A payment institution is a non-bank company authorised to provide regulated payment services, such as money transfers, card acquiring for merchants, payment accounts and payment initiation. In the European Union the licence is granted under the Second Payment Services Directive, known as PSD2 (Directive (EU) 2015/2366), which each Member State has written into its national law.
The licence is issued by the regulator of the country where the company has its head office, called the home Member State. Once authorised, the institution can offer its services in every other country of the European Economic Area (the 27 EU Member States plus Iceland, Liechtenstein and Norway) through a notification process known as passporting, with no second licence.
The payment institution licence sits between a bank licence and a simple registration. It is the most widely held fintech licence in Europe because it gives access to a market of around 450 million people for a fraction of the capital a bank needs.
If your model needs a wallet balance or prepaid product, compare the two routes in our guide to EU payment institution and EMI licensing by jurisdiction before you choose.
PSD2 Annex I lists eight payment services. A payment institution is authorised for specific services only, and the services you choose set your initial capital, your own funds method, whether safeguarding applies and how closely the regulator examines your systems.
| Annex I point | Service | Initial capital |
|---|---|---|
| 1 | Placing cash on a payment account, and operating that account | €125,000 |
| 2 | Cash withdrawals from a payment account, and operating that account | €125,000 |
| 3 | Executing payment transactions (credit transfers, direct debits, card payments) from funds in the account | €125,000 |
| 4 | Executing payment transactions where the funds are covered by a credit line | €125,000 |
| 5 | Issuing payment instruments and acquiring payment transactions for merchants | €125,000 |
| 6 | Money remittance | €20,000 |
| 7 | Payment initiation services (paying from a customer's bank account on their instruction) | €50,000 |
| 8 | Account information services (showing a customer their accounts held elsewhere) | Insurance instead of capital |
Where a firm applies for several services, the highest capital figure applies. Apply for the services your business plan uses in the first three years and show how each one is delivered. Regulators question broad permissions that the business plan does not explain, and adding a service later through a variation is a routine process.
Four authorisation types cover most non-bank payment models in the EU. The right one follows from two questions: does the customer hold a balance with you, and will you serve customers outside your home country?
| Authorisation | What it allows | Initial capital |
|---|---|---|
| Payment institution | Any of the eight PSD2 services, passportable across the EEA | €20,000, €50,000 or €125,000 |
| Electronic money institution | Issuing e-money (wallets, prepaid cards) plus all payment services, passportable | €350,000 |
| Small payment institution (national exemption) | Payment services in the home country only, average monthly volume up to €3 million | Set nationally; often none |
| Account information service provider | Account information only, by registration | None; professional indemnity insurance |
PSD2 Article 32 lets Member States exempt firms whose average monthly payment volume over the previous 12 months does not exceed €3 million. The exemption is national and cannot be passported. Lithuania offers a restricted licence with no initial capital and a 2-month decision period, France a simplified authorisation at €40,000, and Spain and the Netherlands their own low-volume routes. Germany, Luxembourg and Malta have no small payment institution regime.
A firm that only aggregates account data registers under PSD2 Article 33 rather than seeking full authorisation. It holds no initial capital but must carry professional indemnity insurance, sized under the European Banking Authority (EBA) guidelines, covering its liability to banks and customers.
Initial capital is the amount the company must hold when it is authorised. It must be paid up in cash, free of any charge and evidenced by a bank confirmation, and most regulators accept it being paid in at the final stage once they have indicated they will approve the application.
Own funds are the capital the institution must hold at all times after authorisation. Under PSD2 Article 8 and 9, own funds must never fall below the initial capital or the figure produced by one of three calculation methods, whichever is higher. The regulator decides the method, and it may require up to 20% more or allow up to 20% less based on its assessment of the firm's risk.
| Method | How it is calculated | Typical use |
|---|---|---|
| A: fixed overheads | 10% of the previous year's fixed overheads | Start-ups with low volumes |
| B: payment volume | 4% of the first €5 million of monthly average volume, falling in bands to 0.25% above €250 million, then multiplied by a scaling factor | The default method in several Member States, including Germany and the Netherlands |
| C: relevant indicator | 10% of the first €2.5 million of interest, commission and fee income, falling in bands to 1.5%, then multiplied by a scaling factor | Firms with income-led models |
The scaling factor is 0.5 for a money remittance only firm and 1 for firms providing any of the core services 1 to 5.
