EMI License & Payment Institution Authorisation: Jurisdictions & Requirements

What Is EMI & Payment Institution Licensing?

EMI and Payment Institution licensing is the regulatory authorisation a business needs to legally issue electronic money or provide payment services. The licence is granted by a national financial regulator under one of two EU directives, or under the equivalent regime in non-EU European jurisdictions, and prescribes which activities the operator may perform, what capital must be held, how client funds must be safeguarded, and how the operator must report on operational and financial resilience.

The two EU regimes sit alongside each other. EMD2 (Directive 2009/110/EC) governs EMI authorisation, with minimum initial capital of €350,000 under Article 4 and ongoing own funds calculated under Method D, set at 2% of average outstanding electronic money under Article 5.^[1] PSD2 (Directive (EU) 2015/2366) governs PI authorisation, with tiered initial capital of €20,000 (money remittance only), €50,000 (payment initiation), or €125,000 (any Annex I points 1 to 5 service) under Article 7. PIs must also hold ongoing own funds under Article 9, calculated using Method A, B, or C as determined by the competent authority. Providers offering only payment initiation, account information, or both are outside that Article 9 requirement. PIS providers still need €50,000 initial capital under Article 7 and professional indemnity insurance or a comparable guarantee under Article 5(2); AIS-only providers need insurance or a comparable guarantee under Article 5(3), as retained by Article 33.^[2]

An EMI permission set can include PI permissions. For a hybrid EMI, EMD2 Article 5 requires Method D for issuance plus the competent authority’s selected PSD2 Method A, B, or C amount for payment services unrelated to issuance. Required own funds are at least the sum of those limbs, subject to the €350,000 initial-capital floor and the applicable supervisory adjustments; the calculations remain separate and are not offset.^[1][2]

The framework is in its deepest transition since EMD2 was first adopted in 2009. PSD3 and the directly applicable Payment Services Regulation (PSR) reached provisional political agreement on 27 November 2025 in Strasbourg, closing inter-institutional negotiation that began with the European Commission's June 2023 proposals,^[3] and technical work continued afterwards to finalise the texts.

The final compromise texts are Council documents ST-8221-2026-INIT (PSR) and ST-8222-2026-INIT (PSD3), dated 17 April 2026; COREPER confirmed the provisional agreement on 22 April 2026. The ECON Committee voted on 5 May 2026. As of 10 September 2026, the Parliament listed 14 December 2026 as the indicative plenary date; Official Journal publication follows formal adoption by both institutions and has no fixed date.

Under the agreed texts, the PSR would generally apply 21 months after entry into force, with the Verification of Payee provisions under PSR Articles 50 and 57 applying 27 months after entry into force; PSD3 would require transposition within 21 months, and payment institutions authorised, and e-money institutions active, before that point could continue for up to 27 months while competent authorities verify compliance. Neither text can take general effect before July 2028.^[4]

Under the agreed texts, PSD3 and the PSR would reshape rather than tighten the regime, with four substantive changes for EMIs and PIs:^[5]

• EMD2 would be repealed; EMIs would become a sub-category of payment institutions, with Method D preserved for the e-money activity.
• One or more safeguarding methods may be used; where segregation is selected, firms should manage concentration and, where appropriate, endeavour not to keep all safeguarded funds with one credit institution.
• A stronger fraud framework would be introduced, including a PSP refund obligation where a fraudster impersonates the consumer’s own PSP.
• Verification of Payee (an IBAN-and-name check), mandatory for euro credit transfers under the Instant Payments Regulation since 9 October 2025 in the euro area, would extend to all credit transfers 27 months after the PSR enters into force.^[26]

Central-bank safeguarding is already a legal option under PSD2 Article 10 as amended by the Instant Payments Regulation, at the central bank’s discretion; it does not await PSD3. However, ECB Decision (EU) 2025/222 Article 3 prohibits Eurosystem central banks from providing safeguarding accounts to non-bank payment service providers or CASPs. TARGET settlement access does not replace a safeguarding arrangement.^[38][39]

Three other regimes determine what an EMI/PI mandate looks like in 2026. The DORA Regulation (EU) 2022/2554 has applied to EU EMIs and PIs, including institutions exempted under EMD2 or PSD2, since 17 January 2025; the European Supervisory Authorities designated the first 19 critical ICT third-party providers on 18 November 2025.^[6] The EU AML Reform Package (Regulation (EU) 2024/1624, the AMLR; Regulation (EU) 2024/1620 establishing AMLA; Directive (EU) 2024/1640, the AMLD6) applies largely from 10 July 2027: the AMLR applies generally from that date and most of AMLD6 must be transposed by it, but AMLD6’s beneficial-ownership access rules were due earlier (Article 74 by 10 July 2025; Articles 11 to 13 and 15 by 10 July 2026) and its single access point to real estate information (Article 18) is due by 10 July 2029. AMLA has been operational since 1 July 2025 at its Frankfurt headquarters in the Messeturm.^[7] MiCA Regulation (EU) 2023/1114 Article 48(1) requires every e-money token (EMT) issuer to be authorised as either a credit institution or an EMI under EMD2; Circle Internet Financial Europe SAS, authorised by the ACPR on 1 July 2024, was the first global stablecoin issuer to comply.^[8]

An EMI or PI licence is not a single product. EU EEA-passport regimes (the fourteen Member State authorities) offer single-market access from a single home regulator, but with sharply diverging supervisory intensity: the Bank of Lithuania revoked a run of EMI and PI licences between 2022 and Q2 2026, while the Central Bank of Ireland's "Dear CEO" letter cycle from January 2023 onwards raised the safeguarding bar across the Irish payments population. The United Kingdom recoupled rather than decoupled: the FCA's new CASS 15 regime under PS25/12 took effect on 7 May 2026, materially raising the safeguarding standard.

