[email protected]
+44 7563 115980 (phone and WhatsApp)
PSD3 merges e-money into a new Payment Services Directive. In Cyprus, every electronic money institution (EMI) and payment institution licensed by the Central Bank of Cyprus (CBC) will need to show that it meets PSD3 within 27 months of entry into force. Institutions that do are treated as authorised under PSD3. Those that do not must stop the services concerned when the transition ends.
The CBC has not yet set out a PSD3 process for existing institutions. But since 2025 it has raised its expectations through new directives on governance and on the suitability of directors and key personnel, and through a new licensing process for applicants. Those changes show how the CBC will read a PSD3 file. Our PSD3 re-authorisation guide explains the EU-wide process.
The table counts firms with a current Cypriot home licence on the EBA Central Register at 30 October 2026, from the Buckingham register of licensed EU payment and e-money firms.
| Firms with a home licence in Cyprus | Number |
|---|---|
| E-money institutions | 30 |
| Payment institutions | 10 |
| Registered account information firms | 1 |
| Firms passporting into at least one other country | 36 |
Cyprus is unusual in having three times as many EMIs as payment institutions. Many Cypriot EMIs serve international businesses, trading and investment firms, and cross-border merchants, and several belong to groups that also hold investment firm or crypto-asset licences in Cyprus. For an e-money-heavy sector, the PSD3 changes to e-money safeguarding timing and capital matter more than in most countries.
| Step | Timing |
|---|---|
| Council adopts its first reading position on PSD3 and the PSR | 29 October 2026 |
| European Parliament approves the texts in plenary | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| PSD3 applies through national law; the PSR applies directly | 21 months after entry into force |
| Transition for existing institutions ends | 27 months after entry into force, extendable by up to 3 months in exceptional cases |
Cyprus will transpose PSD3 by replacing the Provision and Use of Payment Services and Access to Payment Systems Laws of 2018 to 2025 and the Electronic Money Laws of 2012 and 2018. The Payment Services Regulation applies directly.
| Change | What it does |
|---|---|
| Fit and proper directives (2025) | Suitability requirements for board members and key personnel of payment service providers, and for directors and advisers of EMIs |
| Governance directives (May 2026) | Internal organisation and governance of EMIs and of payment institutions: internal controls, risk management, compliance, AML controls, ICT risk, outsourcing, complaints and reporting |
| New licensing process (August 2026) | A pre-application exploratory stage before any application, early testing of good repute, possible enhanced due diligence reports, and applications treated as withdrawn if left unanswered |
| Crypto and e-money tokens (2026) | Crypto-asset service providers transferring or holding e-money tokens for clients need payment institution authorisation or a partnership with an authorised provider |
The governance directive for EMIs was published on 29 May 2026 and took effect on publication. It requires a sound governance framework, clear responsibilities, adequate internal controls, effective risk management, a working compliance function, AML controls and ICT risk management, with a separate ICT risk function in some cases. The payment institution directive covers the management body, internal controls, compliance, outsourcing, complaints, whistleblowing and reporting to the CBC. Together they cover much of what PSD3 asks for in the governance and internal control section of the authorisation file.
The new process applies to applicants, not to existing institutions. But it shows the CBC's priorities. The stated aims are more transparency about requirements and early identification of issues, especially on good repute. The CBC may ask for an enhanced due diligence report from a specialist firm, and it will treat applications as withdrawn if the applicant does not respond within a set period.
Existing institutions should expect the same priorities in re-authorisation. Shareholders, directors and key function holders will be looked at again against the fit and proper directives. Responses to CBC questions will need to be quick and complete. And where ownership has changed since the original licence, the file should show clearly who the ultimate owners are and how they were assessed.
For an EMI-heavy market, the move from five business days to next business day safeguarding is the main operational change. Funds still held at the end of the business day after receipt must be safeguarded, for e-money as well as payment services. Institutions must try to avoid holding all customer funds with one bank, which can take time in a smaller banking market. Where an institution safeguards with a bank in another member state, which is permitted, the account letters, insolvency position and user information must reflect that. Our PSD3 safeguarding rules guide explains the PSD3 rule.
