🇬🇷 Payments in Greece, Cyprus, and Malta

Three markets, one currency, three acceptance economies

Greece, the Republic of Cyprus, and Malta are three distinct payment acceptance markets, united by their currency and divided by their infrastructure. Greece adopted the euro on January 1, 2001, Cyprus and Malta on January 1, 2008. Monetary convergence did not bring any convergence in how payments are accepted. In Greece, payment acceptance is driven by the tax authority, and the national instant rail is mandatory for every merchant. In Cyprus, card acquiring runs through a single operator owned by the country’s banks. Malta issues EU licenses to companies that process almost nothing in its own retail market. The “Southern Europe” label therefore covers no shared model of acceptance.

A domestic card scheme is a national acceptance network with its own rules and its own fee schedule, onto which local transactions can be routed. None of the three countries has one, so Visa and Mastercard carry nearly all card volume, with no local competitor to put pressure on scheme fees. This directly affects the cost structure, because there is no equivalent of the domestic routing used in France, Italy, or Portugal. The negotiating levers are the acquirer margin and the payment method mix, not the choice of network, since no local scheme can take over from Visa or Mastercard on a domestic transaction. The cost difference between two merchants comes down to their acquiring contracts and the share of non-card rails in their payment volume.

DIAS, the hub of Greek interbank payments

DIAS Interbanking Systems S.A. operates Greece’s automated clearing house for retail payments. It was founded on June 15, 1989, by 14 commercial banks. The Bank of Greece and the European Central Bank oversee the system. Its shareholders include the Bank of Greece, Greek credit institutions, and payment service providers such as Alpha Bank, Eurobank, Piraeus Bank, National Bank of Greece, and Euronet. All of the country’s retail interbank flows pass through DIAS.

• DIAS Payment Service: interbank credit transfers, including bulk payments by businesses and public bodies.
• DIAS Direct Debit: domestic and SEPA direct debits.
• Instant Payments: instant settlement based on the SEPA Instant Credit Transfer scheme.
• IRIS: alias-based instant payments, offered through three channels (consumers, professionals, and retail).
• RF/QR Payments: bill payment by structured reference or QR code, widely used for recurring bills and public bodies.
• DIAS ATM: switching for interbank ATM withdrawals.
• POS / ePOS: acceptance services connected to the providers in the market.

The RF reference is a structured identifier that the creditor prints on its invoice and the payer enters when making the payment. Each incoming payment therefore carries its own matching key. Nearly four in ten transactions use an RF reference or a QR code rather than a manually entered IBAN. Bank reconciliation in Greece therefore relies largely on an identifier supplied by the payer. When the billing system does not generate a reference in the expected format, payments arrive without that key and have to be matched by hand, line by line. A software vendor used to letting payers type in an IBAN and a free-text description will inevitably produce payments like these.

IRIS: the alias-based instant rail and its three channels

IRIS is the alias-based instant payment service that DIAS has operated since 2018, built on the SEPA Instant Credit Transfer scheme. The payer identifies the payee by phone number or tax ID instead of an IBAN. The debit and credit become irrevocable within seconds. No card number is transmitted, no mandate is stored, and no chargeback-style dispute exists. The service comes in three channels, each with its own use cases and enrollment process.

Since June 30, 2026, IRIS has opened beyond Greece through the EuroPA alliance, which links national account-to-account payment solutions. The network brings together Bizum in Spain, MB WAY in Portugal, and BANCOMAT Pay in Italy, joined by Vipps MobilePay. The first phase covers only person-to-person transfers by phone number; merchant payments will come later. Until that second phase opens, the alliance has no effect on merchant acceptance. A Spanish or Italian visitor cannot pay for a purchase in Greece this way.

Mandatory acceptance: cards first, then instant payments

In Greece, the obligation for businesses to accept certain payment methods was introduced through tax legislation, and tax law still governs it. Article 65 of Law 4446/2016 requires categories of businesses, designated by ministerial decision, to accept card payments. The list grew until it covered all economic activities, and then the nature of the obligation changed. It now covers not only which instrument is accepted but also the traceability of revenue. Connecting the terminal to the cash register and to the tax authority has become a condition for doing business. The aim is tax collection: payments that bypass this circuit stay out of the records sent to the authority. That is why the obligation, which first targeted cards alone, was extended to instant payments.

Whether the framework applies to merchants with no establishment in Greece is still debated among international providers. Adyen says the rules could also cover merchants without a local entity, but does not take a firm position. It cites a €1,500 fine under decision 119899/13-12-2023. With no settled position, the question has to be assessed entity by entity with local counsel, since a single group-wide rule cannot reflect different establishment situations. Distance selling into Greece from a foreign company does not automatically trigger the cash register obligations.

Taxation through payments: myDATA, e-invoicing, and mandatory electronic spending

myDATA is AADE’s platform for receiving the books and invoicing documents of Greek businesses. The POS terminal–cash register link feeds each transaction into it as it happens, so payment, receipt, and tax reporting form a single chain. B2B e-invoicing closes the loop for business-to-business transactions. Each payment generates the tax document the moment it occurs, instead of being reported in a return prepared after the fact.

• Legal basis for e-invoicing: Council Implementing Decision (EU) 2025/502 of February 25, 2025, authorizing Greece to derogate from Articles 218 and 232 of Directive 2006/112/EC. The derogation runs from July 1, 2025, to December 31, 2027.
• Phase 1 (March 2, 2026): businesses with gross revenue above €1 million in fiscal year 2023.
• Phase 2 (October 1, 2026): all other businesses established in Greece.
• Mechanism: the B2B invoice is sent to myDATA, which assigns it a unique identifier. It is a clearance model, with validation before issuance.
• Out of scope: transactions with taxable persons established in another member state remain subject to optional e-invoicing; businesses that are only VAT-registered in Greece, with no establishment there, are in principle excluded from the domestic mandate.

