How to Launch a Fintech Company: Licensing, Banking & Infrastructure

What You Need to Launch a Fintech Company

A fintech company in 2026 needs five interlocking components: a regulated operating entity in the licensing jurisdiction, sufficient initial capital under the chosen regime, a payment institution or electronic-money institution authorisation, an operational and safeguarding banking arrangement, and a live compliance stack covering AML/CFT, DORA, and PSD2 reporting.

In the licensing jurisdiction, the operating entity is typically a private limited company. Entity form varies: an osaühing (OÜ) in Estonia, a limited liability company in Cyprus, a private limited company in the United Kingdom, a free-zone company in Abu Dhabi or Dubai, a British Columbia, Ontario, or federal corporation in Canada, or a proprietary limited company in Australia. Capital structure must reflect both the regulator’s minimum and the ongoing own-funds requirement under PSD2 Article 9 or the equivalent national rule.

Licensing is the gate. Inside the EU, the relevant authorisations are PI under PSD2 (Directive (EU) 2015/2366) and EMI under EMD2 (Directive 2009/110/EC). In the UK, the equivalents are authorised PI and authorised EMI under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 respectively. Outside Europe, the routes diverge sharply: the UAE has three regulators (CBUAE for onshore, ADGM Financial Services Regulatory Authority, and DIFC Dubai Financial Services Authority); Canada operates two parallel regimes (FINTRAC for money-services-business registration and the Bank of Canada under the Retail Payment Activities Act); Australia regulates under AUSTRAC for remittance and is mid-reform on stored-value facilities and payment services.

Banking is often a binding practical constraint, but a fintech company needs an operational account for its own treasury and a lawful safeguarding arrangement for client funds: segregation, or insurance or a comparable guarantee, under PSD2 Article 10 and EMD2 Article 7, as set out under Licensing Requirements below.^[1][2]

Where credit-institution segregation is selected, in our experience the safeguarding acknowledgement letter is the document that most often determines whether the authorisation lands on schedule. Secure-assets and insurance or guarantee routes require their own equivalent evidence.

Capital must be paid up before the file is filed. Under PSD2 Article 7, the initial capital for a PI is €20,000 (money remittance only), €50,000 (payment initiation services only), or €125,000 (services 1 to 5 of PSD2 Annex I). EMI initial capital is €350,000 under EMD2 Article 4.

Ongoing own funds differ by activity. A PI uses the competent authority’s selected PSD2 Method A, B, or C. An EMI uses EMD2 Method D, equal to 2% of average outstanding e-money, and adds the separately calculated requirement for unrelated payment services. The required total is at least the sum of those limbs, subject to the initial-capital floor and any permitted supervisory adjustment.^[1][2]

Ongoing compliance is the permanent operating expense. Inside the EU, the PSD2 conduct and reporting rules, the EU Travel Rule under Regulation (EU) 2023/1113 (where the firm intermediates crypto-asset transfers), the AML Regulation (Regulation (EU) 2024/1624) when it applies generally from 10 July 2027, and DORA under Regulation (EU) 2022/2554 (applicable since 17 January 2025) run in parallel. The UK FCA operates an equivalent perimeter under the EMRs, PSRs, and the FCA Handbook.

Experienced applicants using credit-institution segregation begin safeguarding-bank conversations in parallel with the licence file, not after, because a regulator that opens an information request on that selected route will not close the file on a “to be confirmed” answer. Applicants selecting secure assets, insurance, or a comparable guarantee advance the equivalent custody, eligibility, policy, or guarantee evidence instead. The dependency sequence is the differentiator.

Formation runs first, but capital can be paid up alongside director appointments. Evidence for the selected safeguarding method should be advanced before capital is locked.

Infrastructure Checklist

Choosing the Right Jurisdiction

Jurisdiction choice determines the regulatory framework, the capital requirement, the market access, the corporate tax treatment, and the realistic licensing timeline. For a fintech company, the key variables are EU passporting (or its absence), the distinction between full prudential authorisation and AML-style registration, and the relative weight of safeguarding rules in the home regulator’s onboarding assessment.

