2012, transposing the E-Money Directive.
• The Prevention and Suppression of Money Laundering Activities Law (as amended in 2021 and 2024 to transpose AMLD5 and AMLD6).
• The Companies Law Cap. 113, the Contract Law Cap. 149, and the Civil Procedure rules as overhauled in 2023.

The Cyprus market is open, English-speaking, common-law-adjacent, and oriented toward international clients. The combination of the 15% corporate tax rate (see our Cyprus corporate tax guide), the 80% IP Box deduction (see the Cyprus IP Box article), and an EU passporting licence is what continues to attract serious fintech and credit operations.

The Central Bank of Cyprus

The Central Bank of Cyprus (CBC) is the national competent authority for the licensing and supervision of credit institutions, EMIs, and PIs. It also acts as the resolution authority under the Bank Recovery and Resolution Law and operates the national designated payment systems oversight. For credit institutions classified as "significant" under the SSM thresholds (Bank of Cyprus Holdings and Eurobank Limited), day-to-day prudential supervision is conducted by the European Central Bank with the CBC participating in the Joint Supervisory Team. Less significant institutions remain under direct CBC supervision.

The CBC publishes detailed application packs and supervisory manuals for each licence category. Pre-application engagement with the CBC's Licensing Division is the norm and, for any non-trivial EMI or PI file, a pre-application meeting saves months of iteration.

Credit institutions & the post-merger market

The 2025 merger of Hellenic Bank into Eurobank Cyprus to form Eurobank Limited was the most consequential structural change in Cyprus banking since the 2013 restructuring. The combined entity now sits alongside Bank of Cyprus Holdings as one of two systemic banks dominating retail and corporate lending. A second tier of established banks — AstroBank, Alpha Bank Cyprus, Ancoria Bank — together with the branches and subsidiaries of CDB Bank, Société Générale, Eurobank EFG Private Bank and certain Russian/Lebanese-heritage institutions, provides meaningful competition particularly in the SME and private-banking segments.

The practical consequence of the merger for borrowers is that the bilateral relationship market has narrowed at the top end, while club deals and cross-border participations from Greek, Israeli and Gulf lenders have become more common on mid-cap transactions.

Lending: senior secured, mezzanine, syndicated

Cyprus loan products track the standard European pattern, with documentation usually based on LMA (Loan Market Association) templates adapted for Cyprus security and Cyprus tax. The principal categories are:

• Senior secured term loans and revolving facilities from domestic banks, typically priced over EURIBOR with a margin reflecting the credit and a fixed schedule of amortisation or bullet at maturity.
• Real-estate finance, both investment loans and development facilities, secured by Cyprus mortgages and assignment of rental income or sale proceeds.
• Acquisition finance, typically structured as a senior facility into a Cyprus bidco with share pledges, account control and an intercreditor agreement.
• Mezzanine and unitranche from private credit funds, usually with English-law documentation and Cyprus-law security.
• Syndicated facilities with one of the systemic banks as agent and security agent.
• Asset-based lending, particularly receivables-backed and inventory-backed finance for trading companies.

Cyprus does not impose interest withholding tax on outbound loan interest paid to non-residents (with limited exceptions for payments to entities in EU-listed non-cooperative jurisdictions — see the defensive withholding tax guide). This makes Cyprus an attractive jurisdiction for cross-border lending platforms.

The Cyprus security package

A textbook Cyprus security package on a corporate financing combines the following Cyprus-law instruments. Each must be properly perfected — the time limits and registration formalities are unforgiving.

Share pledges & assignment of receivables

The Cyprus share pledge is one of the most lender-friendly security instruments in Europe. Under section 138 of the Contract Law Cap. 149, a pledge over shares in a Cyprus private company is created by agreement and perfected by deposit of the share certificates together with a blank stock transfer form executed by the pledgor. No public registration is required, no stamp duty is due on the pledge document itself beyond the nominal duty (see our stamp duty guide), and the pledge ranks ahead of subsequent unsecured creditors of the pledgor.

