Circular No. 2026-10 of the Central Bank of Tunisia dated September 25, 2026

Tunis, September 25, 2026.

Circular of the Central Bank of Tunisia No. 2026-10

Subject: Rules governing the activity and functioning of payment institutions.

The Governor of the Central Bank of Tunisia,

Having regard to Organic Law No. 2004-63 of July 27, 2004, on the protection of personal data,

Having regard to Organic Law No. 2015-26 of August 7, 2015, on the fight against terrorism and the repression of money laundering as amended and supplemented by Organic Law No. 2019-9 of January 23, 2019,

Having regard to Law No. 2000-83 of August 9, 2000, on electronic exchanges and e-commerce,

Having regard to Law No. 2005-51 of June 27, 2005, on electronic fund transfers,

Having regard to Law No. 2016-35 of April 25, 2016, fixing the status of the Central Bank of Tunisia, notably its Article 8,

Having regard to Law No. 2016-48 of July 11, 2016, on banks and financial institutions, notably its Articles 20 and 21,

Having regard to Decree-Law No. 2023-17 of March 11, 2023, on cybersecurity,

Having regard to the circular to credit institutions No. 2006-1 of March 28, 2006, on the regulation of outsourcing conditions,

Having regard to the circular to credit institutions No. 2006-19 of November 28, 2006,

on internal control in credit institutions,

Having regard to the circular to banks and financial institutions No. 2017-6 of July 31, 2017, on accounting, prudential and statistical reporting to the Central Bank of Tunisia,

Having regard to the circular to banks and financial institutions No. 2017-08 of September 19, 2017, on internal control systems and rules in the matter of the fight against money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction, as amended and supplemented by subsequent texts and notably Circular No. 2025-17 of December 22, 2025,

Having regard to the circular of the Central Bank of Tunisia No. 2018-16 of December 31, 2018, on the rules governing the activity and functioning of payment institutions,

Having regard to the circular of the Central Bank of Tunisia No. 2020-11 of May 18, 2020, on the conditions for the provision of domestic mobile payment services,

Having regard to Opinion No. 2026-10 of the Compliance Control Committee dated September 25, 2026, as provided for by Article 42 of Law No. 2016-35 of April 25, 2016, fixing the status of the Central Bank of Tunisia.

Decides:

Article 1: This circular aims to set the conditions for the application of Articles 20 and 21 of Law No. 2016-48 on banks and financial institutions. It defines in particular the conditions for exercising the activity of payment institutions and the specific requirements in terms of governance, internal control and reporting to the Central Bank of Tunisia.

Title One:
Of Services

Article 2: Payment institutions are authorized to provide their customers with the following services:

• The opening of payment accounts in dinars, of levels 1, 2 and 3 as defined by Articles 15 and 17 of this circular.
• Deposit and withdrawal operations in cash on payment accounts opened on their books.
• Direct debit operations on payment accounts opened on their books.
• Electronic fund transfer operations and fund transfer operations carried out by cash remittance.
• Payment operations carried out by any means of long-distance or proximity communication, even when these operations require a cash remittance for their realization.
• The issuance of electronic payment means backed by payment accounts opened on their books.
• The marketing of prepaid electronic money means issued by banks or the National Office of Posts.
• The receipt of funds from abroad by wire transfer or by making them available via cross-border money transfer companies.
• Manual exchange operations, as an ancillary activity, in accordance with the rules and conditions set by the Central Bank of Tunisia.

Payment services are provided exclusively in Tunisian dinars and within Tunisian territory.

Article 3: Fund transfer operations carried out by cash remittance, mentioned in the fourth bullet point of Article 2 of this circular, are capped at an amount of three thousand (3,000) dinars per operation.

Fund availability operations from abroad, referred to in Article 2 of this circular, are capped at the equivalent of twenty thousand (20,000) dinars per operation.

These operations must be duly justified.

Article 4: Payment institutions are required to adhere to the payment and clearing systems appropriate to the nature of their activities.

In this regard, payment institutions may be acquirers in the sense of card payments either by direct affiliation or through a partner bank.

Article 5: In accordance with the provisions of paragraph 5 of Article 21 of the aforementioned Law No. 2016-48, payment institutions must take out a professional civil liability insurance policy or provide a bank guarantee of sufficient amount in line with their own funds to cover the risks related to the provision of payment services.

The minimum amount of the insurance policy or bank guarantee is determined by payment institutions based on the following criteria:

• The risk profile of the institution.
• The type of activity and payment services provided by the institution.
• The volume of activity of the institution.

Payment institutions must put in place a calculation methodology for the value of the insurance policy or bank guarantee and submit it for prior approval by the Central Bank of Tunisia.

They proceed, at least once a year, to the review of this amount and, if necessary, to its adjustment.

Title Two:
Of Governance Rules

Article 6: Payment institutions must put in place an effective governance system, adapted to the nature, complexity and volume of their activities and their risk profiles, in order to establish sound and prudent management that guarantees their sustainability while preserving the interests of shareholders, creditors and clients.

The board of directors or the supervisory board of the payment institution is responsible in particular for:

• Defining the development strategy of the institution, in line with the risk appetite policy and financial inclusion orientations,
• Drawing up a governance framework in line with the size, complexity and nature of the activity as well as the risk profile of the institution,
• Defining and ensuring the effective application of a conflict of interest management policy,
• Approving the internal control system, including the system for managing money laundering, terrorism financing and proliferation of weapons of mass destruction risks, as well as ensuring the annual monitoring of its implementation by the general management or the executive board,
• Monitoring the effective implementation by the general management or the executive board of the development strategy of the institution using appropriate performance indicators,
• Anchoring a real risk culture in the management of the institution and ensuring the effectiveness and independence of control functions,
• Defining a nomination and remuneration policy,
• Ensuring the protection of the interests of users of payment services and their personal data,
• Approving the fund segregation procedure referred to in Articles 24 and 25 of this circular in the global account which must reflect in an exhaustive manner the nominal list of customer and merchant payment account holders opened with the payment institution as well as their balances.