A merchant acquirer processed €96 million in its last financial year, a monthly average of €8 million, and had fixed overheads of €1.2 million. Under Method A its own funds requirement is €120,000 (10% of €1.2 million), which is below its €125,000 initial capital, so €125,000 applies. Under Method B it is €275,000: 4% of the first €5 million (€200,000) plus 2.5% of the next €3 million (€75,000), multiplied by a scaling factor of 1. The method the regulator chooses therefore changes the capital requirement by more than double.
Build the calculation into your three-year financial forecast, test it against a stressed scenario where volumes grow faster than income, and show the regulator where any extra capital would come from.
EMIs follow a fourth method, Method D, under which own funds must be at least 2% of average outstanding e-money.
Safeguarding means protecting customers' money so that it is returned to them if the institution becomes insolvent. PSD2 Article 10 gives two options:
Member States apply the rules with different degrees of detail. The Netherlands requires a separate customer funds foundation (a stichting derdengelden), France expects funds to be protected every day including weekends where the firm offers instant payments, and Malta and the Netherlands expect the safeguarding bank's commitment in writing before the licence is granted. The Central Bank of Ireland states it has no tolerance for weaknesses in safeguarding.
The safeguarding account is often the longest lead item in the project. Banks carry out their own due diligence on the applicant, so open the conversation as soon as the business plan is settled. Design reconciliations to run daily from the first day: regulators in Ireland, Lithuania and the Netherlands examine the reconciliation process in detail, and the agreed PSD3 text strengthens safeguarding further.
Passporting lets an authorised payment institution offer its services in another EEA country by notification, under PSD2 Article 28. There are two routes:
The institution notifies its home regulator, which forwards the notification to the host regulator within one month. For branches and agents, the home regulator decides on registration within three months of a complete notification, after considering any concerns the host regulator raises on anti-money laundering grounds. In practice, cross-border services can start within one to two months of authorisation and branches or agents within three months.
Agents are registered with the home regulator and appear on the EBA central register of payment and e-money institutions. The institution remains fully responsible for its agents' conduct and anti-money laundering controls, so an agent-led model needs an agent onboarding, training and monitoring programme in the application. Only EMIs may use distributors to distribute and redeem e-money.
Every Member State applies the same PSD2 rules, but the regulators differ in working language, local presence expected, fees and supervisory style. Choose the jurisdiction for the business you will run in five years: where your customers, senior team and banking partners are, not only where the first licence is quickest.
| Jurisdiction | Regulator | Working language |
|---|---|---|
| Lithuania | Bank of Lithuania | English and Lithuanian |
| Ireland | Central Bank of Ireland | English |
| Netherlands | De Nederlandsche Bank (DNB) | English and Dutch |
| Malta | Malta Financial Services Authority (MFSA) | English |
| France | Autorité de contrôle prudentiel et de résolution (ACPR) | French |
| Germany | BaFin | German for formal submissions |
| Luxembourg | Commission de Surveillance du Secteur Financier (CSSF) | English and French |
| Spain | Banco de España | Spanish |
The Bank of Lithuania has authorised one of the largest groups of payment and e-money institutions in the EU. It checks an application for completeness within 5 business days and decides within 3 months of a complete file. The state levy is €898 for a payment institution licence and €682 for the restricted, Lithuania-only licence. Authorised institutions can join CENTROlink, the central bank's own payment system, which gives direct access to SEPA euro payments without relying on a correspondent bank.
The registered office and head office must be in Lithuania, and the Bank of Lithuania expects senior management and real operations in the country. It publishes its licensing decisions, including refusals, which gives applicants a clear picture of the standard it applies. See our Lithuania payment institution licence page for the full requirements.
