Central Bank of Tunisia updates payment institution regulations

The Central Bank of Tunisia (BCT) has issued circular no. 2026-10, significantly updating the regulatory framework for payment institutions. Replacing the 2018 regulations, the new rules will take effect three months after their publication on September 25, 2026.

Key updates include enhanced cybersecurity requirements, such as a mandatory annual audit of IT systems by an independent firm certified by the National Cybersecurity Agency (ANCS). Institutions must also report any cyberattacks or intrusions to the BCT and ANCS immediately. For remote account openings, providers must implement at least two-factor authentication and use facial recognition or equivalent technology, which must be audited every two years.

The circular also defines three levels of payment accounts for individuals and legal entities: - Level 1: Reserved for individuals, with a maximum balance of 1,500 dinars. - Level 2: For individuals and legal entities, with a maximum balance of 5,000 dinars and daily cash withdrawals limited to 3,000 dinars. - Level 3: For individuals and legal entities, with a maximum balance of 20,000 dinars and daily cash withdrawals limited to 10,000 dinars.

Authorized services include cash deposits and withdrawals, electronic fund transfers, and distance or proximity payments, all conducted exclusively in Tunisian dinars within the country. Additionally, institutions may manage electronic money and receive funds from abroad, with foreign fund availability capped at the equivalent of 20,000 dinars per operation.