Cyprus’ fintech sector is approaching 200 companies, with around 55 per cent involved in payments, but the growth of digital finance is putting fresh demands on regulation, cybersecurity and the people running financial institutions, a summit in Limassol heard this week.
European University Cyprus professor Pieris Chourides presented preliminary research at the Forbes Cyprus Next Gen Banking & Fintech Summit showing the prominence of payment services in the industry. He said “businesses from India and other markets were using Cyprus as a base to enter the European Union, attracted by its regulatory environment and skilled workforce.”
The findings set the scene for a discussion involving Kraken, Nuvei and Bank of Cyprus (BoC) on how digital assets, stablecoins and newer payment systems could serve businesses and consumers.
Alexia Theodorou, head of Kraken Cyprus, said “clear regulatory requirements and direct access to the authorities had been important in the company’s decision to establish a European base on the island, after considering several jurisdictions.”
She pointed to tokenisation, which allows assets such as shares to be represented digitally, as a way of enabling round-the-clock trading and developing new services. But she cautioned against adopting technology simply because it was available, saying there had to be a practical benefit.
In Cyprus, she saw opportunities in tourism, where faster settlement, lower transaction costs and automated payment processes could help businesses handling international customers.
Kraken has also backed financial and technology education on the island. As reported, Kraken and its parent company Payward awarded six scholarships to University of Cyprus postgraduate students this week, three in finance and three in data science.
Laura Miller, chief revenue officer and global head of eCommerce at Nuvei, said early expectations that cryptocurrencies would become a routine means of paying for everything had proved overblown. Consumers, she argued, cared less about the technology behind a transaction than whether it worked quickly and securely.
She cited contactless payments and digital wallets as examples of products adopted because they make everyday purchases easier. Stablecoins, meanwhile, could be useful for cross-border transfers and improving access to financial services, provided consumer safeguards and accountability kept pace.
From the banking side, George Koushis, BoCs’ executive director of technology and operations, said established lenders were also looking at stablecoins and tokenisation. They could bring together innovation, financial resources, regulatory experience and existing customer relationships, he said.
For Cyprus, though, the shortage of experienced specialists remained a constraint. Koushis said “the problem was not simply the number of graduates, but attracting people with the experience to compete internationally.” He also called for more effective government policies to support the sector.
The question of trust carried into a separate discussion on cybersecurity, where speakers warned that relying on outside technology providers did not remove responsibility from financial firms or their boards.
Solon Houtris, chief information security officer at XM, said “financial businesses had become increasingly dependent on cloud providers, software companies and other external partners.” Their security arrangements needed to be assessed before contracts were signed and monitored throughout the relationship.
He called for clear contractual obligations, regular oversight and contingency plans for disruptions, adding that artificial intelligence was making attacks more complex and faster-moving. That, he said, made automated detection and response increasingly important.
Nicholas Kattirtzis, head of governance, risk and compliance advisory at Odyssey Cybersecurity, said “the EU’s Digital Operational Resilience Act (DORA) required a broader focus than simply restoring IT systems after an incident.” The priority was keeping critical financial services running and demonstrating, through testing, how quickly they could recover.
Management teams therefore needed to know how long an outage could last, whether recovery targets were realistic and what actual exercises had shown, rather than relying on written procedures alone, he said.
Andreas Michaelides, a partner at Scordis, Papapetrou & Co LLC, said boards needed to engage directly with cyber risks, question the executives responsible and keep records of their decisions. In the event of an attack, their actions before the incident could come under scrutiny.
He also stressed prompt reporting to the relevant authorities, preservation of evidence and a careful review of insurance cover. Michaelides said, according to the information available to him at the summit, Cyprus had yet to pass legislation providing for certain DORA enforcement powers and penalties.
The cybersecurity panel was moderated by Ioannis Georgoulas, president of the Cyprus Association of Electronic Money and Payment Institutions (ACEMPI), who linked confidence in digital financial services to the management of both credit and technology risks.
The wider debate echoed separate summit remarks by London Business School professor Costas Markides, who argued that traditional banks had so far held their ground against fintech challengers, while facing new pressures from technology companies.