The Central Bank of Ireland suits groups with North American or UK heritage that want an English-speaking regulator and a deep talent pool in Dublin. There is no application fee; authorised firms pay an annual industry funding levy with a minimum of €5,000. The process starts with a Pre-Application Key Facts Document of 15 to 20 pages, submitted five working days before an initial meeting, followed by a key information check, a full assessment with interviews of proposed senior office holders, a "minded to authorise" letter and the grant.
The Central Bank expects board decision-making, financial control, compliance and risk management to sit in Ireland, at least one independent non-executive director, and compliance and risk functions that are not outsourced. Detail is on our Ireland payment institution licence page.
DNB is methodical and clear in writing, and suits firms focused on mainland European corporate and merchant markets. The application fee is €10,400. Day-to-day management must be carried out by at least two people working substantially from the Netherlands, and anyone acquiring 10% or more of the company needs a declaration of no objection, assessed in parallel with the licence. DNB's Expert Centre on Market Access meets applicants before they file.
The MFSA works in English and grants an in-principle approval before the final licence, with pre-licensing conditions to be met within six months. The application fee is €10,000 for one licence category and €15,000 where e-money and payment services are combined, and annual supervisory fees start at €25,000 for a payment institution. The company must be directed from Malta by at least two people, with a compliance officer and a money laundering reporting officer (MLRO) in place at all times.
The ACPR conducts the process in French and charges no application fee. Its Fintech Charter commits it to a presentation meeting within two weeks of a request and to fixed response times through the assessment. Two effective managers must be based in France. France also offers a simplified payment institution authorisation at €40,000 of capital for firms below €3 million a month, without passporting.
BaFin authorises payment institutions under the Payment Services Supervision Act (ZAG). It charges by time spent, expects the head office and at least two managing directors in Germany, and requires the anti-money laundering officer to sit at management level in Germany. Germany suits firms whose main market is German-speaking consumers and merchants and that will build a full German team.
The CSSF charges a €30,000 examination fee and an annual fee of €30,000. Central administration and the registered office must be in Luxembourg. The jurisdiction suits corporate payments, asset servicing and wealth-adjacent models that benefit from proximity to Luxembourg's fund and banking sector.
Banco de España charges no application fee and decides within 3 months of a complete file, with the clock stopping while it waits for information. Documents are submitted in Spanish, and the registered office, central administration and effective management must be in Spain. The own funds method chosen applies for three years. Spain suits firms serving Spanish-speaking consumers and merchants, and offers a low-volume route for payment institutions below €3 million a month.
Finantsinspektsioon charges a €3,000 processing fee for a payment institution application and decides within 3 months of a complete file and no later than 6 months from the application. Applications have been accepted only through its online portal since 18 March 2026. The company must be founded in Estonia with its head office there, and the regulator refuses applicants that intend to operate mainly elsewhere.
For a first EU licence with a pan-European customer base, Lithuania and Ireland are the two most common choices: Lithuania for its English-language process, low fees and CENTROlink access, Ireland for its depth of talent and its standing with banks and card schemes. Germany and France are the right choice from the outset where most customers are in those countries and the firm will operate in the local language.
Regulator fees are a small part of the total. The larger items are the senior team hired before authorisation, the technology for safeguarding, anti-money laundering and ICT security, office and substance costs, the initial capital itself and the legal and advisory work on the application file.
| Jurisdiction | Regulator application fee | Annual supervisory fee |
|---|---|---|
| Lithuania | €898 state levy (restricted licence €682) | Percentage of income, set annually |
| Ireland | None | Industry funding levy, minimum €5,000 |
| Netherlands | €10,400 | Set annually by DNB |
| Malta | €10,000 (€15,000 with e-money) | From €25,000 plus a variable element |
| France | None | Annual ACPR contribution |
| Germany | Charged by time spent | Annual cost allocation |
| Luxembourg | €30,000 | €30,000 |
| Spain | None | None published |
| Estonia | €3,000 | Set annually by Finantsinspektsioon |
Budget for the initial capital in full, plus enough working capital to meet the own funds requirement and operating costs for at least the first 12 months after authorisation. Regulators test this in the financial forecast.
