A payment institution is a company authorised to provide payment services, such as running payment accounts, executing transfers, issuing cards, acquiring card payments for merchants and sending money abroad. Unlike a bank, it cannot take deposits; unlike an electronic money institution (EMI), it cannot issue stored value that customers keep and spend later.
The Spanish regime is set by Royal Decree-Law 19/2018 of 23 November on payment services, which transposes the EU's second Payment Services Directive (PSD2), and by Royal Decree 736/2019 on the legal regime of payment services and payment institutions. The Banco de España authorises and supervises payment institutions, after a report from the Executive Service of the Commission for the Prevention of Money Laundering (SEPBLAC).
Royal Decree-Law 19/2018, Article 1.2, lists eight payment services. The authorisation is granted service by service, so the application should request exactly what the product needs.
| Payment service | Typical product | Initial capital |
|---|---|---|
| (a) and (b) Cash placed on and withdrawn from a payment account | Account with cash top-up or ATM access | EUR 125,000 |
| (c) and (d) Executing payment transactions, including from a credit line | Business payment account, SEPA transfers, direct debits | EUR 125,000 |
| (e) Issuing payment instruments and acquiring | Card issuing, merchant acquiring | EUR 125,000 |
| (f) Money remittance | International money transfer without an account | EUR 20,000 |
| (g) Payment initiation | Open banking payments from a customer's bank account | EUR 50,000 |
| (h) Account information | Open banking data aggregation | No capital; insurance required |
Spain is one of the four largest economies in the euro area and a common base for firms serving Spanish-speaking customers in Europe and building links with Latin America. Remittance, merchant acquiring and business payment firms use a Spanish licence to serve the domestic market and passport into the rest of the European Economic Area.
The Banco de España publishes a defined procedure, a statutory decision period and a fixed list of documents, and it expects real substance in Spain. Firms comparing Spain with other member states will find the trade-offs in the firm's guide to EU payment institution authorisation.
Initial capital is harmonised across the EU by PSD2, Article 7, and applied in Spain by Royal Decree-Law 19/2018. Where a firm requests several services, the highest applicable amount applies.
| Services requested | Minimum initial capital |
|---|---|
| Money remittance only | EUR 20,000 |
| Payment initiation only | EUR 50,000 |
| Any of services (a) to (e) | EUR 125,000 |
| Account information only | None; professional indemnity insurance instead |
After authorisation, own funds must never fall below the higher of the initial capital and the amount calculated under one of the three methods in the annex to Royal Decree 736/2019 (Articles 17 and 18). The firm notifies the Banco de España every three years, in January, which method it will use. Payment initiation and account information providers must also hold professional indemnity insurance, or an equivalent guarantee, covering the territories where they operate (Royal Decree-Law 19/2018, Article 16).
The capital figure is a floor. The business plan must also fund staff, technology, audit, safeguarding banking and compliance for the first three years, including a case where volumes grow more slowly than planned.
Royal Decree-Law 19/2018, Article 14, allows a firm to register as a small payment institution instead of seeking full authorisation. The threshold is a value test: the average monthly value of payment transactions over the previous 12 months, including those through agents, must not exceed EUR 3 million.
| Point | Small payment institution | Authorised payment institution |
|---|---|---|
| Services | (a) to (f) only | All eight services |
| Volume limit | EUR 3 million average monthly value | None |
| How it starts | Registration, effective 20 days after filing | Authorisation, decided within 3 months |
| EU passporting | Not available | Available |
| Above the threshold | Apply for authorisation within 30 calendar days | Not applicable |
The small route suits a domestic launch with modest volumes. A firm that expects to exceed EUR 3 million a month, or to serve other EU countries, should apply for full authorisation from the start.
Royal Decree-Law 19/2018, Article 11.3, requires the central administration, the registered office and part of the payment activity to be in Spain. The Banco de España looks for decisions taken in Spain by people who are present and accountable, rather than a registered address alone.
Directors and general managers are assessed for good repute, knowledge and experience, and the application includes the evidence for each of them. The board should combine payments, finance, risk and compliance experience, with enough independence to challenge the business.
Significant shareholders are assessed for reputation and financial soundness, and the source of their capital must be documented. Foreign founders can own a Spanish payment institution on the same terms as Spanish founders.
The same figures should appear throughout the file: volumes, staff, providers and costs in the business plan, the risk assessment and the financial model. A consistent file is the main factor in a shorter review.
Royal Decree 736/2019, Article 2.1, lists the contents of an application. The main items are below.
| Document | What it shows |
|---|---|
| Programme of operations | Each payment service, customers, channels and markets |
| Business plan | Forecasts for the first three financial years |
| Evidence of initial capital | Capital paid up at the required level |
| Safeguarding | The method chosen and how funds are segregated and reconciled |
| Governance and internal control | Board, risk management, compliance and internal audit |
| Incident and complaints procedures | Security incident handling and customer complaints |
| Sensitive payment data and continuity | How data is protected and how the service continues in a disruption |
| Security policy | Risk assessment and security controls |
| Anti-money laundering controls | Risk assessment, due diligence, monitoring and reporting |
| Organisation, agents and outsourcing | Structure, use of agents and outsourced functions |
| Shareholders, directors and auditors | Identity and fitness evidence |
| Articles and registry certificate | Corporate purpose, registered office and central administration in Spain |
| Insurance | Professional indemnity cover for payment initiation and account information |
A payment institution that holds customer funds must protect them using one of two methods (Royal Decree-Law 19/2018, Article 21, applying PSD2, Article 10). Funds not paid out by the end of the business day after receipt are either held in a separate account at a credit institution or invested in low-risk assets, or covered by an insurance policy or bank guarantee for the full amount.