Six jurisdictions cover the credible mainstream choice set for a fintech founder operating in the EU, the UK, the Middle East, North America, or APAC.

Inside the EU, Estonia and Cyprus offer PSD2/EMD2 authorisation with full passporting across the EEA (the 27 EU states plus Iceland, Liechtenstein and Norway)^[28] under PSD2 Article 28 and EMD2 Article 3; capital floors are EU-harmonised, and the EMI licensing guide compares their timelines with the larger Member States.^[1][2]

In Iceland, Liechtenstein, and Norway, EMD2 applies under EEA Joint Committee Decision 120/2010, in force since 1 November 2012, and PSD2 under JCD 165/2019, in force since 1 May 2022; JCD 41/2025 incorporates MiCA and does not govern payment licences.^[25][28]

Under the Electronic Money Regulations 2011 and the Payment Services Regulations 2017, the UK FCA operates a comparable regime, but post-Brexit holds no EU passport. Three regulators with three distinct frameworks operate in the UAE.

Canada and Australia run AML-anchored registration regimes with no prudential capital floor, suited to remittance-led models rather than e-money issuance.

The credible-floor question is sharper for fintech than for crypto. A crypto exchange can route to an offshore VASP licence and operate from a Caribbean or Indian Ocean jurisdiction. A fintech that issues e-money cannot: e-money issuance requires authorisation in a jurisdiction with an EMI-equivalent framework, and the credible jurisdictions that issue EMIs are concentrated in the EU/EEA, the UK, the UAE free zones, and a handful of comparable hubs. Canada and Australia accommodate payment services but do not issue an e-money licence in the European sense.

Fintech Licensing Jurisdictions Compared

Choose Estonia if the team has, or will build, a substantive Estonian operating presence and the distributed-profits tax model matters. The Finantsinspektsioon is selective and runs 15 to 24 months on an EMI or PI authorisation, the licensing capital sits at the PSD2/EMD2 minimum, and the corporate tax structure (22/78 on distributions) leaves retained earnings untaxed at the entity level. See the full Estonia licensing guide for the operational detail.

Choose Cyprus if the priority is a Mediterranean base with English-speaking professional infrastructure and access to a regulator that has actively built EMI capacity since 2018. The Central Bank of Cyprus’s EMI register of 28 September 2026 lists 32 licensed EMIs, eight of them licensed since January 2025, which indicates active throughput rather than a closed pipeline. The 15% corporate tax rate (from 1 January 2026) is the published headline; effective economics also depend on the dividend levies, the 2.65% General Healthcare System contribution and, for domiciled resident shareholders, the 5% Special Defence Contribution on dividends from 2026 profits.^[33]

Choose the United Kingdom if the target market is sterling-denominated and the value of FCA-grade institutional brand outweighs the loss of EU passporting. The FCA runs one of the longest-established payments regimes, with extensive published guidance in its Approach Document,^[24] and the Small EMI and Small PI categories provide a low-friction starting point for early-stage operators: a Small PI sits at or below the €3m monthly average payment transactions threshold, a Small EMI at or below €5m in average outstanding electronic money.

Against that stands a real trade-off: a UK EMI cannot serve EU customers on a passporting basis, because UK firms lost EU passporting when the Brexit transition period ended on 31 December 2020. The temporary permissions regime is a separate mechanism, and it ran the other way, covering inbound EEA firms operating in the United Kingdom.

Choose the UAE if the target market is the MENA region, the UAE’s growing population of remittance corridors, or the institutional client base served from ADGM and DIFC. The three regulators are not interchangeable: onshore retail payments and stored-value activity sit with the Central Bank of the UAE; ADGM and DIFC issue financial-services permissions to firms domiciled in those free zones, with capital and conduct rules set in each regulator’s rulebook. Federal corporate tax is 9 percent on taxable income above AED 375,000 for ordinary taxable persons; a Qualifying Free Zone Person that meets the substance and other conditions pays 0 percent on qualifying income and 9 percent on other taxable income.

