An electronic money institution (EMI) in Europe operates under several regimes at once: the Electronic Money Directive for its licence, PSD2 for its payment services, MiCA where it issues stablecoins, the anti-money laundering rules, and DORA for its technology. Each is changing on its own timetable. The firms that supervise well are those that run them as one compliance framework with one calendar.
| Regime | Status at 17 October 2026 | Key date |
|---|---|---|
| Electronic Money Directive (2009/110/EC) | In force; governs EMI authorisation and capital | Applies until PSD3 replaces it |
| PSD2 (Directive (EU) 2015/2366) | In force; governs payment services | Applies until PSD3 and the PSR apply |
| PSD3 and Payment Services Regulation | Agreed politically; awaiting Council first reading position | Agreement 27 November 2025; plenary indicated for 14 December 2026 |
| MiCA (Regulation (EU) 2023/1114) | Fully applicable; transitional periods ended | E-money token rules since 30 June 2024; transition ended by 1 July 2026 |
| Transfer of Funds Regulation (EU) 2023/1113 | In force; payer and payee information on transfers | Since 30 December 2024 |
| Anti-Money Laundering Regulation (EU) 2024/1624 | Adopted; not yet applicable | Applies from 10 July 2027 |
| DORA (Regulation (EU) 2022/2554) | In force | Since 17 January 2025 |
An EMI is authorised by one national regulator under the Electronic Money Directive as written into that country's law. It may issue electronic money, provide payment services and run related operational services, but it may not take deposits, and it may not pay interest on e-money balances. E-money must be redeemable at any time and at par value.
Monitor own funds at each reporting date and model them against growth. A wallet business that doubles its outstanding e-money doubles its Method D requirement, so the capital plan should show where the next round of capital will come from before it is needed.
Safeguarding protects customers' money so it can be returned if the EMI becomes insolvent. Under Article 7 of the Electronic Money Directive, funds received in exchange for e-money are protected using the PSD2 methods: segregation in a separate account at a credit institution or in secure, liquid, low-risk assets, or an insurance policy or guarantee from a bank or insurer outside the group. Funds received by card or other payment instrument must be safeguarded once they are credited to the EMI and no later than five business days after the e-money is issued.
Supervisors look for four things in an EMI's safeguarding:
The agreed PSD3 text adds a central bank account option and EBA standards on spreading funds across banks, so review concentration now. The firm's safeguarding practice designs and tests these arrangements.
PSD3 repeals the Electronic Money Directive and makes issuing e-money a payment service, so EMIs become payment institutions with an e-money permission. The Council and Parliament reached a provisional agreement on 27 November 2025 and the Parliament's ECON committee approved the texts on 5 May 2026. As at 17 October 2026, EUR-Lex lists both only as Commission proposals and the Parliament's Legislative Observatory shows them awaiting the Council's first reading position.
The agreed text sets initial capital for issuing e-money at €250,000, added to €150,000 where the institution also provides core payment services and €50,000 for payment initiation. Existing EMIs continue through a transition and supply evidence to their regulator to confirm they meet the new rules.
What an EMI should have in place now:
Our guide to PSD3 and the Payment Services Regulation sets out each change.
Under MiCA, a stablecoin that references one official currency, such as the euro or the US dollar, is an e-money token. Only a credit institution or an EMI may offer one to the public in the EU, which places EMIs at the centre of the EU stablecoin market.
MiCA's transitional periods for crypto-asset service providers ended on 1 July 2026 at the latest in every Member State. An EMI that does not issue tokens but holds, transfers or exchanges them for customers must decide whether each activity is e-money, a payment service or a crypto-asset service, and hold the matching authorisation. See our guide to the MiCA stablecoin licence.
The EU is replacing national anti-money laundering rulebooks with one directly applicable regulation. The Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027, alongside the Sixth Anti-Money Laundering Directive and the new Anti-Money Laundering Authority (AMLA), set up by Regulation (EU) 2024/1620 in Frankfurt to coordinate national supervisors and directly supervise a limited number of high-risk cross-border firms.
Until then, EMIs follow their home state's law implementing the current directives, and the Transfer of Funds Regulation has required payer and payee information on transfers, including crypto-asset transfers, since 30 December 2024.
EMIs handle high volumes of cross-border, card and digital flows, so supervisors expect an anti-money laundering programme built on evidence:
| Element | What supervisors look for |
|---|---|
| Business-wide risk assessment | Risks by product, customer, country and channel, updated at least annually |
| Customer due diligence | Risk-based onboarding, with enhanced checks for higher-risk customers |
| Transaction monitoring | Rules set to the firm's actual flows, with alerts reviewed and documented |
| Sanctions screening | Customers and payments screened against EU and other relevant lists |
| Suspicious activity reporting | Clear escalation to the MLRO and timely reports to the financial intelligence unit |
| Agents and distributors | Onboarding, training and monitoring of every agent and distributor |
Use 2026 to map current procedures against the AMLR, which brings harmonised rules on customer due diligence, beneficial ownership and limits on large cash payments. The firm's financial crime practice runs these gap analyses.
