Circular of the Central Bank of Tunisia No. 2026-10 of September 25, 2026

Tunis, September 25, 2026.

Circular of the Central Bank of Tunisia No. 2026-10

Subject: Rules governing the activity and functioning of payment establishments.

The Governor of the Central Bank of Tunisia,

Having regard to Organic Law No. 2004-63 of July 27, 2004, relating to the protection of personal data;

Having regard to Organic Law No. 2015-26 of August 7, 2015, relating to the fight against terrorism and the repression of money laundering, as amended and supplemented by Organic Law No. 2019-9 of January 23, 2019;

Having regard to Law No. 2000-83 of August 9, 2000, relating to electronic exchanges and e-commerce;

Having regard to Law No. 2005-51 of June 27, 2005, relating to electronic funds transfer;

Having regard to Law No. 2016-35 of April 25, 2016, establishing the status of the Central Bank of Tunisia, particularly its Article 8;

Having regard to Law No. 2016-48 of July 11, 2016, relating to banks and financial institutions, particularly its Articles 20 and 21;

Having regard to Decree-Law No. 2023-17 of March 11, 2023, relating to cybersecurity;

Having regard to Circular to credit institutions No. 2006-1 of March 28, 2006, relating to the regulation of outsourcing conditions;

Having regard to Circular to credit institutions No. 2006-19 of November 28, 2006, relating to internal control in credit institutions;

Having regard to Circular to banks and financial institutions No. 2017-6 of July 31, 2017, relating to accounting, prudential, and statistical reporting to the Central Bank of Tunisia;

Having regard to Circular to banks and financial institutions No. 2017-08 of September 19, 2017, relating to internal control systems and rules in matters of combating money laundering, terrorist financing, and the financing of proliferation of weapons of mass destruction, as amended and supplemented by subsequent texts and notably Circular No. 2025-17 of December 22, 2025;

Having regard to Circular of the Central Bank of Tunisia No. 2018-16 of December 31, 2018, relating to the rules governing the activity and functioning of payment establishments;

Having regard to Circular of the Central Bank of Tunisia No. 2020-11 of May 18, 2020, relating to the conditions for providing domestic mobile payment services;

Having regard to Opinion No. 2026-10 of the Compliance Control Committee dated September 25, 2026, as provided for by Article 42 of Law No. 2016-35 of April 25, 2016, establishing the status of the Central Bank of Tunisia.

Decides:

Article 1: This circular aims to set the application conditions for Articles 20 and 21 of Law No. 2016-48 relating to banks and financial institutions. It defines in particular the conditions for exercising the activity of payment establishments and the specific requirements regarding governance, internal control, and reporting to the Central Bank of Tunisia.

Title One
Of Services

Article 1: Payment establishments are authorized to provide their customers with the following services:

• Opening of payment accounts in dinars, of levels 1, 2, and 3 as defined by Articles 15 and 17 of this circular.
• Cash deposit and withdrawal operations on payment accounts opened on their books.
• Direct debit operations on payment accounts opened on their books.
• Electronic funds transfer operations and funds transfer operations carried out by cash remittance.
• Payment operations carried out by any remote or proximity communication means, even when these operations require a cash remittance for their realization.
• Issuance of electronic payment instruments backed by payment accounts opened on their books.
• Marketing of prepaid electronic money instruments issued by banks or the National Office of Posts.
• Receipt of funds from abroad by wire transfer or by making them available via cross-border money transfer companies.
• Manual exchange operations, as an ancillary activity, in accordance with the rules and conditions fixed by the Central Bank of Tunisia.

Payment services are provided exclusively in Tunisian dinars and within Tunisian territory.

Article 2: Funds transfer operations carried out by cash remittance, mentioned in the fourth bullet point of Article 2 of this circular, are capped at an amount of three thousand (3,000) dinars per operation.

Funds availability operations from abroad, referred to in Article 2 of this circular, are capped at the equivalent of twenty thousand (20,000) dinars per operation.

These operations must be duly justified.

Article 3: Payment establishments are required to adhere to appropriate payment and clearing systems suited to the nature of their activities.

In this regard, payment establishments may act as acquirers in the sense of card payments either by direct affiliation or through a partner bank.

Article 4: In accordance with the provisions of paragraph 5 of Article 21 of the aforementioned Law No. 2016-48, payment establishments must subscribe to a professional civil liability insurance policy or provide a bank guarantee of sufficient amount in line with their own funds to cover risks related to the provision of payment services.

The minimum amount of the insurance policy or bank guarantee is determined by payment establishments based on the following criteria:

• The risk profile of the establishment.
• The type of activity and payment services provided by the establishment.
• The volume of activity of the establishment.

Payment establishments must implement a calculation methodology for the value of the insurance policy or bank guarantee and submit it for prior approval by the Central Bank of Tunisia.

They proceed, at least once a year, to review this amount and, if necessary, adjust it.

Title Two
Of Governance Rules

Article 5: Payment establishments must put in place an effective governance system, adapted to the nature, complexity, and volume of their activities and their risk profiles, in order to establish sound and prudent management that guarantees their sustainability while preserving the interests of shareholders, creditors, and clients.

The board of directors or supervisory board of the payment establishment is responsible in particular for:

• Defining the development strategy of the establishment, in coherence with the risk appetite policy and orientations in terms of financial inclusion;
• Elaborating a governance framework in line with the size, complexity, and nature of the activity as well as the risk profile of the establishment;
• Defining and ensuring the effective application of a conflict of interest management policy;
• Approving the internal control system, including the system for managing money laundering, terrorist financing, and proliferation of weapons of mass destruction risks, and ensuring annual monitoring of its implementation by the general management or executive board;
• Monitoring the effective implementation by the general management or executive board of the establishment's development strategy using appropriate performance indicators;
• Anchoring a genuine risk culture in the management of the establishment and ensuring the effectiveness and independence of control functions;
• Defining a nomination and remuneration policy;
• Ensuring the protection of the interests of users of payment services and their personal data;
• Approving the fund escrow procedure referred to in Articles 24 and 25 of this circular in the global account which must reflect exhaustively the nominal list of customer and merchant payment account holders opened with the payment establishment and their balances.

