Cyprus Central Bank: Credit Granting & Review Processes Directive (2026), Practical Compliance Guide

On 29 May 2026, the Central Bank of Cyprus (CBC) published a substantially revised credit granting directive Cyprus practitioners had been anticipating since the regulator’s late-2025 consultation round. The directive overhauls documentation standards, tightens loan underwriting rules, introduces new periodic-review cadences and, for the first time, imposes direct supervisory reporting obligations on credit servicers operating in the Cyprus market. For compliance officers, general counsel, risk teams and restructuring advisors at credit institutions, electronic money institutions (EMIs) and outsourced servicers alike, the central bank directive Cyprus has issued demands concrete, time-bound action.

This guide translates the key provisions into a practical, English-language compliance playbook, complete with checklists, timelines, comparison tables and template guidance, so that affected entities can move from awareness to implementation without delay.

TL;DR, What the 2026 Credit Granting Directive Cyprus Means at a Glance

The revised directive consolidates and strengthens the CBC’s framework for credit origination, ongoing monitoring and forbearance. Here is what you need to know immediately:

• Scope expanded. The directive now covers credit institutions, credit-acquiring companies, authorised credit servicers and EMIs that offer tied credit products, not just traditional banks.
• Documentation and retention overhaul. All credit decisions must be supported by standardised written records, retained for a minimum of seven years from loan maturity or write-off, whichever is later.
• Underwriting tightened. Enhanced affordability-assessment criteria, mandatory debt-service-coverage ratios and collateral-valuation rules apply to every new facility and material restructuring.
• Periodic review cadence mandated. Performing loans require at least annual reviews; watch-list and non-performing exposures require quarterly reviews with documented escalation triggers.

Immediate action items by time horizon:

• Within 30 days (by late June 2026): Appoint a directive-implementation owner; conduct a gap analysis of current credit policies against the new requirements.
• 30–90 days (July – August 2026): Update internal credit-policy manuals, servicer contracts and underwriting templates; schedule staff training.
• 90–180 days (September – November 2026): Complete IT-system changes for monitoring and reporting; submit first quarterly underwriting attestation; pay revised supervisory fees.

Background and Scope, Which Entities Are Covered by the Central Bank Credit Granting Directive (2026)

The CBC derives its rule-making authority from the Business of Credit Institutions Laws of 1997 to 2026 and the relevant EU framework, including the Capital Requirements Directive (CRD) and the EU Credit Servicing Directive (Directive (EU) 2021/2167). The credit granting directive Cyprus issued on 29 May 2026 replaces and consolidates the prior Consolidated Credit Granting and Review Process Directive that had been in force since its last major update in 2023. It does not merely amend selected provisions; it introduces entirely new chapters on servicer oversight, supervisory fees and borrower-communication standards.

The directive applies to the following categories of regulated entities:

• Credit institutions, all banks licensed and supervised by the CBC, including branches of EU and third-country institutions operating in Cyprus.
• Credit-acquiring companies and credit servicers, entities authorised under Cypriot transposition of the EU Credit Servicing Directive to purchase or manage non-performing loan (NPL) portfolios.
• Electronic money institutions (EMIs) and payment service providers (PSPs), where they offer credit products tied to payment services, following the CBC’s separate but related directives for EMIs and PSPs.

Timeline of Publication and Effective Dates

Key Requirements by Theme Under the Credit Granting Directive Cyprus

The directive reorganises the CBC’s requirements into four interlocking themes. Each theme carries specific documentation, process and reporting obligations that together form the backbone of the new credit granting processes Cyprus institutions must follow.

Documentation Requirements

Every credit decision, from initial origination through each subsequent modification, forbearance event or restructuring, must now be backed by a standardised written record. The directive specifies minimum content for these records:

• Borrower identification and beneficial-ownership verification (cross-referenced with AML/CFT customer-due-diligence files).
• Purpose-of-loan statement and source-of-repayment analysis.
• Risk-grading rationale, including the internal model or scorecard used and any manual overrides with documented justification.
• Collateral description, independent valuation report (where applicable) and haircut applied.
• Approval authority: name, title and delegated-authority level of the approving officer or committee.

Retention has been extended to seven years from loan maturity or write-off, whichever is later, an increase from the prior five-year standard. Records must be stored in a format that allows retrieval within two business days of a CBC supervisory request.

