Tunisia cybersecurity and financial regulation updates

Tunisia has implemented new regulatory measures focused on strengthening cybersecurity and digital protocols across public and financial sectors.

In early September 2026, government head Sarra Zaafrani Zenzri issued a directive for public institutions to enhance security against increasing cyber threats. This mandate requires the use of HTTPS and multi-factor authentication, prohibits the use of social media for administrative documents, and necessitates that all official correspondence use the ‘.tn’ email domain. Furthermore, systems must undergo annual audits by agencies certified by the National Cybersecurity Agency.

Following this, the Central Bank of Tunisia updated the regulatory framework for payment institutions. Effective late 2026, these new rules include mandatory annual IT audits by independent firms certified by the National Cybersecurity Agency and requirements for institutions to report cyberattacks immediately. For remote account openings, providers must utilize at least two-factor authentication alongside facial recognition or equivalent technology. The regulations also established three distinct levels of payment accounts with specific balance and withdrawal limits for individuals and legal entities.