Tunisia’s central bank has replaced its 2018 framework for payment institutions with Circular 2026-10, published on 25 September. The rules strengthen governance, internal controls, reporting, customer-fund protection and cybersecurity requirements for non-bank payment providers. They will take effect three months after publication.
The framework defines services ranging from dinar-denominated payment accounts and cash deposits or withdrawals to transfers, electronic payment instruments and incoming cross-border remittances. Services must be provided in Tunisian dinars and within Tunisia. Cash transfers are capped at TND3,000 per transaction, while incoming funds from abroad are capped at the equivalent of TND20,000 per transaction.
THREE ACCOUNT LEVELS
The circular keeps three payment-account tiers but raises their balance caps. Level-one balances are now capped at TND1,500 (previously TND500); level two at TND5,000 (previously TND1,000) with maximum daily cash withdrawals of TND3,000; and level three at TND20,000 (previously TND5,000) with daily cash withdrawals capped at TND10,000.
Remote account opening, already allowed under the 2018 rules, is extended to all account types, provided institutions use secure identity verification, proof-of-life controls such as facial recognition or equivalent methods, at least two-factor authentication and documented customer consent. Technology must undergo pre-production testing, penetration testing and periodic independent security audits.
CYBERSECURITY AND GOVERNANCE
Payment institutions must arrange annual IT security audits by firms certified by Tunisia’s National Cybersecurity Agency and report cyber incidents immediately. They must also establish an audit and risk committee alongside independent risk-management, internal-audit and compliance functions.
The framework requires customer funds to be held separately from providers’ own resources, while institutions remain responsible for agent networks and customer disclosures. Collected funds must be deposited by the next business day in a single ring-fenced account at an approved depository bank and cannot be used for providers’ operating needs.