Tunisia TN

Banque Centrale de Tunisie Circular 2026-10, published 25 September 2026 and confirmed on the regulator's own site, is the active-defence story of the cycle for Tunisia's payment sector. The circular repeals and replaces Circular 2018-16 and, on corroborating Tunisian press reporting, mandates an annual cybersecurity audit certified by the national cybersecurity agency ANCS for all licensed payment institutions. It further requires a board-level audit-and-risk committee, embedding technical compliance oversight at governance level rather than leaving it to operational teams alone. These requirements sit alongside a tightening of digital-KYC identification procedures, read together as a package that raises the baseline technical-control expectation for the sector rather than responding to a single incident.

The architecture-over-incident framing matters here: there is no disclosed breach or enforcement action driving this circular as reported. Instead, the BCT is acting ahead of any incident to formalise cyber-audit cadence and governance accountability, which is the kind of structural move that this monitor treats as more analytically significant than a reactive enforcement step in an already well-regulated centre. The content of the obligation -- a recurring certified audit tied to a national technical authority, plus a standing board committee -- is confirmed to exist via the T1 regulator source, though the granular detail of the audit and committee requirements rests on T3 Tunisian press corroboration rather than a retrieved primary circular text, which keeps those specifics at a probable rather than confirmed tier.

The three-month transition window, running from the 25 September 2026 publication date to approximately 25 December 2026, is the operative compliance clock. Payment institutions have that period to stand up the audit-and-risk committee and arrange the first ANCS-certified cyber audit cycle, alongside whatever digital-onboarding and identification-technology changes the circular requires. No enforcement posture for non-compliance after that date has been sourced this cycle.

Outlook

The near-term marker is the compliance deadline itself, around 25 December 2026. Confirmation of the primary circular text directly from the BCT would resolve the current gap between the confirmed fact of the circular's existence and date, and the probable-tier detail of its specific audit and governance requirements. Analysts should watch for whether ANCS publishes implementing guidance on the certification standard referenced by the circular, which would be the next concrete milestone in this compliance-technology track.

Tunisia's standing AML/CTF architecture is governed by Organic Law No. 2015-26 of 7 August 2015, as amended by Organic Law No. 2019-9, with CTAF -- housed at the Banque Centrale de Tunisie -- operating as the designated financial intelligence unit. BCT Circular No. 2017-08, as amended by Circular No. 2025-17, operationalises sector controls including goAML filing and a ten-year record-retention standard. This standing record is corroborated by third-party commentary rather than a primary text retrieved this cycle, which keeps the governing-law citation at a probable tier even though the underlying facts are well established.

Two developments this cycle sit inside this frame. First, BCT Circular 2026-10, published 25 September 2026 and confirmed directly on the BCT's own site, repeals and replaces Circular 2018-16, tightening digital-KYC identification protocols for payment institutions alongside the governance and cyber-audit measures addressed under compliance technology. This is a confirmed, structural tightening of the identification layer that underpins AML controls for the payment-institution sector specifically, with a three-month transition to roughly 25 December 2026. Second, a joint order of the Ministers of Tourism, the Interior and Finance, dated 29 January 2026, placed licensed casinos under the full Organic Law 2015-26 regime -- risk assessment, a compliance officer, staff training, independent audit, ten-year record retention and immediate suspicious-transaction reporting to CTAF -- repealing a narrower 2018 casino-specific order. This casino-sector extension rests on a single trade-press source without a retrieved primary gazette text, capping it at a probable tier, and falls outside this cycle's immediate recency window as a January dated development surfaced now.

On the international-standing axis, Tunisia is confirmed not to be among the jurisdictions on the FATF's list of jurisdictions under increased monitoring as of the 19 June 2026 Plenary statement, consistent with a 2019 follow-up mutual evaluation report that rated the country compliant or largely compliant on the substantial majority of the FATF's forty recommendations. This is independently corroborated against FATF's own published list and is the strongest-sourced finding in this domain this cycle.

Read together, the picture is of a regime enforcing and extending existing AML/CFT architecture into new sectors (casinos) and new identification technology (digital-KYC for payment institutions), rather than one undergoing legal-base reform. No change to Organic Law 2015-26 itself, nor to CTAF's institutional role, was identified this cycle.

Outlook

The casino order's absence of a retrieved primary gazette text and the payment-circular's reliance on secondary corroboration for granular detail are the two live gaps in this domain. Resolving either would move the relevant finding from probable to confirmed. Tunisia's grey-list-absent status is stable and was reaffirmed independently this cycle; no near-term FATF review affecting that status has been sourced.