This country-specific Q&A provides an overview of Fintech laws and regulations applicable in Cyprus.
What are the sources of payments law in your jurisdiction?
In the Republic of Cyprus payments are regulated by The Payment Services and Access to Payment Systems Laws of 2018 and 2019 (the “Payment Services Law”) and The Electronic Money Laws of 2012 and 2018 (the “Electronic Money Law”).
The Payment Services Law transposed into national law the provisions of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market and has provisions regulating:
the transparency of conditions and requirements for payment services;
the respective rights and obligations of payment service users and payment service providers in relation to the provision of payment services as a regular occupation or business activity; and
the granting of authorisation, operation and supervision of payment institutions.
The Electronic Money Law transposed into national law the following directives of the European Parliament and of the Council:
2009/110/EC of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions; and
(EU) 2015/2366 of 25 November 2015 on payment services in the internal market.
Can payment services be provided by non-banks, and if so on what conditions?
Payment institutions, regulated by the Payment Services Law, and Electronic Money Institutions, regulated by the Electronic Money Law, can provide such services in the Republic of Cyprus. For the provision of payment services and electronic money services respectively, an authorisation by the Central Bank of Cyprus (the “CBC”) is required.
In order for authorisations to be granted, an application must be submitted to the CBC, presenting to the CBC, inter alia, the applicant’s organisational structure, business plan, programme of operations, risk management procedures, security policy and evidence that the applicant satisfies any capital requirements.
Payment Institutions or Electronic Money Institutions authorised in another EU member state, may offer their services in the Republic of Cyprus pursuant to the right of establishment and freedom to provide services, in accordance with the provisions set out in the Payment Services Law and in the Electronic Money Law, as applicable.
What are the most popular payment methods and payment instruments in your jurisdiction?
At the moment cash transactions remain the most popular method of payment in Cyprus, noting that, pursuant to a decree issued by the Council of Ministers on 18 June 2021, exercising its powers under the Section 30A of the Assessment and Collection of Taxes Laws of 1978 to (No. 3) of 2021, certain categories of business are now obligated to accept payments by card. It is noted that the obligated entities must ensure that consumers are informed of their right to pay through payment cards in a way which is clear and is not subject to any misinterpretation.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
The concept of open-banking was introduced in the Republic of Cyprus through the transposition, through the respective national law, of the 2nd Payment Services Directive (PSD 2) – Directive (EU) 2015/2366 (the “PSD2”). The PSD2 broadened the scope of the Payment Services Law and introduced third party service providers (the “TPP”). With the client’s consent a TPP, provided that such TPP has been authorized by the CBC, may collect and consolidate information on a client’s accounts in order to enable such client to have a full view of his financials in a secure manner; and also to initiate online payments directly from the client’s bank account.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The national law providing for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (Law 125(I)/2018), was published in the official gazette of the Republic of Cyprus on the 30th of July 2018 (the “Data Protection Law”), repealing the previous law providing for the protection of data.
The Data Protection Law was adopted to effectively transpose Regulation (EE) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC , which applies as of 25 May 2018 (the “GDPR”).
The GDPR expanded the spectrum of data protected in comparison to the previous legislation which was repealed, for example “personal data” now includes biometric data, which is likely to play an important role in the fintech area due to its importance in relation to identity verification and authentication services.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
The Cyprus Securities and Exchange Commission (“CySEC”) has established an Innovation Hub which aims to act as a platform for both supervised and non-supervised entities to come together and share knowledge in order to accelerate their business models in line with the CySEC’s commitment to ensuring regulated entities’ investor protection. The CySEC via the Innovation Hub offers support to market participants who are introducing innovative financial products or services. On 10 February 2020, the CySEC issued a “Report on the Activities of CySEC’s Innovation Hub”, which essentially describes the objectives of the Innovation Hub and outlines any progress made thus far. The CySEC notes that the Innovation Hub attracted full-spectrum interest from both Fintech and Regtech companies, supervised entities and entities not subject to supervision, from Cyprus and abroad.
