Cyprus Payment Institution (PI) Licence 2026: Capital, Central Bank Authorisation & EU Passporting

Fintechs choosing an EU base keep returning to Cyprus for the same reasons: an English-speaking common-law system, a reformed 15% corporate tax rate from 2026, and a Central Bank that runs a credible but proportionate PSD2 authorisation process. A Payment Institution (PI) licence is the entry ticket — it lets a company move customer money legally and, crucially, passport that permission across the whole European Economic Area from a single Cyprus base.Directive (EU) 2015/2366 (PSD2)

This guide sets out what a PI licence actually is, the initial-capital tiers by service, who authorises it and under which law, what the Central Bank of Cyprus (CBC) expects in the application, how client funds must be safeguarded, and where the regime is heading under PSD3. Zeno is not a law firm; it coordinates independent Cyprus Bar advocates and ICPAC accountants who handle the regulated filings.

What is a Cyprus payment institution licence?

A PI licence is authorisation from the Central Bank of Cyprus to provide one or more of the payment services listed in Annex I of the Cyprus law transposing PSD2 — for example executing transfers, acquiring or issuing payment instruments, money remittance, or payment initiation. Without it, providing those services to the public is a criminal offence.

The services are grouped in Annex I of the Provision and Use of Payment Services and Access to Payment Systems Law of 2018, which mirrors Annex I of PSD2. Points 1 to 5 cover the core services (placing and withdrawing cash, executing direct debits, card transactions and credit transfers, issuing or acquiring payment instruments); point 6 is money remittance; point 7 is payment initiation services (PIS). Which points you apply for determines both your permitted activity and your capital.Provision and Use of Payment Services and Access to Payment Systems Law of 2018, Annex I

A PI is not a bank and cannot take deposits or pay interest; nor can it issue electronic money — that requires the heavier Cyprus EMI licence. The PI sits in the sweet spot for money-transfer businesses, acquirers, PISP/AISP open-banking players and remittance operators.

How much initial capital do you need?

Initial capital is tiered by service: €20,000 for money remittance only, €50,000 for payment initiation services, and €125,000 where you provide any of the services in points 1 to 5 of Annex I. The capital must be paid up before authorisation and maintained at all times.

These are floors, not ceilings. Once trading, a PI must also hold ongoing own funds calculated under the methods in PSD2 (a percentage of fixed overheads, or of payment volume, subject to a supervisory scaling factor), and the CBC can require more where the risk profile justifies it. Account information service providers (AISPs) that provide only point 8 activity are registered rather than licensed and face no initial-capital minimum but must hold professional indemnity insurance.Provision and Use of Payment Services and Access to Payment Systems Law of 2018Directive (EU) 2015/2366 (PSD2), Articles 7 and 9

Who authorises a PI and under what law?

The Central Bank of Cyprus is the sole competent authority. It authorises and supervises payment institutions under the Provision and Use of Payment Services and Access to Payment Systems Law of 2018 (the national transposition of PSD2), applying the CBC directive on authorisation and the EBA Guidelines on authorisation (EBA/GL/2017/09).

PSD2 is Directive (EU) 2015/2366, adopted on 25 November 2015 and transposed by every EU member state. Cyprus enacted it in 2018 and has amended it several times since. Because the framework is EU-harmonised, a CBC authorisation is recognised across the EEA — that is what makes passporting possible. The CBC publishes its own directive on the authorisation and operating conditions of payment institutions, which sets out documentation, fit-and-proper and prudential expectations in detail.Central Bank of Cyprus — Licensing and supervision of payment institutionsEBA Guidelines on authorisation of payment institutions (EBA/GL/2017/09)

What does the CBC application require?

The application is a substantial file: a three-year business plan and financial projections, a programme of operations, governance and internal-control frameworks, an AML/CFT manual, safeguarding arrangements, IT and security policies, evidence of paid-up capital and fit-and-proper documentation for directors, senior managers and qualifying shareholders.

The CBC follows the EBA authorisation guidelines closely, so the content and format of each section are effectively prescribed. The elements a credible file must cover include:

• Corporate vehicle: a Cyprus company (see the company registration guide) with a registered office and, in practice, real substance and local management in Cyprus.
• Governance: a competent board, a clear organisational chart, and appointed roles for compliance, risk, internal audit and money-laundering reporting (MLRO).
• Fit-and-proper: CVs, criminal-record and credit checks for directors, senior managers and holders of qualifying holdings (10%+).
• AML/CFT framework aligned to the Cyprus Prevention and Suppression of Money Laundering Activities Law and CBC directives.
• Security and operational-resilience policies, including incident reporting and strong customer authentication (SCA) under the PSD2 technical standards.
• Safeguarding method, capital evidence and audited opening balance sheet.

