Tunisia’s Central Bank Overhauls Payment Institution Regulations

The Central Bank of Tunisia (BCT) has comprehensively revised the rules governing payment institutions. Published on September 25, 2026, Circular No. 2026-10 outlines the conditions for operating, payment account limits, merchant rules, partnerships, cybersecurity standards, and compliance/reporting obligations. This new circular replaces Circular No. 2018-16 and will enter into force three months after its publication.

Capped Accounts Up to 20,000 Dinars

The new circular authorizes payment institutions to offer a wide range of services, including:

Opening Level 1, 2, and 3 payment accounts in Tunisian dinars.
Cash deposits and withdrawals.
Direct debits.
Electronic funds transfers.
Cash-based funds transfers.
Remote and proximity payments.

Institutions may also issue electronic payment instruments, commercialize prepaid electronic money issued by banks or the National Post Office, and receive funds from abroad. Manual currency exchange may be conducted as an ancillary activity.

These services are exclusively conducted in Tunisian dinars within Tunisian territory. Cash-based funds transfers are capped at 3,000 dinars per transaction. The provision of funds from abroad is limited to the equivalent of 20,000 dinars per transaction and must be justified.

The BCT distinguishes three levels of payment accounts:

Account Level	Eligible Users	Maximum Balance	Daily Cash Withdrawal Limit
Level 1	Individuals only	1,500 dinars	Not specified
Level 2	Individuals & Legal Entities	5,000 dinars	3,000 dinars
Level 3	Individuals & Legal Entities	20,000 dinars	10,000 dinars

The account level determines the amount of information the institution must collect from the account holder. For corporate clients, the file may include the company name, headquarters location, legal form, authorized signatories, a recent extract from the National Business Register, identification of beneficial owners, and financial standing documents.

The circular further specifies that a single individual or legal entity may hold only one client payment account with a given institution. These accounts cannot be funded by credits or advances and must never show a negative balance.

Remote Onboarding and Merchant Accounts

Payment institutions may now open accounts remotely. They may use technological identification methods, provided the verification level is at least equivalent to in-person identification. The system must verify identity documents and the client’s physical presence (e.g., via liveness detection). Two-factor authentication is mandatory. Personal data must be protected, and processing must be based on the client’s explicit consent.

Before deployment, the remote onboarding system must undergo:

Pre-production environment testing.
Penetration testing.
Security audits by independent bodies accredited by the National Cybersecurity Agency.

Subsequent audits are required at least every two years, or whenever regulatory changes or technological modifications could impact system security.

For merchants, the circular introduces a specific Merchant Account to receive flows from accepted electronic payments. This account can be used for proximity or remote payments (including via mobile phone) and is not subject to the Level 1–3 account limits.

However, its operation is strictly regulated:

It can only be funded by flows from transactions accepted by the merchant.
A formal agreement must be signed between the payment institution and the merchant, defining operational and closure procedures.

Client Funds and Partnerships Under Strict Control

The BCT mandates a strict separation between client/merchant funds and the payment institution’s own resources.

Client and merchant funds must be deposited into a single omnibus account at an authorized bank by the next business day.
The balance of this omnibus account must equal the sum of all client and merchant account balances.
These funds cannot be used to finance the institution’s operational needs.

The circular also regulates commercial and technical partnerships with companies possessing distribution networks, specialized expertise, or technological infrastructure. Such partnerships require prior authorization from the BCT.

The application file must detail:

Partner identity, shareholding structure, and governance.
Technical and financial capabilities.
Business model, services involved, and objectives.
A three-year business plan.
Risk mapping and mitigation measures.
Protocols for data protection, security, internal control, business continuity, and partnership termination.

Enhanced Cybersecurity and Reporting Obligations

Cybersecurity: Payment institutions must submit their systems to an annual security audit by an independent firm certified by the National Cybersecurity Agency. A copy of the report must be sent to the BCT. Institutions must also test system resilience against attacks and maintain a business continuity plan. Any attack, intrusion, or disruption affecting IT systems must be reported immediately to both the BCT and the National Cybersecurity Agency.

Reporting: Reporting requirements have been tightened:

Monthly: Commercial indicators and operational status by channel, submitted within 15 days of the period’s end.
Quarterly: Accounting statements and certain branch-related information.
Annually: Data on governance, internal control, cybersecurity, and complaints, with deadlines up to 45 days.
Auditor’s Report: Must be submitted to the BCT at least one month before the general assembly. It must cover client fund segregation, anti-money laundering/counter-terrorism financing (AML/CFT) measures, operational risk management, and complaint handling.

Branches: 15 Days for BCT, 45 Days for Clients

The new regulation also governs the physical branch network:

Any opening, closure, or transfer of a branch must be declared to the BCT at least 15 business days in advance.
In case of closure or transfer, clients must be informed individually and via the institution’s website at least 45 days in advance.
Branches must be easily accessible and have a minimum floor area of 20 m².

Conclusion

With this circular, the BCT replaces the 2018 regulatory framework with a more detailed regime covering the entire operation of payment institutions. Key developments include updated account limits, enhanced client identification, remote onboarding, merchant accounts, fund protection, partnership oversight, cybersecurity standards, branch network rules, and stricter reporting obligations. The new framework will apply three months after its publication.