The Cyprus government, by a Council of Ministers’ decision N.85.629 dated 30 August 2018, has formed an ad hoc working group to develop and implement blockchain technology in Cyprus. The priority in the national strategy is the enactment of a legal framework regulating blockchain and cryptocurrencies. Following the aforementioned decision N.85.629, three subcommittees of the working group were formed, namely: (a) a legal framework; (b) application in the public sector; and (c) application in the financial industry. The main objectives of the subcommittees are to (i) identify cases of public or private sector services that could be enhanced with Distributed Ledger Technology (“DLT”), (ii) develop guidelines and specifications that should be taken into account in the future development of the National DLT Services Infrastructure for it to support the deployment of the identified public sector use cases, and (iii) identify the parameters that should be included in the proposed regulatory framework. The national strategy aims to regulate, through a legal framework, cryptocurrencies and the trading of cryptocurrencies, assuming a categorisation of cryptocurrencies into Security Tokens and Non-Security Tokens. In this respect, on the 6th of September 2021, the Cyprus Ministry of Finance publicized the draft DLT Law and announced a public consultation on the draft.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
We do not identify and/or anticipate any imminent risks to the growth of fintech, especially having in mind that CySEC has taken positive steps towards embracing fintech, therefore further positive developments are expected. The only potential hurdle in the development of fintech in Cyprus, especially in matters relating to cryptocurrencies, is the CBC’s reluctant approach towards fintech and cryptocurrencies.
What tax incentives exist in your jurisdiction to encourage fintech investment?
Taxation is based on Residency status;
12,5% corporate tax on corporate trading profits;
Notional Interest Deduction (NID) available for new capital introduced;
Intellectual Property (IP) Box Regime in line with the “nexus” principle, offering 80% exemption of qualified profit from exploitation of IP assets;
Corporate tax on sale of securities: 100% exemption;
No withholding tax on outgoing payments (dividends- interest-royalties);
Dividend income is exempt (subject to relaxed conditions);
Applicability of all EU directives; Foreign exchange differences are tax neutral; Group relief availability (for 75% holdings);
Tax exempt re-organizations;
Advanced tax ruling practice offers safety and predictability for investments;
Attractive and constantly expanding Double Tax Treaty network.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Thus far most fintech related investment are from pre-seed funding up to Series A investment, due to the fact that at the moment most fintech related investment derives from start-up companies. As time goes by and Cyprus becomes a Fintech hub we expect this to change and to begin witnessing Series B and Series C investments.
At the moment we are also experiencing an increased interest for ICOs, as well as for investment in new software. Due to the Registry of Crypto-Asset Service Providers we have seen a significant increase of interest for crypto-asset related investments.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
As mentioned above, Cyprus offers a number of tax incentives for investors and entrepreneurs looking to either relocate or comment business activities. The Republic of Cyprus is an EU-member state and at the same time benefits from its location which provides access to Europe, Middle East and Africa.
As part of the overall effort to continuously improve and simplify the Cyprus tax system as well as to remain a highly compliant and attractive jurisdiction, various new bills have been passed into new laws in July 2015. Amongst these, there has been the introduction of the concept of Non-Domiciled individuals for tax purposes.
The main aim of introducing the Non-Domicile concept is to constitute Cyprus as a prime choice of destination for persons (both EU and non-EU) wishing to move their personal tax residency to another country. The non-domicile concept offers significant tax advantages and already enjoys a great interest.
Non-Cyprus residents who decide to move their personal tax residency in Cyprus, will automatically be considered as non-domiciled in Cyprus for a maximum of 17 years.
For tax purposes, non-domicile persons who become Cyprus tax residents will now be completely exempt from Special Defence Contribution tax (“SDC”).
SDC generally applies on dividends and interest. As SDC tax does not apply in the case of Cyprus tax resident individuals who are non-domiciled in Cyprus, dividend and interest earned by such persons will now be completely tax exempt in Cyprus.
Pursuant to a decision of the Council of Ministers on 15 October 2021, the Digital Nomad Visa Scheme was introduced in Cyprus, initially with a ceiling of 100 residence permits to be issued, which was extended to 500 residence permits on March 3 2022. The “Cyprus Digital Nomad Visa” Scheme allows nationals from non-EU and non-EEA countries, who can perform their work location-independently using telecommunications technology, to reside temporarily in Cyprus and work for an employer registered abroad or perform work through telecommunications technology for companies or clients located abroad.