A Swiss FINMA Article 1b fintech licensee whose business model focuses on Swiss-franc payment services is eligible, subject to SNB criteria, to participate in Swiss Interbank Clearing with a Swiss National Bank sight account; authorised EU/EEA payment and e-money institutions have been able to request TARGET participation since 6 October 2025.

The decision is rarely which jurisdiction has the lowest application fee. It is which jurisdiction the safeguarding banks, scheme operators, correspondent network, and target markets will all accept.

Who Needs an EMI or PI Licence?

E-money issuance and payment services require the permission appropriate to the activity, subject to statutory exclusions and exemptions. An EMI or credit institution may issue e-money; PI authorisation covers the permitted payment services. AIS-only providers follow PSD2 Article 33 registration rather than full PI authorisation. Product names and the mere holding of a balance do not determine the route.

Electronic money issuers are the core EMI population. The legal definition of electronic money under EMD2 Article 2(2) is "electronically, including magnetically, stored monetary value as represented by a claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions, and which is accepted by a natural or legal person other than the electronic money issuer." Prepaid cards, e-wallets, gift programmes, employee benefit cards, B2B payout cards, in-app stored balances, and electronic vouchers fall within this definition only if all its elements are met and no applicable exclusion applies.

Initial capital is €350,000; ongoing own funds under Method D are 2% of average outstanding e-money, with competent authorities authorised to vary by ±20% based on internal-control adequacy.^[1]

An IBAN wallet, balance and debit card do not by themselves establish e-money issuance. Classification depends on the actual arrangements and EMD2 Article 2(2), including an agreement to issue a monetary asset separate from the funds received. A fintech combining e-money issuance with payment services may need a hybrid EMI/PI permission set. The Bank of Lithuania reproduces this distinction from the CJEU’s judgment in C-661/22, paragraphs 47 and 48.^[35]

Hybrid applicants must compute Method D for e-money issuance and the competent authority’s selected Method A, B, or C for unrelated payment services separately, with no offsetting, and present the resulting sum subject to the initial-capital floor and permitted supervisory adjustments.^[1][2]

Practitioner observation: misclassifying a hybrid as a pure EMI at application stage is one of the most common causes of regulator-required re-papering, second only to safeguarding-bank attestation gaps.

Payment Institutions without e-money are the PI-only population: B2B cross-border payment processors, money remittance houses, card acquirers, foreign-exchange specialists, payroll providers, and merchant payment facilitators. The licence is PSD2-only with the lower tiered capital floor under Article 7, and many of these operators eventually upgrade to EMI authorisation as their business model develops stored-value features.

Open banking providers sit in two categories under PSD2 Article 4. Payment Initiation Service Providers (PISPs) initiate payment orders from a customer's account at another PSP and require €50,000 initial capital under PSD2 Article 7(b), plus professional indemnity insurance or a comparable guarantee under Article 5(2). Account Information Service Providers (AISPs) aggregate account information across PSPs. AIS-only providers follow Article 33 registration, with insurance or a comparable guarantee under Article 5(3) and no Article 7 initial capital. Providers offering only PIS, AIS, or both are outside the ongoing own-funds requirement in Article 9; other PIs hold own funds using Method A, B, or C as determined by the competent authority.

Under the agreed texts, the open-banking rules would sit in the directly applicable PSR: account servicing providers would need at least one dedicated data-access interface for AISPs and PISPs (Article 35) and a dashboard letting the customer monitor and withdraw data access (Article 43). The PSR would also require a consumer’s own payment service provider to refund authorised payments that a third party induced by impersonating that provider through communication channels attributed to it, provided the consumer notified the provider without undue delay and reported the fraud to the police; the refund does not apply where the consumer acted fraudulently or with gross negligence (Article 59).^[26]

E-money token issuers under MiCA Article 48 are the newest population. The standard EU route requires an EMT issuer to be authorised as a credit institution or an EMI, subject to the limited exceptions in MiCA Articles 48(4)–(5).^[8] The issuer’s bank or EMI authorisation governs the issuance permission; MiCA Title IV governs the white paper (Article 51), issuance and redemption at par, investment of the funds received, prohibition on interest payment to holders under Article 50, and the EBA significant-token regime under Article 56. Editorial position: the Circle-ACPR template of July 2024 has made France the de facto MiCA EMT domicile in 2026.

For a euro-stablecoin issuer targeting European institutions, France is a candidate to assess against the planned issuance model, target markets, and banking requirements.

Crypto-asset service providers adding fiat rails are a growing subset. A MiCA CASP authorisation under Regulation (EU) 2023/1114 does not include payment services or e-money issuance. A CASP adding fiat services must assess the actual funds flow: payment services may require PI permissions, while issuing e-money requires an EMI or credit-institution route. An IBAN or a retained payment-account balance alone does not establish e-money issuance, as the Court of Justice clarified in ABC Projektai (C-661/22).^[40] The two regimes are coordinated but not consolidated; several large CASPs operate both authorisations in parallel from the same home regulator, with shared governance, AML, and risk-management documentation. An independent specialist introduced through our crypto licensing service handles the parallel application sequencing.

Embedded finance and Banking-as-a-Service operators sit in a fourth band. A marketplace that holds buyer funds in escrow before releasing to seller, a ride-share platform that pays drivers from a stored balance, a payroll platform that holds salary funds before distribution, or a vertical-SaaS product that offers card programmes to its customers is typically issuing electronic money or providing payment services, depending on the specific funds-flow and contractual structure.

The CJEU judgment in Case C-661/22 ABC Projektai UAB v Lietuvos bankas on 22 February 2024 materially clarified the EMI/PI border: where funds are received without being immediately accompanied by a payment order, the activity is a payment service rather than e-money issuance, unless the customer has consented to e-money issuance via a contractual agreement.^[9] Several embedded-finance operators that historically classified themselves as EMIs may need to re-classify under the ABC Projektai test.