Article 6: Payment establishments with a Board of Directors may provide for the cumulation of the functions of Chairman of the Board of Directors and those of General Director.

The number of members of the board of directors or supervisory board must be adapted to the nature, complexity, and volume of the payment establishment's activity and its risk profile.

The chairman of the board of directors or supervisory board, the members of the board of directors or supervisory board, the general director, the deputy general director, and the chairman or members of the executive board must permanently satisfy the conditions of honorability and adequate expertise, particularly in electronic payments, to diligently discharge their responsibilities.

Article 7: In accordance with current legislation, payment establishments are required to notify the Central Bank of Tunisia within a period not exceeding seven working days of any appointment of the chairman of the board of directors or supervisory board, a member of the board of directors or supervisory board, the general director, the deputy general director, and the chairman or a member of the executive board.

The Central Bank of Tunisia may oppose said appointment within a period of one month from the date of receipt of a complete file comprising the required documents.

The file submitted to the Central Bank of Tunisia must include the documents referred to in Article 47 of this circular.

Article 8: Payment establishments must create an audit and risk committee emanating from the board of directors or supervisory board.

This committee drafts a charter, approved by the board of directors or supervisory board, defining its attributes, composition, operating rules, and its relationship with the board of directors or supervisory board and the operational structures of the establishment.

The audit and risk committee is called upon in particular to:

• Ensure the quality, reliability, and relevance of the financial information production system and examine financial statements before their approval by the board of directors or supervisory board.
• Assess the organization and effectiveness of the internal control and compliance system, including the consistency of measurement, monitoring, and risk management devices.
• Supervise the activity of audit and risk structures, validate and follow up on the audit program and, where applicable, the work of other structures charged with control missions.
• Examine deficiencies identified by control structures, external audit, and the supervisory authority, and ensure follow-up on the implementation of corrective action plans.

The audit and risk committee is responsible for assisting the board of directors or supervisory board in:

• Approving the risk appetite and management policy as well as the associated measurement and monitoring systems and their limits.
• Approving the business continuity plan, ensuring the identification and consideration of risks likely to affect the continuity of payment services, particularly fraud risks, cybersecurity risks, data security breaches, risks related to the use of third-party providers, as well as the availability and resilience of information systems.
• Designating the heads of risk management, audit, and compliance structures.

Article 9: Payment establishments must create within their organization audit, risk management, and compliance control functions. These control functions must be independent of operational and support structures and must have clear attributes.

Payment establishments ensure that control functions are equipped with the necessary human and technical resources to effectively exercise their missions both at the level of the establishments themselves and at the level of their payment agent networks.

Title Three
Of Internal Control Rules and Combating Money Laundering, Terrorist Financing, and Proliferation of Weapons of Mass Destruction Risks

Article 10: Payment establishments are subject to the provisions of Circular of the Central Bank of Tunisia No. 2006-19 of November 28, 2006, relating to internal control. To this end, they must put in place an internal control system adapted to the nature, size, and complexity of their activities and the risks associated with them.

Article 11: Payment establishments must equip themselves with:

• A secure and scalable information system in line with the nature and complexity of payment operations.
• An operational security device that ensures the traceability of executed payment operations and collected funds and provides the position of all payment accounts opened on their books.
• A real-time recording and processing system for payment operations both at the level of the establishment itself and at the level of its payment agent network.
• An appropriate internal device for combating money laundering, terrorist financing, and proliferation of weapons of mass destruction, covering all their activities.
• A formalized complaint handling device and personal data protection for their clients, in conformity with current legal and regulatory provisions.
• An adequate risk management device, including operational risks and cyber risk.
• A formalized, tested, and updated business continuity plan.

Article 12: Payment establishments must subject their computer systems to an annual IT security audit conducted by a firm certified by the National Cybersecurity Agency. A copy of the audit report must be communicated to the Central Bank of Tunisia.

Payment establishments must carry out tests to analyze the security level of their computer systems and evaluate their capacity to effectively face attacks targeting said systems. To this end, they ensure that tests do not present operational disruption risks and do not call into question the continuity of service of their information systems.

Payment establishments determine intervention deadlines and hours and ensure that their business continuity plans provide for adequate measures to be taken in case of disruption or unavailability of their information systems due to tests or cyberattacks.

Payment establishments must immediately inform the Central Bank of Tunisia and the National Cybersecurity Agency of any attack, intrusion, and other disruptions likely to hinder the functioning of their information systems.

In this case, payment establishments are required to comply with the measures established by the National Cybersecurity Agency to address these disruptions.

The Central Bank of Tunisia must be informed without delay of the measures taken.

Article 13: Payment establishments are subject to the provisions of Circular No. 2017-08 of September 19, 2017, as amended by subsequent texts. To this end, they must put in place a device for combating money laundering, terrorist financing, and proliferation of weapons of mass destruction in accordance with Article 12 of this circular.

This device must be based on a risk-based approach and include in particular policies, procedures, organization, human and technical resources, and internal control measures allowing to ensure the identification, assessment, understanding, control, monitoring, and mitigation of money laundering, terrorist financing, and proliferation financing risks to which the establishment is exposed. In this framework, establishments must:

• Ensure that the aforementioned device covers all activities, products, services, distribution channels, customer categories, geographic zones, and technologies used, including activities carried out through payment agents or any other partner or third party to which the establishment resorts in the course of its activities.
• Conduct a risk assessment in accordance with Article 4 of Circular No. 2017-08. This assessment must be regularly updated and on the occasion of any significant change affecting its activity, organization, products, services, network, distribution channels, or technologies used.
• Integrate into the aforementioned assessment emerging risks resulting notably from the use of new technologies, remote relationship entry or enrollment processes, innovative payment and funds transfer solutions, as well as outsourcing operations.
• Provide vigilance measures towards customers proportionate to the identified risk level, including, depending on the case, simplified or enhanced vigilance measures, based on national risk assessment results and the risk self-assessment carried out by the establishment;
• The respect of the ceilings referred to in Article 3 of this circular does not dispense the establishment in any way from its vigilance obligations provided by legislation and regulation in force in matters of combating money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction;
• Ensure continuous and adapted training of staff members, payment agents, and concerned persons on money laundering, terrorist financing, and proliferation financing risks as well as on the obligations incumbent upon them in this matter.