Article 7: Payment institutions with a Board of Directors may provide for the cumulation of the functions of Chairman of the Board of Directors and those of General Manager.

The number of members of the board of directors or supervisory board must be adapted to the nature, complexity and volume of the payment institution's activity and its risk profile.

The chairman of the board of directors or supervisory board, the members of the board of directors or supervisory board, the general manager, the deputy general manager and the chairman or members of the executive board must permanently satisfy the conditions of honorability and adequate expertise, notably in electronic payments, to diligently discharge their responsibilities.

Article 8: In accordance with current legislation, payment institutions are required to notify the Central Bank of Tunisia within a period not exceeding seven working days of any appointment of the chairman of the board of directors or supervisory board, a member of the board of directors or supervisory board, the general manager, the deputy general manager and the chairman or a member of the executive board.

The Central Bank of Tunisia may oppose such appointment within a period of one month from the date of receipt of a complete file comprising the required documents.

The file submitted to the Central Bank of Tunisia must include the documents referred to in Article 47 of this circular.

Article 9: Payment institutions must create an audit and risk committee emanating from the board of directors or supervisory board.

This committee draws up a charter, approved by the board of directors or supervisory board, defining its duties, composition, rules of operation and its relations with the board of directors or supervisory board and the operational structures of the institution.

The audit and risk committee is called upon in particular to:

• Ensure the quality, reliability and relevance of the financial information production system and examine the financial statements before their approval by the board of directors or supervisory board.
• Assess the organization and effectiveness of the internal control and compliance system, including the consistency of risk measurement, monitoring and control systems.
• Supervise the activity of audit and risk structures, validate and follow up on the audit program and, if necessary, the work of other structures charged with control missions.
• Examine the shortcomings identified by control structures, external audit and the supervisory authority, and ensure the follow-up of the implementation of corrective action plans.

The audit and risk committee is responsible for assisting the board of directors or supervisory board in:

• The approval of the risk appetite and management policy as well as the related measurement and monitoring systems and their limits.
• The approval of the business continuity plan, ensuring the identification and consideration of risks likely to affect the continuity of payment services, notably fraud risks, cybersecurity risks, data security breaches, those related to the use of third-party providers as well as the availability and resilience of information systems.
• The designation of the heads of risk management, audit and compliance structures.

Article 10: Payment institutions must create within their organization audit, risk management and compliance control functions. These control functions must be independent of operational and support structures and must have clear attributions.

Payment institutions ensure that control functions are equipped with the necessary human and technical resources to effectively exercise their missions both at the level of the institutions themselves and at the level of their payment agent networks.

Title Three:
Of Internal Control Rules and the Fight Against Money Laundering, Terrorism Financing and Proliferation of Weapons of Mass Destruction Risks

Article 11: Payment institutions are subject to the provisions of the circular of the Central Bank of Tunisia No. 2006-19 of November 28, 2006, on internal control. To this end, they must put in place an internal control system adapted to the nature, size, complexity of their activities and the risks associated with them.

Article 12: Payment institutions must equip themselves:

• With a secure and scalable information system in line with the nature and complexity of payment operations.
• With an operational security system that ensures the traceability of executed payment operations and collected funds and provides the position of all payment accounts opened on their books.
• With a system for recording and processing payment operations in real time both at the level of the institution itself and at the level of its payment agent network.
• With an appropriate internal system for the fight against money laundering, terrorism financing and proliferation of weapons of mass destruction, covering all their activities.
• With a formalized system for handling complaints as well as the protection of personal data of their clients, in conformity with current legal and regulatory provisions.
• With an adequate risk management system including operational risks and cyber risk.
• With a formalized, tested and updated business continuity plan.

Article 13: Payment institutions must submit their computer systems to an annual IT security audit carried out by a firm certified by the National Cybersecurity Agency. A copy of the audit report must be communicated to the Central Bank of Tunisia.

Payment institutions must conduct tests to analyze the security level of their computer systems and evaluate their capacity to effectively face attacks targeting said systems. To this end, they ensure that the tests do not present risks of operational disruption and do not call into question the continuity of their information systems' services.

Payment institutions set the deadlines and hours of intervention and ensure that their business continuity plans provide for adequate measures to be taken in the event of disruption or unavailability of their information systems due to tests or cyberattacks.

Payment institutions must immediately inform the Central Bank of Tunisia and the National Cybersecurity Agency of any attack, intrusion and other disruptions likely to hinder the functioning of their information systems.

In this case, payment institutions are required to comply with the measures established by the National Cybersecurity Agency to address these disruptions.

The Central Bank of Tunisia is obligatorily informed without delay of the measures taken.

Article 14: Payment institutions are subject to the provisions of Circular No. 2017-08 of September 19, 2017, as amended by subsequent texts. To this end, they must put in place a system for the fight against money laundering, terrorism financing and proliferation of weapons of mass destruction in accordance with Article 12 of this circular.

This system must be based on a risk-based approach and include in particular policies, procedures, organization, human and technical resources and internal control measures allowing to ensure the identification, assessment, understanding, control, monitoring and mitigation of money laundering, terrorism financing and proliferation financing risks to which the institution is exposed. In this framework, institutions must:

• Ensure that the aforementioned system covers all activities, products, services, distribution channels, customer categories, geographical areas as well as the technologies used, including activities carried out through payment agents, or by any other partner or third party to which the institution resorts in the framework of its activities.
• Conduct a risk assessment in accordance with Article 4 of Circular No. 2017-08. This assessment must be regularly updated and on the occasion of any significant change affecting its activity, organization, products, services, network, distribution channels or technologies used.
• Integrate into the aforementioned assessment emerging risks resulting notably from the use of new technologies, remote relationship onboarding or enrollment processes, innovative payment and fund transfer solutions as well as outsourcing operations.
• Provide vigilance measures towards customers proportionate to the identified risk level, including, as the case may be, simplified or enhanced vigilance measures, based on the results of national risk assessments and the risk self-assessment carried out by the institution;
  The respect of the ceilings referred to in Article 3 of this circular does not in any case exempt the institution from its vigilance obligations provided for by the legislation and regulation in force in the matter of the fight against money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction;
• Ensure continuous and appropriate training of staff members, payment agents and concerned persons on money laundering, terrorism financing and proliferation financing risks as well as on the obligations incumbent upon them in this matter.

