What You Need to Build an Agentic Payments Product
An agentic payments product needs five interlocking components: a regulated-activity analysis mapping who holds funds, keys, and mandates; an operating entity; a licence or a partnered rail (EMI, PI, agent model, or a MiCA CASP authorisation for crypto-native rails); safeguarding and settlement banking; and a mandate framework that proves the agent’s authority to spend, wired into the compliance stack. Of the five, the analysis leads, because the licence follows the money flow, not the technology.
Four questions make up the regulated-activity map. Who holds the fiat float while it waits to be spent: holding client funds for payment execution is a payment service needing an EMI or PI permission. Who controls the crypto asset in the same position: that is MiCA custody, or safeguarding under the e-money rules where the unit is an EMT.
Who converts between the unit and fiat: MiCA exchange services. And who issues the unit the agent spends: most crypto-native agent flows settle in stablecoins, and issuing one that references a single official currency is e-money token issuance under MiCA Title IV, with redemption at par and reserved issuer status; an asset-referenced token follows Title III instead.[1]
Unlike a conventional fintech build, the protocol layer is already standardised: x402 revives the HTTP 402 status code as a payment-required handshake and was contributed by Coinbase to the Linux Foundation in 2026, AP2 standardises mandate proof, and the card networks run their own agent rails through Visa Intelligent Commerce and Mastercard Agent Pay. A protocol integration is not a licence: the build decision is which permission sits behind the handshake.
Infrastructure Checklist
| Component | What It Involves | Typical Timeline |
|---|---|---|
| Regulated-activity analysis | Written map of who holds funds, keys, and mandates per flow; determines EMI vs PI vs CASP vs partnered rail | 2 to 4 weeks (before everything else) |
| Operating entity | Registered company in the licensing domicile; holds the authorisation, customer contracts, and safeguarding obligations | 1 to 2 weeks |
| Licence or partnered rail | EMI (€350,000 capital) / PI (€20,000 to 125,000) / MiCA CASP (Article 67 safeguards: max(EUR 50,000/125,000/150,000 class floor, 25% of previous-year fixed overheads; projected first-12-month overheads for a new firm). Qualifying own funds, insurance/comparable guarantee, or a combination) / agent-model onboarding with a licensed principal | Weeks (agent model) to 12 to 24+ months (proprietary EMI) |
| Safeguarding & settlement banking | Safeguarding account at a credit institution, operating rails, stablecoin float custody and redemption leg | 8 to 16 weeks (parallel) |
| Mandate & protocol layer | x402 / AP2 integration, mandate issuance and revocation records, spend limits, audit trail | 8 to 16 weeks (parallel) |
| Compliance stack | Strong customer authentication design, AML/CFT, Travel Rule on crypto legs, DORA controls, safeguarding audit | 6 to 10 weeks initial, then continuous |
Sequencing follows the analysis: the activity map decides the route; the route decides the domicile and the capital; entity and file then gate banking. Mandate engine and protocol integration run in parallel with the regulatory file, but their design documents belong inside it: a regulator reviewing an agent-initiated flow asks precisely how authority is granted, capped, evidenced, and revoked.
Choosing the Right Jurisdiction
For the proprietary-licence route, jurisdiction choice determines the supervisory culture, the authorisation timeline, the tax treatment, and how naturally the payments licence pairs with a MiCA authorisation for the crypto side of the flow. Capital floors are EU-harmonised: €350,000 for an EMI under EMD2 Article 4, €20,000 to €125,000 for a PI under PSD2 Article 7, so the differentiation is supervisory, not financial.[2]
Jurisdiction Comparison
| Factor | Lithuania | Malta | Cyprus | Estonia | Ireland |
|---|---|---|---|---|---|
| Regulator | Bank of Lithuania | MFSA | Central Bank of Cyprus | Finantsinspektsioon | Central Bank of Ireland |
| Licence types | EMI / PI / Small EMI | EMI / PI authorisation under the Financial Institutions Act (Cap. 376) | EMI / PI | EMI / PI | EMI / PI |
| Realistic timeline | 15 to 22 months (gate operationally tight) | 12 to 16 months | 12 to 18 months | 15 to 24 months (selective) | 16 to 24 months |
| Corporate tax | 17% | 35% company tax; possible 5% combined effective result after a qualifying 6/7 shareholder refund on distributed trading profits | 15% from 2026 (12.5% FY25) | 22% distributed / 0% retained | 12.5% (trading) |
| MiCA pairing | Separate CASP authorisation; same regulator | Separate CASP authorisation; same regulator | Separate CASP authorisation from CySEC | Separate CASP authorisation; same regulator | Separate CASP authorisation; same regulator |
| EEA passporting | Yes | Yes | Yes | Yes | Yes |
Timelines are practitioner estimates from first engagement to authorisation, not statutory decision periods. Corporate tax rates follow each state’s company formation guide, as of .