Choose Canada if the model is remittance-led, cross-border money-services-focused, or aimed at the US-Canada corridor. The RPAA’s risk-management and funds-safeguarding requirements have applied since 8 September 2025, and on 29 September 2026 the Bank of Canada’s registry listed 1,679 registered PSPs, about 85% of them headquartered in Canada and 9% in the United States, with 446 further applications in review.^[34] The absence of a minimum capital requirement is genuine; the safeguarding, risk-management, and incident-response obligations under the RPAA framework are not.

Choose Australia if the model is remittance, money-transfer, or APAC-focused payments without e-money issuance. AUSTRAC operates a registration-based regime under the AML/CTF Act 2006 with no minimum capital. Treasury’s Payments System Modernisation reform is at exposure-draft stage: the full Tranche 1 draft legislation was released on 12 March 2026, with consultation closing 9 April 2026. Under that draft, the new stored-value-facility and payment-service framework would commence 12 months after Royal Assent, followed by a default transition period of one month for existing NCP-facility licensees and six months for other providers.

Setting Up Your Company

Company formation for a fintech is the first operational step because every subsequent component (capital, licence application, banking) requires a registered entity. Most commonly, the formation mistake is incorporating in a tax-optimised jurisdiction that does not host the chosen licensing regulator, then facing restructuring once the file opens.

Entity types vary by jurisdiction. Estonia uses the osaühing (OÜ); Cyprus uses the limited liability company; the UK uses the private limited company under the Companies Act 2006; the UAE uses free-zone companies in ADGM or DIFC for the relevant financial-services permissions, or a mainland LLC where the activity is regulated onshore by the CBUAE; Canada uses a federal corporation under the Canada Business Corporations Act or a provincial corporation; Australia uses a proprietary limited company under the Corporations Act 2001.

Share-capital practice varies sharply: Estonia and Cyprus accept paid-in contributions to be made before the licence file progresses; the UAE typically requires the licensing capital to be paid up before the licence application is submitted.

Director and management substance matters more for fintech than for many other regulated activities, because the regulators assess the firm’s risk-management depth as part of the authorisation review. EU PSD2 home-state regulators apply fit-and-proper assessments to directors and substantial shareholders, and they apply substance tests to the management function: a registered office that is in fact occupied, executive management that is in fact resident, an MLRO who is in fact accountable in the jurisdiction. The UAE framework applies equivalent substance and residency standards. In Australia, a proprietary company needs at least one director who ordinarily resides there, and the AML/CTF compliance officer must be an Australian resident where the services are provided through a permanent establishment in Australia. Canada’s registrations set no equivalent residency test: FINTRAC and the Bank of Canada register foreign money services businesses and payment service providers too, and director residency depends on the incorporation statute (the federal CBCA requires at least a quarter of directors, or one where there are fewer than four, to be resident Canadians; British Columbia and Ontario set no residency rule).

Formation Snapshot by Jurisdiction

e-Residency in Estonia is operationally useful for non-resident founders managing the entity remotely; it does not substitute for the substantive presence the regulator expects from the management function during the licence file. Layering a holding entity into a jurisdiction the home regulator later treats as an indirect parent for substance assessment is the common formation mistake, and it adds three to six months mid-application.

A simpler structure (operating entity in the licensing jurisdiction, one layer of holding above, substance in both places) survives most fit-and-proper reviews.

Licensing Requirements

An EU fintech’s authorisation depends on its regulated activities and any applicable exclusions. Payment institutions (PIs) follow PSD2 (Directive (EU) 2015/2366); electronic-money institutions (EMIs) follow EMD2 (Directive 2009/110/EC). Credit institutions may also provide these services, and AIS-only providers follow PSD2 Article 33 registration. Initial capital ranges from €20,000 (PI, money remittance only) through €125,000 (PI, services 1 to 5) to €350,000 (EMI). Outside the EU, the route depends on the jurisdiction’s framework.

