Cyprus EMI Compliance Requirements: A Practical Guide
Winning a licence is one thing. Staying compliant month after month is where an electronic money institution (EMI) earns the regulator’s trust. EMI compliance in Cyprus covers governance, client funds, financial crime, technology and regular contact with the Central Bank of Cyprus (CBC).
This guide walks through the main areas and shows how to turn each one into daily practice. Your exact duties depend on your services, so use it as a map, not as legal advice.
The rules you work under
An EMI in Cyprus deals with several layers of rules at once:
Core law: the Electronic Money Laws of 2012 and 2018, and the Provision and Use of Payment Services and Access to Payment Systems Laws of 2018 to 2025.
CBC directives: including the Electronic Money Institutions Directive of 2025 and the EMI Internal Organisation and Governance Directive of 2026. Both are published in Greek only.
Anti-money laundering: the Prevention and Suppression of Money Laundering and Terrorist Financing Laws, and the CBC’s AML/CFT Directive of 2025.
Digital resilience: the EU’s DORA regulation, Regulation (EU) 2022/2554.
Start with an obligations register
Keep one register that lists every duty. For each line, record the owner, the control, the system that supports it, the evidence it produces, how often it is reviewed and who it escalates to. This turns a long list of rules into something you can test. It also shows quickly where a duty has no owner.
Governance and accountability
The board and senior management remain accountable, even when work is outsourced. Compliance needs real independence, and risk owners need to be named. Keep records of decisions, issues and how they were fixed.
The CBC also assesses the people themselves. Its 2025 suitability directive covers board members and key function holders, and any proposed appointment or departure must be notified.
E-money rules, safeguarding and reconciliation
Two e-money rules shape your product and your terms. You must issue e-money at par value when you receive funds, and redeem it at par value when the holder asks. You also cannot pay interest or any benefit linked to how long a customer holds e-money, so check your marketing and rewards schemes against this.
Client funds must be safeguarded, and your records must always identify them. Reconcile your ledger against your safeguarding accounts often enough to catch problems early. Every break needs an owner, a reason and a clear closing record. A month-end spreadsheet is not enough for a business that moves money every day.
AML, KYC and sanctions
The CBC’s AML/CFT Directive was published in May 2025 and took effect on 2 June 2025. It applies to EMIs and payment institutions, as well as other firms. It sits alongside the wider AML law, so your policies should reflect both.
In practice, that means customer due diligence, a risk-based approach, sanctions screening, transaction monitoring and clear reporting of suspicious activity. Design each one from trigger to decision: what starts a review, what the reviewer sees, who decides and where the outcome is recorded. New products should also go through a risk assessment before launch. Our article on risk scoring governance shows how to keep this kind of decision explainable.
Technology, outsourcing and DORA
DORA has applied since 17 January 2025, and EMIs are in its scope. It covers ICT risk management, incident reporting, resilience testing and the management of third-party ICT providers. Keep an inventory of your systems, data and suppliers, and check that contracts cover security, incidents, audit access and exit.
What you must tell the CBC
The CBC expects to hear about changes, usually before they happen. Its post-authorisation guidance covers:
Qualifying holdings crossing 20%, 30% or 50%, up or down.
Changes to board members and key function holders.
Adding new payment services, which requires an application.
Appointing agents or distributors.
Changes to your jurisdictions, target markets, client base or client sectors, especially high-risk ones.
Build a check into your product process, so nobody launches a new market or customer type before compliance has asked whether the CBC needs to be told.
In practice: a Limassol EMI adds a new market
Imagine a Limassol EMI whose sales team signs its first customers in a new sector. The first sign of a problem appears in transaction monitoring: alerts double, and two analysts cannot keep up.
With a working register, the gaps are easy to find. The change of client sector should have gone to the CBC in advance. The risk assessment needs updating, the monitoring rules need review, and the analysts need more help. The team writes down what happened, what it fixed and who approved it. That record is what a supervisor will want to see.
Keep evidence that controls work
Policies alone prove little. Keep version-controlled policies, risk assessments, training records, monitoring results, incident logs and reconciliations. Review a few simple measures each month, such as open breaks, alert age, failed integrations and overdue actions.
How Modular Fintech can help with EMI compliance
Modular Fintech offers compliance services and tools for institutions like yours, including:
KYC/AML: customer checks and screening workflows.
RegTech and risk scoring: explainable, versioned risk scores.
Compliance monitoring: transaction monitoring with rules, alerts and case handling.
Policies and technical assistance: help with compliance policies, technical policies and evidence.
We also offer software for lawyers, accountants and companies specialised in AML and KYC. Your institution remains responsible for its own obligations. To discuss your needs, email us at office@modularfintech.com or contact our team.
EMI compliance questions
Who supervises EMIs in Cyprus?
The Central Bank of Cyprus, which authorises EMIs and issues the directives they must follow.
Does DORA apply to a small EMI?
EMIs are in scope, but DORA includes proportionality. Check with your advisers how it applies to your size and services.
Can an EMI outsource its compliance work?
It can outsource tasks, within the rules, but not responsibility. The board stays accountable, so it needs oversight of the provider and a plan for what happens if the arrangement ends.