Payment institutions are required to document, justify and preserve all elements relating to the risk assessment, vigilance measures implemented, controls carried out as well as decisions taken in the framework of the application of the risk-based approach.

These information and documents must be preserved for the periods provided for by current legislation and kept at the disposal of the Central Bank of Tunisia as well as any other competent authorized authority, and communicated to them without delay upon request.

Article 15: Without prejudice to the provisions of Article 14, payment institutions are required to apply, according to the account level, the following minimum customer identification rules:

• Level 1 payment account: Opening requires the establishment of an identification sheet in conformity with Annex No. 1 to this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said sheet.
• Level 2 payment account: Opening requires the establishment of an identification sheet in conformity with Annex No. 2 of this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said sheet.
• Level 3 payment account: Opening requires the establishment of an identification sheet in conformity with Annex No. 3 to this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said sheet.
• Merchant payment account: Opening the merchant account requires the establishment of a merchant identification sheet in conformity with Annex No. 4 to this circular.

Customer identification elements and related documents must be preserved by the payment institution according to current legal and regulatory requirements.

Article 16: Payment institutions must keep registers relating to the operations carried out provided for in Article 2 of this circular.

These registers must be preserved for a minimum period of ten (10) years from the date of execution of said operations.

Title Four:
Of Rules for the Opening and Functioning of Payment Accounts, the Merchant Account and the Global Account

Article 17: Payment institutions are authorized to open customer payment accounts in dinar of three levels: "Level 1 account", "Level 2 account" and "Level 3 account".

The ceilings authorized by account type as well as withdrawal limits are fixed as follows:

• Level 1 payment account: This account is exclusively reserved for natural persons. Its balance is capped at 1,500 dinars.
• Level 2 payment account: This account can be opened by any natural or legal person. Its balance is capped at 5,000 dinars without however that the global amount of cash withdrawals made from the payment account cannot exceed 3,000 dinars per day.
• Level 3 payment account: This account can be opened by any natural or legal person. Its balance is capped at 20,000 dinars without however that the global amount of cash withdrawals made from the payment account does not exceed 10,000 dinars per day.

Article 18: Payment institutions may proceed to the opening of customer payment accounts without the physical presence of the client or their legal representative being required, subject to the use of a reliable and secure technological process guaranteeing a level of identity verification at least equivalent to that required in physical presence.

To this end, payment institutions must ensure in particular that the technological process used allows:

• Verification of the authenticity, integrity, and validity of identification documents, using official sources or interconnection systems with competent authorities' databases whenever possible.
• Verification of the client's physical presence (proof of life) using appropriate technologies, such as facial recognition, audiovisual devices, or any other reliable equivalent mechanism.
• Implementation of at least two-factor authentication mechanisms.
• Obtaining the client's explicit consent for the processing of their personal data, in accordance with current legislation.
• Guaranteeing the confidentiality, integrity, and availability of personal data, as well as their protection using appropriate security measures, notably through reliable encryption processes.
• Automatic generation of a client identification file (Know Your Customer), as well as the retention, regular updating, and traceability of collected data and documents.

Payment institutions must, prior to the production deployment of the technological process, conduct tests in a pre-production environment, the results of which are documented in a performance register allowing, in particular, an assessment of the device's reliability rate, including the false acceptance rate.

They are also required to submit said process to intrusion tests and security audits carried out by independent bodies accredited by the National Cybersecurity Agency, and to implement an incident management system to detect and address any anomaly or fraud attempt.

The technological process must be subject to a periodic audit, at least once every two years, as well as upon any modification of the regulatory framework or the introduction of any technological modification likely to affect the security of the process, the reliability of the remote client enrollment process, or its compliance with the requirements provided for in this article.

The provisions of this article constitute minimum requirements, without prejudice to the application by payment institutions of more stringent measures based on their risk appetites and types of activity.

Article 19: The opening of a payment account is subject to the conclusion of an agreement between the payment institution and the client. A copy of the agreement, in physical or digital format, must be made available to the client.

The agreement must in particular set out the general conditions for opening, operating, and closing the account, as well as the procedures for handling the accounts of deceased persons. It must also define the rights attached to the account, the list of services provided, their description, as well as the applicable commissions and fees.

When the opening of the payment account is carried out electronically, in accordance with the provisions of Article 18 of this circular, the payment institution is required to guarantee the client:

• Permanent access to the content of the agreement.
• The possibility to consult, download, and retain the agreement prior to its acceptance.
• The possibility to manifest consent expressly, electronically, using a reliable identification process ensuring the link between the client and the accepted agreement.
• The right to withdraw if no service has been used during the legal period provided for by Law No. 2000-83 of August 9, 2000, relating to electronic exchanges and commerce.

The procedures for concluding and retaining the agreement in electronic form must guarantee its integrity and probative value, in accordance with current legislation.

Article 20: Any opening of a payment account results in the assignment of an account number conforming to the coding applicable to a bank account and used exclusively to carry out payment operations as defined in Article 2 of this circular.

Article 21: It is prohibited for any payment institution to open more than one client payment account for the same natural or legal person.

Article 22: Payment institutions are prohibited from granting any form of credit on payment accounts or from funding the balance of a payment account with telephone recharge units or any other form of value other than legal tender with discharge value.

