Algeria Fintech Security Playbook: Hardening PSPs Under Instruction 06-2025

Algeria’s First Binding PSP Security Rulebook

For years, Algeria’s fintech sector operated in a regulatory grey zone — innovative enough to produce companies like Yassir and UbexPay, but constrained by the absence of a formal licensing framework for non-bank payment operators. Bank of Algeria’s Instruction 06-2025 changes that permanently.

The regulation, published in 2025, establishes a comprehensive operational framework covering capital adequacy, KYC standards, customer fund protection, agent network governance, and consumer safeguards. For cybersecurity teams at Algerian fintech startups and licensed PSPs, Instruction 06-2025 is not primarily a business opportunity document — it is a compliance checklist with legal consequences.

The cybersecurity obligations embedded in the instruction operate alongside Algeria’s AML framework, which was substantially strengthened by a July 2025 amendment to the primary AML law (No. 05-01, 2005) that expanded oversight to digital assets and strengthened enforcement penalties to DZD 10 million for non-compliant entities. Bank of Algeria Regulation No. 24-03 (August 2024) further defines AML/CFT requirements for virtual asset providers.

This article unpacks the cybersecurity obligations, identifies the gaps most likely to cause compliance failures, and provides a structured hardening checklist.

What Instruction 06-2025 Actually Requires

The regulation establishes three tiers of KYC verification for payment accounts, each with progressively stricter identity assurance:

• Level 1 accounts — maximum transaction threshold of DZD 100,000 (~USD 740) — require basic digital ID verification only
• Level 2 accounts — maximum DZD 500,000 (~USD 3,700) — require scanned identity document plus income proof
• Level 3 accounts — maximum DZD 1,000,000 (~USD 7,400) — require video-conference verification plus Level 2 documentation

Each tier represents a distinct technical requirement: Level 1 demands a functional digital identity API integration; Level 2 requires document verification and storage; Level 3 requires a real-time video KYC capability with biometric liveness detection.

Beyond KYC, the regulation mandates:

• Segregated escrow accounts: all customer funds held by a PSP must be deposited in a dedicated account at a commercial bank, entirely separate from the PSP’s operational capital
• Bank guarantee or professional liability insurance: as a baseline capital protection mechanism for consumers
• Strong customer authentication (SCA): multi-factor verification for all transaction initiation, explicitly modelled on emerging global standards
• Transaction restriction to Algerian Dinars: all services must operate within national territory and in DZD only — a significant constraint on cross-border payment features

LaunchBase Africa’s analysis of Instruction 06-2025 notes that the agent network provisions impose full liability on PSPs for all actions undertaken by their cash-in/cash-out agents, including AML compliance and anti-fraud monitoring — a requirement that pushes cybersecurity responsibilities downstream to the agent interface layer.

What PSPs Must Implement to Stay Compliant

1. Build a Three-Tier KYC Authentication Stack Before License Renewal

The tiered KYC system is not merely an onboarding feature — it is a live control that must be verifiable at every transaction point. A PSP that onboards a Level 1 user and then allows that account to make Level 2-scale transfers without triggering a KYC escalation is in violation. Implement KYC tier enforcement at the API layer: every payment initiation request must check the account’s current KYC tier against the requested transaction amount and return an error if the tier is insufficient. Log every tier escalation and rejection for Bank of Algeria audit access. Video KYC for Level 3 requires a real-time liveness-check component — budget for a certified biometric provider, as in-house solutions are unlikely to pass regulatory scrutiny.

2. Establish Cryptographic Segregation Between Customer Funds and Operating Capital

The escrow account requirement in Instruction 06-2025 is fundamentally a reconciliation and integrity control: at any point in time, the balance of the PSP’s customer escrow account must exactly match the aggregate of all customer wallet balances. Implement automated daily reconciliation with cryptographic audit trails — every debit and credit to the escrow account should be linked to a specific customer transaction hash. If the escrow balance ever diverges from the aggregate customer balance by more than a defined tolerance (e.g., DZD 1,000), trigger an immediate alert to the compliance team. Do not rely on manual accounting cycles for this — a manual process that runs weekly will fail to detect intra-week fraud.