Payment establishments are required to document, justify, and preserve all elements relating to risk assessments, vigilance measures implemented, controls performed, as well as decisions taken in the framework of applying the risk-based approach.

These information and documents must be preserved for the periods provided by current legislation and kept at the disposal of the Central Bank of Tunisia as well as any other competent authorized authority, and communicated to them without delay upon request.

Article 14: Without prejudice to the provisions of Article 14 [Note: Source text says Article 14, likely referring to previous context or typo in source, but transcribed as is], payment establishments are required to apply, according to the account level, the following minimum client identification rules:

• Level 1 Payment Account: Opening requires the creation of an identification form conforming to Annex No. 1 to this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said form.
• Level 2 Payment Account: Opening requires the creation of an identification form conforming to Annex No. 2 of this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said form.
• Level 3 Payment Account: Opening requires the creation of an identification form conforming to Annex No. 3 to this circular, containing relevant client identification information, supported by any official document, a copy of which is attached to said form.
• Merchant Payment Account: Opening of the merchant account requires the creation of a merchant identification form in accordance with Annex No. 4 to this circular.

Client identification elements and related documents must be preserved by the payment establishment according to current legal and regulatory requirements.

Article 15: Payment establishments must keep registers relating to operations performed provided for in Article 2 of this circular.

These registers must be preserved for a minimum duration of ten (10) years from the date of execution of said operations.

Title Four
Of Rules for Opening and Operating Payment Accounts, Merchant Accounts, and Global Accounts

Article 16: Payment establishments are authorized to open customer payment accounts in dinar of three levels: "Level 1 account", "Level 2 account", and "Level 3 account".

The ceilings authorized by account type as well as withdrawal limits are fixed as follows:

• Level 1 Payment Account: This account is exclusively reserved for natural persons. Its balance is capped at 1,500 dinars.
• Level 2 Payment Account: This account can be opened by any natural or legal person. Its balance is capped at 5,000 dinars without however the total amount of cash withdrawals made from the payment account exceeding 3,000 dinars per day.
• Level 3 Payment Account: This account can be opened by any natural or legal person. Its balance is capped at 20,000 dinars without however the total amount of cash withdrawals made from the payment account exceeding 10,000 dinars per day.

Article 17: Payment establishments may proceed to the opening of customer payment accounts without the physical presence of the client or their legal representative being required, subject to the use of a reliable and secure technological process guaranteeing a level of identity verification at least equivalent to that required in physical presence.

To this end, payment institutions must ensure in particular that the technological process used allows:

• Verification of the authenticity, integrity, and validity of identification documents, using, where possible, official sources or interconnection systems with the databases of competent authorities.
• Verification of the client's physical presence (proof of life) using appropriate technologies, such as facial recognition, audiovisual devices, or any other reliable equivalent mechanism.
• Implementation of at least two-factor authentication mechanisms.
• Obtaining the client's explicit consent for the processing of their personal data, in accordance with current legislation.
• Guaranteeing the confidentiality, integrity, and availability of personal data, as well as their protection using appropriate security devices, notably through reliable encryption processes.
• Automatic generation of a client identification file (Know Your Customer), as well as the retention, regular updating, and traceability of collected data and documents.

Payment institutions must, prior to the production deployment of the technological process, conduct tests in a pre-production environment, the results of which are documented in a performance register allowing, in particular, the evaluation of the device's reliability rate, including the false acceptance rate.

They are also required to submit said process to intrusion tests and security audits carried out by independent bodies accredited by the National Cybersecurity Agency, and to set up an incident management system to detect and handle any anomaly or fraud attempt.

The technological process must be subject to a periodic audit, at least once every two years, as well as whenever there is any modification to the regulatory framework or the introduction of any technological modification likely to affect the security of the process, the reliability of the remote client enrollment process, or its compliance with the requirements set forth in this article.

The provisions of this article constitute minimum requirements, without prejudice to the application by payment institutions of more stringent measures based on their risk appetites and types of activity.

Article 18: The opening of a payment account is subject to the conclusion of an agreement between the payment institution and the client. A copy of the agreement, in physical or digital format, must be made available to the client.

The agreement must in particular set out the general conditions for opening, operating, and closing the account, as well as the procedures for handling the accounts of deceased persons. It must also define the rights attached to the account, the list of services provided, their description, as well as the applicable commissions and fees.

When the payment account is opened electronically, in accordance with the provisions of Article 18 of this circular, the payment institution is required to guarantee the client:

• Permanent access to the content of the agreement.
• The possibility to consult, download, and retain the agreement prior to its acceptance.
• The possibility to manifest consent expressly, electronically, using a reliable identification process ensuring the link between the client and the accepted agreement.
• The right to exercise the right of withdrawal if no service has been used during the legal period provided for by Law No. 2000-83 of August 9, 2000, relating to electronic exchanges and commerce.

The procedures for concluding and retaining the agreement in electronic form must guarantee its integrity and probative value, in accordance with current legislation.

Article 19: Any opening of a payment account results in the assignment of an account number conforming to the codification applicable to a bank account and used exclusively to perform payment operations as defined in Article 2 of this circular.

Article 20: It is prohibited for any payment institution to open more than one client payment account for the same natural or legal person.

