Central bank rewrites mobile payment rules, mandates annual cyber audits

The central bank (BCT) published circular 2026-10 on 25 September, replacing rules that had been unchanged since 2018 for mobile payment operators. Each payment institution must now have an annual cybersecurity audit carried out by a firm certified by the national cybersecurity agency, and set up its own audit and risk committee. The new rules also widen what payment accounts can do, adding direct debits and remote payments. They take effect three months after publication.

← See the full edition