On enforcement, the pledgee may — if the pledge agreement so provides — either appropriate the shares in satisfaction of the secured obligation or sell them privately, in each case without a prior court order. The only condition is that the enforcement notice prescribed by the pledge document is served and the requisite notice period has elapsed. This self-help feature is why Cyprus holding companies are routinely used as the security "chokepoint" in cross-border financing structures.

Assignment of receivables is created by agreement; to be effective as a legal assignment (rather than merely an equitable one), written notice must be given to the account debtor. In a financing context the notice is typically held in escrow and served only on default; until then the assignment operates in equity, with the borrower retaining the day-to-day collection right.

EMI & PI licensing under PSD2

Cyprus has become a serious EU fintech licensing hub. The two principal authorisations are:

Electronic Money Institution (EMI)

• Statute: Electronic Money Law of 2012 (transposing Directive 2009/110/EC).
• Activities: Issuance of e-money, redemption, distribution; plus all PSD2 payment services.
• Initial capital: €350,000.
• Own funds: Higher of initial capital, Method A/B/C/D under PSD2, and 2% of average outstanding e-money.
• Safeguarding: Client funds segregated at a Cyprus credit institution or covered by qualifying insurance.

Payment Institution (PI)

• Statute: Provision and Use of Payment Services Law of 2018 (transposing PSD2).
• Initial capital: €20,000 (money remittance only), €50,000 (payment initiation), or €125,000 (account services, transfers, card acquiring).
• Own funds: Higher of initial capital and ongoing requirement computed under Method A, B or C.
• Safeguarding: Same regime as EMI for client funds.
• Account information services (AISP): A lighter "registration" rather than full authorisation, with PI conduct rules.

AML and ongoing compliance

Every Cyprus credit institution, EMI, and PI is an "obliged entity" under the Prevention and Suppression of Money Laundering Activities Law. The transposition of AMLD5 (2021) and AMLD6 (2024 amendments) tightened the rules around beneficial ownership, customer due diligence, and reporting. Operational obligations include:

• Risk-based customer due diligence on onboarding and on a continuous basis.
• Beneficial-ownership identification with cross-check against the UBO Register (see the UBO register guide).
• Appointment of an MLCO/AMLCO with direct access to the board.
• Transaction monitoring and Suspicious Activity Reports to MOKAS, the Cyprus FIU.
• Enhanced due diligence on PEPs and on customers from EU non-cooperative jurisdictions.
• Annual independent audit of the AML function.

Sanctions screening — EU, UN, OFAC — is mandatory on every transaction. The CBC has issued substantial fines for sanctions and AML failures since 2022, and the supervisory bar continues to rise.

Enforcement & the 2023+ court reform

The Cyprus court system underwent its largest reform in fifty years in 2023, with effects continuing to roll out through 2025–2026. The principal changes for finance practitioners are:

• The introduction of a Commercial Court with specialist judges and accelerated case management for claims above defined thresholds.
• The introduction of an Admiralty Court.
• A reformed Civil Procedure Code based on the English CPR template, with active case management, electronic filing, and tighter timetables.
• Materially shorter time-to-judgment in commercial disputes (subject to caseload).
• Modernised rules on interim injunctions, asset freezing (Mareva-style), and disclosure (Norwich Pharmacal-style).

For a secured lender, the practical effect is that mortgage and debenture enforcement timelines have shortened, and the willingness of the court to grant freezing orders in support of enforcement has increased. Self-help enforcement of share pledges, of course, does not engage the court at all in the first instance.

Examinership, receivership, liquidation

Cyprus insolvency law was rewritten in 2015 with the introduction of examinership (modelled on the Irish procedure) and a modernised personal insolvency framework. The principal corporate procedures are:

• Examinership — a court-supervised reorganisation under Part IVA of the Companies Law Cap. 113. The court appoints an examiner (an insolvency practitioner) and grants a moratorium of up to four months (extendable in limited circumstances) during which no creditor may enforce. The examiner negotiates a scheme of arrangement that, if approved by creditors and confirmed by the court, binds dissenting creditors.
• Receivership — appointment of a receiver and manager by a secured creditor under a floating-charge debenture. The receiver takes control of the charged assets and operates the business to realise value for the secured creditor.
• Compulsory liquidation — by court order on the petition of a creditor, the company itself, or the Registrar.
• Voluntary liquidation— members' voluntary (for solvent winding-up) or creditors' voluntary (where the company is insolvent).