Loan Underwriting Rules Cyprus, Affordability and Risk-Weighting Changes

The directive introduces several changes to the loan underwriting rules Cyprus banks have applied to date:

• Debt-service-coverage ratio (DSCR) floors: For commercial borrowers, the directive sets a minimum DSCR of 1.20× for new facilities. Deviations require documented board-level or senior-management exception approval.
• Debt-to-income (DTI) guidance for retail borrowers: Total debt service (including the proposed facility) should generally not exceed a percentage of verified net disposable income, with the CBC reserving the right to specify exact thresholds via circular.
• Collateral-valuation standards: Independent valuations are required at origination for all exposures above a specified materiality threshold. Re-valuations must follow at defined intervals, annually for commercial real estate and every three years for residential real estate, or upon a trigger event such as market-price decline or loan default.
• Climate and ESG risk integration: The directive introduces a forward-looking requirement for institutions to assess environmental risk factors, particularly physical and transition risks, as part of the creditworthiness assessment for material exposures. Industry observers expect the CBC to issue supplementary guidance on methodology by year-end 2026.

Loan Review and Monitoring, The New Cadence Under the Loan Review Directive 2026

Prior CBC guidance recommended annual reviews but allowed considerable flexibility. The 2026 loan review directive now mandates minimum review frequencies:

• Performing loans: Annual review at a minimum, including updated financial analysis, covenant-compliance check and collateral-adequacy assessment.
• Watch-list exposures: Quarterly review with a documented action plan for upgrading or downgrading the exposure.
• Non-performing exposures (NPEs): Quarterly review, plus an immediate ad hoc review upon any material deterioration event (e.g., missed payment beyond 30 days, insolvency filing, significant collateral impairment).

Each review must conclude with a formal recommendation, maintain, upgrade, downgrade or trigger forbearance, and the recommendation must be recorded in the central credit file within five business days.

Supervisory Fees and Reporting

The directive revises the supervisory-fee structure to reflect the expanded scope of CBC oversight:

The quarterly underwriting attestation is a new obligation: institutions must certify that a representative sample of credit decisions taken in the preceding quarter complied with the directive’s affordability, documentation and approval-authority requirements. The CBC will use these attestations to prioritise on-site examination activity.

Obligations for Credit Servicers Cyprus and Outsourced Providers

One of the most significant expansions in the 2026 directive is the introduction of direct, granular obligations for credit servicers Cyprus entities. Until now, servicers were primarily governed by the terms of their outsourcing contracts with originating banks and the transposition legislation. The directive now establishes CBC-imposed duties that run alongside, and in some cases override, contractual arrangements.

Contracting and Oversight of Servicers

Banks that outsource credit-management activities must now embed specific directive-aligned clauses in their outsourcing agreements, including the CBC’s right of direct access to servicer records, audit rights, minimum SLA metrics and termination triggers for repeated non-compliance. Existing contracts must be amended within the 90-day implementation window.

Data and Reporting Duties

Servicers must maintain data infrastructure capable of generating the monthly portfolio reports the CBC expects to prescribe via supplementary circular. Early indications suggest the reporting template will require granular loan-level data on forbearance type, cure rates, recovery amounts and borrower-communication records.

Transfer-of-Rights and NPL-Management Constraints

Where credit-acquiring companies purchase NPL portfolios, the directive requires the transferring bank and the acquiring entity to jointly ensure that the borrower’s rights, including the right to a restructuring assessment, are preserved. The acquiring entity must apply the same affordability and forbearance standards as the originating bank. This is an area where the credit granting directive Cyprus provisions align closely with the EU Credit Servicing Directive’s borrower-protection requirements.

How Banks Should Update Underwriting and Loan Review Policies

Compliance with the 2026 directive requires more than cosmetic policy amendments. The likely practical effect will be a fundamental re-engineering of credit-decision workflows for many institutions, particularly smaller banks and cooperative credit institutions that have relied on less formalised processes.

Model Validation and Documentation

Institutions using internal credit-scoring models or automated decision tools must now:

1. Document the model methodology, including data inputs, weighting logic and any machine-learning components, in a format accessible to CBC examiners.
2. Validate models annually, using out-of-sample testing and back-testing against actual default experience, with results reported to the board risk committee.
3. Record manual overrides, every instance where a human decision-maker deviates from the model recommendation must be documented with a written rationale and approved at a level above the originating officer.