Where to Get Licensed

This European comparison has two tiers: fourteen EU EEA-passport jurisdictions where a single home authorisation extends to all 30 European Economic Area Member States, and three non-EU European jurisdictions (United Kingdom, Gibraltar, Switzerland) that operate independent regimes with selective bilateral access. The right choice depends on target markets, banking tolerance, capital position, and the depth of substance the operator can credibly provide on the ground.

Tier 1: EU EEA-passport (14 jurisdictions)

The EU regulated tier is where MiCA EMT issuance, SEPA access, and pan-European passporting live, and where supervisory intensity has risen materially since 2023.

France is the credible domicile for serious euro-stablecoin and EMT issuance in 2026. The ACPR authorises EMIs under the Code monétaire et financier, Articles L.526-1 et seq., with safeguarding obligations at L.526-32 et seq. Initial capital is €350,000. Circle Internet Financial Europe SAS, authorised on 1 July 2024, was the first global stablecoin issuer to comply with MiCA Article 48 via ACPR-issued EMI authorisation; on 20 April 2026 Circle France additionally received AMF approval under MiCA Article 60(4), the notification route for an EMI’s own tokens, to provide custody and transfer services for USDC and EURC across the EEA without separate CASP authorisation (announced 4 May 2026).^[8][27]

Realistic timeline: 13 to 18 months. Corporate tax: 25% normal rate. A separate 3.3% social contribution may apply to corporate tax above a €763,000 annual allowance, subject to exemptions; reduced SME rates and other contributions need a company-specific assessment.^[37] Editorial position: when an operator says "I want a MiCA EMT licence", France is the answer unless there is a specific banking, substance or market reason to go elsewhere.

Ireland is an EU domicile to assess for embedded finance, Banking-as-a-Service, and large-float EMI businesses. The Central Bank of Ireland (CBI) authorises EMIs under the European Communities (Electronic Money) Regulations 2011 (SI 183/2011) and PIs under the European Union (Payment Services) Regulations 2018 (SI 6/2018). Initial capital is €350,000.

The CBI's 20 January 2023 "Dear CEO" letter to the payments industry required external safeguarding audit by 31 July 2023 (subsequently extended to 31 October 2023 by the CBI's 25 May 2023 Safeguarding Notice), and has driven a step-change in safeguarding bar across the Irish population.^[10] Per CBI data, the Irish PI/EMI population expanded from 14 firms in 2016 to 51 in 2023, with safeguarded funds rising from €726 million to €7.82 billion over the same period; this is by far the fastest-growing sector under CBI supervision.^[11] Realistic timeline: 16 to 24 months. Corporate tax: 12.5% trading rate.

Practitioner observation: Ireland is not a "fast-track" jurisdiction. It is the credible jurisdiction. Operators who position it as fast are mismeasuring the file.

Lithuania remains the largest single EMI cluster in the EU by count, but the supervisory cycle has changed materially. The Bank of Lithuania (Lietuvos bankas) authorises EMIs under the Law on Electronic Money and Electronic Money Institutions and PIs under the Law on Payments, with initial EMI capital of €350,000 and an application fee of €1,463. Between 2022 and Q2 2026 the regulator revoked a run of EMI and PI licences, including:^[12]

• Payrnet (June 2023).
• Transactive Systems (1 June 2023), with a €280,000 fine.
• Majestic Financial (28 March 2024); on 27 February 2026 the Regional Administrative Court annulled that decision at first instance and returned the sanction to the Bank of Lithuania.
• Foxpay (22 November 2024); Foxpay's subsequent appeal was rejected by the Regional Administrative Court on 16 March 2026.
• Fundstr (20 June 2025), for severe and systematic AML and CTF breaches.
• KogoPay (22 July 2025), for failure to meet own-funds requirements and insolvency.
• Paytend Europe (4 March 2026), for AML and TF breaches.

Finolita Unio's appeal against the 8 June 2021 revocation was definitively rejected by the Supreme Administrative Court of Lithuania (LVAT) in November 2024. The regulator also fined more than 20 firms over €4 million in aggregate over the same period. The PSP Lab 2025 outlook, a consultancy count, records zero new EMI or Authorised PI authorisations in Lithuania from January to August 2025,^[13] though the Bank of Lithuania did grant payment-institution licences with EMT scope to MiCA CASP applicants (including Decentralized and Nuvei) in December 2025. The Bank of Lithuania’s own count fell from 141 institutions (88 EMIs and 53 Payment Institutions) at the end of Q1 2022 to 119 licensed institutions (76 EMIs and 43 Payment Institutions) at end-2024, a year in which it issued three licences and revoked nine; its EMI list checked on 29 September 2026 contained 70 institutions with a full licence.^[12][28]

CENTROlink, the Bank of Lithuania’s payment system, still gives licensed EMIs and PIs direct access to SEPA schemes, but access has tightened for high-risk verticals post-Payrnet. Standard corporate income tax: 17%.

Editorial position: Lithuania is no longer the default jurisdiction for greenfield EMI applications in 2026. For established applicants with substantive Lithuanian operating teams and strong AML track records, it remains viable. For opportunistic applicants chasing a "fast" EU passport, the gate is operationally closed.

Netherlands has become the rising net beneficiary of the flow away from Lithuania and the UK. DNB authorises EMIs and PIs under the Wet op het financieel toezicht (Wft) of 28 September 2006, with the EMI licence requirement at Section 2:10a, the payment-institution licence requirement at Section 2:3a and safeguarding at Sections 3:29a and 3:29aa; the AFM handles conduct supervision.^[29]

Initial capital is €350,000. Realistic timeline: 13 to 21 months. Corporate tax: 19% on taxable profits up to and including €200,000, and 25.8% on the excess. Practitioner observation: DNB has emerged as the most pragmatic of the large EU regulators, with a credibility-and-speed balance close to Ireland's at materially shorter timelines.

Luxembourg is the financial-services hub of choice for large institutional payment operators and fund-services payment overlays. The CSSF authorises EMIs and PIs under the Loi du 10 novembre 2009 relative aux services de paiement, as amended by the Law of 20 July 2018 transposing PSD2. PI authorisation at Article 7; EMI authorisation at Articles 24-2 et seq.