Article 21: Payment institutions are prohibited from granting any form of assistance on payment accounts or from funding the balance of a payment account with telephone recharge units or any other form of value other than legal tender with discharge value.

The payment account must never present a debit balance.

Article 22: Payment institutions may open, for the benefit of merchants accepting proximity or remote payments, including via mobile phone, transition payment accounts known as "merchant accounts," which are not subject to the caps provided for in Article 17 of this circular.

This account is credited exclusively with operating flows generated by payment transactions accepted by the merchant and collected on their account opened with the concerned payment institution.

The payment institution must conclude an agreement with the merchant setting out their rights and obligations, in particular the operating procedures of the account as well as the conditions for its closure.

The model of the agreement must be transmitted to the Central Bank of Tunisia.

Article 23: Funds credited to client payment accounts and merchant accounts held by the institution must be accounted for in a manner allowing their distinct identification from the institution's own funds and other operating funds.

These funds must be deposited in a single global account opened by the payment institution with a bank authorized to receive deposits, no later than the next business day following their receipt.

Commissions received by the payment institution for payment services must not be accounted for at the level of the global account.

Article 24: The global account must satisfy the following conditions:

• Be subject to a "global account agreement," duly signed by the payment institution and a depositary bank, specifying in particular the operating procedures of the global account, the conditions for fund management by the bank, the procedures for informing the payment institution about movements made on the global account, and the remuneration applicable to this account.
• Present, at all times, a balance equal to the sum of the balances of all client payment accounts and merchant accounts opened with the payment institution.
• Be dedicated to exclusive use, prohibiting any use of the funds deposited therein for the financing of the payment institution's operating needs.
• Be distinct and separate from accounts opened by the payment institution for its own needs.

The payment institution must have at all times a detailed breakdown of the global account by holder of client payment account and merchant account and by balance.

Article 25: Any payment institution is required to ensure, in a regular and documented manner, the reconciliation between the balance of the global account and the sum of the balances of client payment accounts and merchant accounts opened on its books.

Title Five
Of Agencies, the Use of Payment Agent Networks, and Partnerships

Article 26: Any payment institution must, in the course of its activity, open at least one agency.

The agencies of payment institutions may provide all services provided for in Article 2 of this circular.

Any opening, closure, or transfer of an agency by a payment institution must meet the minimum requirements set forth in the specifications document attached as Annex No. 5 to this circular.

Article 27: Payment institutions may mandate, under their responsibility and for their own account, legal entities or natural persons with the status of merchant and exercising their activities in accordance with the legislation and regulations applicable to them, in order to provide certain payment services.

Article 28: Payment institutions may mandate two categories of payment agents:

a- Principal payment agents who can only provide the following services:

• Opening of level 1 and level 2 payment accounts as defined in Articles 15 and 17 of this circular.
• Cash deposit and withdrawal operations on payment accounts opened with the institution.
• Fund transfer operations performed by cash handover.
• Payment operations performed by any remote communication means, even when these operations require cash handover for their execution.
• Marketing of any electronic payment instrument backed by the payment account issued by the payment institution.
• Making funds available from abroad via cross-border money transfer companies.

b- Retail payment agents who can only provide the following services:

• Opening of level 1 payment accounts, as defined by Articles 15 and 17 of this circular.
• Cash deposit and withdrawal operations on payment accounts opened with the institution.
• Fund transfer operations performed by cash handover.
• Payment operations performed by any remote communication means, even when these operations require cash handover for their execution.

Article 29: Payment institutions may, in the course of their activities, conclude commercial or technical partnerships with legal entities possessing a distribution network, specialized skills, or technological infrastructure.

The conclusion of any partnership is subject to prior authorization from the Central Bank of Tunisia.

In the context of these partnerships, payment institutions are required to respect the following requirements:

• Ensure strict segregation between the information systems of the payment institution and those of the partner, in order to guarantee effective separation between the activities of the institution and those exercised by the partner.
• Ensure strict separation and protection of the institution's client funds against any use for purposes other than the provision of services provided for by this circular, as well as against any seizure or set-off measures related to the partner's own activities.
• Guarantee the confidentiality, integrity, and security of clients' personal data and ensure that their use is strictly limited to the purposes for which they were collected.
• Prohibit the partner from using any names, signs, communications, materials, or processes likely to create, in the minds of third parties, confusion regarding the exercise of a banking activity or the status of payment service provider.
• Ensure clear and transparent information to clients regarding the identity of the payment institution as a payment service provider, applicable tariff conditions, and recourse channels in case of dispute.
• Put in place the necessary devices to ensure the continuity of services provided to clients and limit risks resulting from partner failure.

Any partnership must be formalized by a written agreement specifying in particular the roles and responsibilities of the contracting parties, control and monitoring procedures, commitments regarding regulatory compliance, security, and data protection, as well as the conditions for termination of the partnership.

The agreement must further stipulate that the payment institution's clients cannot be held responsible for acts or failures attributable to the partner entity.

Article 30: Payment institutions may, within the framework of partnerships, issue co-branded cards.

Clients must be informed, in a clear and transparent manner, of the card's characteristics, the identity of the issuing payment institution, the role of each party, as well as the conditions of use, pricing, and complaint handling.

Any communication relating to issued co-branded cards must be clear, fair, and non-misleading, and must not mislead regarding the identity of the issuing institution.

The payment institution remains solely responsible for the issuance of payment instruments as well as for compliance with all applicable legal and regulatory obligations.

Article 31: Payment institutions must define and implement a policy governing the use of payment agents, which covers in particular the selection, training, control, and profile of these agents.

Article 32: Before entering into a relationship with principal payment agents and retail payment agents, the payment institution must ensure:

• Their honorability and the absence of any legal impediment opposing the exercise of the merchant activity.
• The adequacy of their human, technical, and financial resources.
• Their ability to comply with regulatory provisions regarding the provision of services for which they are mandated.