The Scheme’s goal is to strengthen Cyprus as a center for the provision of electronic services, where in combination with the other advantages offered by Cyprus, the attraction of digital nomads will contribute to the development of the business ecosystem and consequently to the economic development of the country. The introduction of the “Cyprus Digital Nomad Visa Scheme” is included in the Strategy for Attracting Businesses for Activities or/and Expansion of their Activities in Cyprus.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
EU Citizens are free engage in any economic activity, either as paid employees or self-employed persons, service providers under the same conditions as Cypriot citizens.
Non-EU Citizens must obtain a work permit, noting that a number of criteria need to be satisfied for the competent authority to issue the work permit, including that the employer was unable to find available local or EEA personnel for the relevant position.
Pursuant to the Government’s Strategy for Attracting Businesses for Activities or/and Expansion of their Activities in Cyprus the existing policy for employing Highly Skilled Third Country Nationals has been simplified.
Foreign interest companies which comply with certain criteria shall register with the Business Facilitation Unit in order to be able to employee Non-EU personnel provided that the following criteria are also satisfied:
The Non-EU employee will be paid a minimum gross monthly salary of at least € 2.500
The Non-EU employee holds a university diploma or degree or equivalent qualification or confirmation of relevant experience in a corresponding job of at least 2 years duration
The employment contract has a duration of at least two years.
It is noted that the maximum number of third-country nationals that can be employed is set at 70% of all employees over a period of 5 years, from the date of joining the Business Facilitation Unit. After the lapse of 5 years if it is not possible to employ 30% of Cypriot workers, the matter will be re-examined on a case-by-case basis.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
As mentioned above, the government of the Republic of Cyprus introduced further incentives to attract investors and foreign businesses in Cyprus, part of this is be the establishment of a Business Facilitation Unit that will act as the main point of contact for all foreign interest companies.
In addition to the above the “Cyprus Digital Nomad Visa” has been introduced, with individuals that are granted with a Digital Nomad residence permit benefitting from the following:
Right of residence for a year in Cyprus, with a possibility of renewal for further two years.
Right of residence for family members, for the same period as the Digital Nomad, without the right to be employed of perform economic activity in Cyprus.
If they reside in the Republic for one of more periods that in total exceed 183 days within the same tax year, then they are considered tax residents of Cyprus, provided they are not tax residents in any other country.
Family members can reside in Cyprus for the same period as the Digital Nomad, however, without the right to be employed of perform any economic activity in Cyprus.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Cyprus law affords protection to intellectual property rights such as trademarks, patents, industrial designs and copyrights.
Trademarks in Cyprus are afforded protection pursuant to the Trademark Law Cap. 268, and by virtue of a registration with the national competent authority. Protection can also be afforded at an EU or on international level pursuant to the following:
the Paris Convention for the Protection of Industrial Property,
the WIPO (World Intellectual Property Organisation) Convention,
the Madrid Protocol,
the Agreement on Trade-Related Aspects of Intellectual Property Rights.
Patent protection is afforded, pursuant to the Cyprus Patents Law (16(I)/1998), to inventions that satisfy the following criteria:
they are novel;
it is an inventive step; and
must have the potential to be used for industrial purposes.
Patents can be registered and protected domestically, at an EU level and internationally. It is noted that computer programs for Cyprus law purposes are not considered as patentable.
This is an intellectual property rights which protects the visual appearance of a product or part of it. Such protection is afforded pursuant to the Industrial Designs and Models Law (4(I)/2002), noting that in order for design or model to be protected and registrable it must be novel and have an individual character.
Copyright is an automatic right protecting a broad range of rights, including artistic work, software and computer programs. Provided that the criteria set out by the Copyright and Neighbouring Rights Law (59/1976) are met then copyright protection is afforded automatically without any prerequisite for registration.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
The first step towards the regulation of cryptocurrencies was taken through the amendment of the AML Law, wherein “Crypto-Assets” have been defined, as per the first section, and further to this the AML Law now regulates the provision of services by Crypto-Asset Services Providers (“CASPs”). The AML Law defines a CASP as a person who provides or exercises, one or more, of the following services or activities to another person or on behalf of another person
The exchange between crypto-assets and fiat currencies
Exchange between crypto-assets
Management, transfer, holding, and/or safekeeping, including the custody of crypto-assets or cryptographic keys or means which allow the exercise of control on crypto-assets
Offering and/or sale of crypto-assets, including the initial offering; and
Participation and/or provision of financial services regarding the distribution, offer, and/or sale of crypto-assets, including the initial offering.