Initial EMI capital is €350,000. Circular CSSF 26/906 of 20 January 2026 sets central administration, internal governance and risk-management requirements for Luxembourg PIs and EMIs, with a compliance deadline of 30 June 2026; Circular CSSF 22/806 governs outsourcing.^[30] Realistic timeline: 16 to 24 months. Substance is heavily weighted in the supervisory cycle.

The standard combined corporate income tax rate in Luxembourg City is 23.87% from tax year 2025. Municipal rates differ outside the city; the actual liability depends on the company's taxable position.

Malta serves the MiCA-adjacent fintech population well, with a single regulator covering crypto, payments, and securities. The MFSA authorises EMIs and PIs under the Financial Institutions Act, Chapter 376 of the Laws of Malta (1994), with subsidiary MFSA Financial Institution Rules. Initial capital is €350,000. PSP Lab, a consultancy, recorded five new Maltese EMI licences in the first eight months of 2025 but ten Authorised PI cancellations against four new PI authorisations, a sign that the payments side of the supervisory cycle is tightening.^[13]

Realistic timeline: 12 to 16 months. Corporate tax: 35% headline; around 5% effective on distributed trading profits after the 6/7ths shareholder refund (about 10% on passive interest and royalties), subject to substance and anti-abuse tests.

Cyprus overlaps with the forex broker population and is a credible mid-tier EMI domicile. The Central Bank of Cyprus authorises EMIs under the Electronic Money Law of 2012 (L.81(I)/2012) and PIs under the Provision and Use of Payment Services and Access to Payment Systems Law of 2018 (L.31(I)/2018). The CBC issued an updated Electronic Money Institutions Directive of 2025.

Initial capital is €350,000.^[14] Corporate tax was raised to 15% for tax years from 1 January 2026 onwards, gazetted 31 December 2025; profits earned in FY 2025 remain at 12.5%.

Estonia is realistic only for native Estonian operating teams with deep AML capabilities. The Finantsinspektsioon (FI) authorises EMIs and PIs under the Makseasutuste ja e-raha asutuste seadus, enacted 17 December 2009. On 29 September 2026 the FI’s register listed nine Estonian payment institutions, plus two operating under an exemption, and four e-money institutions, including Lightspark Payments Europe, which the FI authorised as an EMI and crypto-asset service provider in June 2026.^[31] Post-Danske, the FI has been one of the most cautious EU regulators for new EMI applications.

Corporate tax: 22% on distributed profits, with no tax on retained earnings, a meaningful advantage for reinvested fintech growth. Practitioner observation: the FI's caution reflects a deliberate post-Danske policy; new EMI applications by foreign promoters without substantive Estonian presence are rarely successful.

Belgium is mid-tier with strong correspondent banking access through the Eurosystem. The National Bank of Belgium (NBB) authorises EMIs and PIs under the Loi du 11 mars 2018 relative au statut et au contrôle des établissements de paiement et des établissements de monnaie électronique, Belgian Official Gazette 26 March 2018. Safeguarding at Article 42 (PI) and Article 194 (EMI). Initial capital is €350,000. Corporate tax: 25%.

Latvia consolidated payment supervision when Latvijas Banka absorbed the former Financial and Capital Market Commission (FCMC) on 1 January 2023, and the Law on Payment Services and Electronic Money was amended to transfer competence. Initial capital is €350,000. Banking access remains constrained by the Baltic-wide post-ABLV de-risking cycle. Corporate tax: 20% on distributed profits (Estonian model).

Germany is among the most supervision-intensive options in the EU: BaFin authorises EMIs and PIs under the Zahlungsdiensteaufsichtsgesetz (ZAG), enacted by Act of 17 July 2017, in force 13 January 2018. §10(1) PI; §11(1) EMI; §17 PI safeguarding; §18 EMI safeguarding; §12 capital tiers. Initial EMI capital is €350,000.

The post-Wirecard FISG, passed in May 2021 and largely in force from 1 July 2021, gave BaFin direct intervention powers over outsourcing companies from 2022; BaFin’s parallel internal reform created its Focus Units.^[15] The 4 November 2025 Operation Chargeback action day, led by the Koblenz General Prosecutor's Office and the BKA with Europol and Eurojust support, targeted three criminal networks suspected of causing an estimated €300 million in damages affecting 4.3 million cardholders across 193 countries.^[16]

Realistic timeline: 18 to 27 months. Corporate tax: approximately 30% all-in.

Practitioner observation: BaFin is now Tier-1 global supervision intensity. Choose Germany only if the business is operated out of Germany with German-resident senior management; the regulator is unforgiving of remote-substance applications.

Spain is a quietly active domicile with deep Iberian and LatAm market access. The Banco de España authorises EMIs under Ley 21/2011 de 26 July 2011 de dinero electrónico (BOE-A-2011-12909) and PIs under Real Decreto-ley 19/2018, with implementing rules in Real Decreto 778/2012 (EMI) and Real Decreto 736/2019 (PI).

Initial capital is €350,000. PSP Lab, a consultancy, counts two new Spanish Authorised PI licences in 2025 and cancellations equal to 37.5% of new authorisations.^[13] Corporate tax: 25%.

Italy remains a difficult application jurisdiction in 2026. Banca d'Italia authorises EMIs ("IMEL") under Title V-bis of the Testo Unico Bancario (D.Lgs. 385/1993), with the IMEL register maintained under Article 114-quater TUB, and PIs under Decreto Legislativo 27 gennaio 2010, n. 11.

