Cybersecurity in Tunisia's Financial Sector: The New Rules

Cybersecurity in Tunisia's financial sector has moved from a technical topic to a regulatory requirement. With mobile payments growing fast and remote onboarding now allowed, the Central Bank of Tunisia (BCT) and the National Cybersecurity Agency (ANCS) are setting firmer rules on audits, incident reporting and identity checks. For fintechs, security is now part of the licence, not an optional extra.

Why the risk is rising

The attack surface of Tunisian finance is expanding quickly. According to BCT figures for 2025 reported by La Presse, mobile payment transactions rose 80.5% to 8.4 million, e-wallets in circulation reached 469,000 and online payments grew 31% in value. Banks are also replacing core systems and opening new digital channels.

The regulator is aware of the risk. Speaking at the Africa Banking Forum in Tunis in February 2025, BCT Vice-Governor Mourad Abdessalem listed the rise of cyber threats among the emerging risks that financial stability must withstand, and called for closer cooperation between central banks.

Public data on cyber incidents in Tunisian financial institutions is scarce, so it is hard to measure the threat precisely. What is clear is that regulation is catching up.

The legal framework for cybersecurity in Tunisia's financial sector

Three layers of rules apply to banks and fintechs.

National cybersecurity law

Decree-law 2023-17 on cybersecurity, issued in 2023, is the national framework. It is administered by the ANCS (Agence nationale de la cybersécurité); some reports still refer to the agency by its former acronym, ANSI. The decree-law covers security audits and the accreditation of the firms that carry them out. BCT circulars now refer to it directly.

BCT rules for payment institutions

Payment institutions were first covered by circular 2018-16, which already required an annual IT security audit sent to the BCT, a tested business continuity plan and management of operational and cyber risk, according to Ilboursa.

The new circular 2026-10, published on 25 September 2026, goes further. Based on reporting by Challenges, Webdo and Launch Base Africa:

• Annual audit of information systems by an independent firm certified by the ANCS, with the report sent to the BCT.
• Immediate notification of any attack or intrusion to both the BCT and the ANCS.
• Segregation of the institution's systems from those of its partners, and protection of customer funds from partners.
• Remote onboarding only with at least two-factor authentication and a presence check by facial recognition or equivalent, with that technology audited at least every two years.
• Governance: a board-level audit and risk committee and independent risk, compliance and internal audit functions.
• Record keeping: Launch Base Africa reports that transaction logs must be kept for 10 years.

Institutions have three months from publication to comply. See our full guide to payment institutions in Tunisia.

Banks and remote onboarding

For banks, a BCT circular of 28 February 2025 sets minimum requirements for electronic customer onboarding. Remote identity verification must be at least as strong as in-person checks under circular 2017-08, and due diligence must match each client's risk. Our article on e-KYC and AML rules explains how these rules fit with anti-money-laundering obligations.

Data protection and sovereignty

Cybersecurity and data protection overlap. Personal data processing in Tunisia is governed by Organic Law 2004-63, supervised by the INPDP, a text widely seen as outdated. Read more in our article on data protection for fintechs.

A second debate concerns sovereignty. In a February 2026 opinion piece in L'Economiste Maghrébin, Abdelwaheb Ben Moussa, an IT manager at a public bank, argued that cybersecurity should be treated as part of national sovereignty: control and localisation of bank data, less dependence on proprietary foreign systems, and protection of public trust, since a major attack could slow digital adoption. These are views, not rules, but they reflect concerns inside the sector.

What this means for fintech founders

Security costs are now part of the business model. Practical steps for a Tunisian fintech:

1. Budget for audits early. An annual audit by an ANCS-certified firm is mandatory for payment institutions; book it into your financial plan.
2. Write an incident response plan that includes immediate notification to the BCT and the ANCS, not just internal escalation.
3. Choose e-KYC vendors carefully. Facial recognition and liveness tools must pass periodic audits; ask vendors for audit history and data-hosting details.
4. Segregate systems and data from partners such as telecom operators, agents and white-label providers.
5. Log everything and plan storage for long retention periods.
6. Train staff and agents, since social engineering and agent-level fraud are common entry points in mobile money markets.

For banks working with fintechs, these rules also make due diligence easier: a partner that already passes ANCS-certified audits is a lower risk.

What to watch next

• The full text of circular 2026-10, especially how the ANCS certification process works in practice.
• Enforcement after the three-month transition, which ends in late December 2026.
• Data protection reform, which would change how customer data can be stored and shared.
• AI-driven fraud and defence. As banks adopt AI, both attackers and defenders gain new tools; see our piece on AI in Tunisian banking.

Tunisia's rules are now closer to international practice. The challenge is execution: enough certified auditors, enough skilled security staff and enough budget, especially for smaller fintechs.