Financial services regarding the distribution, offer, and/or the sale of crypto-assets is defined by the AML Law defined as the following investment services:
Reception and transmission of orders
Execution of orders on behalf of clients
Dealing on own account
Provision of investment advice
Underwriting and/or placing of crypto-assets on a firm commitment basis
Placing of crypto-assets without a firm commitment basis
Operation of a multilateral trading facility for buying and selling crypto-assets
In this respect, any CASP that intends to offer any of the abovementioned services in Cyprus must register for anti-money laundering purposes at the CASP registry which will be held by CySEC. It is noted that during this first year of operations we have seen great interest from large crypto-exchanges to register as CASPs in Cyprus, with the first two registrations being completed very recently, with more to follow in the very near future.
The framework introduced through the AML Law is certainly a positive step forward for Cyprus becoming an attractive destination for investors and businesses engaging in crypto-asset related activities, however, other than the AML Law there is no other regulatory framework with respect to crypto-assets.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Initial Coin Offerings (“ICOs”) have become increasingly popular as a way of raising funds. It is very common for cryptocurrencies to be used in an ICO. There is no prohibition on ICOs in Cyprus; and since the amendment of the AML Law in February 2021 ICOs are regulated as they fall under the services provided by a CASP. In this respect any person or entity wishing to perform an ICO must register with CySEC as a CASP, subject to complying with all the requirements set by CySEC for the registration.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
There is a considerable increase in the number of blockchain projects in the last few years and we expect this to increase even further as Cyprus embraces new technologies more and more. We have seen blockchain being implemented more and more in the issuance of blockchain-backed certificates, with the University of Nicosia being at the forefront of this progress, as well as the increased use of blockchain technology in the financial services sector.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
We believe that the use of artificial intelligence is an unavoidable next step for the financial sector and regulation of blockchain and technology will take into account the use of artificial intelligence and encourage its use.
CySEC has established an Innovation Hub which aims to act as a platform for both supervised and non-supervised entities to come together and share knowledge in order to accelerate their business models in line with the CySEC’s commitment to ensuring regulated entities’ investor protection. The CySEC via the Innovation Hub offers support to market participants who are introducing innovative financial products or services. On 10 February 2020, the CySEC issued a “Report on the Activities of CySEC’s Innovation Hub”, which essentially describes the objectives of the Innovation Hub and outlines any progress made thus far. CySEC notes that the Innovation Hub attracted full-spectrum interest from Fintech and Regtech companies, including companies using or intending to use artificial intelligence in their activities.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
This is very limited in Cyprus at this time.
Are there any areas of fintech that are particularly strong in your jurisdiction?
Pursuant to the AML Law and the introduction of the Registry of Crypto-Asset Service Providers we have seen great interest from major crypto-exchanges to bring their operations or part of their operations in Cyprus. Additionally, we expect an increase of interest from tech companies, such as game development companies.
As mentioned above, CySEC has indicated an increased interest for participation in its Innovation Hub from fintech and regtech companies.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
It appears that incumbent financial institutions demonstrate their willingness to collaborate for the development of fintech in Cyprus, supporting relevant initiatives. For example, the Bank of Cyprus actively supports and promotes the action of IDEA Innovation Center, which was founded in 2015 as an incubator-accelerator for startups and an entrepreneurship hub for Cypriot young entrepreneurs.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
The Association of Cyprus Banks entered into a memorandum of understanding with the government, represented by the Deputy Ministry of Research, Innovation and Digital Policy with the aim of promoting the use of electronic identification and electronic signature solutions in the provision of banking services.
We have also seen large banking institutions organizing their own fintech-related expositions and innovation programs, such as the Cyprus FinTech Expo, where Hellenic Bank was the main sponsor of the exposition.
Are there any strong examples of disruption through fintech in your jurisdiction?
Even though there is no single example that can be isolated, one can looking at the changes in the banking sector to understand the level of disruption. More and more electronic money institutions and payment institutions are being licensed by CBC pursuant to the Electronic Money Law and the Payment Services Law, this can only be seen as a positive step towards more tech-embracing banking services.
It should also be noted that due to the implementation of PSD2’s obligations regarding open banking, in recent months more and more Account Information Service Providers have been licensed. We believe that more initiatives are on their way to further expand Cyprus’ fintech landscape.
Estimated word count: 4044
Join our mailing list to receive updates on new Guides: