Cyprus: Fintech

The In-House Lawyer Logo

This country-specific Q&A provides an overview to Fintech law in Cyprus.

It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.

This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit

  1. What are the sources of payments law in your jurisdiction?

    The principal legislation governing sources of payments in Cyprus are:

    • the Central Bank of Cyprus Law 2002 (CBCL), which establishes and regulates the relevant competent authority, the Central Bank of Cyprus (CBC) in its interaction with pan-EU payment systems such as TARGET2-CY;
    • the Business of Credit Institutions Law 1997 (BCI Law), which regulates authorised credit institutions in Cyprus as well as those passporting into Cyprus from elsewhere in the European Economic Area (EEA). The BCI Law transposes the Capital Requirements Directive 2013/36/EU (CRD IV);
    • the Payment Services Law 2018 (PSL), which transposes the Payment Services Directive (EU) 2015/2366 (PSD2);
    • the Electronic Money Law 2012 (EML), which transposes Electronic Money Directive 2009/110/EC (EMD); and
    • the Settlement Finality in Payment Systems and Securities Settlement Systems Law 2003 (SFL) which transposes the Settlement Finality Directive 98/26/EC (SFD).
  2. Can payment services be provided by non-banks, and if so on what conditions?

    Yes. Based on the provisions of the PSL payment services may be provided by non-bank institutions:

    • where licensed and authorised by the CBC under the PSL; and
    • where passporting into Cyprus from another EEA state under the terms of the PSL and PSD.
  3. What are the most popular payment methods and payment instruments in your jurisdiction?

    Based on number of payments sent, in order of priority:

    • Cards payments with cards issued by resident payment services providers (PSPs): 50.4 million;
    • Credit transfers, whether electronic or paper based: 17.8 million;
    • Cheques (domestic market only): 14.5 million; and
    • E-money payments with e-money issued by resident PSPs: 1.7 million.

    Based on value of payments sent, in order of priority:

    • Credit transfers, whether electronic or paper based: EUR222 billion;
    • Cheques (domestic market only): EUR22.9 billion; and
    • Card payments with cards issued by resident PSPs: EUR3.5 billion; and
    • E-money payments with e-money issued by resident PSPs: EUR0.1 billion.

    In general terms Cyprus has adopted the TARGET2 real time gross settlement system for the Eurozone, known as “TARGET2-CY”. As such credit transfers in Cyprus are facilitated through TARGET2-CY. The CBC operates TARGET2-CY according to the Directive of the Central Bank of Cyprus on TARGET2-CY System of 2017.

    JCC Payment Systems Limited (JCC) is the principal card operating company in Cyprus. It was formed as a joint enterprise between the five principle credit institutions in Cyprus: Bank of Cyprus, Hellenic Bank, Alpha Bank, National Bank of Greece and Astro Bank. JCC acts as a card acquirer on its own behalf for Visa, MasterCard and Diners and as an acquiring processor for American Express cards.

    Cheques in Cyprus are cleared through the Cyprus Clearing House (CCH). The CCH is operated by the CBC.

  4. What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?

    The open banking method, also known as application programming interface banking (API Banking) is currently implemented in Cyprus in line with the provisions of the PSD2 and operates through platforms established by the following local banks:

    • Bank of Cyprus
    • Hellenic Bank

    Implementation of API Banking in Cyprus in practice is currently at a ‘sandbox’ stage of development and is not popular in the market.

  5. How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?

    The General Data Protection Regulation 2016/67 (GDPR) is directly applicable in Cyprus since 25 May 2018. GDPR attaches to the processing of personal data by ‘controllers’ or ‘processors’ and this will apply to all such persons established in Cyprus and the EU. Personal data refers to any information relating to an identified or identifiable natural person. A business which may be working with corporate entities, may still be processing data relating to individuals within those corporate entities. By way of example, employee details and names or emails of individuals within corporations can constitute personal data.

    GDPR is consequently a pervasive legislative framework for the provision of financial services to consumers and business in Cyprus.

  6. What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?

    The Cyprus Securities and Exchange Commission (CySEC) being the regulator for investment businesses and related matters in Cyprus has recently announced the establishment an Innovation Hub which will act mainly as a type of sandbox platform allowing supervised and non-supervised entities in innovative or new industries to acquire ongoing access to CySEC’s regulatory insights which will principally enable them to duly comprehend and consequently implement the applicable regulatory requirements while engaging simultaneously in an exchange of information and communication with the regulator in an attempt to influence in a positive way the regulator’s decision-making process in this industry.

    The Cyprus Innovation Hub, is due to become operational in September 2018.

  7. Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?

    In our view the following comprise possible risks to the growth of the fintech market in Cyprus:

    • Additional tax incentives: The Cyprus financial and banking crisis of 2013 and the consequent Memorandum of Understanding entered into in March 2013 between the Eurogroup, European Commission, European Central Bank and International Monetary Fund has impacted on the ability of the Cyprus government to tailor its current tax regime to the needs of new industries emerging industries, including in fintech. This has arguably placed Cyprus at a competitive disadvantage in respect of some fintech-inspired developments such as initial coin offerings (ICOs).
    • Attitude of the CBC: In contrast to CySEC (see above re Innovation Hub) the CBC has generally taken a conservative view on permitting authorised banking institutions from carrying out non-traditional banking activities, including facilitating transactions in crypto-assets such as bitcoin. Whilst fintech is clearly a broader movement than payments in crypto-currencies, the weariness of the Cyprus banking sector to this area may constitute a risk to the overall development of fintech in Cyprus.
  8. What tax incentives exist in your jurisdiction to encourage fintech investment?

    Despite the commentary above on new tax incentives, the base tax situation in Cyprus is generally very positive for businesses:

    • Corporate income tax is set generally at 12.5% on resulting net profits. This tax rate may be further reduced subject to careful tax planning.
    • There is no capital gains tax in Cyprus.
  9. Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?

    Fintech investment in Cyprus is mostly Series B and C in nature as opposed to Series A.

    Many CySEC-authorised investment firms and investment funds have started to become involved in the trading of crypto-assets with prominent blue-chip institutions abroad. Recent CySEC circulars has clarified and strengthened the basis of such trading.

    The fintech sandboxing programmes relating to API Banking (see above) have further strengthened the participation of some Cypriot credit institutions in this area as well.

    Finally Cyprus hosts the University of Nicosia (UNIC), which is the world’s first university to accept tuition fees in crypto-currency. In addition UNIC staff have been a powerful and beneficial voice on–island for the dissemination of new ideas in the jurisdiction.

  10. If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?

    Cyprus’ greatest strengths, from a fintech investment perspective comprise the following:

    • Proximity to key markets and geographies which are forging ahead in fintech and crypto development, including Israel, Middle East, Russia and Belarus.
    • Legal system is derived from English common law. English and commonwealth legal precedent is of persuasive effect in the court of Cyprus. In this way Cyprus is able to benefit from recent jurisprudence developed in other countries.
    • EU and European Monetary Union Member State, full application to the EU acquis in Cyprus. Is likely to operate as a bridge to the UK within the Eurozone/EU following Brexit.
    • Low set up and operating costs. English language, with a multilingual highly trained workforce.
    • Extensive network of Bilateral Investment Treaties, with approximately 30 countries.
    • Favourable domestic tax system:

    - Corporate Income Tax rate of 12.5%
    - Standard VAT rate of 19%
    - Extensive network of Double Tax Treaties, with 52 countries
    - Generous withholding tax exemptions.

  11. Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?

    • EEA / EU nationals: Cyprus is a full member state of the EU and applies the four core freedoms, including freedom of movement. As such all EU / EEA citizens are free to work in Cyprus.
    • Non-EU/EEA: A work permit is required which can be obtained if the Ministry of Labour is satisfied that a Cypriot national or an EU citizen is not available to do the job. In practice expedited processes are offered to certain non-EU citizens, such as those of Russia and Serbia.
    • Citizenship by investment: Fast track citizenship is available subject to screening processes for persons investing above certain thresholds in Cyprus. Persons and families obtaining such citizenship would be free to work in Cyprus as any other Cypriot or EU/EEA national.
  12. If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?

    We expect that the advent of the CySEC Innovation Hub (see above) should have a positive impact on the relocation of regional talent to Cyprus.

    In respect of non-EU migration, a Cyprus start-up visa scheme has recently been approved with a view to encourage foreign investments from non-EU countries in the fields of innovation and research and development (R&D). The founder of the start-up would be eligible to apply should it be an individual start-up, or alternatively in the case of a group start-up up to five persons are eligible to apply (one founder and senior executives). The relevant investors must have a start-up capital of at least EUR50.000 and an innovative business or business plan must be in place. An innovative business would be one where the R&D cost forms at least 10% of the operating costs in at least one of the three years of its operation prior to the application. The business headquarters, as well as control and management must take place in Cyprus.

  13. What protections can a fintech use in your jurisdiction to protect its intellectual property?

    The following intellectual property (IP) protections may be available in Cyprus:

    • Patents:

      - Making a national application for a patent, namely to file an application for a national patent certificate with the Patent Registrar. The application will be forwarded to the European Patent Organisation (EPO) for further examination who will then issue a search report. Should the application be successful the Registrar will accordingly publish the patent certificate of registration, followed by the search report.

      - Protection at an international level can be sought through submission of a single application under the provisions of the Patent Cooperation Treaty 1970 in a large number of countries which are signing parties to the treaty. Following submission of the application, its contents will be publicly disclosed after the lapse of 18 months.

      - An online application can further be made in order to secure protection at a European level, using the EPO Online Filing service. Fintech could enjoy IP protection in some or all of the countries which are signatories to the Convention on the Grant of European patents (EPC). The applicant may choose to indicate which countries the patent is to be protected in.

      - A further consideration in cases of companies dealing with certain fintech products would be industrial registered designs.

