Payments
- What are the sources of payments law in your jurisdiction?
Payment services in Cyprus are mainly regulated by The Provision and Use of Payment Services and Access to Payments Law of 2018 (L. 31(I)/2018) (The Payments Law), and the Electronic Money Law of 2012 (L.81(I)/2012) (The Electronic Money Law), as both are aligned with the EU regulatory payments law framework.
The Payments Law implements the provisions of the European Directive (EU) 2015/2366 on payment services in the internal market (PSD II). The Directive, by replacing the previous framework, seeks to unify and expand the scope of the internal payments market, offering the legal conditions for more effective, transparent, secure, innovative, and efficient payments and payment services. The Directive provides new regulated services, Payment Initiation Services and Account Information Services and requires banks to permit open access for their clients’ banking data to authorised Third Party Providers (TPPs), thereby introducing open banking. In this way, the Directive opens the payments market to new players and payment providers and unlocks the opportunity for the development of more innovative and data-driven payment services. The relevant Cyprus law regulates the authorisation, operation and supervision of payment institutions carrying out the provided regulated services, as these have widened in scope.
The Electronic Money Law transposes provisions of the European Directive 2009/110/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions and of PSD II, and regulates the issue, distribution and redemption of electronic money and the authorisation, operation and supervision of electronic money institutions.
- Can payment services be provided by non-banks, and if so on what conditions?
Cyprus permits the provision of payment services by payment institutions and electronic money institutions, in accordance with the payment laws.
The payment institutions and electronic money institutions must be licensed and authorised by the Central Bank of Cyprus (CBC) before offering any payment services. Authorised institutions from other EEA states can offer payment services in Cyprus by exercising their passporting rights.
To be authorised by the CBC, these institutions must complete a relevant CBC application process, where they must demonstrate and detail their organisational structure and internal mechanisms, effective and adequate controls ensuring proper risk and security problems’ minimization and management, in relation to the provision of payment services. The institutions must abide by specified capital requirements and restrictions on holding own funds.
- What are the most popular payment methods and payment instruments in your jurisdiction?
The most popular payment methods in Cyprus are by cash, card, credit transfers, direct debits, and cheques. Cash transactions remain the most popular in Cyprus, amounting to 88% of the at-point-of-sale transactions in volume and 72% in value (in July 2016).
Data / open banking
- What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Open banking was introduced in Cyprus through the transposition of PSD II to the domestic framework. Banks are required to provide authorised TPPs open access to the banking data of their clients, upon clients’ consent, through secure APIs. The relevant legal framework regulates two types of TPPs, Payment Initiation Service Providers, which collect data for the initiation of payments from clients’ accounts, and Account Information Service Providers, which collect data for the consolidation of account information dispersed in various payment accounts of bank’s clients. TPPs are authorised by the CBC.
Open banking is, generally, at a sandbox level for most commercial banks in Cyprus, including the largest banks in Cyprus, Bank of Cyprus, and Hellenic Bank.
- How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The Regulation (EU) 2016/679 (General Data Protection Regulation) and the corresponding Cyprus law, L.125(I)/2018 are the main points of reference in terms of data regulation. The processing of personal data of financial services consumers and businesses, to the extent they involve data of data subjects (meaning natural persons), must be processed in compliance with the provisions of the data protection framework. GDPR imposes restrictions on the transfer of data to countries outside the EEA; any international data transfer may be made on the exclusive basis of the prescribed grounds of such transfer.
The scope of personal data is quite wide, covering any information relating to a natural person, including biometric data, which may be of specific interest to fintech businesses relying on technology to remotely identify their clients. The data protection framework is bound to significantly influence the internal processes of fintech businesses providing services to consumers and businesses.
Market conditions
- What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
Cyprus has a national digital strategy for the development of information and communication technology, a cybersecurity and an e-government strategy for the secure development of the cyberspace. Recently, Cyprus operates a Deputy Ministry of Research, Innovation and Digital Policy under the Ministry of Finance, empowered to develop digital transformation, facilitate the operation of startup businesses and support the Institute for Research and Innovation; the Institute funds and supervises research and development driven projects. That research, innovation and digital policy belong to the Finance Ministry indicates that innovation and digitalisation are viewed as instrumental to economic growth.