PSD2 Article 12 requires the regulator to decide within 3 months of receiving a complete application. The clock runs only while the file is complete, so it stops while the regulator waits for answers to its questions. The table shows each regulator's own published standard.
| Regulator | Published standard | In months |
|---|---|---|
| Bank of Lithuania | Completeness check in 5 business days; decision 3 months from a complete file | 3 (restricted licence 2) |
| Central Bank of Ireland | 90% of assessments within 90 business days of a complete file | About 4.5 |
| DNB, ACPR, Banco de España, MFSA | 3 months from a complete application | 3 |
| CSSF | 3 months from a complete file; 12 months at most | 3 to 12 |
| BaFin | 3 months from a complete file; an application not completed within 12 months is refused | 3 to 12 |
Sources: Bank of Lithuania, Central Bank of Ireland, DNB, CSSF and BaFin publications listed in the references.
| Phase | What happens | Duration |
|---|---|---|
| Preparation | Business plan, policies, forecasts, hires and bank discussions | 4 to 8 weeks |
| Assessment | Completeness check, questions, interviews | 4 to 6 months |
| Conditions | Capital paid in, safeguarding account live, systems tested | 1 to 2 months |
| Passporting | Notifications to host regulators | 1 to 3 months |
The firm plans payment institution authorisations at 6 to 8 months from submission, which allows for the regulator's questions and for the conditions to be met before the licence is granted. Add four to eight weeks before submission to prepare a complete file, and one to three months after authorisation for passporting. The single biggest factor within your control is the completeness and quality of the file on the day it is submitted.
The process follows the EBA Guidelines on authorisation and registration under PSD2 (EBA/GL/2017/09), which set out the information every regulator asks for.
Most regulators offer a meeting before filing. Ireland requires a key facts document in advance, the Netherlands runs an Expert Centre on Market Access, and France commits to a meeting within two weeks. Use it to confirm the services, the group structure and the substance plan.
This is the core document. It sets out the services, customers, channels, countries, money flows, three-year financial forecasts with a stressed scenario, governance, risk management, safeguarding, IT and security, outsourcing and a wind-down plan. A complete file is typically 80 to 200 pages plus annexes.
| Document | What it shows the regulator |
|---|---|
| Programme of operations | Each service, how it works and the money flows |
| Business plan and forecasts | Three years of profit and loss, balance sheet and cash flow, base and stressed |
| Own funds calculation | The requirement under the expected method and the capital source |
| Governance and organisation chart | Who decides what, and where they are based |
| Safeguarding arrangement | The method, the bank and the daily reconciliation |
| Business-wide risk assessment | The money laundering and fraud risks and the controls set against them |
| ICT and security documentation | The DORA framework, providers and incident process |
| Wind-down plan | How customers are repaid if the firm closes |
The supporting policies cover anti-money laundering and counter-terrorist financing, sanctions, safeguarding, risk management, capital adequacy, business continuity, ICT and information security, incident management, outsourcing, complaints, fraud prevention, conflicts of interest and record keeping. Each must describe how your business actually operates.
Each director, the MLRO, the compliance officer and other senior managers submit a CV, a personal questionnaire and evidence of good repute, knowledge and experience, and most regulators interview them. Every shareholder with 10% or more must show where its funds come from and that it is suitable to own a regulated firm.
Expect several rounds of written questions. Answer each fully and promptly: in Ireland a file left without a response for 60 business days is treated as dormant.
The regulator indicates its intention to approve and lists the conditions to be met first: capital paid in, safeguarding account open, key hires in post and systems tested. The licence is granted once they are met, and the institution appears on the national register and the EBA register.
Submit passport notifications for each target country, ideally prepared during the assessment so they can be filed on the day of authorisation.
The EBA's 2023 peer review of authorisation under PSD2 asked national regulators to apply the same high standard across the EU, and the leading regulators now publish what a strong application contains. Their published guidance points to six qualities.
