e-KYC and AML in Tunisia: Remote Onboarding Rules

Tunisia now has written rules for e-KYC, letting customers open an account without visiting a branch: one circular for banks in February 2025 and one for payment institutions in September 2026. Both sit on top of an anti-money laundering (AML/CFT) framework that is getting stricter as the country heads into a new international evaluation. For fintechs, remote onboarding is now legal, but it comes with audit, testing and reporting requirements.

The AML/CFT foundation

Tunisia's anti-money laundering rules come from Organic Law No. 2015-26 of 7 August 2015 on combating terrorism and suppressing money laundering, amended by Organic Law No. 2019-9 of 23 January 2019. The law requires banks, payment institutions, brokers and other obliged entities to identify customers, monitor transactions and report suspicions.

Reports go to the Commission tunisienne des analyses financières (CTAF), Tunisia's financial intelligence unit. Since 2021, suspicious transaction reports (STRs) have been filed through the goAML platform. The Central Bank of Tunisia's (BCT) Circular No. 2017-08 on customer identification remains the reference for verifying identity.

International pressure

• The European Parliament added Tunisia to the EU list of high-risk countries in February 2018, according to North Africa Post.
• The Financial Action Task Force (FATF) removed Tunisia from its list of jurisdictions under increased monitoring at its October 2019 plenary.
• In its 2020 follow-up report, the FATF rated Tunisia compliant or largely compliant on 36 of its 40 Recommendations, with no "non-compliant" rating.
• In June 2025, the CMF said Tunisia would undergo a MENAFATF mutual evaluation during 2025-2026.

That evaluation explains the tighter supervision of recent years. A weak result could raise the cost of correspondent banking for every Tunisian financial institution, fintechs included.

The numbers: suspicion reports rising fast

According to the CTAF's 2024 activity report, as reported by WMC and La Presse:

• The CTAF received 1,236 STRs in 2024, up 45% on 2023.
• Payment institutions filed 119 STRs, up from 4 in 2023. The CTAF links this mainly to international money transfer products exposed to migrant-smuggling networks.
• Among processed files, more than 61% concerned migrant smuggling and 15% sports betting.
• The CTAF flags digital technologies, especially crypto-assets, as a growing risk (see crypto regulation in Tunisia). Its national risk assessment update includes payment institutions for the first time.

The message for fintechs is that supervisors now see them as a real AML exposure.

Banks: Circular 2025-06 on electronic enrolment

On 28 February 2025, the BCT published Circular No. 2025-06, setting minimum rules for banks' electronic customer enrolment, after an opinion from the compliance control committee. Its six chapters and 18 articles require banks to:

• use an automated or semi-automated process to collect, verify and store identification data;
• reach a level of identity assurance at least equivalent to an in-person check under Circular 2017-08;
• apply due diligence proportionate to each customer's risk profile;
• rely on technologies such as facial recognition and biometrics, and keep the rate of wrongly accepted identities low, measured with a formula the circular defines;
• encrypt KYC files, store identity documents securely and check their integrity regularly;
• test the technology before deployment, keep a performance register and maintain procedures for fraud attempts.

Payment institutions: Circular 2026-10

On 25 September 2026, the BCT issued Circular No. 2026-10 on payment institutions, replacing Circular 2018-16. According to Managers, it takes effect three months after publication. It explicitly allows remote onboarding if verification is at least as strong as in-person identification:

• checks on the authenticity of identity documents and the customer's actual presence (liveness);
• at least two-factor authentication;
• explicit consent to personal data processing;
• pre-production tests, intrusion tests and security audits by bodies accredited by the national cybersecurity agency (ANCS), then audits at least every two years and after major changes.

KYC is tiered: the higher the account level, the more information is collected, with caps shown in the chart below. Cash withdrawals are limited to TND 3,000 a day at level 2 and TND 10,000 at level 3. A person can hold only one payment account per institution. For the wider licensing picture, see our guide to payment institutions in Tunisia.

What this means for fintech founders

• Remote onboarding is a regulated product, not a feature. Budget for ANCS-accredited audits, intrusion tests and periodic re-certification.
• Design for tiers. A light level-1 account lets mobile wallets onboard users quickly. Higher limits require full due diligence.
• Biometrics are personal data. Explicit consent, encryption and storage rules overlap with data protection obligations.
• Monitoring matters as much as onboarding. The jump in payment-institution STRs shows supervisors expect transaction monitoring, especially on cross-border flows.
• Vendors are your responsibility. Whether you use a local or foreign e-KYC provider, testing, audits and incident handling stay with the licensed institution.

With the MENAFATF evaluation underway, expect supervisors to check how these rules are applied in practice, not just on paper.