The framework also reaches consumers. Under the income tax code, Greek taxpayers must show electronic spending equal to 30% of their actual income, with the requirement capped at €20,000 a year. Any shortfall is taxed: 22% of the gap is added to the tax due (PwC, Worldwide Tax Summaries, Greece). Greek consumers therefore have a direct tax incentive to pay by card or IRIS, and that incentive acts on them before it acts on merchants.

Cyprus: JCC, the single gateway for acceptance

JCC Payment Systems Ltd, founded in 1989, handles acquiring, clearing, and settlement of card transactions for the Cypriot market, a position with no equivalent in Western Europe. It is owned by local banks: Bank of Cyprus holds control, alongside Hellenic Bank, Alpha Bank Cyprus, National Bank of Greece (Cyprus), and AstroBank. The Central Bank of Cyprus oversees the JCC card system. An international acquirer can enter the market, but without JCC’s bank shareholders or its connections to public administrations.

• Acquiring and processing: authorizations from issuers, plus clearing and settlement of Visa, Mastercard, and Diners Club International transactions under license.
• Multi-brand acceptance: Visa, Mastercard, American Express, Diners Club, UnionPay, and JCB, useful coverage for a highly diverse tourist customer base.
• JCC Gateway: e-commerce gateway with payment links and QR code payments.
• Tap to Pay on Android: contactless acceptance on a phone, with no dedicated terminal.
• Dynamic Currency Conversion: DCC is built into the merchant offering.
• Ancillary services: SEPA direct debits, ATM management, gift cards, installment payments, and the myLOYALTY loyalty program.

JCCsmart.com, the bill payment portal operated by JCC, is the second pillar of its business. Cypriots use it to pay bills, subscriptions, and public charges. More than 800 registered organizations are connected (JCC), including local authorities, water utilities, sewer services, and government agencies. Recurring bills in Cyprus are paid through this channel. A provider entering this segment would have to build an equivalent biller directory and shift an entrenched payment habit.

Malta: a licensing hub with a tiny retail market

Malta’s payments sector consists mainly of institutions licensed there that do business elsewhere. The island’s retail market is the most cash-reliant in the euro area, while these institutions process flows that never touch Malta. The Malta Financial Services Authority licenses financial institutions under the Financial Institutions Act and is the jurisdiction’s single regulator. The institutions then passport their services across the European Economic Area. A Maltese license is therefore a way to operate in other EEA markets, not to serve local commerce.

The FATF put Malta on its gray list in June 2021 and removed it in June 2022. Gray-listing signals weaknesses in a country’s anti-money laundering framework, and correspondent banks respond by tightening checks on flows from that country. The episode was costly for the sector: local press reported that about 40 licenses had been surrendered by the end of 2021 (The Shift News, November 2021). Delisting restored the jurisdiction’s regulatory standing, but correspondent banks’ due diligence policies continued to weigh on access to accounts.

Malta is also home to a locally listed card payments software vendor, RS2 Software plc, whose platform serves acquirers and processors outside the island. The jurisdiction thus combines licensing with exported technical expertise. Malta has fewer than 600,000 residents, while the institutions licensed there serve the entire European Economic Area. That asymmetry shapes how to read the market: decisions made in Malta concern European flows, and rarely Maltese commerce.

Tourism, multicurrency, and dynamic currency conversion

All three markets receive far more visitors each year than their populations would suggest. A large share of the cards presented is therefore issued outside the euro area, often outside the European Economic Area. Where a card comes from affects acceptance costs and the fraud profile. The seasonal concentration of visitors affects cash flow timing. Pricing based on a domestic mix can miss the real cost by several tenths of a percentage point, and the gap is widest in the peak months.

The large share of British visitors to Cyprus and Malta feeds directly into acceptance costs. Since Brexit, a UK-issued card is a non-EEA card, and the IFR interchange caps no longer apply to it. Interregional interchange is capped under the commitments Visa and Mastercard made to the European Commission in 2019: 0.2% and 0.3% for card-present transactions, and 1.15% and 1.50% for card-not-present. At a Cypriot hotel that earns a third of its revenue from British cards, remote bookings paid with those cards fall under the interregional caps. A Nicosia business serving local customers, by contrast, remains fully within the scope of the IFR.

Operating across the three markets

The three countries share the euro, the SEPA schemes, and EU payments law, but no acceptance chain. No single contract covers all three. A regional rollout splits into three projects, with three timelines, three counterparts, and three definitions of what “compliant” means. Greece stands apart: the provider’s certification under the tax framework determines whether it can collect payments at all, before any discussion of pricing or features.

• Map the Greek terminal base in the myAADE registry before any migration: a terminal that is not registered, or is registered to a former provider, blocks compliance.
• Treat the cash register as a payment component in Greece. User acceptance testing covers the receipt issued, not just the authorization obtained.
• Size IRIS for low-ticket payments: limits of €500 per transaction and €1,000 per day when the mandate took effect, with an increase announced for consumers.
• Build RF/QR references into Greek invoicing: together with standing orders, they account for nearly 39% of DIAS system transactions, and reconciliation depends on them.
• Put DCC terms in the contract in Cyprus and Malta, and track the dispute rate, since British customers are overexposed to this product.
• In Malta, keep the licensing process separate from the banking process: the first moves fast, the second determines the go-live date.
• Prepare for Greek e-invoicing: phase 1 on March 2, 2026, for businesses with 2023 revenue above €1 million, and phase 2 on October 1, 2026, for all others.