Legal support for fintech in Europe

Alena Mach

15.11.2025 | 6 min read

Updated: 16.10.2026

There is no single "fintech licence" in Europe: the requirements depend on exactly what your product does — transfers money, issues electronic money, provides crypto-asset services, or only shows account information. Legal support for fintech therefore starts with a precise classification of the activity, and then covers authorisation, compliance, contracts and expansion into other markets.

COREDO has supported financial and crypto projects since 2016 — from analysing the business model to preparing documents for the regulator and AML support after launch.

How to determine the regulatory regime for a fintech project

The regulator assesses the services the client receives, not the name of the product. The words "platform", "app" or "technology company" do not by themselves answer the question of whether a licence is required. So the first step is to describe the business model in detail: which operations are carried out, whose money or assets pass through the company, and who its clients are.

Different regimes apply to the main areas of fintech in the EU:

One company often falls under several regimes at once, and the boundaries between them must be checked for each product. For example, MiCA does not apply to crypto-assets that qualify as financial instruments: such assets are assessed under the relevant financial-services regime. Nor does MiCA apply to crypto-assets that qualify as deposits, or to a number of other categories.

PSD2 also has exclusions: a number of services and operations are carved out of its scope. The Central Bank of Ireland stresses that responsibility for correctly applying an exclusion lies with the company itself, and that legal advice should be obtained in case of doubt. In Ireland, for example, certain exclusions also require notifying the regulator — in particular, for the limited network exclusion above a certain volume of operations.

Payment services and electronic money: what applies today

Payment services in the EU are regulated today by PSD2, transposed into the national law of each country. The directive singles out new types of services: initiating a payment on the client's instruction and providing consolidated information on the client's accounts held with one or more banks. The Central Bank of Ireland, for example, accepts applications for the authorisation of a payment institution and an electronic money institution. It also accepts applications for the registration of an account information service provider (AISP) and a small electronic money institution.

Electronic money is monetary value stored in electronic form, which represents a claim on the issuer, is issued on receipt of funds for payment transactions, and is accepted by persons other than the issuer. If your product holds client funds that can be used to pay third parties, it is worth checking whether you are issuing electronic money. Not every wallet amounts to the issuance of electronic money, but the question needs to be settled before launch.

PSD2 authorisation is valid in every EU Member State: a payment institution can provide the services it is authorised for in other countries under the freedom to provide services or through a branch. National regimes, however, differ in detail. In Ireland, for instance, there is no small payment institution regime, so companies that want to provide payment services must obtain payment institution authorisation. Our service for obtaining financial licences in the EU helps match the regime and jurisdiction to your model.

Crypto-assets: CASP authorisation under MiCA

MiCA sets a general rule. Crypto-asset services in the EU may be provided only by a company authorised as a crypto-asset service provider (CASP) or by a specified financial entity that has met the notification conditions under Article 60. The second route is not open to everyone. It is designed for entities that are already regulated, such as investment firms, and only for the services that Article 60 allows.

The transitional period for companies that had been operating under national rules before 30 December 2024 has ended. Article 143(3) of MiCA allowed them to continue operating until 1 July 2026 at the latest, or until a decision on their application. Member States could shorten that period or not apply it at all. A company that had not obtained CASP authorisation by the end of the transitional period must stop providing services until it is authorised. So an earlier national VASP registration does not replace authorisation under MiCA today.

What goes into a CASP authorisation application

The application is submitted to the competent authority of the country of registration, and Article 62 of MiCA sets out its contents in detail. In particular, it includes:

• a programme of operations: which services the company will provide, and where and how it will market them;
• a description of corporate governance, information on the management body and holders of qualifying holdings, confirmation of their good repute, and, for the management body, their qualifications as well;
• internal control and risk-management mechanisms, including the risks of money laundering and terrorist financing, and a business continuity plan;
• technical documentation of the ICT systems and security arrangements, together with a description of them for non-specialists;
• the procedure for segregating crypto-assets and client funds, and the complaints-handling procedure;
• policies for specific services — for example, a custody policy, trading-platform rules or an order-execution policy;
• confirmation of the prudential safeguards under Article 67.

CASP prudential requirements do not come down to a single share-capital figure. Article 67 requires safeguards to be maintained on an ongoing basis at no less than the higher of two amounts. The first is the minimum capital set for the type of services in Annex IV; the second is a quarter of fixed overheads for the preceding year. The safeguards can be made up of own funds, an insurance contract or a comparable guarantee, or a combination of these.

One more practical point: MiCA does not provide for operating through agents without their own status. If a CASP wants to receive and transmit client orders, or provide advice, through a third party, that third party must itself be a CASP.

To provide services in several EU countries, a CASP sends its home authority a list of the Member States and the list of services for cross-border provision. It also sends the start date of that provision and a list of other activities outside MiCA. The authority passes this information to the contact points of the host states, and also to ESMA and EBA. We take care of preparing the application, the AML documents and the correspondence with the regulator — this is part of our service for obtaining a crypto licence (CASP).