Cyprus participates in important blockchain initiatives, such as the European Blockchain Partnership, the Declaration on the Utilisation of Distributed Ledger Technology (DLT) (with France, Italy, Portugal, Greece, Malta, Spain) and the Blockchain Technology for Algorithmic Regulation and Compliance.
The Distributed Ledger Technologies (DLT) (Blockchain) National Strategy (“Strategy”), which constitutes a full-fledged strategic plan for the use of blockchain, and other DLT, in the public and private sector, discusses the implementation of a DLT-centered legislation. The Strategy demonstrates, yet again, regulators’ emphasis on technological development in financial services since it discusses at length the regulation of virtual currencies and cryptoassets and the promise of DLT in financial services. The Strategy sets up an ad-hoc committee to forward the objectives identified therein; a subcommittee is dedicated to assessing DLT in the financial industry.
From a regulatory standpoint, the Cyprus Securities and Exchange Commission (CySEC) has issued bespoke rules, substantiating the investments law, for investment-based crowdfunding. Cyprus Investment Firms may operate as crowdfunding platforms/providers after complying with both the general investment law requirements and the bespoke rules. Crowdfunding activity is, thus, encouraged.
CySEC has undertaken sandbox – like initiatives to foster innovation and protect investors by running the Innovation Hub. The Hub enables the exchange of knowledge, experience, and regulatory/compliance wisdom between CySEC and fintech/regtech entities, regulated or not. Reporting on the Hub, CySEC applauded its productive operation, the innovative and active approach of the participants and the valuable feedback gathered for regulation and supervision purposes.
- Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
We do not identify any imminent risks to fintech growth. On the contrary, regulators’ positive disposition towards fintech should encourage its further development. Still, predicting fintech activity and development is difficult due to the outbreak and the lasting effects of the global pandemic.
The CBC has been reluctant to facilitate the provision of fintech services, especially where they involve cryptocurrencies. A continuing reluctant approach could hinder the prospects of fintech growth in Cyprus.
- What tax incentives exist in your jurisdiction to encourage fintech investment?
Cyprus offers a tax-wise conducive to business framework, with a low corporate tax of 12.5% and a developed network of double tax treaties. Fintech businesses may benefit from the general tax-friendly conditions in Cyprus.
Encouraging innovation, and research and development, Cyprus offers an 80% tax exemption, based the nexus approach and subject to capital expenditure being written off for a five-year period, on qualifying profits arising out of the exploitation of research and development intellectual property (IP) qualifying assets, which broadly include patents and copyrightable software. This kind of IP is pertinent to fintech activity. The effective tax rate for corporate income, taking advantage of this tax incentive, is 2.5%.
Qualifying investors may deduct the investment cost from their annual taxable income when they make risk-finance investment in small/medium-sized enterprises. The deduction must a) not exceed €150.000 and b) be limited to 50% of investors’ taxable income in the year of the investment. For investments exceeding the relevant limit, the law provides a carry-forward option.
The notional deduction on interest allows the deduction of notional interest from the taxable income of eligible businesses. This amounts to significant tax return on qualifying equity investment. Relief is primarily intended for small/medium-sized enterprises.
- Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Custodial, non-custodial wallet providers, ICO issuers, forex companies, crypto-exchanges, blockchain-enabled projects attract investment. Most fintech companies attract pre-seed investment, while only a portion of those seek series A investment before expanding their operations. Series B investment is quite rare for fintech companies, limited to non-regulated companies or in case of major Cyprus Investment Firm’s business transfer to another company. Series C finance has yet to be raised for fintech companies in Cyprus.
- If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
Cyprus is a business-conducive jurisdiction, especially for financial services. Cyprus is an internationally recognised financial centre, offering optimal conditions for financial activity, and attracting foreign financial actors.