Cyprus has become a base for crypto-asset service providers under MiCA, and several groups combine a CASP with an EMI. The CBC has said that crypto-asset service providers that transfer e-money tokens or hold them in custody for clients are providing payment services and need payment institution authorisation, unless they partner with an authorised provider. Under PSD3, a CASP applying for payment institution authorisation may reuse the information it filed for MiCA if it is still current. Groups should map which entity provides which service and fix gaps or overlaps before filing the PSD3 file. The CBC set a 20 February 2026 date for existing crypto-asset service providers offering these services to apply, which shows it is prepared to set firm dates where activity crosses into payments. It would be prudent to expect firm dates in the PSD3 process too.
PSD3 requires an institution to have its head office in the member state that authorises it and to carry out at least part of its payment business there. Part can be less than the majority, but it must be real activity. Many Cypriot institutions belong to groups whose founders, technology teams or main markets are elsewhere, so this test deserves a careful look.
Evidence that helps includes board meetings held and decisions taken in Cyprus, executive directors and control function holders based in Cyprus, payment operations such as safeguarding, reconciliations or onboarding carried out by staff in Limassol or Nicosia, and outsourcing to group companies documented and overseen from Cyprus. The CBC's governance directives already point in this direction. Institutions with a thin local presence should decide now whether to strengthen it or restructure, since either takes longer than preparing the file.
A Cypriot EMI that issues e-money and also provides card payments and transfers moves from EUR 350,000 initial capital today to EUR 400,000 under PSD3. One that only issues e-money moves to EUR 250,000, although ongoing own funds of 2% of outstanding e-money usually set the real requirement. Our PSD3 capital requirements guide has worked examples. The winding-up plan is new and must provide for returning safeguarded funds in a disorderly wind-down. For EMIs serving business clients across many countries, the plan should deal with currency, sanctions screening and the time needed to verify where funds should go. Our PSD3 winding-up plan guide covers the contents.
PSD3 requires the authorisation file to identify directors and people responsible for management, and those holding qualifying holdings, with evidence of their reputation, knowledge and experience. The CBC's fit and proper directives already set detailed suitability requirements for board members, key personnel and EMI advisers. Cypriot institutions should refresh suitability assessments for every board member and key function holder, document how each meets the directives, and check that the register of shareholders and ultimate owners is current. A board member who joined without a formal assessment, or a change in ownership not fully notified, is easier to resolve now than during re-authorisation.
Many Cypriot EMIs provide accounts and payments to business clients in many countries, including firms in higher-risk sectors. The PSD3 file includes the institution's internal controls for money laundering and terrorist financing, and the EU Anti-Money Laundering Regulation will apply directly from 10 July 2027, before the PSD3 transition ends. Cypriot institutions should align their customer due diligence, beneficial ownership checks and transaction monitoring with the Regulation now, so the PSD3 file can describe controls that already meet the new rules. Our EU AML Regulation guide explains what changes.
Buckingham Capital Consulting has advised payment and e-money firms since 2013 on licensing, compliance and banking, including Own Solutions' EMI licence from the Central Bank of Ireland and FCA authorisations for Nexpay, Orbital and Hryze. We prepare PSD3 gap analyses against the CBC's 2026 governance directives, safeguarding reviews, capital projections and winding-up plans for Cypriot institutions, and help crypto groups align MiCA and payments authorisations. See our Cyprus EMI licence and Cyprus payment institution licence guides, or contact us to discuss your institution.
They must show the Central Bank of Cyprus that they meet PSD3 within 27 months of entry into force. If they do, they are treated as authorised under PSD3.
Directives on the internal organisation and governance of EMIs and of payment institutions, published in May 2026 and effective on publication.
No. It applies to new applicants from August 2026, but it shows the CBC's focus on good repute and complete, timely responses.
The CBC has said CASPs that transfer or hold e-money tokens for clients need payment institution authorisation unless they partner with an authorised provider.
EUR 250,000 for e-money issuance alone, or EUR 400,000 with the core payment services, plus ongoing own funds.
The payment services laws of 2018 to 2025 and the electronic money laws of 2012 and 2018.
Get in touch: +44 7563 115980 (phone and WhatsApp) or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)