When an entrepreneur first comes to me with the idea of entering the payments services market in Europe, the same question usually reads in their eyes: “Where do you even start?” Regulation of payment institutions in the EU is not a single law or a single regulator, but a whole architecture of directives, national acts, supervisory practices and technical standards. And it is precisely how competent the first step is that determines whether a payment institution license will be your asset or a constant source of stress and constraints.
I have been developing COREDO since 2016 as a company that combines legal, regulatory and business vision in a single project. During this time the COREDO team has participated in the launch and scaling of dozens of fintech projects in the EU, the UK and Asia — from small payment institutions with a niche product to holdings combining the status of a payment institution and an e‑money institution in multiple jurisdictions.
In this article I will explain how regulation of payment institutions works in practice in the EU, what to look for when choosing a country, what the differences are between a payment institution license and an e‑money license, and what requirements for AML, governance and IT infrastructure need to be built into the model from day one. I will speak as a practitioner who is responsible not only for legal compliance but also for the profitability of such projects.
Regulation of payments: PSD2 and e‑money
- EU Directive 2015/2366 (PSD2) – a framework document that sets out the general requirements for payment services in the EU: list of services, Licensing of payment institutions, third‑party access to accounts (open banking, XS2A), strong customer authentication and basic consumer protection requirements.
- Directive 2009/110/EC (electronic money): defines the status of an electronic money institution (EMI), requirements for the issuance and circulation of electronic money, safeguarding of client funds and the minimum share capital for e‑money institutions.
- National legislation of EU countries: each country implements PSD2 and Directive 2009/110/EC into its own laws, adding national specifics: requirements for substance, for the office, for top management, the level of IT security, reporting, etc.
The COREDO team constantly works at the intersection of these levels: we start with an analysis of the client’s business model under PSD2 and Directive 2009/110/EC, and then adapt it to a specific jurisdiction: Lithuania, Estonia, Ireland, Cyprus, Luxembourg or other EU countries.
Payment institution and e-money institution: difference
One of the first questions clients ask me is: “Do we need a payment institution license in Europe or immediately an electronic money license?”
Main difference
- Payment institution (PI) – grants the right to provide payment services listed in PSD2: acquiring, money remittance, execution of payment transactions, issuing of payment instruments, PISP/AISP, etc.
- Electronic money institution (EMI): additionally grants the right to issue electronic money and to hold clients’ funds in the form of an electronic balance (wallets, prepaid cards, stored-value services).
- the minimum share capital for a payment institution is lower than for an e‑money institution, especially if we are talking about a “small payment institution” or a limited license;
- EMIs have stricter requirements for safeguarding, prudential supervision, reporting and risk management.
Which PSD2 services require a license?
To avoid mistakes with the license, it’s important to honestly ask yourself: which specific operations do you want to perform?
- execution of payment transactions (including SEPA payments and cross-border payment services in the EU);
- issuing of payment instruments (cards, virtual cards, other instruments);
- acquiring of payment transactions (merchant acquiring, including online acquiring and payment gateways);
- money remittance (classic transfers without an account);
- services enabling cash to be placed on or withdrawn from a payment account;
- PISP and AISP (open banking).
Minimum statutory capital and supervision
For any payment institution and e‑money institution in the EU, it is critical to correctly assess capital requirements and the potential increase in supervisory burden as the business scales.
Capital: what is it?
In COREDO projects we always model a 3–5 year scenario: how growth in transaction volume will affect own funds requirements and, accordingly, the financial model. This helps avoid a situation where the business scales faster than the shareholders are willing to recapitalize the company.
Prudential supervision in the banking sector
Prudential supervision of payment institutions in the EU is built on a risk‑oriented approach. Regulators look not only at capital adequacy, but also at:
- risk management (operational, liquidity, compliance risk);
- internal control system;
- procedures for safeguarding client funds;
- IT and cyber risks.
Choosing an EU jurisdiction: strategy, not price
The COREDO team usually advises entrepreneurs to look at country choice from several angles:
- Regulator: speed of communication, transparency of processes, willingness to innovate (regulatory sandboxes for fintech, attitude to new models, including paytech and embedded finance).
- Requirements for substance:
- requirement for a physical office;
- local staff (board, MLRO, risk, compliance);
- the depth of presence the regulator requires to recognize the company as genuinely managed from that country.
- Requirements for safeguarding clients’ funds:
- which banks/institutions accept funds;
- whether insurance can be used;
- specifics of account segregation and their oversight.
- Reporting and supervisory burden: report frequency, complexity of forms, intensity of inspections.
- Tolerance toward non-residents and cross-border models: an important factor for projects targeting clients from the CIS, Asia, Africa.
Single European passport for licensing
One of the EU’s key advantages: a single European passport for payment institutions and e‑money institutions.
- provide cross-border payment services in the EU without a separate license in each country;
- open a branch in other EU countries;
- build a network of agents and distribution across the territory.
- local consumer legislation;
- KYC/AML specifics for residents of different countries;
- local rules for marketing financial services;
- requirements for the language of documentation and customer support.
AML requirements for EU payment institutions
Any regulator in Europe today views AML/CFT as a key criterion for payment institutions and electronic money. If your anti‑money‑laundering procedures look formal, your chances of licensing success approach zero.