Initial EMI capital is €350,000. PSP Lab, a consultancy, puts Italian cancellations at 78.57% of new Authorised PI authorisations and 50% of new EMI authorisations, rates it lists among Europe’s regulatory red flags.^[13]

Italian EMIs and PIs need the financial-intermediary tax calculation: IRES at 24% plus the 3.5% sector surcharge, and base IRAP at 6.65% for calendar tax years 2026–2028 before regional adjustments. IRES and IRAP have different tax bases, so adding their rates does not produce a reliable all-in profit-tax rate.^[41]

Poland is the largest non-Baltic Central European market and a growing fintech hub. The Komisja Nadzoru Finansowego (KNF) authorises EMIs and PIs under the Ustawa z dnia 19 sierpnia 2011 r. o usługach płatniczych (consolidated Dz.U. 2025 poz. 611). PI authorisation at Article 60. Initial EMI capital is €350,000. Corporate tax: 19% (9% on non-capital-gains income for eligible small taxpayers or first-year businesses, subject to prior-year and tax-year revenue limits of up to €2 million and Article 19 exclusions).

Tier 2: Non-EU European (United Kingdom, Gibraltar, Switzerland)

The non-EU European tier offers independent regulatory regimes with selective bilateral access: EU passporting is not available, and UK and Swiss licensees access EU markets via local establishment or reverse solicitation under national rules.

United Kingdom is recoupling rather than decoupling. The FCA authorises EMIs under the Electronic Money Regulations 2011 (SI 2011/99) and PIs under the Payment Services Regulations 2017 (SI 2017/752). Initial capital for an Authorised EMI is €350,000, a floor the EMRs 2011 express in euro; PI tiers mirror PSD2. EEA passporting was unilaterally lost on 1 January 2021. The major 2026 change is FCA Policy Statement PS25/12, published 7 August 2025, which introduces the Payments and Electronic Money (Safeguarding) Instrument 2025 (FCA 2025/38) with new CASS 15, SUP 3A and SUP 16.14A (the "Supplementary Regime") in force from 7 May 2026.^[17] The CASS 15 obligations are:

• Daily safeguarding reconciliations, excluding weekends and public holidays.
• Maintained resolution pack.
• Annual reasonable-assurance safeguarding audit by a qualified auditor, with a six-month submission window for the first audit report and four months thereafter.
• Monthly regulatory return.

An audit exemption applies where a firm has not been required to safeguard more than £100,000 of relevant funds at any time over a period of at least 53 weeks; until 14 May 2027 that period runs from 7 May 2026. The "Post-Repeal Regime", introducing a statutory trust over relevant funds, has been deferred pending Supplementary Regime bedding-in. Realistic FCA application timeline: 9 to 16 months. Corporate tax: 25% (19% small profits rate).

Practitioner observation: FCA reputation among acquirers and correspondent banks is recovering after the 2021-2023 wind-down wave. CASS 15 gives acquirers and banks a concrete safeguarding standard against which to test a UK EMI.

Gibraltar is the UK gateway. The Gibraltar Financial Services Commission (GFSC) authorises EMIs and PIs under the Financial Services Act 2019. UK market access currently rests on transitional arrangements, pending the permanent Gibraltar Authorisation Regime under Schedule 2A FSMA 2000 (inserted by the UK Financial Services Act 2021, c. 22). Sector-specific transitional passporting for PSPs and EMIs under Schedule 7 PSRs 2017 and regulation 74A EMRs 2011 was extended to 31 December 2026 by the Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2025 (SI 2025/1182).^[18] Initial EMI capital is €350,000. Corporate tax: 15% (from 1 July 2024).

Switzerland has no direct EMI equivalent. Three Swiss authorisation options exist for the EMI use case:^[19]

• The FinTech licence under Article 1b BankA (the "fintech licence"): permits public deposits up to CHF 100 million without interest payment and without investment of deposits, with minimum capital of 3% of the public deposits and collectively held crypto-based assets accepted, at least CHF 300,000.
• A full banking licence: minimum CHF 10 million.
• The Banking Ordinance sandbox exemption (Article 6(2) BankO): public deposits up to CHF 1 million, generally not invested or remunerated, with depositors told in advance that they are unsupervised and unprotected.^[32]

On 29 September 2026, FINMA's published list showed six Article 1b licensees.^[32] The Federal Council opened a consultation on 22 October 2025 (closing 6 February 2026) on an amendment to the Financial Institutions Act (FinIA) proposing two new licence categories: payment instrument institutions, which would replace the existing fintech licence, remove the CHF 100 million client-deposit limit and be allowed to issue a special type of stablecoin; and crypto-institutions. No dispatch to Parliament had been published by 29 September 2026, so no entry-into-force date is set.^[32]

Swiss Article 1b fintech licensees focused on Swiss-franc payments are among the domestic participants eligible, subject to SNB criteria, for Swiss Interbank Clearing (SIC) with a Swiss National Bank sight account; central-bank settlement access is not unique to Switzerland, since UK authorised EMIs and PIs can apply for Bank of England RTGS settlement accounts and EU/EEA ones can request TARGET participation.

FINMA Guidance 01/2026 of 12 January 2026 on the custody of crypto-based assets directly affects any Swiss EMI-equivalent dealing with stablecoins or token custody. On our planning estimate, all-in cost runs CHF 1.8 million to CHF 3.2 million for fiat payment business. Corporate tax: 11.7% to 20.5% canton-dependent (2026).^[34]

Jurisdiction comparison

All fourteen EU jurisdictions in the table below share the EMD2 Article 4 initial capital of €350,000 and offer EU passporting. Non-EU rows carry their own capital floors (€350,000 in the United Kingdom, expressed in euro by the EMRs 2011; €350,000 in Gibraltar, likewise expressed in euro by its Electronic Money Regulations 2020; 3% of accepted public deposits and collectively held crypto-based assets, but at least CHF 300,000, in Switzerland)^[25] and operate outside the EU passport (the UK applies CASS 15 from 7 May 2026; Gibraltar retains UK access through transitional passporting to 31 December 2026, pending the permanent Gibraltar Authorisation Regime; Switzerland offers eligibility for SIC participation with an SNB sight account instead). The columns retained below carry the variation that drives the choice between them. Timelines in this guide are practitioner estimates from first engagement to authorisation, not statutory decision periods.