Choose Lithuania if the product wants the deepest EMI ecosystem in the EU: Lithuania remains the largest single EMI cluster by count, with the vendor, talent, and banking periphery that follows. Its supervisory cycle has changed materially: the Bank of Lithuania has revoked a run of EMI and PI licences since 2023, including Payrnet and Lock Trust in 2023 and Kevin EU and Foxpay in 2024, so the file must be built to the current bar, not the 2019 one.[9] For the full mechanics, see the EMI licensing guide.
Choose Malta if the product is a crypto-fiat hybrid, which most agentic flows are. In Malta, as in Lithuania, Estonia and Ireland, one authority supervises crypto, payments, and securities, which avoids the two-regulator coordination Cyprus requires (the Central Bank of Cyprus for EMIs, CySEC for CASPs) when an EMI licence and a MiCA authorisation must describe the same flow.[10] In our experience, Malta's edge on this route is the depth of its crypto-fiat hybrid caseload rather than the supervisory structure itself. See the EMI licensing guide and the crypto licensing hub.
Choose Cyprus if a credible mid-tier domicile with a 12 to 18 month path fits, particularly where the team already operates in the forex-adjacent ecosystem Cyprus serves. Choose Estonia if the distributed-profits model (0% on retained earnings) matters to a reinvestment-heavy build and the team can pass a selective 15 to 24 month gate.
Setting Up Your Company
Company formation is the first operational step because the authorisation file, the safeguarding account, and every partner-rail contract require a registered entity. Under-capitalising the entity at incorporation is the formation mistake specific to payments builds. An EMI or payment institution must have its initial capital paid in and evidenced before the file is submitted; a CASP must evidence its MiCA Article 67 prudential safeguards in the form it has chosen: own funds, an insurance policy or comparable guarantee, or a combination. Re-papering share capital mid-application costs review time.
Formation by Jurisdiction
| Jurisdiction | Entity type | Formation cost | Timeline | Min. capital |
|---|---|---|---|---|
| Lithuania | UAB (Private Limited Company) | From about EUR 21 in state fees; provider fees quoted per case | 3 to 5 business days | EUR 1,000 (EMI/PI regulatory capital applies separately) |
| Malta | Private Limited Liability Company (Ltd) | EUR 400 to 1,000 indicative; provider fees quoted per case | 3 to 7 working days | EUR 1,164.69 authorised; 20% paid up |
| Cyprus | Private Company Limited by Shares (Ltd) | EUR 325 to 775 indicative; provider fees quoted per case | 5 to 10 working days (1 to 2 expedited) | None (one share suffices) |
| Estonia | OÜ (Private Limited Company) | €265 to €415 statutory; provider fees quoted per case | 1 business day (online with digital signature) | €0.01 per shareholder |
Formation figures are Year-1 costs as of , from each jurisdiction’s company formation guide: statutory, or indicative where a market-priced registered office is included; provider fees are quoted per case, and regulatory capital is excluded. In every domicile the entity should exist before the authorisation project starts: the entity name anchors the file, the safeguarding account application, and the protocol-layer contracts.