EMI versus PI. A payment institution may provide any of the eight payment services in PSD2 Annex I but cannot issue electronic money. An electronic-money institution may issue e-money and additionally may provide all payment services. Annex I’s closed list covers services enabling cash to be placed on a payment account, services enabling cash withdrawals from a payment account, execution of payment transactions, execution of payment transactions covered by a credit line, issuing or acquiring of payment instruments, money remittance, payment initiation services, and account information services.

The licence choice follows the legal activity, not the product label. A wallet or prepaid card is e-money only if it meets every element of EMD2 Article 2(2) and no exclusion applies; an EMI or credit institution may issue it. Payment services such as remittance, payment initiation and acquiring require the relevant PSD2 permission unless excluded; AIS-only providers use Article 33 registration. PSD3, once in force, will collapse the EMI and PI categories into a single payment-institution framework with e-money issuance as an authorised sub-service.

Capital and own funds. Under PSD2 Article 7, PI initial capital is €20,000 for money remittance only (service 6), €50,000 for payment initiation only (service 7), and €125,000 for any of services 1 to 5; PSD2 Article 9 then applies the supervisor-selected Method A, B, or C. Under EMD2 Articles 4 and 5, EMI initial capital is €350,000 and issuance own funds use Method D at 2% of average outstanding e-money.^[1][2]

A hybrid EMI adds the requirement for unrelated payment services: the ongoing requirement is at least the sum of Method D and that PSD2 limb, with the initial-capital floor and permitted supervisory adjustments still applying.^[1][2]

Under the April 2026 Council compromise, the draft PSD3 Article 5 floors are €40,000 for Annex I point 5 only, €50,000 for point 6, €150,000 for points 1 to 5 subject to the point-5-only carve-out, and €250,000 for point 8. A provider spanning more than one category must add the applicable minima. These draft values do not replace current law until the legislative and national implementation steps are complete.^[13]

Safeguarding. Under the segregation method in PSD2 Article 10, funds still held at the end of the business day following receipt go to a separate credit-institution or eligible central-bank account, or into qualifying secure, liquid, low-risk assets, and must not be commingled with other persons’ funds. Insurance or a comparable guarantee from a non-group provider for an equivalent amount is the alternative and must be payable if the firm is unable to meet its financial obligations.^[1][2]

The central-bank option is conditional in practice: Eurosystem central banks do not provide safeguarding accounts to non-bank payment service providers or CASPs under ECB Decision (EU) 2025/222 Article 3. Eligibility for a TARGET settlement account does not change that restriction.^[36]

EMD2 Article 7 carries those methods into e-money safeguarding, subject to national method selection. Funds received through a payment instrument may wait until they reach the EMI’s payment account or otherwise become available to it, but must be safeguarded no later than five business days after the e-money is issued.^[1][2]

Where a credit-institution account is the chosen route, the regulator tests the acknowledgement letter; the statute does not make that route universal.^[1][2]

In the UK, the Payments and Electronic Money (Safeguarding) Instrument 2025 (FCA 2025/38) has applied since 7 May 2026 and prescribes daily reconciliation and the form of the safeguarding acknowledgement letter.

Passporting and the agent model. An EU-authorised PI or EMI passports across the EEA under PSD2 Article 28 / EMD2 Article 3 by notification to the home regulator. PSD2 Article 19 permits a PI to provide payment services through agents in its name; EMD2 Article 3(5) extends this to EMI agents for payment services unrelated to e-money issuance.

Agents and distributors cannot themselves issue e-money: only the principal EMI may issue. Agent registration with the home regulator typically takes two to three months from filing. For an early-stage fintech that wants to operate before its own licence is granted, the agent model is the standard route to time-to-market.