The single most underweighted column in this table is "regulator supervisory intensity", which we cannot render in a table cell. Editorial position, based on the timelines above and recent supervisory practice: the credible-and-fast tier is led by France (ACPR) and the Netherlands (DNB); the credible-and-slow tier by Ireland (CBI); the credible-and-very-slow tier by Germany (BaFin); the historically-fast-but-now-gated tier by Lithuania.

Editorial position: the choice between France and Ireland for a serious EU EMI mandate now turns on two questions. Are you issuing a euro stablecoin or EMT? Choose France. Are you building a Banking-as-a-Service or embedded-finance platform with large client floats? Choose Ireland. Anything else is a banking-and-substance question, not a regulator-quality question.

Key Requirements

EMI and Payment Institution authorisation requirements vary by jurisdiction and tier, but six categories appear in every regulated regime: initial capital and ongoing own funds, corporate substance, and key persons, safeguarding of client funds, AML, and CFT controls, operational resilience, and reporting and governance. DORA governs that pillar for EU EMIs and PIs within its scope; the United Kingdom, Gibraltar, and Switzerland routes follow their own local requirements, and EU counterparties may add contractual ones. The depth, evidence standard, and enforcement intensity of each varies sharply across the seventeen jurisdictions.

Initial capital and ongoing own funds

Initial capital and ongoing own funds are the requirement most often underestimated. Under EMD2 Article 4, initial EMI capital is €350,000, and under EMD2 Article 5, ongoing own funds for the e-money issuance activity are calculated under Method D: 2% of average outstanding electronic money, with competent authorities authorised to vary by ±20% based on internal-control adequacy. For non-e-money payment services within a hybrid EMI, ongoing own funds for those activities are calculated under one of three PSD2 methods:^[2]

• Method A (fixed-overhead): 10% of the preceding year's fixed overheads.
• Method B (payment-volume): scaling with a k-factor of 0.5 to 1.
• Method C (composite-indicator): based on interest income and commissions.

Hybrid applicants compute Method D for e-money issuance and the competent authority’s selected Method A, B, or C amount for unrelated payment services separately, without offsetting. EMD2 Article 5 requires at least the sum of Method D and the unrelated-payment-services limb, with the initial-capital floor and applicable supervisory adjustments preserved.^[1][2]

For example, if a hybrid EMI calculates €1 million under Method D plus €600,000 for unrelated payment services, the combined requirement is €1.6 million before any applicable adjustment, not the higher €1 million limb.^[1]

Practitioner observation: capital cushion of 12 months operating expenditure on top of the regulatory floor is now the de facto requirement at every Tier-1 regulator. Six months is no longer credible; thin-cushion applications are challenged.

Corporate substance and key persons

Corporate substance and key persons is the second universal requirement and the most common cause of application failure. Under PSD2 an applicant with a registered office must have its head office in the same Member State and carry out at least part of its payment service business there, and its directors and managers must be of good repute with appropriate knowledge and experience; local incorporation and locally resident directors are national or supervisory expectations that vary by regime. Senior management roles commonly expected are:

• Money Laundering Reporting Officer (MLRO): primary contact for the regulator on AML/CFT matters.
• Chief Compliance Officer (CCO): regulatory compliance oversight across the firm.
• Chief Risk Officer (CRO): enterprise risk framework, including ICAAP and operational risk assessment.
• Chief Finance Officer (CFO): own-funds calculation, regulatory reporting, and audit liaison.

Supervisory expectations on substance differ materially across Tier-1 regulators. In Ireland, the CBI applies the Pre-Approval Controlled Function (PCF) regime and requires evidence of local residency for key roles; in Germany, BaFin scrutinises remote-substance applications closely post-Wirecard; and in Lithuania, the Bank of Lithuania's recent enforcement cycle was driven in significant part by substance and key-person failings.

Practitioner observation: hiring the MLRO, CCO, and CFO in the licensing jurisdiction before filing the application (not after grant) is the single most impactful step on regulator credibility.

Safeguarding of client funds

Safeguarding of client funds is universal in name and increasingly tight in practice. Most EMIs use segregation in a credit institution, and daily reconciliation, with documented procedures and an evidence trail, is the universal expectation. Under EMD2 Article 7, three safeguarding methods are available:

• Segregation in a separate account at a credit institution.
• Investment in low-risk liquid assets meeting the secure-asset criteria.
• Insurance or comparable guarantee from a third-party insurer or credit institution.

The FCA's CASS 15 regime under PS25/12, effective 7 May 2026, mandates:^[17]

• Daily safeguarding reconciliations, excluding weekends and public holidays.
• A maintained resolution pack.
• An annual reasonable-assurance audit by a qualified auditor, unless the firm qualifies for the exemption in SUP 3A.1.1R(2) because it has not been required to safeguard more than £100,000 at any time over at least 53 weeks (until 14 May 2027, since 7 May 2026): six-month submission window for the first audit report, four months thereafter.
• A monthly regulatory return.

The April 2026 Council compromise permits one or more safeguarding methods. Its concentration rule applies where segregation is used: firms should, where appropriate, endeavour not to hold all safeguarded funds with one credit institution. It does not impose a second method in every case; proportional detail remains for regulatory technical standards.^[3]

Editorial position: the operators who land their EMI grant cleanly are not the ones with the strongest application file. They are the ones whose safeguarding bank confirmation was secured before the regulator opened the substantive review.

AML and CFT controls

AML and CFT controls have moved fastest in regulatory expectations: the EU AML Reform Package applies largely from 10 July 2027 (AMLD6’s transposition deadlines run from 10 July 2025 to 10 July 2029), with AMLA operational since 1 July 2025 at its Frankfurt headquarters.^[7] The package comprises three operative instruments:

• Regulation (EU) 2024/1624, the AMLR: the single rulebook applying directly across Member States.
• Regulation (EU) 2024/1620, establishing AMLA as the EU-level supervisor.
• Directive (EU) 2024/1640, the AMLD6: the directive layer Member States must transpose.

