Lead Signal
Tunisia's central bank has moved to tighten, not loosen, the supervisory architecture around payment institutions. Banque Centrale de Tunisie Circular 2026-10, published on 25 September 2026, repeals and replaces the prior Circular 2018-16 and overhauls payment-institution governance, customer identification and cybersecurity requirements, with a three-month transition window that runs to approximately 25 December 2026. The circular is confirmed on the BCT's own site and corroborated by independent Tunisian press reporting on its substance. Among the confirmed elements are a board-level audit-and-risk committee requirement and, on probable but not yet primary-sourced grounds, an annual cybersecurity audit certified by the national cybersecurity agency (ANCS).
The structural reading is that Tunisia's payment sector is being pulled toward a more codified, audited compliance posture at the same time digital-KYC and onboarding identification rules are tightened. This sits squarely within the AML/CTF regime (D7) as a standing-record update rather than a new legal base, since the country's foundational AML/CFT law remains Organic Law No. 2015-26, with CTAF continuing as the designated financial intelligence unit.
Other Developments
A January 2026 joint ministerial order brought casinos fully inside the AML/CFT perimeter. A joint order of the Ministers of Tourism, the Interior and Finance, dated 29 January 2026, applies the full Organic Law 2015-26 regime to licensed casinos, requiring risk assessment, a compliance officer, staff training, independent audit, ten-year record retention and immediate suspicious-transaction reporting to CTAF. This repeals a narrower 2018 casino-specific order and is corroborated by a single trade-press source rather than a retrieved primary gazette text, which caps the finding at a probable tier.
Tunisia remains outside the FATF grey list. As of the FATF's 19 June 2026 Plenary statement, Tunisia is not among the jurisdictions under increased monitoring, consistent with the country's 2019 follow-up mutual evaluation report rating it compliant or largely compliant on the substantial majority of the FATF's forty recommendations.
Cross-Monitor Connections
The payment-institution circular's digital-KYC and cyber-audit provisions carry a direct read-across to the World Payments Monitor's operational-resilience and licensing tracks, where the same instrument drives tightening findings. The casino order's extension of suspicious-activity reporting obligations is a conflict-finance-adjacent development only in the general sense that gaming-sector AML gaps are a recognised layering vector; no Tunisia-specific conflict-finance nexus was identified this cycle. No Tunisia nexus was found in the ongoing Houthi-network sanctions-designation stream reviewed this cycle.
Outlook
The near-term marker is the circular's compliance deadline around 25 December 2026, when payment institutions must demonstrate full conformity with the new governance, cyber-audit and digital-identification requirements. Separately, a draft Foreign Exchange Code reform (Bill 115/2025), which would permit BCT-authorised crypto holding and exchange under declared thresholds, remained in Finance and Budget Committee hearings with business organisations through at least June 2026, with no floor vote reported; current law continues to prohibit most crypto dealing in the meantime. Confirmation of the primary gazette text for both the payment-institution circular and the casino order would raise both findings above their current source-tier ceiling.