Priority on liquidation follows the standard pattern: (1) costs and expenses of the liquidation, (2) preferential debts (limited categories of employee claims and certain taxes), (3) claims of holders of floating charges, (4) unsecured creditors, (5) deferred and shareholder claims. Fixed-charge holders sit outside the waterfall to the extent of their security.

Worked example: a secured acquisition financing

Consider a Cyprus financing for the acquisition of a Cyprus-incorporated target operating a regulated business. The fact pattern:

• Purchase price €40,000,000 for 100% of TargetCo (Cyprus).
• Senior facility of €25,000,000 from a Cyprus systemic bank.
• Mezzanine facility of €8,000,000 from a Luxembourg credit fund.
• Equity of €7,000,000 from the sponsor.
• BidCo (Cyprus) is the borrower; TargetCo becomes its wholly-owned subsidiary on closing.

The security architecture:

1. Share pledge over BidCo shares granted by the sponsor (Cyprus-law, self-help enforceable) — for the benefit of senior and mezzanine pari passu under the intercreditor agreement.
2. Share pledge over TargetCo shares granted by BidCo immediately on closing — same beneficiaries.
3. Debenture from BidCo and TargetCo creating a fixed and floating charge over all assets — registered at the Registrar within 21 days under section 90.
4. Mortgageover TargetCo's Cyprus real estate at the Department of Lands and Surveys.
5. Assignment of intra-group receivables, in particular BidCo's receivable against TargetCo arising from the on-loan of the senior proceeds.
6. Account pledges over the BidCo and TargetCo operating and proceeds accounts held with the senior agent bank, governed by a tri-party account control agreement.
7. Intercreditor agreement (English-law) governing the ranking between senior and mezzanine, payment block periods, enforcement standstills, and turnover.

On default, the senior agent — acting as security agent for both lender groups — can move quickly: serve notice under the share pledge, take control of BidCo's share register, sell to a third party or appropriate, and bypass any need for a Cyprus court order. The receivables and account-control mechanics ensure that operating cash is captured from the moment of default. Mortgage enforcement, if required, proceeds through the post-2023 reformed process.

Common mistakes in Cyprus financings

1. Missing the 21-day filing window. A charge created but not registered within 21 days is void against the liquidator. Calendar this on the day of signing.
2. Taking an English-law share pledge over Cyprus shares. Enforcement against the share register has to happen in Cyprus. Foreign-law share pledges over Cyprus shares routinely run into conflict-of-laws problems and recognition issues. Use a Cyprus-law pledge.
3. Forgetting to perfect receivables assignments by notice. Without notice to the account debtor, the assignment is only equitable and ranks behind a later legal assignee who does give notice (the rule in Dearle v Hall, applied in Cyprus).
4. Inadequate financial-assistance analysis. Section 53 of the Companies Law restricts a public company from giving financial assistance for the acquisition of its own shares. The carve-outs and the 2015 amendments need to be analysed properly for any acquisition financing.
5. Underestimating sanctions risk. Post-2022 the enforcement appetite of the CBC and MOKAS has materially increased. Sanctions, UBO and source-of-funds analysis should be done before drawdown, not after.
6. Treating the EMI/PI application as a forms exercise. The CBC scrutinises the business plan, capital adequacy projections, IT and security policy, and the credibility of senior management. A weak file is rejected — or, worse, dragged through 18+ months of iteration.
7. Ignoring tax-residency substance for the lending vehicle. A Cyprus lending company that pays no Cyprus interest withholding tax depends on its Cyprus tax residency. Without board and management substance in Cyprus, treaty access and the favourable interest regime are at risk. See our note on economic substance.