The payment institution must ensure permanently that principal payment agents and retail payment agents apply the same level of requirement as the payment institution itself regarding client identification.

The payment institution that uses payment agents remains fully responsible, vis-à-vis its clients, the Central Bank of Tunisia, and third parties, for acts carried out by its agents in the course of providing the services for which they are mandated.

Article 33: The payment institution must conclude an agreement with its principal and retail agents that sets out at minimum:

• The services offered by payment agents.
• The liability of payment agents.
• The obligations of the payment institution towards payment agents regarding training, implementation of procedures, documents, materials, and technical means necessary for the provision of services for which they are mandated.
• The procedures for control exercised by the payment institution on payment agents.
• The procedures for remuneration of services offered by payment agents on behalf of the payment institution.
• The prohibition for a principal payment agent or a retail payment agent to delegate or transfer their mandate to another payment agent or any other person.

Article 34: The payment institution may only mandate payment agents who open an "agent account" on its books, which operates according to the following rules:

• The agent account is intended exclusively to execute the services listed in Article 29 of this circular.
• Credit facilities granted by the payment institution on the agent account are prohibited.
• The agent account must never present a debit position.
• The agent account is distinct and separate from the merchant account referred to in Article 23 of this circular. When the same person holds the status of payment agent and merchant accepting proximity or remote payments, including mobile payment, they are required to open two distinct accounts, with separation and traceability of flows specific to each activity.

The payment institution is required to take necessary measures to ensure that the services listed in Article 29 of this circular are executed only within the limit of the available credit balance on the agent account.

The cap rules listed in Article 17 of this circular are not applicable to the agent account.

Article 35: Payment institutions must ensure that payment agents clearly inform the public of their status as payment agents, as well as the identity of the payment institution or institutions for whose account they act.

Article 36: Payment institutions are required to:

• Put in place, for the benefit of any payment agent or partner, a mandatory and continuous training program aimed at maintaining and improving their qualifications in the exercise of activities mandated or entrusted to them.
• Put in place an audit program for agents and partners based on a risk-based approach, covering in particular:
• Compliance with vigilance and client identification rules.
• Compliance with operational and regulatory procedures.
• Quality of service provided to clients.
• Compliance of operations performed with authorized services.

To this end, payment institutions are required to transmit to the Central Bank of Tunisia a report approved by the board of directors or supervisory board, including the preliminary audit program for agents or partners, the status of its implementation, the main conclusions of missions carried out, as well as corrective measures taken and those planned with their implementation deadlines.

• Terminate any mandate with a payment agent or partner in case of deficiencies or serious failures observed following controls or audits, take without delay all necessary measures to control identified risks and, if necessary, redirect operations to other agents or partners, as well as inform affected clients about measures taken and inform the Central Bank of Tunisia.

Title Six
Client Protection Device and Complaint Handling

Article 37: Without prejudice to the provisions of Article 84 of Law No. 2016-48, payment institutions must adopt a marketing and pricing policy based on the principles of transparency, fairness, and client protection.

To this end, they are required to:

• Provide, prior to any subscription, clear and accessible information regarding offered services and applicable tariffs, and prohibit any practice likely to mislead the clientele.
• Ensure that information, contractual documents, communication materials, and tariff grids are presented in a clear and appropriate manner, in particular for persons with specific needs and illiterate persons.
• Put in place an equitable pricing policy based on the added value of services and proportionate to costs incurred as well as the quality of services provided.
• Guarantee the protection of personal data, in accordance with current legislation.

Article 38: Payment institutions must adopt a communication policy towards clientele based on the principle of transparency.

To this effect, they are required to set rules and procedures guaranteeing:

a) Prior to the execution of the transaction:
Communication to the client of the transaction status, its amount, as well as associated commissions and taxes.

b) Subsequent to the execution of the transaction:
Communication to the client of the outcome of the transaction, its amount, associated commissions and taxes, as well as the new balance of their payment account and the transaction reference number.

c) Periodic information:
Making available to the client, by any appropriate means, a statement of operations performed on the payment and merchant account, according to the modalities provided in the account agreement.

d) Permanent information:
Making available to the public, at the level of their entire network, as well as at the level of their principal and retail payment agents, all information regarding applicable tariff conditions, by category of operation.

Article 39: Without prejudice to the provisions provided for by Circular No. 2020-11 of May 18, 2020, relating to the conditions for providing domestic mobile payment services, payment institutions are required to put in place:

• Clear policies and procedures for receiving and handling client complaints.
• A structure responsible for handling client complaints.
• Clear policies and procedures for handling payment accounts of deceased persons in compliance with current legislative provisions.

Article 40: Any operation performed by a payment institution, through its agencies or agents, must result in the production of an electronic or, where applicable, physical receipt, which must in particular include:

• The date of the operation.
• Elements allowing the identification of the order giver.
• Elements allowing the identification of the beneficiary.
• The amount of the operation.

Article 41: The payment institution must inform its clients of any decision to suspend a product or service at least one month before its effective date by any means leaving a written trace and on its website.

Article 42: Authorized payment institutions are registered in a registry kept for this purpose by the Central Bank of Tunisia.

The Central Bank of Tunisia publishes on its website the list of authorized payment institutions, information regarding services provided, the address of their agencies, and the identity of their partners as well as their payment agents and the payment services for which they are mandated.

Title Seven
On Information and Relations with the Central Bank of Tunisia

Article 43: Prior to the commercialization of any product or service and any tariff revision, payment institutions must submit to the Central Bank of Tunisia a file containing at least:

• A descriptive sheet detailing the objective of launching the product or service, its main characteristics, its pricing conditions, and the associated procedure note.
• An assessment of the risks associated with the product or service and the modalities for their mitigation.
• A copy of the residual risk assessment report for money laundering or terrorist financing associated with the use of new technologies, in accordance with Article 20 of Circular No. 2017-08 of September 19, 2017, as amended and supplemented by subsequent texts.
• A report signed by the compliance control officer of the establishment concerned, attesting that the contractual documents of the product or service do not contravene current legislation and regulations.
• A note describing the pricing criteria and the underlying reasons for the tariff revision or the establishment of the commission in terms of added value offered to the clientele.
  Any decision ending the commercialization of a product or service must be subject to prior notification and motivated explanation to the Central Bank of Tunisia.