Licensing Requirements
Who holds the funds determines the licence. Holding a fiat float for agent-initiated spending is e-money or payment-service territory: in the ordinary EMD2 regime, an EMI requires €350,000 initial capital and ongoing own funds at least equal to the higher of that floor and the sum of issuance requirements (Method D: 2% of average outstanding e-money) and requirements for payment services unrelated to issuance (Method A, B or C), subject to the Article 5(5) supervisory adjustment; a PI authorisation carries €20,000 to €125,000 under PSD2 Article 7 depending on the services.[2]
Crypto-native rails swap in MiCA: CASP authorisation with prudential safeguards of at least €50,000 to €150,000 by activity class, or a quarter of the previous year’s fixed overheads if higher (Article 67), and, where the product issues the stablecoin the agents spend, Title IV issuer status for an e-money token or the Title III route for an asset-referenced token.[1]
What separates the routes is legal, not technical. In ABC Projektai (Case C-661/22) the Court of Justice drew the e-money versus payment-service line, and the EBA’s non-binding opinion of 10 June 2025 (EBA/Op/2025/08) treats transfers of e-money tokens on behalf of clients as a payment service, which is how a “crypto” agent flow can land back inside PSD2 territory.[3]
This page stays at decision level: the authorisation mechanics, domicile files, and fee schedules live in the dedicated EMI licensing guide and the crypto licensing hub.
Licence, or partnered rail?
A proprietary EMI is the deep route: 12 to 24+ months and case-specific scoping. The EMI licensing guide sets out its stated greenfield-EMI budget; agentic-specific build costs are scoped separately, and the €350,000 regulatory initial capital is separate. Launching on partnered rails is the fast route: operating as an agent or distributor of a licensed principal, or building on the card networks’ agent programmes, and graduating to a proprietary licence once volume justifies it. The trade-off is margin and control against time and capital; most agentic builds sequence partnered-rail launch first, proprietary file second, and design the mandate engine so it survives the migration.
Banking
Banks are structurally cautious about agent-initiated flows: the counterparty authorising each payment is software, the fraud-liability question is unsettled, and the flow pattern (thousands of small machine-triggered transactions) trips the same monitoring rules written for card fraud. Layer a stablecoin float on top and the desk inherits crypto due diligence as well; the safeguarding bar itself has risen across the EU supervisory cycle.
In practice the architecture has three legs. A safeguarding account at a credit institution holds client funds segregated under the statutory regime, and it is the hardest account to open: safeguarding banks are scarce and selective. Operating and settlement rails move the merchant-side money. And the stablecoin leg needs custody for the float plus a redemption path at par for EMT balances.
Specific to agentic payments are three settlement components: the agent-initiated collection leg (the x402-style handshake that pulls funds under a mandate), the float safeguarding leg, and the merchant settlement leg sized for machine-speed volume.
Ongoing Compliance
An EMI’s ordinary ongoing own-funds requirement is the higher of €350,000 and the sum of Method D (2% of average outstanding e-money) and Method A, B or C for payment services unrelated to issuance. The supervisor may adjust the calculated requirement by up to ±20% under EMD2 Article 5(5), while the initial-capital floor remains; any statutory waiver needs a separate assessment.[2]
Compliance is a permanent operating expense that scales with the float. The operating stack (safeguarding audits, AML/CFT staffing, DORA controls,[4] SCA monitoring) runs from the low six figures annually for a lean licensed operation toward €500,000+ as volume grows, consistent with the €200,000 to 500,000 AML and DORA programme build inside a greenfield EMI budget.
On top sit the agentic-specific obligations: mandate issuance, capping, and revocation records for every agent authority; strong customer authentication design that survives the human-not-present flow; Travel Rule data under the Transfer of Funds Regulation on crypto legs;[6] and the incoming AML package (Regulation (EU) 2024/1624) with its harmonised customer due diligence.[7]
Two regulatory milestones deserve watching: the PSD3/PSR package (general application not before July 2028, EMD2 repealed)[5][11] and the AMLR application, both of which land inside the lifetime of any authorisation filed now.
Realistic Timeline and Costs
End-to-end, an agentic payments product reaches production in 3 to 6 months on partnered rails and 12 to 24+ months on a proprietary EMI or CASP authorisation. Mandate engine, protocol integration, and banking stack build in parallel with whichever regulatory route is chosen; on the proprietary route the safeguarding account is the usual critical path.