The payment account must not at any time show a debit balance.

Article 23: Payment institutions may open, for merchants accepting proximity or remote payments, including via mobile phone, transitional payment accounts known as "merchant accounts," not subject to the caps provided for in Article 17 of this circular.

This account is credited exclusively with operating flows generated by payment transactions accepted by the merchant and collected on their account opened with the relevant payment institution.

The payment institution must conclude an agreement with the merchant setting out their rights and obligations, in particular the operating procedures of the account and the conditions for its closure.

The model of the agreement must be transmitted to the Central Bank of Tunisia.

Article 24: Funds credited to client payment accounts and merchant accounts held by the institution must be accounted for in a manner allowing their distinct identification from the institution's own funds and other operating funds.

These funds must be deposited in a single global account opened by the payment institution with a bank authorized to receive deposits, no later than the next business day following their receipt.

Commissions received by the payment institution for payment services must not be accounted for at the level of the global account.

Article 25: The global account must satisfy the following conditions:

• Be subject to a "global account agreement," duly signed by the payment institution and a depositary bank, specifying in particular the operating procedures of the global account, the conditions for fund management by the bank, the procedures for informing the payment institution about movements on the global account, and the remuneration applicable to this account.
• At all times, show a balance equal to the sum of the balances of all client payment accounts and merchant accounts opened with the payment institution.
• Be dedicated to exclusive use, prohibiting any use of the funds deposited therein to finance the operating needs of the payment institution.
• Be distinct and separate from accounts opened by the payment institution for its own needs.

The payment institution must have at all times a detailed breakdown of the global account by holder of client payment account and merchant account and by balance.

Article 26: Any payment institution is required to ensure, in a regular and documented manner, the reconciliation between the balance of the global account and the sum of the balances of client payment accounts and merchant accounts opened in its books.

Title Five:
On agencies, the use of payment agent networks, and partnerships

Article 27: Any payment institution must, in the course of its activity, open at least one agency.

The agencies of payment institutions may provide all services provided for in Article 2 of this circular.

Any opening, closure, or transfer of an agency by a payment institution must meet the minimum requirements set out in the specifications document attached as Annex No. 5 to this circular.

Article 28: Payment institutions may mandate, under their responsibility and for their own account, legal entities or natural persons with the status of merchant and exercising their activities in accordance with the legislation and regulations applicable to them, in order to provide certain payment services.

Article 29: Payment institutions may mandate two categories of payment agents:

a- Principal payment agents who can only provide the following services:

• Opening of level 1 and level 2 payment accounts as defined in Articles 15 and 17 of this circular.
• Cash deposit and withdrawal operations on payment accounts opened with the institution.
• Fund transfer operations carried out by cash handover.
• Payment operations carried out by any remote communication means, even when these operations require cash handover for their execution.
• Marketing of any electronic payment instrument backed by the payment account issued by the payment institution.
• Making funds available from abroad via cross-border money transfer companies.

b- Retail payment agents who can only provide the following services:

• Opening of level 1 payment accounts, as defined by Articles 15 and 17 of this circular.
• Cash deposit and withdrawal operations on payment accounts opened with the institution.
• Fund transfer operations carried out by cash handover.
• Payment operations carried out by any remote communication means, even when these operations require cash handover for their execution.

Article 30: Payment institutions may, in the course of their activities, conclude commercial or technical partnerships with legal entities possessing a distribution network, specialized skills, or technological infrastructure.

The conclusion of any partnership is subject to prior authorization from the Central Bank of Tunisia.

In the context of these partnerships, payment institutions are required to respect the following requirements:

• Ensure strict segregation between the information systems of the payment institution and those of the partner, in order to guarantee effective separation between the activities of the institution and those exercised by the partner.

• Ensure strict separation and protection of the payment institution's client funds against any use for purposes other than the provision of services provided for by this circular, as well as against any seizure or set-off measures related to the partner's own activities.

• Guarantee the confidentiality, integrity, and security of clients' personal data and ensure that their use is strictly limited to the purposes for which they were collected.

• Prohibit the partner from using any names, signs, communications, supports, or processes likely to create, in the minds of third parties, confusion regarding the exercise of a banking activity or the status of payment service provider.

• Ensure clear and transparent information to clients regarding the identity of the payment institution as a payment service provider, the applicable tariff conditions, and the avenues for recourse in case of dispute.

• Implement the necessary devices to ensure the continuity of services provided to clients and limit risks resulting from the partner's failure.

Any partnership must be formalized by a written agreement specifying in particular the roles and responsibilities of the contracting parties, the procedures for control and monitoring, commitments regarding regulatory compliance, security, and data protection, as well as the conditions for termination of the partnership.

The agreement must further stipulate that the payment institution's clients cannot be held responsible for acts or failures attributable to the partner entity.

Article 31: Payment institutions may, within the framework of partnerships, issue co-branded cards.

Clients must be informed, in a clear and transparent manner, of the card's characteristics, the identity of the issuing payment institution, the role of each party, as well as the conditions of use, pricing, and complaint handling.

Any communication relating to co-branded cards issued must be clear, fair, and non-misleading, and must not mislead regarding the identity of the issuing institution.

The payment institution remains solely responsible for the issuance of payment instruments and for compliance with all applicable legal and regulatory obligations.

Article 32: Payment institutions must define and implement a policy governing the use of payment agents, covering in particular the selection, training, control, and profile of these agents.

Article 33: Before entering into a relationship with principal payment agents and retail payment agents, the payment institution must ensure:

• Their honorability and the absence of any legal impediment opposing the exercise of the merchant activity.
• The adequacy of their human, technical, and financial resources.
• Their ability to comply with regulatory provisions regarding the provision of services for which they are mandated.

The payment institution must ensure continuously that principal payment agents and retail payment agents apply the same level of requirement as the payment institution itself regarding client identification.