MiCA and e-money tokens. Under MiCA Article 48(1), only credit institutions and EMIs may issue e-money tokens; Article 48(2) provides that e-money tokens are deemed to be electronic money.^[22]

EBA Opinion EBA/Op/2025/08 of 10 June 2025 is non-binding supervisory advice that amends neither PSD2 nor MiCA. It treats specified EMT services as PSD2 payment services, namely transferring EMTs on behalf of clients and operating custodial wallets from which clients can receive EMTs from and send EMTs to third parties; exchange and purchase intermediation fall outside, and an EMI may notify custody and transfer of its own issued EMTs under MiCA Article 60(4).

Where separate CASP and PI or EMI authorisations are required, the relevant MiCA Article 67 and PSD2 or EMD2 capital requirements apply cumulatively; an institution using the Article 60 notification route is exempt from Article 67 under Article 60(10).^[12]

The follow-up opinion of 12 February 2026, also non-binding, set supervisory expectations for the end of the EBA No-Action Letter transition on 2 March 2026: where PSD2 applies, a CASP providing those EMT services needs its own PI or EMI authorisation, or an agency or partnership arrangement with an authorised payment service provider, and any continuation without one depends on conditions set by the national competent authority rather than on a filing.

Even a first-party transfer of EMTs for a client can qualify, whether or not the wallet is a payment account.^[12]

A founder building a euro stablecoin uses the EMT route under MiCA Article 48: the issuer must be a credit institution or an EMI. It notifies the white paper at least 20 working days before publication under Article 51 rather than seeking an extra standalone Title IV authorisation.^[22]

Separately, the issuer notifies its intention to offer the EMT or seek admission to trading at least 40 working days in advance under Article 48(6). The narrow EMD2 exemptions preserved by Article 48(4)–(5) do not remove the white-paper requirement in Article 48(7).^[22]

Non-EU licensing pathways. Outside the EU, the routes diverge:

• United Kingdom: the FCA regime mirrors PSD2 in substance under the Electronic Money Regulations 2011 and Payment Services Regulations 2017, with the practical difference that there is no EU passport and the FCA operates the Small EMI and Small PI categories, a Small PI sitting at or below the €3m monthly average payment transactions threshold and a Small EMI at or below €5m in average outstanding electronic money.
• United Arab Emirates: three regulators apply. The Central Bank of the UAE covers onshore retail payment services (RPSCS Circular 15/2021, initial capital AED 100,000 to AED 3 million by licence category and payment volume) and stored-value facilities (SVF Circular 6/2020, paid-up capital of at least AED 15 million); the ADGM Financial Services Regulatory Authority handles Money Services Business permissions (Category 3C, base capital USD 250,000); and the DIFC Dubai Financial Services Authority issues Providing Money Services and Stored Value Issuer permissions (Category 3D USD 200,000 and, for issuing stored value, Category 3C USD 500,000; money transmission alone sits in Category 4 at USD 140,000, and advising or arranging at USD 30,000).^[35]
• Canada: two parallel regimes apply. FINTRAC MSB registration sits under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and Bank of Canada PSP registration sits under the Retail Payment Activities Act, whose risk-management and funds-safeguarding requirements have applied since 8 September 2025, with a one-off registration application fee of CAD 2,500 (November 2024 base, indexed annually by the change in Canada's September all-items CPI per s.25(1) RPAR).
• Australia: AUSTRAC regulates remittance and money-transfer activity under the AML/CTF Act 2006, with the Treasury Payments System Modernisation reform proposing a new SVF and payment-service framework; under the March 2026 exposure draft it would commence 12 months after Royal Assent, with a further one- or six-month default transition.

For the full EMI and payment-institution category page, see the EMI and payment licensing guide. Brexit conditions on the UK route are covered in the licensing overview.

Banking

Banking is the single most underestimated component of a fintech launch. A licensed fintech needs two distinct banking arrangements: a safeguarding arrangement for client funds, and an operational account for the firm’s own treasury. Safeguarding is the regulator’s gate; the operational side is the firm’s runway.