Staff Training and Record Keeping

The directive requires institutions to maintain a training register demonstrating that all staff involved in credit origination, review and restructuring have received directive-specific training within 90 days of the publication date. Annual refresher training is mandated thereafter. Training records must be available for CBC inspection and should cover, at a minimum:

• Affordability-assessment methodology and DSCR/DTI application.
• Documentation standards and record-retention obligations.
• Forbearance and restructuring procedures, including borrower-communication requirements.
• Escalation protocols for watch-list and NPE exposures.

Loan Documentation, Forbearance and Restructuring, Practical Clauses and Templates

The directive does not prescribe verbatim contractual clauses, but it establishes minimum content requirements that institutions must reflect in their loan documentation and forbearance templates. Practical steps for banking compliance 2026 Cyprus include the following updates.

Forbearance Process Map

Institutions must implement a structured, documented forbearance process that follows a defined sequence:

1. Early identification: Automated triggers (e.g., 15 days past due, covenant breach) flag accounts for assessment.
2. Borrower engagement: Written contact within five business days of trigger, setting out available options and the borrower’s right to submit financial information for a restructuring assessment.
3. Affordability re-assessment: Full re-underwriting using the directive’s affordability criteria, documented in the credit file.
4. Solution proposal: Written restructuring offer (or rejection with reasons) within 30 business days of receiving complete borrower financial data.
5. Monitoring: Restructured facility placed on watch-list with quarterly review for a minimum of 12 months.

Required Borrower Communications and Disclosures

The directive mandates specific disclosures to borrowers at defined trigger points, expanding on the prior Arrears Management Directive. Required communications include:

• Pre-arrears notice: When an account moves to 15 days past due, a written notification detailing outstanding amounts, available resolution options and contact details for the institution’s restructuring unit.
• Forbearance offer letter: Clear summary of proposed terms, including interest-rate adjustments, maturity extensions, principal deferrals and the financial impact on total repayment.
• Annual restructuring-status update: For borrowers in active forbearance, an annual letter summarising the loan restructuring Cyprus terms in force, compliance status and remaining obligations.
• Transfer-of-rights notice: Where a loan is sold to a credit-acquiring company, advance written notice to the borrower at least 30 calendar days before transfer, detailing the new servicer’s identity and contact information.

Governance, Senior Staff Responsibilities and Fit-and-Proper Considerations

The CBC expects the board of directors (or equivalent governing body) of each covered entity to formally adopt the updated credit-policy framework and to designate a senior officer responsible for directive compliance. This designated officer must hold a role at the level of Chief Risk Officer, Chief Credit Officer or equivalent.

The directive reinforces the Fitness and Probity framework by requiring that individuals exercising credit-approval authority above defined thresholds satisfy the CBC’s fit-and-proper criteria. Institutions should cross-reference their delegated-authority registers with the CBC’s Fitness and Probity requirements and ensure that all relevant personnel have up-to-date assessments on file.

Board-level oversight obligations include reviewing the quarterly underwriting attestation before submission to the CBC, approving any DSCR-exception policy, and receiving at least semi-annual reports on the institution’s overall credit-quality metrics, forbearance volumes and servicer-performance indicators. For institutions relying on the Deposit Protection Scheme, the borrower-communication provisions also serve a consumer-protection function, ensuring that borrowers understand their rights during restructuring or portfolio transfer.

Operational Checklist and Banking Compliance 2026 Cyprus Roadmap

The following prioritised checklist translates the directive into concrete operational steps. Assign ownership, set internal deadlines and track completion.