Cyprus is an EU member state and hosts a stable liberal democracy with a strong banking system and commitment to free economy. Cyprus is located at the hub of Europe, the Middle East and Africa, provides an advanced telecommunications’ network and infrastructure, and is a well-established common law system, well-known to international, leading financiers. Cyprus provides the most foundational conditions for business growth. Cyprus is a services hub, with a well-known and long-standing tradition in the financial industry, which constitutes one of the main pillars of the Cyprus economy. The workforce is well-trained, richly experienced, highly qualified, and knowledgeable in the provision of services.
As explained in question 8, Cyprus constitutes a tax-friendly jurisdiction for general business activity, with specialized tax support to small/medium-sized enterprises and innovative entities.
Regulators’ and competent authorities’ positive and active approach towards facilitating fintech activity, with the exception of CBC which is more cautious in its approach, should also be considered by prospective fintech businesses.
Access to talent / immigration
- Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
As an EU member state, Cyprus guarantees the freedom of people in the internal market. EEA citizens may freely work in Cyprus, without permission.
Non-EEA residents may work in Cyprus, once they obtain a work permit, which may be granted once the competent authority is satisfied that the applicable criteria have been met. To obtain work permit for foreign labour force, employers must demonstrate that they were unable to find available local or EEA personnel for the relevant work position.
- If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
The Cyprus government has taken measures to enable the transfer of foreign workforce to Cyprus. The Cyprus Startup Visa Scheme provides that non-EEA entrepreneurs involved with innovative businesses may be granted a visa to work, either as a team or individually subject to certain criteria. The startup project owners must have access to €20,000 funding, while proving that they are innovative, with the headquarters and effective control located at Cyprus.
Intellectual property
- What protections can a fintech use in your jurisdiction to protect its intellectual property?
Cyprus offers wide IP protection through a nexus of domestic, EU and international laws, conventions, and regulations. As an EU Member State and signatory to fundamental international conventions on IP, the Cyprus legal system ensures effective and comprehensive IP protection. A fintech may protect its IP through specific processes depending on the type of rights involved, such as patents, copyright, trademarks, and industrial designs.
Trademarks, concerning commercial IP, are subject to registration at domestic and EU level. Trademarks may be registered with the competent domestic authority or with the EU Intellectual Property Office. An EU-registered trademark is protected in all EU Member States and may be enforced in Cyprus.
Patents, involving invention and authorship, may be registered domestically, through the EU regime (as EU Patent) and internationally (under the Patent Cooperation Treaty administered by the World Intellectual Property Organization). The patents granted under the European Patent Office or the Patent Cooperation Treaty may be enforced as national patents, subject to the national rules of the enforcement jurisdiction. Under Cyprus patent law, computer programs are excluded from patentable property.
Cyprus offers copyright protection. While not registrable in Cyprus, copyright owners take measures to prove their authorship as proof of ownership. Cyprus-based public blockchain-enabled solutions are used to record evidence of copyright ownership. Cyprus is member to significant international conventions that provide reciprocal protection to Cyprus-based copyrighted works in other signatory countries. Cyprus is a signatory to the Berne Convention for the Protection of Literary and Artistic Works, which covers a broad range of rights, including software copyrights and computer programs, the Rome Convention, and the World Intellectual Property Organization Copyright Treaty.
Cryptocurrencies and blockchain
- How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Cryptocurrencies or cryptoassets are not specifically regulated or prohibited in Cyprus. CySEC and CBC have issued warnings and recommendations for dealing with cryptocurrencies.
CBC maintains a reserved stance towards cryptocurrencies, having repeatedly warned the public for potential risks involved, highlighting their volatility, susceptibility to money-laundering and the lack of legal protections attached to these currencies. According to CBC, virtual currencies do not constitute legal tender. CBC, consequently, does not authorise or grant any license to activities involving virtual currencies, even if they seem to fall within its regulatory competence.