Article 44: Any partnership agreement with cross-border money transfer companies, in the context of providing fund availability services from abroad, is subject to the prior authorization of the Central Bank of Tunisia.
To this end, payment institutions must ensure that cross-border money transfer companies apply the necessary due diligence regarding the identification of clients and, where applicable, their beneficial owners, and they must, for this purpose, have access to all information on the ordering party.

Article 45: Payment institutions are required to transmit to the Central Bank of Tunisia, prior to their adoption, the standard models of mandate contracts to be concluded with payment agents and any project for modification or revision of these models. The Central Bank of Tunisia may oppose the adoption of the standard contract model within a period of one month from the date of its communication.

Article 46: In application of Article 8 of this circular, nomination files to be transmitted to the Central Bank of Tunisia must include:

• A letter of motivation signed by the chairman of the board of directors or supervisory board, detailing notably the reasons for the choice of the person in question, their expected contribution to strengthening the collective skills of other members of the board of directors or supervisory board or the management body.
• A detailed curriculum vitae of the designated person.
• A copy of an identity document of the designated person.
• An extract of the criminal record of the designated person issued less than 3 months ago.
• A sworn declaration signed by the designated person, attesting that they are not subject to legal prohibitions, established according to the model in Annex No. 6 to this circular.
• A sworn declaration signed by the chairman of the board of directors or supervisory board, attesting that the designated person is not in a situation of conflict of interest.
  The Central Bank of Tunisia may, as part of the examination of this file, request payment institutions to communicate any additional information or document it deems useful, within a period not exceeding fifteen (15) days from the date of receipt of the file.

Article 47: Prior to the launch of any partnership within the meaning of Article 30 of this circular, payment institutions are required to submit to the Central Bank of Tunisia an authorization request accompanied by a file containing at least the following elements:

• Identification of the partner, including its shareholding structure, governance bodies, activity, experience, as well as its technical, financial, and organizational capacities in the areas concerned by the partnership.
• A note explaining the object of the partnership, the business model specifying notably the remuneration modalities of the parties, the services to be commercialized, the objectives pursued, as well as the expected benefits for the payment institution and its clientele.
• A forecast business plan covering at least the first three years of the partnership, highlighting notably the assumptions retained, the commercial objectives pursued, activity projections, and associated financial forecasts.
• A risk map inherent to the partnership as well as the measures provided for their identification, assessment, and control.
• A description of the operational modalities for implementing the partnership, including the technical, organizational, and internal control devices envisaged.
• The measures provided for to guarantee the protection of personal data, the confidentiality of information, as well as the security of information systems.
• The modalities for monitoring, control, and audit of the partner by the payment institution, as well as, where applicable, by the Central Bank of Tunisia.
• The devices provided for to ensure service continuity as well as the conditions governing the cessation of the partnership.
• The draft convention linking the two parties, clearly specifying the rights and obligations of each.
  The Central Bank of Tunisia may request any additional document or information it deems useful for the processing of the file.

Article 48: Each payment institution must communicate to the Central Bank of Tunisia at least one month before the holding of its general meeting the report of the statutory auditors as part of their mission to evaluate the internal control device implemented by the payment institution in application of the provisions of this circular.
The aforementioned report must particularly focus on the following control points:

• The procedure for ring-fencing client funds in the global account and the conditions for its implementation.
• The device for combating money laundering, terrorist financing, and the proliferation of weapons of mass destruction.
• The operational risk management device.
• The client complaint management device.

Article 49: Payment institutions are required to comply with the provisions of Circular No. 2017-6 on accounting, prudential, and statistical reporting.
A new annex titled "Annex No. 1bis on reporting by payment institutions" is added to Circular No. 2017-6.
Payment institutions must communicate reporting to the Central Bank of Tunisia in accordance with Annex No. 1bis to Circular No. 2017-6 of July 31, 2017.

Article 50: In the event of unavailability of the Data Exchange System (SED), payment institutions must transmit their declarations to the following email address: reporting.EP@bct.gov.tn

Article 51: This circular repeals and replaces Circular No. 2018-16 of December 31, 2018, on the rules governing the activity and functioning of payment institutions, and enters into force within a period of three months from the date of its publication.

The Governor,
Fethi Zouhaier Nouri

Annex 1 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
CLIENT IDENTIFICATION ELEMENTS FOR HOLDERS OF LEVEL 1 PAYMENT ACCOUNTS

• Name and first name
• Date and place of birth
• Nationality
• Profession
• Phone number
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address if different from the national identity card
• Estimated monthly income

Annex 2 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
CLIENT IDENTIFICATION ELEMENTS FOR HOLDERS OF LEVEL 2 PAYMENT ACCOUNTS I- For natural persons

• Name and first name
• Date and place of birth
• Nationality
• Profession
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address
• Estimated monthly income
  II - For legal entities
• Trade name or company name
• Registered office address
• Legal form
• Mandates and powers (Name, first name of the person authorized to operate the account and signature specimen)
• Recent extract from the national business register
• Beneficial owner(s)
• Any element allowing assessment of the financial situation

Annex 3 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
CLIENT IDENTIFICATION ELEMENTS FOR HOLDERS OF LEVEL 3 PAYMENT ACCOUNTS I- For natural persons

• Name and first name
• Date and place of birth
• Nationality
• National identity card number or passport number or residence card number or any identity document issued by a recognized foreign authority
• Official address
• Profession practiced
• Declaration of the source of income
  II - For legal entities
• Trade name or company name
• Registered office address
• Legal form
• Nature of activity
• Recent extract from the national business register
• Mandates and powers (Name, first name of the person authorized to operate the account and signature specimen)
• Any element allowing assessment of the financial situation
• Beneficial owner(s)