1. Day 1–7: Appoint implementation lead. Designate a senior officer (CRO or equivalent) as the directive-implementation owner. Notify the board.
2. Day 7–30: Gap analysis. Compare existing credit-policy manuals, documentation templates, servicer contracts and IT-system capabilities against every directive requirement. Produce a written gap-analysis report.
3. Day 30–60: Policy and template redrafting. Update the credit-policy manual, underwriting templates, forbearance-process documentation and borrower-communication templates. Engage legal counsel for contract amendments.
4. Day 30–60: Servicer-contract amendment. Negotiate and execute amended outsourcing agreements incorporating directive-mandated clauses (CBC audit rights, reporting obligations, termination triggers).
5. Day 60–90: Staff training. Deliver directive-specific training to all credit-origination, review, restructuring and customer-facing staff. Record attendance in the training register.
6. Day 60–90: IT-system configuration. Configure core banking and loan-management systems to support new review cadences, trigger-based alerts, automated reporting templates and document-retention timelines.
7. Day 90: Internal dry run. Run a pilot quarterly-attestation exercise on a sample portfolio. Identify and remediate issues before the first live CBC submission.
8. Day 90–120: First quarterly attestation preparation. Compile the underwriting-sample attestation for the first reporting period. Submit to the board risk committee for review.
9. Day 120–180: Supervisory fee payment. Calculate revised supervisory fees and ensure budget allocation. Pay by the Q4 2026 deadline.
10. Ongoing: Monitoring and continuous improvement. Embed directive compliance into the institution’s three-lines-of-defence model. Schedule internal-audit reviews and update policies as CBC supplementary circulars are issued.

Enforcement, Penalties and Supervisory Engagement

The CBC’s supervisory approach follows the Single Supervisory Mechanism’s risk-based methodology. Industry observers expect the regulator to rely initially on guided remediation, issuing findings and recommendations during on-site examinations, before escalating to formal enforcement measures for persistent or material non-compliance. Available sanctions under the Business of Credit Institutions Laws include written warnings, mandatory remediation plans with fixed deadlines, administrative fines and, in severe cases, restrictions on business activities or revocation of authorisation.

Proactive engagement with the CBC is strongly advisable. Institutions that identify compliance gaps should consider notifying their supervisory contact at the CBC early, presenting a credible remediation plan with clear milestones. Historical supervisory practice in Cyprus suggests that transparent, early engagement materially reduces the risk of punitive outcomes.

What Lenders and Servicers Should Tell Borrowers and Counterparties

Customer-facing teams need clear, consistent messaging about what the directive means for existing and prospective borrowers. Recommended communications include:

• For existing borrowers in forbearance: A brief notice explaining that the institution has updated its restructuring and communication procedures in line with the CBC’s 2026 directive, and that borrowers may receive more frequent written updates on their facility status.
• For new applicants: Updated pre-contractual information sheets reflecting enhanced affordability-assessment requirements and documentation that borrowers will need to provide.
• For counterparties (e.g., loan purchasers, co-lenders): A summary of new outsourcing-agreement requirements and data-sharing obligations that will be incorporated into participation and syndication agreements.

All borrower communications should be in clear, non-technical language, in both Greek and English where the borrower’s preference is recorded, and should include the institution’s dedicated contact point for queries related to credit decisions or restructuring.

Conclusion, Next Steps for Compliance With the Credit Granting Directive Cyprus

The 29 May 2026 directive represents the most comprehensive overhaul of credit-origination and review standards in Cyprus in over a decade. The expanded scope, tighter underwriting floors, mandatory review cadences and direct servicer obligations together create a materially higher compliance burden, but also an opportunity for institutions that move quickly to strengthen credit quality and demonstrate supervisory readiness. The immediate priority is to complete a gap analysis within 30 days, update policies and contracts within 90 days, and prepare for the first quarterly attestation by Q4 2026. Entities seeking specialist advisory support on banking compliance 2026 Cyprus should engage experienced Cyprus-based counsel without delay.

This article is for general informational purposes only and does not constitute legal advice. Readers should consult qualified legal counsel for advice specific to their circumstances. Last reviewed: 15 June 2026. This guide will be updated when the CBC publishes official English translations or supplementary circulars.

Sources

1. Central Bank of Cyprus, Directives on Credit Granting and Review Processes
2. Central Bank of Cyprus, Consolidated Credit Granting & Review Process Directive (up to 2023)
3. Harneys, The Central Bank of Cyprus Introduces New Directives for EMIs and PSPs
4. Georgiades & Pelides, Cyprus Banking Regulation Chapter
5. KPMG Cyprus, Central Bank of Cyprus AML/CFT Directive Update
6. Legal500, Banking & Finance: Cyprus Country Guide