The payment institution using payment agents remains fully responsible, vis-à-vis its clients, the Central Bank of Tunisia, and third parties, for acts carried out by its agents in the course of providing the services for which they are mandated.

Article 34: The payment institution must conclude an agreement with its principal and retail agents that sets out at minimum:

• The services offered by payment agents.
• The liability of payment agents.
• The obligations of the payment institution towards payment agents regarding training, implementation of procedures, documents, supports, and technical means necessary for the provision of services for which they are mandated.
• The procedures for control carried out by the payment institution on payment agents.
• The procedures for remuneration of services offered by payment agents on behalf of the payment institution.
• The prohibition for a principal payment agent or a retail payment agent to delegate or assign their mandate to another payment agent or any other person.

Article 35: The payment institution may only mandate payment agents who open an "agent account" in its books, which operates according to the following rules:

• The agent account is intended exclusively to execute the services listed in Article 29 of this circular.
• Credit facilities granted by the payment institution on the agent account are prohibited.
• The agent account must not at any time show a debit position.
• The agent account is distinct and separate from the merchant account referred to in Article 23 of this circular. When the same person holds the status of payment agent and merchant accepting proximity or remote payments, including mobile payment, they are required to open two distinct accounts, with separation and traceability of flows specific to each activity.

The payment institution is required to take the necessary measures to ensure that the services listed in Article 29 of this circular are executed only within the limit of the available credit balance on the agent account.

The capping rules listed in Article 17 of this circular are not applicable to the agent account.

Article 36: Payment institutions ensure that payment agents clearly inform the public of their status as payment agents, as well as the identity of the payment institution or institutions for whose account they act.

Article 37: Payment institutions are required to:

• Implement, for any payment agent or partner, an obligatory and continuous training program aimed at maintaining and improving their qualifications in the exercise of activities mandated or entrusted to them.
• Implement an audit program for agents and partners based on a risk-based approach, covering in particular:
• Compliance with vigilance and client identification rules.
• Compliance with operational and regulatory procedures.
• Quality of service provided to clients.
• Compliance of operations carried out with authorized services.

To this end, payment institutions are required to transmit to the Central Bank of Tunisia a report approved by the board of directors or supervisory board, including the planned audit program for agents or partners, the status of its implementation, the main conclusions of missions carried out, as well as corrective measures taken and those planned with their implementation deadlines.

• Terminate any mandate with a payment agent or partner in case of deficiencies or serious failures observed following controls or audits, take immediately all necessary measures to control identified risks and, if applicable, redirect operations to other agents or partners, as well as inform affected clients of the measures taken and inform the Central Bank of Tunisia.

Title Six:
Client protection device and complaint handling

Article 38: Without prejudice to the provisions of Article 84 of Law No. 2016-48, payment institutions must adopt a marketing and pricing policy based on the principles of transparency, fairness, and client protection.

To this end, they are required to:

• Provide, prior to any subscription, clear and accessible information regarding offered services and applicable tariffs, and prohibit any practice likely to mislead the client base.
• Ensure that information, contractual documents, communication supports, and tariff grids are presented in a clear and appropriate manner, in particular for persons with specific needs and illiterate persons.
• Implement a fair pricing policy based on the added value of services and proportionate to the costs incurred as well as the quality of services provided.
• Guarantee the protection of personal data, in accordance with current legislation.

Article 39: Payment institutions must adopt a communication policy towards clients based on the principle of transparency.

To this effect, they are required to set rules and procedures guaranteeing:

a) Prior to the execution of the transaction:
Communication to the client of the transaction status, its amount, as well as the commissions and taxes associated with it.

b) Subsequent to the execution of the transaction:
Communication to the client of the outcome of the transaction, its amount, the commissions and taxes associated with it, as well as the new balance of their payment account and the transaction reference number.

c) Periodic information:
Making available to the client, by any appropriate means, a statement of operations carried out on the payment and merchant account, according to the modalities provided in the account agreement.

d) Permanent information:
Making available to the public, at all levels of their network, as well as at the level of their principal and retail payment agents, all information regarding applicable tariff conditions, by category of operation.

Article 40: Without prejudice to the provisions provided for by Circular No. 2020-11 of May 18, 2020, relating to the conditions for providing domestic mobile payment services, payment institutions are required to implement:

• Clear policies and procedures for receiving and handling client complaints.
• A structure responsible for handling client complaints.
• Clear policies and procedures for handling the payment accounts of deceased persons in compliance with current legislative provisions.

Article 41: Any operation carried out by a payment institution, through its agencies or agents, must result in the production of an electronic or, if applicable, physical receipt which must in particular include:

• The date of the operation.
• Elements allowing the identification of the order giver.
• Elements allowing the identification of the beneficiary.
• The amount of the operation.

Article 42: The payment institution must inform its clients of any decision to suspend a product or service at least one month before its effective date by any means leaving a written trace and on its website.

Article 43: Approved payment institutions are registered in a register kept for this purpose by the Central Bank of Tunisia.

The Central Bank of Tunisia publishes on its website the list of approved payment institutions, information regarding services provided, the address of their agencies, and the identity of their partners as well as their payment agents and the payment services for which they are mandated.

Title Seven:
On Information and Relations with the Central Bank of Tunisia

Article 44: Prior to the commercialization of any product or service and to any tariff revision, payment institutions must send to the Central Bank of Tunisia a file containing at least:

• A descriptive sheet detailing the objective of launching the product or service, its main characteristics, its pricing conditions, as well as the related procedure note.
• An evaluation of the risks associated with the product or service and the modalities for their mitigation.
• A copy of the residual risk assessment report for money laundering or terrorist financing associated with the use of new technologies, in accordance with Article 20 of Circular No. 2017-08 of September 19, 2017, as amended and supplemented by subsequent texts.
• A report signed by the compliance control officer of the concerned establishment, attesting that the contractual documents of the product or service do not contravene current legislation and regulation.
• A note describing the pricing criteria, and the underlying reasons for the tariff revision or the establishment of the commission in terms of added value offered to the clientele.
  Any decision ending the commercialization of a product or service must be subject to prior notification and motivation to the Central Bank of Tunisia.