The safeguarding question is the binding constraint, not the operational question. Of the statutory methods set out under Licensing Requirements, segregation at a credit institution is the one that puts a bank on the critical path, and a credit institution issues the acknowledgement letter only for the selected account structure.^[1][2]

Where credit-institution segregation is selected, closure of the safeguarding section depends on that letter: a draft is not enough; the regulator wants the executed document. Other selected methods require their corresponding final evidence.

In the UK, FCA Instrument FCA 2025/38 (applicable from 7 May 2026) prescribes the letter form, daily reconciliation, and an annual safeguarding audit, unless the firm has not had to safeguard more than £100,000 at any time over at least 53 weeks (SUP 3A.1.1R(2)).^[14]

Treasury, payroll, FX, and vendor payments sit in the operational banking layer. An EU-licensed fintech typically holds operational accounts at one or two credit institutions and uses an EMI-style provider for FX and multi-currency settlement.

SEPA scheme adherence and settlement access are separate steps: an EMI or PI adheres to the SEPA Credit Transfer scheme, and separately to the SEPA Instant Credit Transfer scheme, under the relevant European Payments Council rulebook, and then reaches other participants directly or indirectly through one or more clearing and settlement mechanisms of its choice. TIPS is not required for ordinary SEPA Credit Transfer participation; for instant payments, the applicable reachability rules, including TIPS requirements, apply to their own population of providers whatever settlement route is chosen. Most EMIs and PIs reach the schemes indirectly through a sponsor bank for clearing and settlement.^[26]

Correspondent banking and a SWIFT BIC become relevant for non-SEPA flows: increasingly scarce after the global de-risking cycle of 2015–2025, but obtainable for licensed entities with credible AML programmes.

Through Jagelski & Partners’ partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Placement runs as pre-qualification across the network rather than sequential applications: the firm’s analysts assess the client profile against the live appetite of more than 90 institutions, surface credible matches for both the safeguarding leg and the operational leg, then introduce an independent specialist to coordinate placement alongside the licence application.

In our experience, fintech founders who secure a safeguarding letter before the file is filed shorten the path to authorisation by four to ten weeks, because the regulator’s safeguarding question is answered when the file is read, not after.

Jagelski & Partners is paid by the institution, not by the client. We do not charge an onboarding fee. The pricing on the client’s account-opening documentation is the institutional rate. There is no markup layered on top of institutional pricing.

Ongoing Compliance

Ongoing compliance is a permanent operating expense, not a one-time licensing event. For an EU-authorised EMI or PI, the compliance perimeter runs across AML/CFT, PSD2 conduct and reporting, safeguarding audit, complaints handling, passporting notifications, and DORA. The realistic annual envelope for a mid-sized EMI sits between €1.0m and €2.0m.

AML/CFT. EU PIs and EMIs are obliged entities under the fourth Anti-Money Laundering Directive (Directive (EU) 2015/849, as amended by the fifth, Directive (EU) 2018/843), as transposed nationally. From 10 July 2027 the new AML Regulation, Regulation (EU) 2024/1624, applies generally. Most of AMLD6 (Directive (EU) 2024/1640) must be transposed by the same date; the exceptions are its Article 74 amendments to beneficial-ownership access under the fourth Directive, which were due by 10 July 2025, its beneficial-ownership register access rules (Articles 11 to 13 and 15), due by 10 July 2026, and its single access point to real estate information (Article 18), due by 10 July 2029.^[20]

Frankfurt has hosted the operational European Anti-Money Laundering Authority (AMLA) since 1 July 2025. The MLRO function is a permanent senior-management appointment, and the AML/CFT manual is a living document the regulator can request at any time.