CySEC has taken more crypto-inclusive approach and initiatives compared to CBC, while still acknowledging and warning against associated risks. CySEC has identified similar risks with the CBC for virtual currencies, since early 2014. Later, CySEC warned, again, potential cryptocurrency investors for the lack of EU regulatory framework in the crypto-area and the risk of losing their investment.
As per CySEC guidance, while cryptocurrencies are not regulated by a specified regime, initial coin offerings could be subject to existing domestic and EU capital markets regulations to the extent that their nature and function satisfy the existing regulatory conditions.
CySEC, following a relevant European Securities and Markets Authority (ESMA) decision, explicitly and unequivocally explained that derivatives on virtual currencies may now qualify as “financial instruments” under the applicable investment law. Cyprus investment firms must obtain virtual-currency specific authorisation by CySEC before dealing with virtual currency derivatives, having to comply with both the general obligations imposed on investment firms and the rules and restrictions issued specifically for derivatives on virtual currencies by CySEC and ESMA.
Cyprus, through the legislative and executive branch, published the Strategy. In the Strategy, the authorities contemplate the regulation of cryptocurrencies, as part of a wider, comprehensive legislation that will regulate distributed ledger technology. The Strategy offers a categorization of tokens into security tokens and non-security tokens (utility and payment tokens), which will underpin the rules for trading in and dealing with cryptocurrencies. Cryptocurrency trading systems and exchanges will also be subject to regulation, under the supervisory compliance of CySEC. In the prospective legislation, these systems and exchanges will need to abide by requirements dealing with transparency, deterrence of unfair trading practices, prevention of market disruption and manipulation, management of exposures and default risks, as these requirements specifically connect with virtual currencies. Market intermediaries for virtual currency trading and activities will also be subject to regulation.
The adoption of a national distributed ledger technology bill, as envisioned in the Strategy, shall provide specific and comprehensive regulation for cryptocurrencies.
- How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Cyprus does not regulate cryptocurrencies through specific legislation. Initial coin offerings have, however, been the subject of CySEC analysis, under relevant announcements. As per CySEC guidance, initial coin offerings could be subject to the existing capital markets and investment regulatory frameworks, to the extent that their nature and function satisfy and fall within the existing regulatory conditions. Initial coin offerings involving cryptocurrencies that would qualify as financial instruments because of their characteristics and operation, would need to comply with existing regulations (including but not limited to the Prospectus Directive, the Markets in Financial Instruments Directive, the Alternative Investment Fund Managers Directive and the AML Directive) in much the same way as “traditional” financial instruments do.
CySEC in addressing the risks of cryptocurrency activity has previously highlighted with potential ICO-holding entities and interested investors that only experienced and knowledgeable-in-the-area parties should proceed with initial coin offerings.
The current framework and market for initial coin offerings entail uncertainties due to the lack of explicit regulation and detailed guidance on the matter. Developments in the area should, however, be expected in the very near future. The Strategy refers to the regulation of virtual currencies by specific legislation. This legislation is expected to follow the categorization between security, utility and payment tokens as per the Strategy. Following this, initial coin offerings, depending on the type of token offered, are expected to be subject to a set of targeted and specific rules and regulations.
The Strategy itself acknowledges that after accounting and guarding against the ICO and cryptoassets associated risks, ICOs could serve as useful alternatives to funding startups. Therefore, Cyprus in the next couple of years targets and is expected to enable the growth of ICOs.
- Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
Blockchain projects have considerably grown these last couple of years, in Cyprus. To the best of our knowledge and as informed by the founders of the project, a promising blockchain project offering self-sovereign identity solution, having finalized the MVP stage, is set to be included in the forthcoming ISO report, after undergoing and successfully completing an extensive and intense review.
A document management and storing company leveraging public blockchain has been active in the market serving businesses of all commercial purposes, and the University of Nicosia for the issuance of blockchain-backed certificates. Documents in financial services also benefit from the capabilities of this solution, which has successfully applied in the market, for the last couple of years.