For EU-licensed EMIs and PIs, the package brings:

• A single rulebook replacing the patchwork of national transpositions of Directive (EU) 2015/849 as amended by AMLD5, which AMLD6 repeals from 10 July 2027.^[7]
• AMLA’s first direct-supervision cycle is expected in 2028, six months after publication of the selected list. The first selection is capped at 40 when more entities qualify.
• A harmonised €10,000 EU-wide cash payment limit under AMLR Article 80.
• For general occasional transactions, customer due diligence applies at €10,000 or more, whether carried out in a single operation or linked operations; Member States may set lower thresholds.^[7]
• For covered occasional transfers of funds by credit and financial institutions except CASPs, the threshold is €1,000, whether in a single operation or linked operations.^[7]
• For an occasional cash transaction of at least €3,000, AMLR requires at least customer identification and verification, subject to the national cash-limit exception.^[7]
• Suspicion and doubts about previously obtained customer identity data trigger customer due diligence regardless of any monetary threshold.^[7]
• A 25% beneficial-ownership threshold harmonised across all Member States.

AMLA leadership is now in place. The Chair, Bruna Szego, was appointed by Council on 21 January 2025 and joined AMLA on 17 February 2025. Executive Director Nicolas Vasse joined on 16 September 2025. Four Executive Board members took office on 1 June 2025: Simonas Krėpšta, Rikke-Louise Petersen, Derville Rowland, and Juan Manuel Vega Serrano. The fifth and final Board member, Hennie Verbeek-Kusters, was appointed by Council on 23 February 2026 after the original German nominee, Marcus Pleyer, withdrew before taking office.

Non-EU regulators have moved in parallel: the FCA's financial-crime expectations under SYSC 6.3 have intensified materially since the 2023 enforcement cycle. The CBI's 20 January 2023 "Dear CEO" letter included AML expectations alongside safeguarding requirements, and the resulting Irish payments-population-wide remediation programme has set the practical baseline for EU AML supervision.

Operational resilience under DORA

Operational resilience under DORA is now a standing requirement: the Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to EU EMIs and PIs, including institutions exempted under EMD2 or PSD2.^[6][36] Exempted PSD2 PIs and EMD2 EMIs use Article 16’s simplified ICT framework; small size alone does not establish eligibility. DORA’s requirements include:

• An ICT risk-management framework under Articles 5 to 15, or the simplified Article 16 framework for eligible entities.^[36]
• An incident-reporting sequence (classification, initial notification, intermediate report, and final report) for major incidents under Articles 17 to 19 and the operative reporting RTS.^[22]
• A maintained Register of Information for ICT third-party providers under Article 28.
• Periodic resilience testing, including threat-led penetration testing for in-scope firms under Articles 26 to 27.
• Direct ESA oversight of "critical" ICT third-party providers (CTPPs) under Article 31.

The European Supervisory Authorities designated the first 19 critical ICT third-party providers on 18 November 2025:^[20]

• Accenture plc
• Amazon Web Services EMEA Sarl
• Bloomberg L.P.
• Capgemini SE
• Colt Technology Services
• Deutsche Telekom AG
• Equinix (EMEA) B.V.
• Fidelity National Information Services Inc.
• Google Cloud EMEA Limited
• International Business Machines Corporation
• InterXion HeadQuarters B.V.
• Kyndryl Inc.
• LSEG Data and Risk Limited
• Microsoft Ireland Operations Limited
• NTT DATA Inc.
• Oracle Nederland B.V.
• Orange SA
• SAP SE
• Tata Consultancy Services Limited

Critical ICT third-party providers face periodic penalty payments of up to 1% of average daily worldwide turnover under Article 35(8).

Practitioner observation: in the European Supervisory Authorities' 2024 dry-run exercise, only 6.5% of the registers analysed, from almost 1,000 financial entities, passed all 116 Register of Information data-quality checks.^[33] The gap shows up immediately when a CBI, DNB or BaFin review starts asking about ICT third parties.

Reporting and governance

Reporting and governance close the requirement set: every regulated EMI/PI must submit a regular flow of regulatory returns and notifications, and inform the regulator of material changes to the business as they occur. The standard reporting cadence covers:

• Quarterly prudential returns: own funds, capital ratio, fixed overheads, payment volume.
• An annual audited financial statement.
• An annual safeguarding audit, where required by the jurisdiction.
• DORA major-incident reports as they occur.
• AML suspicious activity reports as they arise.
• Ad-hoc notifications for material changes in shareholders, key persons, business model, or outsourcing arrangements.

The FCA’s CASS 15 monthly safeguarding return adds a UK-specific reporting layer from 7 May 2026. For AMLA, operating in at least six Member States triggers periodic assessment, not automatic direct supervision. Selection also depends on a high residual-risk classification and the statutory ranking rules. The first selection begins by 1 July 2027, concludes within six months and is capped at 40 when more entities qualify.

Direct supervision starts six months after publication of the selected list, with the first cycle expected in 2028. Model that potential reporting and governance burden when planning expansion.^[7]

How Jagelski & Partners Helps

An independent specialist introduced by Jagelski & Partners coordinates EMI and Payment Institution licensing as a single mandate: corporate formation, licence application, safeguarding banking placement, capital structuring, and AML and DORA programme set-up run in parallel rather than in sequence, so that capital, substance, and safeguarding banking arrive ahead of the regulator asking.

Jurisdiction selection

The first work item on every mandate is a written jurisdiction assessment. We do not recommend a jurisdiction before mapping four variables together:

• The operator's regulated activities: e-money issuance, payment services under PSD2 Annex I, PISP, AISP, EMT issuance under MiCA Article 48.
• The markets the operator actually targets, not the markets it aspires to.
• The expected e-money float and passporting footprint, which affect safeguarding and whether the institution enters AMLA’s periodic risk assessment. Direct supervision also requires selection.
• The safeguarding banks the operator can realistically reach in each candidate jurisdiction.