Article 45: Any partnership agreement with cross-border money transfer companies, in the context of providing fund availability services from abroad, is subject to the prior authorization of the Central Bank of Tunisia.
To this end, payment institutions must ensure that cross-border money transfer companies apply the necessary due diligence regarding client identification and, where applicable, their beneficial owners, and they must, for this purpose, have access to all information on the ordering party.

Article 46: Payment institutions are required to transmit to the Central Bank of Tunisia, prior to their adoption, the standard contract models to be concluded with payment agents and any draft modification or revision of these models. The Central Bank of Tunisia may oppose the adoption of the standard contract model within a period of one month from the date of its communication.

Article 47: In application of Article 8 of this circular, nomination files to be transmitted to the Central Bank of Tunisia must include:

• A letter of motivation signed by the chairman of the board of directors or supervisory board, detailing notably the reasons for the choice of the person in question, their expected contribution to strengthening the collective skills of other members of the board of directors or supervisory board or of the management body.
• A detailed curriculum vitae of the designated person.
• A copy of an identity document of the designated person.
• An extract of the criminal record of the designated person issued less than 3 months ago.
• A sworn declaration signed by the designated person, by which they attest that they are not subject to legal prohibitions, established according to the model in Annex No. 6 to this circular.
• A sworn declaration signed by the chairman of the board of directors or supervisory board, by which they attest that the designated person is not in a situation of conflict of interest.
  The Central Bank of Tunisia may, in the context of examining this file, request payment institutions to communicate any additional information or document it deems useful, within a period not exceeding fifteen (15) days from the date of receipt of the file.

Article 48: Prior to the launch of any partnership as defined in Article 30 of this circular, payment institutions are required to send to the Central Bank of Tunisia an authorization request accompanied by a file comprising at least the following elements:

• Identification of the partner, including its shareholding structure, governance bodies, activity, experience, as well as its technical, financial, and organizational capacities in the areas concerned by the partnership.
• A note explaining the object of the partnership, the business model specifying notably the remuneration modalities of the parties, the services to be commercialized, the objectives pursued, as well as the expected benefits for the payment institution and for its clientele.
• A prospective business plan covering at least the first three years of the partnership, highlighting notably the assumptions retained, the commercial objectives pursued, activity projections, as well as associated financial forecasts.
• A risk map inherent to the partnership as well as the measures provided for their identification, evaluation, and control.
• A description of the operational modalities for implementing the partnership, including the technical, organizational, and internal control devices envisaged.
• The measures provided for guaranteeing the protection of personal data, the confidentiality of information, as well as the security of information systems.
• The modalities for monitoring, controlling, and auditing the partner by the payment institution, as well as, where applicable, by the Central Bank of Tunisia.
• The devices provided for ensuring service continuity as well as the conditions framing the cessation of the partnership.
• The draft convention linking the two parties, clearly specifying the rights and obligations of each of them.
  The Central Bank of Tunisia may request any additional document or information it deems useful for the processing of the file.

Article 49: Each payment institution must communicate to the Central Bank of Tunisia, at the latest one month before the holding of its general meeting, the report of the statutory auditors within the framework of their mission to evaluate the internal control device implemented by the payment institution in application of the provisions of this circular.
The aforementioned report must particularly focus on the following control points:

• The procedure for ring-fencing client funds in the global account and the conditions of its implementation.
• The device for combating money laundering, terrorist financing, and the proliferation of weapons of mass destruction.
• The operational risk management device.
• The client complaints management device.

Article 50: Payment institutions are required to comply with the provisions of Circular No. 2017-6 on accounting, prudential, and statistical reporting.
A new annex titled "Annex No. 1bis on accounting, prudential, and statistical reporting to the Central Bank of Tunisia" is added to Circular No. 2017-6.
Payment institutions must communicate reporting to the Central Bank of Tunisia in accordance with Annex No. 1 bis to Circular No. 2017-6 of July 31, 2017.

Article 51: In case of unavailability of the Data Exchange System (SED), payment institutions must transmit their declarations to the following electronic address: reporting.EP@bct.gov.tn

Article 52: This circular repeals and replaces Circular No. 2018-16 of December 31, 2018, on the rules governing the activity and functioning of payment institutions, and enters into force within a period of three months from the date of its publication.

The Governor,
Fethi Zouhaier Nouri

Annex 1 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
IDENTIFICATION ELEMENTS FOR CLIENTS HOLDING LEVEL 1 PAYMENT ACCOUNTS

• Name and first name
• Date and place of birth
• Nationality
• Profession
• Phone number
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address if different from the national identity card
• Estimated monthly income

Annex 2 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
IDENTIFICATION ELEMENTS FOR CLIENTS HOLDING LEVEL 2 PAYMENT ACCOUNTS I- For natural persons

• Name and first name
• Date and place of birth
• Nationality
• Profession
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address
• Estimated monthly income
  II - For legal persons
• Trade name or company name
• Registered office address
• Legal form
• Mandates and powers (Name, first name of the person authorized to operate the account and signature specimen)
• Recent extract from the national business register
• Beneficial owner(s)
• Any element allowing to assess the financial situation

Annex 3 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
IDENTIFICATION ELEMENTS FOR CLIENTS HOLDING LEVEL 3 PAYMENT ACCOUNTS I- For natural persons

• Name and first name
• Date and place of birth
• Nationality
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address
• Profession practiced
• Declaration of the source of income
  II - For legal persons
• Trade name or company name
• Registered office address
• Legal form
• Nature of activity
• Recent extract from the national business register
• Mandates and powers (Name, first name of the person authorized to operate the account and signature specimen)
• Any element allowing to assess the financial situation
• Beneficial owner(s)