    • Copyright: A further option would be copyright protection, as Cyprus law provides protection to Cypriot nationals for globally published work, as well as nationals for published work in Cyprus. The relevant copyright does not require registration, albeit it should be noted that there is nothing preventing a competitor to achieve the same outcome but use a different method. Cyprus is a signatory to the Berne Convention for the Protection of Literary and Artistic Works which guarantees protection to all the Convention Member States with no further process being required.
    • Trademarks: Protection of trademarks can be effected in over 80 countries through an application to the Office of the Registrar of Companies and Official Receiver.

    All relevant EU Directives and Regulations relating to IP protection apply and have been introduced into Cyprus domestic legislation.

  14. How are cryptocurrencies treated under the regulatory framework in your jurisdiction?

    The provision of services relating to cryptocurrencies are not currently subject to any specific or bespoke licensing regulation in Cyprus (with the exception of the anti-money laundering regime – see below). However determining whether cryptocurrency or a crypto-asset will be subject to securities, derivatives and other regulation is not a simple exercise and will require analysis against numerous regimes including those under the Business of Credit Institutions Law 1997, Investment Services Law 2017, the Payment Services Law 2018 and the Electronic Money Law 2012. CySEC has issued announcements informing individuals who engage in cryptocurrency transactions about the respective risks associated from the purchase, possession or trading of same but has conceded that these as likely to be permissible under current local law.

    In terms of the treatment of crypto currencies under the Cypriot anti-money laundering regime, we do note that the so-called Fifth Anti-Money Laundering Directive.

    (EU) 2015/849 (5AMLD) expressly brings providers of exchange services between virtual currencies and fiat currencies as well as custodian wallet provider within the scope of the definition of “obliged entities”, meaning that Cypriot based exchanges and wallet providers will soon need to adhere to AML and KYC obligations in much the same way as a bank or other financial institution would need to. 5AMLD will be implemented in Cyprus through amendments to the Prevention and Suppression of Money Laundering and Terrorist Financing Law 2007 (the AML Law).

  15. How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?

    Similar to cryptocurrency regulation, at present, Initial Coin Offerings do not fall within the scope of a specially designated regulatory framework in Cyprus. Considerations such as those outlined above should be observed however.

    In terms of changes over the next 12-24 months, we would refer to the imminent changes to the AML Law following the publication of 5AMLD by the EU.

  16. Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?

    Yes, we are aware of the following projects:

    • The BARAC Research Project: The Blockchain Technology for Algorithmic Regulation and Compliance Project was introduced in April 2017 by Cyprus Blockchain Technologies Limited, a non-profit educational organisation established by academic and financial institutions, local regulators and other technology companies to provide feasibility guidelines to policy makers, industry and regulators by identifying problems and associated solutions through case studies and proof of concept platforms.
    • UNIC Blockchain Initiative: In addition UNIC has initiated a number of blockchain projects in Cyprus through its Blockchain Initiative programme.
    • API Banking: Please refer to our responses above on the API Banking services currently offered by leading Cypriot credit institutions.

    We are aware of other numerous projects which are not able to comment on publicly at this time.

  17. To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?

    We are starting to see the use of artificial intelligence in multiple areas of the financial sector, for example in AI trading techniques in the context of complex quant trading, in fraud detection and risk assessments by credit institutions.

  18. Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?

    We are unaware of much insurtech business being conducted in Cyprus. Our experience indicates that insurers in Cyprus have found it difficult to keep up with fintech developments owing to the size of the market and lack of contrations from overseas.

    That said, the industry is generally becoming more aware of the possibilities in this area. This can be demonstrated through various events and seminars which are insrutech-oriented such as the Hackathon cy #insurtech. Hackathon cy #insurtech focused on the development of applications (Minimum Viable Products — MVP) and operational innovation in the field of insurance and it was held in Cyprus for the first time in January 2018.

  19. Are there any areas of fintech that are particularly strong in your jurisdiction?

    Two areas of fintech seem particularly strong in Cyprus:

    • trading in crypto-assets, bearing in mind the dominance of currency and other asset trading brokers and venues in Cyprus; and
    • the contribution of thought contributors such as UNIC to the industry through the organisation of blockchain events and discussions.
  20. What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?

    While fintech may be one of the greatest disruptors for incumbent financial institutions in Cyprus, fintech has not yet penetrated the domestic financial services market to the extent of disruption at a notable level. In our view Cypriot financial institutions are currently in the process of working out a way to utilise fintech to their advantage through collaboration.

  21. To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?

    There has been an increasing amount of both banks and incumbent financial institutions in Cyprus which organise their own programmes with a view to support the successful development of emerging business ideas, in particular with regards to big data/ open data, artificial intelligence, blockchain, cybersecurity etc.

    A few examples would be Hellenic Bank’s “Cyprus Fintech Expo” and Deloitte’s “ARIS Programme” both of which focused on fintech development and innovation programmes in general.

  22. Are there any strong examples of disruption through fintech in your jurisdiction?

    The traditional bank distribution channels are currently threatened by the drive towards platform models of banking. This is evident through the manner in which banks define customer expectation, which is no longer by looking at what customers expect from their banking experience, but instead, it is fintech and large technology companies that currently set the standards. This may eventually alter power dynamics given the increased competition and open environment which in fact could ultimately benefit customers.