3. Deploy AML Transaction Monitoring Aligned to CTRF Reporting Standards

Algeria’s CTRF (Cellule de Traitement du Renseignement Financier) requires PSPs to file suspicious activity reports for transactions that meet defined risk criteria. The practical implementation requires a real-time transaction monitoring engine that applies rule-based and behavioural screening against every payment — checking for structuring patterns (multiple transactions just below DZD 100,000 thresholds), high-velocity wallet activity, transactions to or from flagged account identifiers, and geographic anomalies. Customer records must be retained for a minimum of five years under Algeria’s AML/CFT framework (Law 05-01, as amended in July 2025). Penalties for non-compliance reach DZD 10 million — an existential risk for an early-stage PSP with limited capital.

4. Implement Strong Customer Authentication That Meets Bank of Algeria’s SCA Standard

The SCA requirement in Instruction 06-2025 mandates multi-factor verification for payment initiation. In practice, this means combining at least two independent authentication factors — typically a device-bound cryptographic key (something you have) and a biometric or PIN (something you are or know). SMS OTP alone does not meet the SCA standard because SIM-swap fraud can compromise it without the account holder’s involvement. Implement FIDO2/WebAuthn for mobile authentication where technically feasible, or at minimum use time-based OTP via an authenticator app (TOTP) rather than SMS. Document your SCA implementation in a technical compliance note and have it reviewed by a certified information security professional — Bank of Algeria inspections will ask for this evidence.

5. Extend Cybersecurity Requirements to Your Agent Network

The Instruction 06-2025 provision making PSPs fully liable for their agents’ actions has a direct cybersecurity implication: every cash-in/cash-out agent terminal is an extension of the PSP’s attack surface. An agent whose device is compromised can become a vector for account takeover, fraudulent cash-out, or AML evasion. Require all agents to complete an annual security awareness training, use PSP-provided hardware or a locked-down app with device integrity checking (jailbreak/root detection, certificate pinning), and connect to the PSP backend exclusively over an encrypted, mutually authenticated channel. Audit agent transaction logs weekly for anomalous patterns — an agent who processes 50 cash-out transactions in one hour is a red flag, not a sales achievement.

A PSP Compliance Readiness Checklist

Before Bank of Algeria conducts its first compliance inspection of licensed PSPs, assess your readiness against these controls:

• KYC tier enforcement at the API layer for all transaction initiation
• Real-time escrow reconciliation with cryptographic audit trail
• AML transaction monitoring engine with CTRF-aligned suspicious activity reporting
• SCA implementation using device-bound authentication (not SMS OTP alone)
• Five-year customer record retention with encrypted, access-controlled storage
• Agent security policy including device integrity checking and encrypted channels
• Incident notification procedure for Bank of Algeria — the regulation implies a notification obligation; document your procedure before an incident occurs
• Professional liability insurance or bank guarantee as specified in the regulation

Fintech Times’ 2026 overview of Algeria’s ecosystem notes that approximately 30-35 fintech startups currently operate in Algeria, with digital payment adoption still constrained by cash dominance. PSPs that build compliant, secure infrastructure now will be positioned to benefit from the next phase of adoption — but only if they survive the initial compliance inspection cycle.

Frequently Asked Questions

Sources & Further Reading

• Algeria Issues New Rules for Fintech and Digital Wallet Providers — Startup Researcher
• Algeria Opens for Fintech: PSP Rules Create a Playbook — LaunchBase Africa
• AML Compliance in Algeria: A 2025 Guide for Fintechs — VoveID
• Algeria’s Fintech Ecosystem in 2026 — The Fintech Times
• Cybersécurité PME et Protection des Données en Algérie — Symloop