The Central Bank of Tunisia (BCT) has published a new circular, replacing the 2018 regulatory framework for payment institutions. The new rules, signed by Governor Fethi Zouhaier Nouri, aim to enhance governance, cybersecurity, and anti-money laundering measures. The circular, numbered 2026-10, was published on September 25, 2026, and will come into effect three months later. This move marks a significant update to the country's payment regulations, eight years after the previous framework was introduced.
One of the key changes is the requirement for annual cyber audits, which must be conducted by independent certified firms approved by the National Cybersecurity Agency (ANCS). Payment institutions must submit the audit reports to the BCT, and in the event of a cyberattack or intrusion, they must immediately notify the central bank and the ANCS. Additionally, remote account openings will be subject to stricter controls, including two-factor authentication and facial recognition or equivalent technology.
The new regulations also focus on enhancing internal controls and risk management. Payment institutions must establish an audit and risk committee to oversee internal controls and assess risk management systems. Furthermore, appointments to leadership or governance positions must be notified to the BCT within seven working days, and the central bank has a month to object to these appointments. These measures aim to strengthen the oversight of payment institutions and their partners.
Despite the stricter regulations, the BCT has left the existing account limits unchanged. The level 1 account, for individuals, remains capped at 1,500 dinars, while the level 2 account, accessible to individuals and businesses, has a limit of 5,000 dinars, with a daily cash withdrawal limit of 3,000 dinars. The level 3 account is capped at 20,000 dinars, with a daily cash withdrawal limit of 10,000 dinars.
The new circular also strengthens the control of payment institutions' partners and agents. Partnerships are still subject to prior approval by the BCT, and the central bank will have greater oversight of these partnerships. These measures aim to prevent potential risks and ensure the stability of the payment system.
The BCT has given payment institutions three months to comply with the new regulations. The central bank's move is expected to enhance the security and stability of Tunisia's mobile payment systems, which have experienced significant growth in recent years. The introduction of the "TUNPAY" label, aimed at unifying the ecosystem, is also part of the BCT's efforts to develop the country's payment landscape.
The new regulations are part of a broader effort to strengthen Tunisia's financial sector and prevent potential risks. The BCT's move is expected to have a positive impact on the country's payment systems, enhancing their security, stability, and efficiency. Payment institutions must now adapt to the new regulatory framework, which will come into effect in the coming months.
Key points
- The Central Bank of Tunisia requires annual cyber audits for payment institutions.
- The new regulations introduce stricter controls for remote account openings and partner oversight.
- The existing account limits remain unchanged, despite the stricter regulations.