Annex 4 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
IDENTIFICATION ELEMENTS FOR MERCHANT ACCOUNT HOLDERS I- For merchant natural persons

• Name and first name
• Date and place of birth
• Nationality
• National identity card number or passport number
• Official address and commercial activity address (if different)
• Identifier in the National Business Register
• Source of income related to the activity
• Beneficial owner
  II - For merchant legal persons
• Trade name or company name
• Legal form
• Corporate object, nature of activity, and sector of activity
• Registered office address
• Identifier in the national business register
• Identity of the legal representative(s) and persons authorized to operate the account
• Mandates and powers
• The beneficial owner(s)
• Any element allowing to assess the financial situation
• Geographic zone of activity
• Expected transactional profile (12 months)

Annex 5 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
SPECIFICATIONS SETTING THE CONDITIONS FOR OPENING, CLOSING, AND TEMPORARY OR PERMANENT TRANSFER OF AGENCIES BY PAYMENT INSTITUTIONS
Article 1: Payment institutions are required to declare to the Central Bank of Tunisia any operation of opening, temporary or permanent closure, or transfer of any agency on a temporary or permanent basis at least fifteen (15) working days in advance.
The declaration of these operations is made in accordance with the declaration models 1 and 2 attached to this annex.
Article 2: Prior to any temporary or permanent closure or any permanent or temporary transfer operation of the agency, payment institutions are required:

• To institute useful organizational measures to take charge of funds received from clients at the agency and to process them in accordance with a procedure manual elaborated for this purpose by the payment institution.
• To inform their clients individually by any means leaving a written trace and on their website, at least forty-five (45) days before the date of closure or transfer.

TITLE I: CONDITIONS FOR IMPLANTATION AND LAYOUT
Article 3: The premises housing the agency must be identifiable by the public and located on a site easily accessible.
Article 4: Without prejudice to the conditions required under current legislation and regulation regarding public reception spaces, the premises must be located in an appropriate place away from constructions and equipment likely to present a source of risk (fuel or gas deposits....).
Article 5: The surface area of the agency must be adapted to the volume of activity and must, in no case, be less than twenty (20) square meters. The shape of the premises must be functional.
Article 6: The premises housing the agency must have:

• A reception area for clients and counters to offer payment services to the public visible upon access to the premises;
• Appropriate arrangements guaranteeing accessibility and easy circulation for persons with specific needs, as well as easy access to the services offered by the agency;
• An independent space for the head of the agency.
  The cash register must be located away from client access, and the funds deposited there must be kept out of public view.

TITLE II: SECURITY CONDITIONS
Article 7: Payment institutions must take all security measures related to the protection of persons and the agency premises. To this end, they must ensure that the premises are permanently connected to the police station by a specialized telephone line.
Article 8: Payment institutions must have a procedure manual for agency security describing notably:

• The instructions to apply to alert the police in case of justified concerns or in case of aggression;
• The conditions for opening and closing doors;
• The conditions for verifying the proper functioning of security installations, access, and the alarm device;
  The procedure manual must be made available to the agency staff.
  Article 9: The head of the agency must possess the qualifications and professional skills necessary for the effective management of an agency.
  The payment institution ensures that the staff of its agencies receives adequate and continuous training, notably in combating money laundering and terrorist financing and the proliferation of weapons of mass destruction. The payment institution must assign at least two people per agency, including the head. Staff must be initiated in the use of security means and their operation in case of necessity.
  Article 10: The agency must be equipped with a safe conforming to Tunisian standards and which must in all cases be connected to the security system.
  Article 11: Prior to the opening of any agency, the payment institution must submit the security device to an external audit. A copy of the audit report must be sent to the Central Bank of Tunisia.

DECLARATION MODEL No. 1:
OPENING OF AN AGENCY
Implantation Site:
Governorate:……………Delegation:……………………………… Commune:……………...…………… Coordinates:
Address:…………………………………………………………..…………………..……………………………………………….
Postal Code:………………………………….………………………………...……....…………………………………………….
E-mail:………………………………………………………………………...……………………………………………………......
Telephone:…………………………………………….
Staff:………………………………………………………………………………………………………………………………..
Head of Agency:
Name:…………………………………………………………………………………………………………………………………….
First Name:…….………………….………….….………..……………..…………………………………………………………………..
Education Level:………………………………
University Diploma:………….…………………
Year of obtaining university diploma:……………………...…………………………………………………… Professional Experience:…………………………………….……………………………….……… Premises Layout:
Surface Area:………..
Form of exploitation of the premises: For rent Owned Envisaged Operations ……………………………………………………………………………………………………………………………………… Specify if the agency will exercise the activity of manual exchange yes no Working Hours: ……………………...……………………………………………………………… Stamp and authorized signature (Name and function of the signatory)

DECLARATION MODEL No. 2:
CLOSURE OF AN AGENCY
Opening Date: ……………………...…………………………………………………………………………………………..
BCT Identifier (agency code): ……………………...………………………………………………………………..
Implantation Site: ……………………...……………………………………………………………………………………….
Governorate: …………………… Delegation: ……………………… Commune: …………………..
Last indicators relating to the activity of the agency subject to closure declaration:
Number of accounts (by level): …………………………………………………………………………….
Number of clients: …………………………………………………………………………………………………….
Reasons for closure:
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………… Procedures put in place to preserve the interests of the clientele of the agency subject to closure ………….……………………………………………………………………………………………………………………………….. ………….……………………………………………………………………………………………………………………………….. ………….………………………………………………………………………………………………………………………………… Stamp and authorized signature (name and function of the signatory)