COREDO was originally formed as a team where AML‑consulting and Legal expertise in financial law work together. This has allowed us to build a practice in which we design the client’s AML model in parallel with the choice of jurisdiction and license, rather than after the fact.
- ownership structure and beneficiary requirements: transparency, no sanctions‑related risks, verification of source of funds;
- the appointment and actual status of the AML officer (MLRO): experience, independence, engagement;
- risk‑based approach: segmentation of clients by risk, enhanced Due Diligence where necessary;
- policies and procedures: customer due diligence, ongoing monitoring, transaction monitoring, sanctions screening, PEP policies;
- use of regtech solutions, but with the understanding that automation does not replace the responsibility of management bodies.
Governance: three lines of defence
In the work of the COREDO team we adhere to the concept of three lines of defence:
- First line: the business units that create the product and interact with customers. They are responsible for compliance with procedures at the operational level.
- Second line: the compliance and risk management functions that develop policies, monitor compliance, and analyse new risks (for example, when launching a new product or entering a new country).
- Third line – internal audit, an independent assessment of the effectiveness of the entire system.
Regulators in many EU countries explicitly expect that, within the structure of a payment institution, the following will be visible:
- an independent compliance officer;
- a risk manager with an understanding of financial and operational risks;
- a plan and scope of internal audit (even if some functions are outsourced).
IT infrastructure and cybersecurity: PSD2 and SCA
For a fintech company, the IT platform is not only a product but also a regulated entity. Requirements for the IT infrastructure and cybersecurity of payment institutions in the EU include:
- compliance with PSD2 requirements for strong customer authentication (SCA);
- data protection in accordance with GDPR;
- resilience, redundancy, incident recovery plans;
- access control, operations logging, vulnerability management.
- API architecture (especially in the context of open banking);
- change management processes;
- outsourcing of critical IT functions and relationships with external providers.
The COREDO team is accustomed to involving IT architects and cybersecurity specialists already at the licensing preparation stage. This allows responding to regulator questions in advance, rather than reworking the platform at the last minute.
Outsourcing and agents: where is the line of what’s allowed
- critical functions (risk management, AML, key IT systems) cannot be completely ‘outsourced’ without losing control;
- necessary agreements, SLAs, monitoring mechanisms, and the regulator’s rights of access to information;
- the regulator assesses the payment institution’s ability to manage a network of agents and partners.
Common mistakes applicants make and how to avoid them
Over the years I have seen several recurring mistakes that significantly prolong or even block obtaining a payment license in the European Union:
- Unclear business model: vague descriptions of services, inconsistencies between the product side and the legal part.
- How we solve it at COREDO: we start with a product workshop, form a clear model, and then write the application pack to fit it.
- Underestimating substance requirements: attempting to build a “virtual office” where the regulator expects a real presence.
- We immediately explain what minimum office and key functions will be required in that specific country.
- A formal approach to AML: copying template policies without taking into account the geography of clients and real risks.
- The COREDO team adapts the AML model to the specific client base (including clients from the CIS and Asia, where risks are higher).
- Weak management team: nominal directors without real experience in payments, risk, and finance.
- In a number of cases we helped clients build a governance structure and select strong managers who satisfy the regulator.
- Lack of a scaling model: the applicant does not show how they will manage risks as transactions grow, enter new countries, or launch new products.
- COREDO’s practice confirms that having a scaling roadmap significantly increases the regulator’s confidence.
Strategic approach to a project: practical recommendations
If you are: a founder, chief financial officer, or head of a fintech division and are considering registering a fintech company in Europe under a payment license, I would recommend structuring the work in stages.
- First: business model, then: jurisdiction.
- Do not choose a country based on “where it’s easiest” or “where acquaintances have already obtained a license”. First describe the product: what payment services, which markets, which customers, how you monetize. The COREDO team often begins cooperation precisely with a product-/business-workshop.
- Do an honest AML and risk self-assessment.
- If you see clients from high-risk regions in your model, complex cross-border chains, work with crypto-assets or embedded finance, do not try to “hide” this from the regulator. Together with COREDO’s clients we develop realistic control measures that can be defended before the supervisory authority.
- Model the ROI of your own license vs operating through a partner.
- Having your own license: it’s not just freedom and margin, but also ongoing expenses for compliance, risk, reporting, IT security, and audit. Sometimes at the start it’s more sensible to build a hybrid model: operate through a partner while simultaneously preparing for licensing. Our experience at COREDO has shown that such strategic flexibility often yields a better result.
- Plan passporting from day one.
- If you target clients across the EU, it’s logical to think in advance about which countries will be key, which specifics need to be considered (language, local consumer law, taxes), and to embed this into the contract architecture, IT systems and compliance processes.
- Don’t postpone organizational design.
- The governance structure, allocation of compliance, risk management and internal audit functions are not a formality for the regulator, but the real resilience profile of the company. The sooner you establish it, the easier it will be to obtain a license and deal with subsequent supervision.
If you plan to create or scale a payment institution or e-money institution in the EU, the COREDO team truly has a lot to offer: from choosing a jurisdiction and license architecture to the operational setup of AML, governance and IT frameworks. And the earlier you involve experts, the more decisions you’ll be able to make from a position of strength, rather than under the pressure of deadlines and regulatory requirements.