A euro-stablecoin issuer with European institutional ambitions, €5 million of available capital and a 20-month runway needs a different recommendation than a B2B cross-border payments operator targeting LatAm with €1 million of capital and a 12-month runway.

Editorial position: Lithuania is no longer the default for new entrants in 2026. The Bank of Lithuania's enforcement cycle has materially closed the gate for opportunistic applicants. France for stablecoin and EMT issuance, Ireland for embedded finance and BaaS, and the Netherlands for pragmatic credibility are the credible EU defaults.

Corporate formation in parallel with the licence application

Once the jurisdiction is selected, corporate formation runs in parallel with the licence application; the substance work is jurisdiction-specific:

• France: a French SAS or SA with locally resident senior managers and registered office in place before the ACPR file is submitted, with senior management interviews scheduled.
• Ireland: an Irish DAC or PLC with at least one EEA-resident director (or a Section 137 bond), a PCF stack identified, and CBI pre-application engagement booked.
• United Kingdom: a UK limited company with FCA-approved persons identified, the CASS 15 safeguarding architecture documented, and FCA pre-application contact opened.

An independent specialist introduced through our company formation service handles formation at the depth the licence requires, not the cheapest depth available.

Safeguarding banking placement

The safeguarding bank placement runs alongside the licence application, not after, because EMI safeguarding is a Tier-1 high-risk category at every credit institution and EMI banking provider. Pre-qualification with institutions that have an active programme for EMI safeguarding accounts is the difference between a four-week safeguarding bank timeline and a four-month one. An EMI mandate typically requires three distinct account types, each with a different acceptability profile:

• The segregated client-money account holding safeguarded e-money funds under EMD2 Article 7.
• The operating account for the firm's own working capital.
• The regulatory capital account holding initial capital and ongoing own funds.

Pre-qualification is handled through our high-risk business accounts workflow. For applications likely to reach the PSD3 transition, we assess concentration within the chosen safeguarding architecture. The April 2026 Council compromise allows one or more methods and, where segregation is selected, says firms should where appropriate endeavour not to hold all safeguarded funds with one credit institution. A second institution or secure-assets component can be prudent contingency planning, but it is not a universal statutory second-method requirement.^[3]

Practitioner observation: the operators who land their EMI grant cleanly are the ones whose safeguarding bank was confirmed before the regulator opened the substantive review.

DORA, AML, and post-launch compliance

DORA readiness, AML manual, KYC tooling, risk-management framework, and regulatory reporting infrastructure are sequenced into the application timeline so that on the day the regulator grants the licence the operator can go live, not start a three-month build. The DORA Register of Information and ICT third-party inventory are now expected by Tier-1 regulators on day one, not at on-site inspection. The pre-grant programme that the operator runs with its introduced specialists typically covers four workstreams:

• Hiring and placing the MLRO, CCO, CFO, and CRO in the licensing jurisdiction before filing.
• Building the AML risk-based approach at customer-segment level rather than at firm level.
• Documenting the sanctions-screening tooling with regulator-grade evidence trails.
• Producing the DORA Register of Information and ICT third-party inventory in the format Tier-1 regulators now expect on first request.

Post-launch the compliance partner handles ongoing compliance reporting, annual safeguarding audits, key-person changes, and the regulatory milestones that fall due: AMLA’s first selection process beginning by 1 July 2027, FCA CASS 15 monthly returns from 7 May 2026, and the PSD3 transposition deadline, 21 months after entry into force (not before July 2028).

MiCA EMT and CASP overlays

For stablecoin and EMT issuance under MiCA Article 48, the independent specialist we introduce coordinates the EMI authorisation with the MiCA Title IV obligations through our crypto licensing service. The EMI authorisation holds the issuance permission; the MiCA white paper, reserve composition, redemption framework, and significant-token threshold compliance run in parallel.

For CASPs adding fiat rails, an independent specialist introduced by Jagelski & Partners assesses the payment-service and e-money perimeter before sequencing any additional authorisation alongside MiCA. The chosen route follows the activity and funds flow.

Agentic payments and AI-agent commerce

AI agents now initiate payments autonomously, including machine-to-machine flows: crypto-native agent flows settle in stablecoins or e-money tokens via protocols such as x402 (contributed by Coinbase to the Linux Foundation in 2026) and Google's Agent Payments Protocol (AP2), while card networks run their own agent rails through Visa Intelligent Commerce and Mastercard Agent Pay.

No jurisdiction has created a dedicated agent-payments licence: the activity is regulated by what the payment does, not by what initiates it. Issuing the EMT an agent spends is EMT issuance, which under MiCA Article 48 and EMD2 requires an EMI authorisation or a bank.

This is where the EMI licence becomes the load-bearing permission for agentic-payment infrastructure. Per the European Banking Authority’s non-binding opinion of 10 June 2025, transferring EMTs on behalf of clients, or running a custodial wallet from which clients can receive EMTs from and send EMTs to third parties, is a PSD2 payment service that a MiCA CASP authorisation alone does not cover: where PSD2 applies, it needs a payment or e-money institution authorisation or an agency or partnership arrangement with an authorised payment service provider (or money-transmitter licensing in the United States).

An EMI may cover custody and transfer of its own issued EMTs by notification under MiCA Article 60(4). The PSD2 commercial-agent exemption covers commercial and legal agents, not AI agents, and almost never reaches an agent-payment platform. We scope the EMI authorisation as the issuance and settlement spine, paired with our work for stablecoin issuers.^[21][21]

For licensing work, the partner who carries the mandate pays Jagelski & Partners for the introduction, and Jagelski & Partners does not bill the client; independent specialists quote their own professional fees separately, and statutory charges remain payable. For banking introductions, Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional banking or EMI pricing, and we do not charge a banking onboarding fee. The institutional rates the client sees on banking onboarding documentation are the rates the institution applies.

Frequently Asked Questions

References