Cost Breakdown
| Phase | Timeline | Notes | Cost Range |
|---|---|---|---|
| Activity analysis & formation | 2 to 6 weeks | Regulated-activity map + entity (EUR 1.5k to 6k across the four domiciles including provider fees, on our planning estimate) | EUR 7,000 to 30,000 |
| Licensing route | Weeks to 24+ months | Partnered-rail onboarding at the floor; proprietary EMI advisory and legal is scoped case by case; MiCA CASP route between | From EUR 15,000; proprietary route quoted per case |
| Banking & safeguarding | 8 to 16 weeks (parallel) | Safeguarding set-up and first-year fees at the top of the range; stablecoin custody separate | EUR 25,000 to 100,000 |
| Mandate engine & protocol integration | 8 to 16 weeks (parallel) | x402 / AP2 integration, mandate records, spend controls, audit trail | EUR 40,000 to 150,000 |
| Year-1 total | 3 to 24 months | Partnered-rail build from the stated floor; proprietary EMI and agentic-specific build costs require case-specific scope, plus EUR 350,000 regulatory capital | From EUR 90,000; proprietary route scoped per case |
Figures are Year-1 ranges as of , in EUR, and exclude regulatory capital, safeguarded client funds, and the stablecoin float itself. From Year 2 the cost centre shifts to the own-funds formula and the compliance operation.
Frequently Asked Questions
Costs & Timeline
Jagelski & Partners scopes agentic payments builds from roughly EUR 90,000 Year-1 all-in on partnered rails (activity analysis, entity, rail onboarding, mandate engine, banking). A proprietary EMI route requires case-specific scoping; see the EMI licensing guide for its stated greenfield-EMI budget, while agentic-specific build costs are scoped separately. The EUR 350,000 regulatory initial capital under EMD2 Article 4 is separate. A MiCA CASP route for crypto-native rails sits between, with prudential safeguards of at least the higher of EUR 50,000, 125,000 or 150,000 by activity class and one quarter of the fixed overheads of the preceding year.
The technology spread is narrow; the licensing route drives the budget. Figures as of .
Production in 3 to 6 months on partnered rails: agent-model onboarding with a licensed principal or the card networks’ agent programmes, with the mandate engine and banking built in parallel. A proprietary authorisation runs 12 to 16 months in Malta, 12 to 18 in Cyprus, 15 to 22 in Lithuania, and 15 to 24 in Estonia, with Ireland at 16 to 24.
Most builds sequence both: launch on partnered rails, file the proprietary application in parallel, and migrate once authorised.
Licensing
The licence follows who holds the funds, not the AI. Holding a fiat float that agents spend is e-money or payment-service territory: an EMI authorisation (EUR 350,000 capital under EMD2 Article 4) or a PI authorisation (EUR 20,000 to 125,000 under PSD2 Article 7). Crypto-native rails need MiCA: CASP authorisation (or an Article 60 notification for an eligible financial entity) for custody and exchange of the units, and, if the product issues the stablecoin itself, Title IV issuer status for an e-money token or the Title III route for an asset-referenced token.[1]
Operating as an agent or distributor of a licensed principal defers the licence entirely, at the cost of margin and control. The regulated-activity analysis settles the route before anything is filed.
No. EU payments law licenses the person providing the payment or crypto-asset service, and an AI agent is not a legal person: the operator whose infrastructure holds the funds, keys, or mandates carries the authorisation. What the agent does need is provable delegated authority: a mandate record showing what it may spend, within what caps, granted and revocable by an identified principal. That is the layer Google’s AP2 standardises, and it is the first thing a supervisor examines in an agent-initiated flow. The licence question and the mandate question are separate, and a credible build answers both in writing.
For the proprietary route, the capital is EU-harmonised, so the choice is supervisory. Lithuania offers the largest EMI ecosystem with a tightened gate; Malta is, in our experience, the strongest crypto-fiat hybrid domicile, with one authority for payments, crypto, and securities, as in Lithuania, Estonia and Ireland but not Cyprus; Cyprus is the credible mid-tier path at 12 to 18 months; Estonia rewards reinvestment-heavy builds with 0% tax on retained profits behind a selective gate.
