The Central Bank of Cyprus (“CBC”) issued a Circular Letter requiring all licensed Payment Institutions (“PIs”) and Electronic Money Institutions (“EMIs”) to submit an independent assurance report regarding compliance with client funds safeguarding requirements.
With a regulatory submission deadline of 30 September 2026, early preparation is essential to identify potential control gaps and ensure a seamless submission. Early engagement allows a gap analysis phase, enabling remediation of any control deficiencies before the formal testing period begins and reducing the risk of a qualified opinion. The assurance engagement must be performed by an independent third-party statutory auditor in accordance with ISAE 3000 (Revised) and assess the adequacy and effectiveness of safeguarding controls and procedures.
Who must comply?
This mandatory regulatory review applies to:
- Electronic Money Institutions (“EMIs”)
- Payment Institutions (“PIs”)
Regulated fintech platforms, payment orchestrators, investment firms, and custodians holding client funds also rely on this framework to establish institutional trust.
Scope of review
In line with the CBC’s thematic review and ICPAC guidelines, the assurance engagement evaluates the design and operating effectiveness of the safeguarding framework across key areas, including:
- Governance and internal controls
- Safeguarding methods and procedures
- Client funds reconciliations and monitoring processes
Submission deadline
The submission deadline to the CBC is 30 September 2026.
Early preparation may assist institutions in identifying potential control gaps, strengthening safeguarding frameworks, and ensuring a smooth assurance process ahead of the submission deadline.
How can SPL Audit assist?
SPL Audit Cyprus provides independent assurance and advisory services to support PIs and EMIs in meeting the CBC safeguarding requirements.
Our services include:
- ISAE 3000 assurance engagements
- Readiness and gap assessment reviews
- Evaluation of safeguarding frameworks and controls
- Review of reconciliations and governance arrangements
- Support in identifying remediation actions prior to formal reporting
Should you wish to discuss the above requirements or understand how the CBC Circular Letter may affect your organisation, you may contact our Advisory Department at SPL Audit Cyprus. We will be pleased to assist you in assessing any actions that may be required. Contact us here.
Estimated reading time: 2 minutes