PSD2 Compliance for Cyprus and Malta Fintechs: A Practical Guide

Payment-services compliance depends on the service, institution and applicable national implementation. PSD2 and the electronic-money framework must be considered alongside current amendments and other relevant rules. This guide does not predict when proposed PSD3 or PSR provisions will apply.

Check the operating model against the source

Identify the applicable authorisation or registration route and competent authority. Do not assume small-institution exemptions are available in every country or that the same capital requirement applies to every activity.

Review strong customer authentication, exemptions and dynamic linking against PSD2 and Delegated Regulation (EU) 2018/389. Dynamic linking concerns the relevant remote electronic payment transactions, not every conceivable payment. Test the actual authentication journey and applicable exception.

Review safeguarding, access interfaces, operational risks and fraud reporting against the relevant law and authority instructions. A generic 99.5% interface-availability target is not presented here as a universal statutory rule. Confirm proposed reforms from current official legislative material before planning deadlines.

Illustrative product example: a payments policy briefing

Evaluate Lexis+ for relevant legislation and commentary and Lexis Create for preparing a reviewed policy document within Microsoft 365. Confirm the edition and exact sources. These products are not demonstrated here as payment authentication, safeguarding reconciliation, fraud monitoring or national regulator-reporting systems.

Official sources and product scope

PSD2 · SCA standards: Regulation (EU) 2018/389 · Central Bank of Cyprus · MFSA

Product references: LexisNexis legal AI (US) · Lexis+ legal research (UK) · Lexis Create+ (US) · Nexis Diligence+ (UK). Product names, features and content vary by edition and market; the site uses its existing product labels. These sources describe product categories, not confirmed local-law coverage.

Reviewed 17 October 2026. Examples are illustrative evaluation scenarios, not customer case studies. General information, not legal advice. Check current consolidated law, technical standards and competent-authority instructions before relying on a rule. Confirm jurisdiction, language, content licence, feature availability and security terms in the proposed subscription. Software does not certify regulatory compliance.

Discuss your team’s next step

Tell us your jurisdiction and one priority task. Request a 30-minute product walkthrough using public or anonymised material; do not send confidential client documents with your enquiry. We will scope the relevant research, drafting or due-diligence demonstration and confirm coverage and limitations.

Request a tailored demo