PSD2 conduct and reporting. The EBA Guidelines on fraud reporting under PSD2 (EBA/GL/2018/05, as amended in 2020) govern the statistical fraud-reporting cycle; the PSD2 major-incident reporting guidelines (EBA/GL/2017/10, revised in 2021) were repealed on 17 January 2025, when harmonised incident reporting under DORA began to apply.^[31] ECB Regulation (EU) 2020/2011 (Payments Statistics) imposes harmonised statistical reporting on PSPs. Under the agreed PSR text, once it applies, payment service providers would have to join fraud information-sharing arrangements (Article 83a), and consumers would gain refunds where a failed payee-verification check caused a defective transfer (Article 57) or where someone impersonating their own provider induced an authorised payment (Article 59).^[32]

Safeguarding audit. An annual independent safeguarding audit applies where the home regime requires one, as in Ireland and the United Kingdom; PSD2 itself does not impose it. In the UK, FCA Instrument FCA 2025/38 (applicable from 7 May 2026) sets daily reconciliation, the form of the safeguarding acknowledgement letter, and an annual audit by a qualified auditor, with an exemption for firms that have not had to safeguard more than £100,000 at any time over at least 53 weeks.^[14]

Operational resilience. Since 17 January 2025, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) has been applicable to PIs, EMIs, credit institutions, investment firms, and CASPs under Article 2(1). DORA covers ICT risk management, incident reporting (initial notification as early as possible, within 4 hours of classification as major and normally no later than 24 hours after awareness (if classified after that window, within 4 hours of classification) under Commission Delegated Regulation (EU) 2025/301), threat-led penetration testing every three years for significant entities, and the Register of Information on ICT third-party contractual arrangements. The first register submission was due 30 April 2025, and runs annually thereafter under Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 (ITS on the Register of Information).

Complaints, passporting, and prudential reporting. PSD2 Article 101 and the EBA Guidelines on complaints handling set the customer-complaint perimeter. Relevant changes to a passport notification, including additional agents, branches, or outsourcing in a host state, must be notified to the home regulator without undue delay under PSD2 Article 28(4); the home regulator forwards them to the host regulator within one month and decides on registering a host-state agent or branch within three months.^[1][2]

A PI reports against its applicable Method A, B, or C requirement and initial-capital floor. A hybrid EMI reports Method D for issuance plus the separate own-funds amount for unrelated payment services, subject to its initial-capital floor and supervisory adjustments.^[1][2]

Annual cost framing. Compliance is a recurring fraction of the firm’s revenue, not a project line. For a small EMI safeguarding €50m of client funds, the realistic annual envelope sits between €300,000 and €500,000 across the MLRO and compliance function, safeguarding audit, ICT controls under DORA, and regulatory levies.

For a mid-sized EMI safeguarding €500m, the figure rises to €1.0m to €2.0m. At €5bn or more of safeguarded client funds, the figure for a large EMI exceeds €5m and includes dedicated second-line and third-line teams, a full DORA programme, and potential AMLA direct supervision.

Realistic Timeline and Costs

Realistically, end-to-end timelines from formation to operational launch run from six months to more than two years. Professional fees land between €40,000 and €250,000, plus initial capital, plus banking float. In our experience, the variance comes from jurisdiction, the completeness of the file at first submission, and whether safeguarding is sequenced in parallel with licensing or after it.

End-to-End Timeline and Cost Range

What compresses the envelope: pre-qualified safeguarding before capital is locked; pre-drafted compliance documentation (AML/CFT manual, governance policies, MLRO appointment); a clean fit-and-proper file for directors and substantial shareholders; and a chosen regulator with a published throughput record. What expands it: safeguarding sequenced after the licence application rather than in parallel; an MLRO appointed late; a parent-company structure the home regulator decides to assess for indirect substance; and an over-engineered product scope that triggers multiple service-line authorisations at once.

Figures date-stamped as of May 2026 and quoted in euros for the EU/UK columns, US dollars for the UAE columns, and Canadian and Australian dollars for the North American and APAC columns respectively where applicable.

Frequently Asked Questions

References