DORA, GDPR and AML: a fintech company's duties after launch

DORA: digital operational resilience

DORA has applied since 17 January 2025. It harmonises operational-resilience requirements for 20 types of financial entities and also covers ICT third-party service providers. For a company within the scope of DORA, legal preparation includes:

• an ICT risk-management system;
• a procedure for handling ICT incidents and reporting major incidents to the supervisory authority;
• digital operational resilience testing;
• management of risks from ICT third-party providers and the key terms of contracts with them.

For certain categories, for example small and non-interconnected investment firms, Article 16 of DORA provides a simplified ICT risk-management framework. This is not an exemption from DORA: such entities apply a lighter, but still mandatory, version of the requirements. Whether your company falls within scope, and to what extent, is determined case by case.

GDPR: customer data

Processing personal data when providing payment services is subject to the GDPR. The European Data Protection Board notes that a payment service provider, depending on the circumstances, can be a controller or a processor. A controller is whoever, alone or together with others, determines the purposes and means of processing, so the company's role depends on the specific circumstances of the processing.

The controller chooses and justifies the legal basis for each purpose of processing. The basis of "performance of a contract" is only suitable for processing that is objectively necessary for the particular service. Where several separate services are bundled into a single contract, necessity is assessed for each of them. An account information service provider, for example, must state explicitly in the contract the purposes for which data is processed.

AML: current duties and the new EU package

In 2024 the EU adopted a new package of anti-money-laundering rules. It consists of a directly applicable regulation for the private sector, a directive on the organisation of national supervisory authorities, and a regulation on the new European authority, AMLA. According to the Council of the EU, the new regulation will begin to apply three years after its entry into force. So a company's main AML duties are currently set by the national law of the licensing country.

In Ireland, for example, a payment institution or electronic money institution must already have an AML/CFT control system that complies with the national law of 2010 at the time of authorisation. The new AMLA authority does not replace national supervisory authorities and financial intelligence units. It coordinates a single system of supervision, and from 2028 will start directly supervising, above all, selected high-risk financial entities that operate in at least six EU Member States.

You can build AML procedures from scratch, or hand over AML functions to an outside team, through our AML support and outsourcing.

How to prepare for applying to the regulator

The contents of an application depend on the type of activity and on the country, so there is no single checklist for the whole EU. A good official example is the Central Bank of Ireland's document, which a future payment institution or electronic money institution completes before a pre-application meeting with the regulator. It needs to describe:

1. the business model: regulated and unregulated activities, customers, markets, sales channels, a forecast of the number of operations and passporting plans;
2. financial stability: a profit-and-loss account and a balance sheet for the first three years;
3. regulatory capital: the amount, source and timing of injections, and the method for calculating the requirements;
4. the key risks and the system for managing them;
5. outsourcing, including the transfer of functions within the group, and the way outsourced functions are controlled;
6. the safeguarding of client funds, and, where applicable, the banking partners for it;
7. business continuity and the procedure for winding down activities;
8. the composition of the board of directors, management, staff and ownership structure.

This is an Irish example, not a single standard for the whole EU, but it illustrates well what supervisory authorities expect. The Central Bank of Ireland separately stresses that it examines in detail the policies on safeguarding client funds, operational and IT risk, outsourcing, capital and credit risk. The documents must describe the company's actual process from start to finish, not general statements.

Contracts and internal documents of a fintech company

Legal support for fintech does not end with filing the application. Many requirements are met through contracts and internal documents, so it is worth preparing them alongside the application:

• contracts with ICT third-party providers — with the key terms that DORA requires from entities within its scope;
• outsourcing and intra-group service contracts — with a clear mechanism for controlling the transferred functions;
• customer terms and data notices — with clear purposes of processing and legal bases;
• a complaints-handling procedure, and, for a CASP, also a procedure for segregating client assets: both documents are expressly required in a MiCA application.

Expanding into other markets: the EU passport and the United Kingdom

The EU passport allows a company to operate in other EU Member States on the basis of a single authorisation, but only within the scope of the permitted services and under the established procedure. For a CASP this is the notification under Article 65 of MiCA, while a payment institution can operate in other countries only with the services stated in its PSD2 authorisation. Passporting plans should be built into the business model from the outset: the Irish regulator, for example, asks for them to be stated already at the pre-application stage.

The United Kingdom is a separate market. Passporting between the United Kingdom and the EEA countries ended with the close of the Brexit transition period, on 31 December 2020. The UK regulator, the FCA, recommends that companies wanting to operate in the EEA follow local legislation and obtain local authorisation where necessary. So UK permissions are assessed separately from the EU passport.

How COREDO supports fintech projects in Europe

We work with fintech companies throughout the whole journey — from the first assessment of the model to compliance after the licence is obtained:

1. Analysis and choice of regime. We study the business model, determine the type of licence and jurisdiction, and discuss the requirements for capital, staff and infrastructure.
2. Preparing the documents. We prepare the business plan, AML/CFT procedures, organisational structure, financial forecasts and the documents on founders and directors, and, for EMIs and payment institutions, the description of the product and the IT architecture.
3. Filing and supporting the review. We file the documents with the regulator, respond to its requests, and make corrections and additions.
4. Compliance after launch. We advise on AML, develop procedures or take on AML functions as an outsourcing arrangement, while ultimate responsibility remains with the company.