Jagelski & Partners maps the flow architecture to the domicile in the first conversation, before any incorporation is filed.
Banking & Operations
Yes, and most crypto-native agent flows settle in stablecoins, which is why x402-style handshakes pair naturally with them. The regulatory consequences follow: an e-money token under MiCA Title IV must be redeemable at par with reserved issuer status, transfers on behalf of clients can constitute a payment service per the EBA’s reading, and Travel Rule data accompanies qualifying transfers under the Transfer of Funds Regulation.
The float itself needs custody and a redemption leg in the banking architecture. Spending a stablecoin is easy; holding and moving it for clients is the regulated part.
Through a three-leg architecture: a statutory safeguarding arrangement for client funds, operating and merchant-settlement rails sized for machine-speed volume, and custody plus a par-redemption path for any stablecoin float. Under PSD2 Article 10, segregation is one statutory method: funds still held at the end of the business day following receipt must be placed in a separate credit-institution or eligible central-bank account, or in qualifying secure, liquid, low-risk assets.[8]
Insurance or comparable guarantee from a non-group provider for an equivalent amount is the alternative. The selected method must protect the funds against other creditors in insolvency.[8] Jagelski & Partners pre-qualifies all three legs across the partner network before the authorisation file is submitted; budget 2 to 4 months with safeguarding as the critical path.
Start Your Agentic Payments Assessment
Request a free written assessment. Jagelski & Partners scopes the regulated-activity flow and licence-versus-rail route, then introduces independent specialists for company formation, authorisation, safeguarding banking and the mandate engine.
Initial assessments are free · Response within one business day
References
Show all references
- European Union, Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), Title IV (electronic money tokens: issuance, redemption at par, and reserved issuer status), eur-lex.europa.eu, accessed .
- European Union, Directive 2009/110/EC (EMD2), Articles 4 and 5, and Directive (EU) 2015/2366 (PSD2), Article 7, eur-lex.europa.eu, accessed .
- Court of Justice of the European Union, Case C-661/22, ABC Projektai UAB v Lietuvos bankas, eur-lex.europa.eu; European Banking Authority, Asset-referenced and e-money tokens under MiCA, eba.europa.eu; Opinion on the interplay between Directive (EU) 2015/2366 (PSD2) and Regulation (EU) 2023/1114 (MiCA) in relation to e-money tokens (EBA/Op/2025/08), , eba.europa.eu, accessed .
- European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), eur-lex.europa.eu, accessed .
- Hogan Lovells, Final compromise texts of the Payment Services Regulation and the Payment Services Directive (PSD3) package, hoganlovells.com; EY, PSD3 impacts on payment and electronic money institutions, ey.com, accessed .
- European Union, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, eur-lex.europa.eu, accessed .
- European Union, Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR), eur-lex.europa.eu, accessed .
- European Union, Directive (EU) 2015/2366 on payment services in the internal market (PSD2), Article 10, eur-lex.europa.eu, accessed .
- Bank of Lithuania (Lietuvos bankas), Licence of UAB PAYRNET revoked for serious violations, bankruptcy proceedings to be initiated, ; Licence of the payment institution UAB Lock Trust revoked, ; Payment institution licence of Kevin EU, UAB revoked, ; Lietuvos bankas revoked UAB Foxpay licence due to serious and systematic breaches, , lb.lt, accessed .
- European Securities and Markets Authority, List of competent authorities designated under MiCA Article 93 (last updated : Lietuvos bankas, the MFSA, Finantsinspektsioon and the Central Bank of Ireland competent for all MiCA titles; in Cyprus, CySEC for CASP authorisation and the Central Bank of Cyprus for Title IV and for Article 60 notifications by credit institutions and EMIs), esma.europa.eu, accessed .
- Council of the European Union, Final compromise texts: Proposal for a Regulation on payment services (PSR), ST 8221/26, and Proposal for a Directive on payment services and electronic money services (PSD3), ST 8222/26, dated , consilium.europa.eu, accessed .