Annex 4 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
IDENTIFICATION ELEMENTS FOR MERCHANT ACCOUNT HOLDERS I- For merchant natural persons

• Name and first name
• Date and place of birth
• Nationality
• National identity card number or passport number
• Official address and commercial activity address (if different)
• National Business Register Identifier
• Source of income related to the activity
• Beneficial owner
  II - For merchant legal entities
• Trade name or company name
• Legal form
• Corporate object, nature of activity, and sector of activity
• Registered office address
• National Business Register Identifier
• Identity of the legal representative(s) and persons authorized to operate the account
• Mandates and powers
• The beneficial owner(s)
• Any element allowing assessment of the financial situation
• Geographic area of activity
• Expected transactional profile (12 months)

Annex 5 to the Circular of the Central Bank of Tunisia No. 2026-10 of September 25
SPECIFICATIONS SETTING THE CONDITIONS FOR OPENING, CLOSING, AND TEMPORARY OR PERMANENT TRANSFER OF AGENCIES BY PAYMENT INSTITUTIONS
Article 1: Payment institutions are required to declare to the Central Bank of Tunisia any operation of opening, temporary or permanent closure, or transfer of any agency on a temporary or permanent basis at least fifteen (15) working days in advance.
The declaration of these operations is made in accordance with the declaration models 1 and 2 attached to this annex.
Article 2: Prior to any temporary or permanent closure or any permanent or temporary transfer operation of the agency, payment institutions are required:

• To establish useful organizational measures to take charge of funds received from clients at the agency and to process them in accordance with a procedure manual developed for this purpose by the payment institution.
• To inform their clients individually by any means leaving a written trace and on their website, at least forty-five (45) days before the date of closure or transfer.

TITLE I: CONDITIONS FOR IMPLANTATION AND LAYOUT
Article 3: The premises housing the agency must be identifiable by the public and located in an easily accessible site.
Article 4: Without prejudice to the conditions required under current legislation and regulations regarding public reception spaces, the premises must be located in an appropriate place away from constructions and equipment likely to present a source of risk (fuel or gas deposits....).
Article 5: The surface area of the agency must be adapted to the volume of activity and must, in no case, be less than twenty (20) square meters. The shape of the premises must be functional.
Article 6: The premises housing the agency must have:

• A reception area for clients and counters to offer payment services to the public visible upon entering the premises;
• Appropriate arrangements guaranteeing accessibility and easy circulation for persons with specific needs, as well as easy access to the services offered by the agency;
• An independent space for the head of the agency.
  The cash register must be located away from client access, and the funds deposited there must be out of public view.

TITLE II: SECURITY CONDITIONS
Article 7: Payment institutions must take all security measures related to the protection of persons and the agency premises. To this end, they must ensure that the premises are permanently connected to the police station by a specialized telephone line.
Article 8: Payment institutions must have a procedure manual for agency security describing notably:

• The instructions to apply to alert the police in case of justified concerns or in case of aggression;
• The conditions for opening and closing doors;
• The conditions for verifying the proper functioning of security installations, access, and the alarm device;
  The procedure manual must be made available to the agency staff.
  Article 9: The head of the agency must possess the professional qualifications and skills necessary for the effective management of an agency.
  The payment institution ensures that the staff of its agencies receive adequate and continuous training, notably in combating money laundering and terrorist financing and the proliferation of weapons of mass destruction. The payment institution must assign at least two persons per agency, including the head. Staff must be initiated in the use of security means and their operation in case of necessity.
  Article 10: The agency must be equipped with a safe conforming to Tunisian standards and which must in all cases be connected to the security system.
  Article 11: Prior to the opening of any agency, the payment institution must submit the security device to an external audit. A copy of the audit report must be sent to the Central Bank of Tunisia.

DECLARATION MODEL No. 1:
OPENING OF AN AGENCY
Implantation Site:
Governorate:……………Delegation:……………………………… Commune:……………...…………… Coordinates:
Address:…………………………………………………………..…………………..……………………………………………….
Postal code:………………………………….………………………………...……....…………………………………………….
E-mail:………………………………………………………………………...……………………………………………………......
Telephone:…………………………………………….
Staff:………………………………………………………………………………………………………………………………..
Head of Agency:
Name:…………………………………………………………………………………………………………………………………….
First name:…….………………….………….….………..……………..…………………………………………………………………..
Education level:………………………………
University diploma:………….…………………
Year of obtaining university diploma:……………………...…………………………………………………… Professional experience:…………………………………….……………………………….……… Layout of premises:
Surface area:………..
Form of exploitation of premises: For rent Owned Envisaged operations ……………………………………………………………………………………………………………………………………… Specify if the agency will exercise the activity of manual exchange yes no Working hours: ……………………...……………………………………………………………… Authorized stamp and signature (Name and function of signatory)

DECLARATION MODEL No. 2:
CLOSURE OF AN AGENCY
Date of opening: ……………………...…………………………………………………………………………………………..
BCT Identifier (agency code): ……………………...………………………………………………………………..
Implantation Site: ……………………...……………………………………………………………………………………….
Governorate: …………………… Delegation: ……………………… Commune: …………………..
Last indicators related to the activity of the agency subject to closure declaration:
Number of accounts (by level): …………………………………………………………………………….
Number of clients: …………………………………………………………………………………………………….
Reasons for closure:
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………… Procedures put in place to preserve the interests of the clientele of the agency subject to closure ………….……………………………………………………………………………………………………………………………….. ………….……………………………………………………………………………………………………………………………….. ………….………………………………………………………………………………………………………………………………… Authorized stamp and signature (name and function of signatory)