Royal Decree 736/2019, Article 16, adds detail: eligible assets are demand deposits at EU credit institutions and zero risk-weighted assets, and an insurance or guarantee must be direct, payable on first demand and cover funds received through agents. The Banco de España looks for daily reconciliation, written procedures and named responsibility. The firm's safeguarding and client assets service designs these arrangements and sources the accounts.
A Spanish payment institution is an obliged entity under Law 10/2010 on the prevention of money laundering and terrorist financing. SEPBLAC reports to the Banco de España on the applicant's framework before authorisation and supervises it afterwards.
Remittance and cross-border businesses receive close attention. The application should show a business-wide risk assessment, customer due diligence by customer type and corridor, sanctions screening, transaction monitoring tuned to the product, and agent oversight where agents are used. The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027, so frameworks written now should anticipate it.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025. A payment institution needs a board-approved ICT risk framework, major incident classification and reporting, resilience testing, a register of ICT third-party arrangements and exit plans for critical providers.
Most payment institutions use outsourced platforms for accounts, card processing, screening and identity checks. The Banco de España expects due diligence on each provider, DORA-compliant contracts and people inside the firm who understand and control each outsourced service.
Royal Decree-Law 19/2018, Article 11.2, gives the Banco de España three months to decide. If no decision is notified in that time the application is treated as refused, so the file should be complete and consistent when it is submitted. A small payment institution registration takes effect 20 days after a complete filing.
| Stage | Typical duration | Basis |
|---|---|---|
| Preparation of the application | 2 to 4 months | Firm's planning figure |
| Statutory decision period | 3 months | Royal Decree-Law 19/2018, Article 11.2 |
| Submission to authorisation | 6 to 8 months | Firm's planning figure, including questions |
| Small payment institution registration | 20 days from a complete filing | Royal Decree 736/2019, Article 4 |
An authorised Spanish payment institution can provide its services in other EEA states under the freedom to provide services, through a branch or through agents in the host state. The Banco de España sends the notification to the host authority before activity begins. Host-state consumer, anti-money laundering and marketing rules still apply.
Before using an agent the firm informs the Banco de España of the agent's details, its anti-money laundering controls and how it selects and trains agents; the Banco de España then enters the agent in its register (Royal Decree 736/2019, Article 13). The firm is responsible for its agents' acts, must check them at least once a year and must publish an up-to-date list of agents.
A payment institution may process euro payments into and out of a business that deals in crypto-assets, but it cannot issue stablecoins. Under the Markets in Crypto-Assets Regulation (MiCA), e-money tokens may be issued only by credit institutions and EMIs, and custody, exchange or transfer of crypto-assets for customers is a separate crypto-asset service that needs authorisation from the CNMV in Spain.
A product that combines fiat payments with stablecoin settlement should be mapped service by service before choosing the licence, as covered in the firm's guide to MiCA CASP authorisation.
The EU's proposed third Payment Services Directive (PSD3) and Payment Services Regulation (PSR) will replace PSD2 and bring payment institutions and EMIs under one framework, with stronger rules on fraud, safeguarding and access to payment systems. The Council and Parliament reached political agreement in late 2025. At the date of review the texts had not been formally adopted or published in the Official Journal, so Royal Decree-Law 19/2018 remains the governing law.
Once adopted, existing payment institutions are expected to have a transition period to show compliance with the new rules. Applications prepared in 2026 should be written to meet both regimes, as set out in the firm's PSD3 and PSR briefing.
An existing Spanish payment institution can be acquired, but the buyer is assessed as a significant shareholder before completion, and due diligence on the target's compliance record is essential.
The firm's Spain payment institution licence service prepares the full application to this standard and manages the Banco de España review through to authorisation.
EUR 20,000 for money remittance only, EUR 50,000 for payment initiation only and EUR 125,000 for accounts, transfers, card issuing or acquiring. Ongoing own funds requirements apply after authorisation.
The average monthly value of payment transactions over the previous 12 months must not exceed EUR 3 million. A small payment institution cannot passport and must apply for full authorisation within 30 calendar days of exceeding the threshold.
The law gives it three months, and an application not decided in that time is treated as refused. The firm plans 6 to 8 months from submission to authorisation.
Yes, for executing payments, but it is not a deposit. The funds must be safeguarded in a separate account or covered by insurance or a bank guarantee.
No. A balance that customers keep and spend later is e-money and requires an EMI licence.
Yes, subject to the Banco de España's assessment of significant shareholders and the requirement for central administration and part of the activity in Spain.
An authorised payment institution can passport across the EEA after notification through the Banco de España. A small payment institution cannot.
Yes, as a regulated acquisition. The Banco de España assesses the new significant shareholders before completion.
Buckingham Capital Consulting has obtained payment institution authorisations for firms including Nexpay, Orbital and Global Send since 2013, and prepares Spanish payment institution applications to the Banco de España's published requirements. The firm builds the capital plan, safeguarding, anti-money laundering and DORA frameworks alongside the application, and arranges the safeguarding and operating accounts the institution needs to launch.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.