The Digital Operational Resilience Act (DORA) has applied to EMIs since 17 January 2025. EMIs are technology-led and rely heavily on cloud, card processing and banking-as-a-service providers, so DORA reaches into vendor contracts, testing and incident handling.
| Major incident report | Deadline |
|---|---|
| Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours from becoming aware of it |
| Intermediate report | Within 72 hours of the initial notification |
| Final report | Within one month of the latest intermediate report |
Source: Commission Delegated Regulation (EU) 2025/301, Article 5.
An EMI should hold a board-approved ICT risk framework, a register of information on every ICT third-party arrangement, contracts that meet DORA's minimum terms, exit plans for critical providers, and an annual testing programme. On 18 September 2026 the EBA also published final Guidelines on the management of third-party risk, covering ICT and non-ICT arrangements that support critical or important functions, with a two-year transitional period. Our article on DORA and digital operational resilience covers the full requirements.
An EMI authorised in one Member State can passport across the 30 EEA countries, cross-border or through branches, agents and distributors. The home regulator remains responsible for prudential supervision, but the firm must also meet host-state rules where they apply: conduct and consumer law, anti-money laundering rules for establishments in the host country, complaints handling and statistical reporting.
Where an EMI operates in a host state through agents or distributors, the host state may require it to appoint a central contact point to oversee anti-money laundering compliance there. Keep a register of passports, agents, distributors and host-state obligations, and review it whenever the footprint changes.
The choice of home state shapes all of this for the life of the licence. Our guide to EU payment institution and EMI licensing by jurisdiction compares the main regulators.
Fraud prevention is a leading supervisory priority. Today, EMIs apply strong customer authentication under PSD2 and, for euro transfers, the payee verification required by the Instant Payments Regulation (Regulation (EU) 2024/886). The PSR will extend name and IBAN checks to every credit transfer and widen providers' liability for fraud, including refunds for bank impersonation scams.
Under PSD2, complaints must be answered within 15 business days, or 35 business days in exceptional cases with a holding reply. Customer terms must set out fees, redemption rights and how funds are safeguarded. EMI customers often include people who rely on digital accounts for everyday spending, so supervisors look for clear communications, accessible support and fair treatment of customers in vulnerable circumstances.
Supervisors expect the board to show that it oversees each of these areas, not only that policies exist. The evidence they look for:
| When | What EMIs need in place |
|---|---|
| Now | DORA framework, register of information and incident reporting; daily safeguarding reconciliation |
| Now | MiCA authorisation for any crypto-asset services, since the transitional periods have ended |
| Late 2026 | PSD3 gap assessment and capital model, ahead of the expected Parliament vote |
| 2026 to 2027 | Gap analysis and update of anti-money laundering procedures to the AMLR |
| 10 July 2027 | AMLR applies |
| Over the two-year transition | Third-party arrangements brought into line with the EBA guidelines of 18 September 2026 |
| From publication of PSD3 | Transition evidence pack for the home regulator; payee verification and fraud refund processes |
Running several changing regimes as one framework: PSD3 preparation, MiCA for e-money tokens, the AMLR from 10 July 2027 and DORA, across every country the EMI passports into.
Only a credit institution or an EMI may issue an e-money token. The issuer publishes a white paper, redeems at par at any time, pays no interest and keeps at least 30% of funds received on deposit with credit institutions.
Yes. DORA has applied to EMIs since 17 January 2025, covering ICT risk management, incident reporting, resilience testing and third-party risk.
The AMLR (Regulation (EU) 2024/1624) applies from 10 July 2027, replacing national rulebooks with one set of EU rules.
Yes, once adopted. The agreed text makes issuing e-money a payment service within the payment institution licence, with transitional arrangements for existing EMIs; as at 17 October 2026 it is not yet adopted.
Yes, by passporting to the other EEA countries, while meeting host-state conduct, anti-money laundering and reporting rules where they apply.
Funds received for e-money are safeguarded using the PSD2 methods; funds received by card or other payment instrument must be safeguarded no later than five business days after the e-money is issued.
Buckingham Capital Consulting has obtained e-money licences in the UK and the EU since 2013, including a Central Bank of Ireland EMI licence for Own Solutions and FCA EMI licences for Dzing Finance, Hryze and HFS. The firm builds and reviews EMI compliance frameworks across safeguarding, financial crime, DORA and PSD3 readiness, for firms operating from one Member State or passporting across Europe.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.