DECLARATION MODEL No. 3:
TRANSFER OF AN AGENCY
Date of opening: ……………………...………………………………………………………………………………………… BCT Identifier (agency code): ……………………...……………………………………………………………… Implantation Site: ……………………...………………………………………………………………………………….. Governorate: ………………….. Delegation: …………………… Commune: …………………….. Last indicators related to the activity of the agency subject to transfer declaration:
Number of accounts (by level): ………………………………………………………………………….
Number of clients: ………………………………………………………………………………………………… Reasons for transfer:
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………..
………….………………………………………………………………………………………………………………………………… Authorized stamp and signature (name and function of signatory)

Annex 6 to the Circular of the Central Bank of Tunisia No. 2026-
2010 of September 25, 2026
SWORN DECLARATION
I, the undersigned Mrs./Miss/Mr …. ………………. ………………. holder of the national identity card or passport No. : ………………..…………… issued at…………………………………. on ……………….……………… and designated as ……………………. by decision of ……. …on date of….. declare under oath that:

• I have not been the subject of a final judgment for forgery, theft, breach of trust, fraud, extortion of funds or third-party assets, subtraction committed by a public depositor, corruption or tax evasion, issuance of a check without funds, handling of goods obtained through these offenses or offense to exchange regulations or legislation relating to the fight against money laundering and terrorist financing and the proliferation of weapons of mass destruction,
• I have not been struck by a final judgment of bankruptcy,
• I have not been manager or agent of companies, convicted under the provisions of the Penal Code relating to bankruptcy,
• I have not been dismissed from administrative or management functions of a company subject to the control of the Central Bank of Tunisia or by one of the authorities responsible for the control of the financial market or insurance and reinsurance companies or micro-finance institutions, pursuant to a sanction imposed by these authorities,
• I have not undergone a sanction of radiation in the exercise of a professional activity regulated by a legal or regulatory framework,
• I have not been responsible for the poor management of a bank or financial institution that caused difficulties that made it necessary to submit the bank or financial institution to a resolution plan or liquidation.
• I am not in one of the situations of prohibition and incompatibility provided for by current legislation and notably Law No. 2016-48 of July 11, 2016 and notably its articles 46, 57 and 58.
  Made at ………..on …………
  Signature

Annex No. 1bis to Circular No. 2017-6 of July 31, 2017, on accounting, prudential, and statistical reporting to the Central Bank of Tunisia

Domain	Declaration Code	Declaration Title	Declaration Periodicity	Maximum Transmission Deadline	Format / Transmission
Accounting Reporting	RCT03	Accounting Situation (Balance Sheet)	Quarterly	D+30	XML
	RCT04	Income Statement	Quarterly	D+30	XML
Activity-Related Reporting	RAM05	Commercial Indicators	Monthly	D+15	XML
	RAM06	Statement of operations by channel in number and amount	Monthly	D+15	XML
	RAT07	List of own agencies and mandated agents	Quarterly	D+30	XML
	RAA10	Distribution of complaints received from clients by reception channel	Annual	D+45	XML
	RAA20	Statement of complaints received broken down by object, deadlines, and follow-up	Annual	D+45	XML
	RAA783	Tariff schedule	Annual	D+45	PDF
Statistical Reporting	RST650	Sectoral distribution of the main items of the asset of the accounting situation	Quarterly	D+30	XML
Reporting on Governance, Internal Control, and Risk Management Devices
Governance	RGT240140	Minutes of board of directors meetings	Quarterly	D+30	PDF
	RGT240150	Minutes of audit and risk committee meetings	Quarterly	D+30	PDF
	RGA210	Capital structure	Annual	D+45	XML

RGA220 Information on governance structures Annual DR+45j XML RGA230 Information on control structures Annual DR+45j XML RGA 240009 Note on the development strategy validated by the board of directors for a period of 3 years Annual DR+45j PDF RGA240020 Annual Report Annual DR+45j PDF RGA240030 Articles of Association Annual DR+45j PDF RGA240050 Organizational Chart Annual DR+45j PDF RGA240190 Signed minutes of the AGM for the relevant fiscal year Annual DR+45j PDF

Internal control, risk management, audit and compliance RCIA250100 Annual audit report on information system security Annual DR+45j PDF RCIA250110 Global account contract with the bank Annual DR+45j PDF RCIA250120 Segregation procedure validated by the Board of Directors Annual DR+45j PDF RCIA250130 Insurance contract or bank guarantee Annual DR+45j PDF RCIA250140 Annual report on the activities of the risk management body for the fiscal year Annual DR+45j PDF RCIA250150 Annual report on the activities of the compliance monitoring body for the fiscal year Annual DR+45j PDF RCIA250160 Annual report on audit work Annual DR+45j PDF

Operational risk reporting
RROS370 Report on service supply disruption incidents and their management Semi-annual End of August PDF RROI380 Preliminary declaration form for immediate reporting of serious incidents In case of serious incident Day of the incident XML

RROI381 Closing form for serious incidents In case of serious incident Date of incident + 10 days RROT390 Quarterly declaration of incidents Quarterly DR+30j XML

Reporting related to the AML/CFT/FP framework
RLABFTA310 Statistics on suspicious transaction reports (Annex 5 to Circular No. 2017-08 as amended by subsequent texts) Annual DR+45j XML RLABFTA320 Questionnaire on the AML/CFT/FP framework Annual DR+45j PDF RLABFTT330 Quarterly statement on frozen assets under UN and national sanctions (Annex 6 to Circular No. 2017-08 as amended by subsequent texts) Quarterly DR+30j XML RLABFTA350 Risk assessment report on money laundering and terrorist financing of the institution covered by Article 4 of Circular No. 2017-08 as amended by subsequent texts Annual DR+45j PDF

Reporting reviewed by statutory auditors
RCACA150 General report on individual financial statements Annual one month before the holding of the AGM PDF RCACA170 Special report under Article 200 of the Commercial Companies Code Annual one month before the holding of the AGM PDF RCACA260 Report on the internal control system as referred to in Article 49 of this Circular Annual one month before the holding of the AGM PDF