DECLARATION MODEL No. 3:
TRANSFER OF AN AGENCY
Opening Date: ……………………...………………………………………………………………………………………… BCT Identifier (agency code): ……………………...……………………………………………………………… Implantation Site: ……………………...………………………………………………………………………………….. Governorate: ………………….. Delegation: …………………… Commune: …………………….. Last indicators relating to the activity of the agency subject to transfer declaration:
Number of accounts (by level): ………………………………………………………………………….
Number of clients: ………………………………………………………………………………………………… Reasons for transfer:
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………… Stamp and authorized signature (name and function of the signatory)

Annex 6 to the Circular of the Central Bank of Tunisia No. 2026-
2010 of September 25, 2026
SWORN DECLARATION
I, the undersigned Mrs./Ms./Mr …. ………………. ………………. holder of the national identity card or passport n° : ………………..…………… issued at…………………………………. on ……………….……………… and designated as ……………………. by decision of ……. …on date of….. declare on honor that:

• I have not been the subject of a final judgment for forgery, theft, breach of trust, fraud, extortion of funds or third-party assets, subtraction committed by a public depositor, corruption or tax evasion, issuance of a check without provision, handling of goods obtained by means of these offenses or infringement of exchange regulation or legislation relating to the fight against money laundering and terrorist financing and the proliferation of weapons of mass destruction,
• I have not been struck by a final judgment of bankruptcy,
• I have not been manager or agent of companies, convicted under the provisions of the Penal Code relating to bankruptcy,
• I have not been dismissed from administrative or management functions of a company subject to the control of the Central Bank of Tunisia or by one of the authorities in charge of controlling the financial market or insurance and reinsurance companies or micro-finance institutions, pursuant to a sanction imposed by these authorities,
• I have not undergone a sanction of radiation in the exercise of a professional activity regulated by a legal or regulatory framework,
• I have not been responsible for the poor management of a bank or financial establishment that caused difficulties that made it necessary to submit the bank or financial establishment to a resolution plan or liquidation.
• I am not in one of the situations of prohibition and incompatibility provided for by current legislation and notably Law No. 2016-48 of July 11, 2016 and notably its articles 46, 57 and 58.
  Made at ………..on …………
  Signature

Annex No. 1 bis to Circular No. 2017-6 of July 31, 2017, on accounting, prudential, and statistical reporting to the Central Bank of Tunisia
Domain Declaration Code Declaration Title Declaration Periodicity Maximum Transmission Deadline Format / Transmission Accounting Reporting RCT03 Accounting Situation (Balance Sheet) Quarterly DR+30j XML RCT04 Income Statement Quarterly DR+30j XML Activity-related Reporting RAM05 Commercial Indicators Monthly DR+15j XML RAM06 Status of operations by channel in number and amount Monthly DR+15j XML RAT07 List of own agencies and mandated agents Quarterly DR+30j XML RAA10 Distribution of complaints received from clients by reception channel Annually DR+45j XML RAA20 Status of complaints received broken down by object, deadlines, and reserved follow-up Annually DR+45j XML RAA783 Tariff Schedule Annually DR+45j PDF Statistical Reporting RST650 Sectoral distribution of the main items of the asset of the accounting situation Quarterly DR+30j XML Reporting on governance, internal control, and risk management devices Governance RGT240140 Minutes of board of directors meetings Quarterly DR+30j PDF RGT240150 Minutes of audit and risk committee meetings Quarterly DR+30j PDF RGA210 Capital Structure Annually DR+45j XML

RGA220 Information on governance structures Annual DR+45j XML RGA230 Information on control structures Annual DR+45j XML RGA 240009 Note on the development strategy validated by the board of directors over a 3-year period Annual DR+45j PDF RGA240020 Annual report Annual DR+45j PDF RGA240030 Articles of Association Annual DR+45j PDF RGA240050 Organizational chart Annual DR+45j PDF RGA240190 Signed minutes of the General Meeting for the relevant fiscal year Annual DR+45j PDF

Internal control, risk management, audit and compliance RCIA250100 Annual audit report on information system security Annual DR+45j PDF RCIA250110 Global account contract with the bank Annual DR+45j PDF RCIA250120 Segregation procedure validated by the Board of Directors Annual DR+45j PDF RCIA250130 Insurance contract or bank guarantee Annual DR+45j PDF RCIA250140 Annual report on the activities of the risk management body for the fiscal year Annual DR+45j PDF RCIA250150 Annual report on the activities of the compliance monitoring body for the fiscal year Annual DR+45j PDF RCIA250160 Annual report on audit work Annual DR+45j PDF

Operational risk reporting
RROS370 Report on service supply disruption incidents and their management Semi-annual End of August PDF RROI380 Preliminary form for immediate declaration of serious incidents In case of a serious incident Day of the incident XML

RROI381 Closure form for serious incidents In case of a serious incident Date of incident + 10 days RROT390 Quarterly declaration of incidents Quarterly DR+30j XML

Reporting on the AML/CFT/FP framework
RLABFTA310
Statistics on suspicious transaction reports (Annex 5 to Circular No. 2017-08 as amended by subsequent texts) Annual DR+45j XML RLABFTA320 Questionnaire on the AML/CFT/FP framework Annual DR+45j PDF RLABFTT330 Quarterly statement on frozen assets under UN and national sanctions (Annex 6 to Circular No. 2017-08 as amended by subsequent texts) Quarterly DR+30j XML RLABFTA350 Risk assessment report on money laundering and terrorist financing risks of the establishment covered by Article 4 of Circular No. 2017-08 as amended by subsequent texts Annual DR+45j PDF

Reporting reviewed by statutory auditors
RCACA150 General report on individual financial statements Annual one month before the holding of the General Meeting PDF RCACA170 Special report under Article 200 of the Commercial Companies Code Annual one month before the holding of the General Meeting PDF RCACA260 Report on the internal control system as referred to in Article 49 of this Circular Annual one month before the holding of the General Meeting PDF