AI
- To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
Companies using artificial intelligence for regtech and fintech purposes have participated in the CySEC-operated Innovation Hub. CySEC assisted the participant-business with its compliance requirements. Artificial intelligence and machine learning solutions are used in the forex industry. Forex and brokerage are areas where artificial intelligence solutions are tested and applied. Businesses using artificial intelligence to optimize payments, through personalized payment methods depending on the type of transaction, also emerge. Cyprus-based businesses combining artificial intelligence with big data and data analytics, and machine learning offer solutions to payment service providers and other financial service providers to analyse and manage their risks.
The Strategy provides that the design of any blockchain solution must consider other technologies, such as artificial intelligence. Regulation is expected to take account of artificial intelligence without hindering its potential use.
Insurtech
- Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Insurtech business activity is limited in Cyprus. For now, leading market participants organise events and hackathons giving voice to promising insurtech business ideas. While insurtech business market is not active yet, the increasing interest of the market is expected to cause noteworthy growth in the area.
- Are there any areas of fintech that are particularly strong in your jurisdiction?
Crypto-trading platforms and crypto-exchanges, operating exclusively from or headquartered in Cyprus, have considerably increased their activity in Cyprus.
Fintech companies offering alternative payment solutions have also entered the fintech landscape. Gaming platforms are also prominently occupying the innovation/tech space.
Cyprus is considered a leading foreign exchange hub attracting and hosting a major part of forex activity. As such, the forex industry in Cyprus has been actively exploring and implementing fintech elements to further strengthen its leading position as a global forex hub.
The banking sector has opened to technological development, introducing new technology products. Incumbent banks are exploring remote onboarding for their clients and other tools to maintain their position especially since the advent of startup businesses offering alternative payment solutions and banking related services.
CySEC commenting on the operation of the Innovation Hub, described the profile of the participant companies giving a glimpse of the developing fintech areas. These include, regtech businesses using big data and analytics for regulatory compliance, especially in case of remote due diligence, cryptoasset companies, asset management businesses, DLT-enabled trading platforms for the offering, transfer and verification of ownership of financial instruments.
Fintech vs incumbent
- What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
There has been some disruptive activity in the Cyprus financial market. Financial services incumbents demonstrate their willingness to cooperate and collaborate for fintech development.
Bank of Cyprus, the largest commercial bank in Cyprus, founded and actively supports the IDEA Innovation Centre, a non-profit startup and innovation incubator. The organisation’s objective is to foster innovation and facilitate cooperation in the technology-development space. PwC Cyprus collaborates with Chrysalis Leap, a startup accelerator, with the active support of its personnel. These are indicative examples of incumbents’ intention to foster the development and operation of startup projects, and thus contribute to collaboration-based development in the area.
The current fintech trends indicate that incumbents will manage to drive fintech development based on collaboration.
- To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
Leading financial market players, including commercial banks, significant auditing/accounting firms, insurance companies, organize and hold their own innovation programmes. This forms part of their own strategic planning and attempt to integrate fintech to their operations. In this sense, incumbents carry out significant part of their own fintech activity, with dedicated fintech departments and officials. Large commercial banks have hosted hackathons and expositions (BOC’s hackathon, Hellenic Bank’s Fintech expo).
Incumbent commercial banks proceed with their own open banking development, guiding though their PSD II obligations. Incumbent banks implement technical solutions to develop open banking functionalities and enable the growth of TPP applications. For the time being, open banking remains at sandbox stage.
- Are there any strong examples of disruption through fintech in your jurisdiction?
Cyprus has laid the foundations for a strong fintech ecosystem. Disruption is not profound in a particular fintech area, but disruptive prospects and elements are evident in the change of the wider market’s attitude, business, and strategic planning. The active response of incumbents to the entry of potential disruptors in the market signifies the potential for wide transformation of financial services. The banking sector is a prime example where the emergence and positive reception of tech-payment providers, and neo-banks have significantly influenced the business operations and planning of large commercial banks.
Christiana Aristidou, Evdokia Marcou
Published in the Country Comparative Guides by the Legal 500