The statutory clock for a CBC decision is three months from a complete application, but incomplete files stop the clock, which is why pre-submission quality control matters so much.Directive (EU) 2015/2366 (PSD2), Article 11

How must client funds be safeguarded?

Client money can never be treated as the PI's own. Funds received for payment transactions must be safeguarded either by segregation — held in a separate account at a credit institution or invested in secure, liquid, low-risk assets — or by an insurance policy or comparable guarantee from an insurer or bank independent of the PI.

Safeguarding is the single most scrutinised operational control. Under the segregation method, user funds must be insulated from the claims of the PI's other creditors, including on insolvency; under the insurance method, the payout must be available to users if the PI fails. The CBC expects daily reconciliation, clear designation of safeguarding accounts and, in practice, that the PI does not commingle operating cash with customer funds even briefly. Getting the safeguarding architecture and bank relationships in place early is often the practical bottleneck in the whole project.Directive (EU) 2015/2366 (PSD2), Article 10

Can a PI use agents and passport across the EU?

Yes to both. A PI may provide payment services through agents, who must be registered with the CBC after due-diligence checks, and an authorised Cyprus PI can passport into any other EEA state — under freedom to provide services or by establishing a branch or agent network — through the CBC's home/host notification procedure.

Agents let a PI extend distribution without each agent needing its own licence, but the PI remains fully liable for the agent's acts and must include agents in its AML and internal-control framework. Passporting is the commercial heart of the Cyprus proposition: a single CBC authorisation reaches roughly 30 EEA markets. The home regulator (CBC) notifies each host regulator, and once the notification period elapses the PI can operate there without a separate authorisation. This is why many groups run pan-European payment operations from one Cyprus entity rather than licensing in several countries.Directive (EU) 2015/2366 (PSD2), Articles 19 and 28

How is a Cyprus PI taxed in 2026?

A licensed PI is an ordinary Cyprus company for tax purposes: corporate income tax at the reformed 15% rate from 1 January 2026, no withholding tax on outbound dividends to non-residents, and access to the EU and double-tax-treaty network. The regulated status changes the supervision, not the headline tax treatment.

The 15% corporate rate applies to trading profits after deductible expenses; the fuller picture, including the special defence contribution and the notional interest deduction, is in our Cyprus corporate tax guide 2026. Regulated entities must always file full statutory audited accounts — the small-company review-engagement option does not apply — as explained in the Cyprus audit requirements guide. Founders relocating to run the entity should review the non-dom and 60-day residency routes for their personal position.Income Tax Law N.118(I)/2002 (as amended for 2026)

What does PSD3 change for PIs?

PSD3 and the accompanying Payment Services Regulation (PSR) will replace PSD2. The headline structural change is that the payment institution and electronic money institution regimes merge into a single Payment Institution able to issue e-money. Provisional political agreement was reached in late 2025, with application expected around 2027 after entry into force.

For a firm authorising now, PSD3 is a reason to design for the future, not to wait. Existing PIs and EMIs are expected to benefit from transitional provisions and re-authorisation windows rather than losing their permissions overnight. The reform also tightens fraud liability (including APP-fraud measures), strengthens open banking, and moves much of the detailed conduct rulebook into a directly applicable regulation (the PSR) for greater harmonisation. Building AML, safeguarding and SCA to a high standard today makes the eventual transition materially easier.European Commission proposals for PSD3 and the Payment Services Regulation

Timeline, cost and next steps

Budget 6 to 12 months from kick-off to authorisation and plan for the paid-up capital plus professional and CBC fees. The gating factors are the quality of the business plan, credible local management and substance, and having capital and safeguarding banking in place before the CBC starts substantive review.

A realistic sequence is: incorporate the Cyprus company and build substance; assemble the management team and qualifying shareholders and clear fit-and-proper checks; write the business plan, programme of operations, AML manual and safeguarding arrangements; deposit the initial capital; then submit to the CBC and manage the question-and-answer cycle. Because a PI is a regulated entity, its accounts are always fully audited by an ICPAC-licensed auditor — factor that ongoing cost into the model from day one. Zeno coordinates the corporate setup and connects you with independent Cyprus Bar advocates and ICPAC accountants who prepare and file the regulated application.