The Digital Operational Resilience Act, known as DORA (Regulation (EU) 2022/2554), has applied to payment institutions and EMIs since 17 January 2025. It sets one EU rulebook for how financial firms manage technology risk, and regulators now assess it as part of the licence application.
Cloud hosting, core banking platforms and card processors are the arrangements regulators examine most closely. Our article on DORA and digital operational resilience sets out the full requirements, including the incident reporting timetable.
The licence starts a supervisory relationship. From the first day the institution must:
Regulators review new institutions closely in their first year, often with an early on-site visit. Treat the commitments in the application as the operating plan, because they will be tested against it.
The European Commission proposed a third Payment Services Directive (PSD3) and a new Payment Services Regulation (PSR) on 28 June 2023. The Council and the European Parliament reached a provisional political agreement on 27 November 2025, the Council's Permanent Representatives Committee confirmed the final compromise texts in April 2026, and the Parliament's ECON committee approved them on 5 May 2026.
| Date | Step |
|---|---|
| 28 June 2023 | Commission proposals published |
| 23 April 2024 | Parliament first reading position |
| 27 November 2025 | Provisional political agreement |
| 5 May 2026 | ECON committee approves the agreed texts |
| Pending | Council first reading position, then Parliament plenary (indicative date 14 December 2026) |
| Pending | Publication in the Official Journal; entry into force 20 days later |
As at 17 October 2026, EUR-Lex lists both files only as Commission proposals and the Parliament's Legislative Observatory shows them as awaiting the Council's first reading position. PSD2 therefore remains the law, and applications in 2026 are assessed under it. The new rules apply only after a transition period that starts at entry into force, so they will not apply before 2028.
Build the application for PSD2 today and design the safeguarding, fraud and governance arrangements to the agreed PSD3 standard. Our guide to PSD3 and the Payment Services Regulation covers each change in detail.
UK payment institutions and EMIs lost their EU passporting rights on 31 December 2020. A UK firm can serve EU customers only through a subsidiary authorised in an EU Member State, with its own capital, directors, MLRO and safeguarding arrangements.
Many groups now hold an FCA authorisation and an EU licence side by side, with one group compliance framework adapted to each regulator. Lithuania, Ireland and the Netherlands are the most common choices for the EU entity. Plan the EU file as a stand-alone application: the regulator assesses the EU company on its own substance, not on the UK parent's record.
No regulator applies a lower standard, because all follow PSD2 and the EBA guidelines. Lithuania offers an English-language process, a €898 fee and a 3-month decision period, and Ireland an English-speaking regulator with no application fee.
Regulators must decide within 3 months of a complete application. The firm plans 6 to 8 months from submission to authorisation, plus one to three months for passporting.
PSD2 sets €20,000 for money remittance only, €50,000 for payment initiation and €125,000 for the core payment services. Account information providers hold professional indemnity insurance instead.
An EMI can issue electronic money, such as wallet balances and prepaid cards, as well as providing payment services. It needs €350,000 of initial capital, against a maximum of €125,000 for a payment institution.
Yes. A licence from one Member State can be passported to all 30 EEA countries by notification to the home regulator, without a second authorisation.
No. As at 17 October 2026 PSD3 and the Payment Services Regulation are agreed politically but not adopted or published in the Official Journal, so PSD2 remains the law.
Yes. UK firms lost EU passporting rights on 31 December 2020, so serving EU customers requires a subsidiary authorised in an EU Member State.
Only credit closely linked to a payment, repaid within 12 months and not funded from customers' payment funds, under PSD2 Article 18(4). Wider lending needs a separate licence.
Buckingham Capital Consulting has obtained payment and e-money authorisations in the UK and the EU since 2013, including a Central Bank of Ireland EMI licence for Own Solutions and FCA payment institution licences for Nexpay, Orbital and Global Send. The firm prepares the complete EU application file, from the programme of operations and DORA framework to the directors' approvals, and arranges the safeguarding and operating accounts alongside it.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.