EMI & Payment Institution Licensing

An EMD2 authorisation passports across 30 EEA states on EUR 350,000 of initial capital. We build the safeguarding file and file it.

Talk to us

What Is EMI & Payment Institution Licensing?

An EMI or Payment Institution licence is the authorisation a business needs to issue electronic money or provide payment services. A national regulator grants it under one of two EU directives, or the equivalent non-EU European regime, and it sets which activities you may perform, what capital you must hold, how you must safeguard client funds, and how you must report. We obtain that authorisation and stand behind the file.

In short: an EMI or Payment Institution authorisation grants the right to issue electronic money or provide payment services on a single licence passportable across 30 EEA states. Initial capital is €350,000 for an EMI under EMD2 Article 4, and €20,000 to €125,000 for a PI under PSD2 Article 7. PSD3 and the Payment Services Regulation reached provisional agreement on 27 November 2025; realistic market readiness is late 2027 to Q1 2028, when EMD2 is repealed and EMIs become a sub-category of payment institutions. We build your file to the regime you will actually be supervised under.

The two EU regimes sit alongside each other. EMD2 (Directive 2009/110/EC) governs EMI authorisation, with minimum initial capital of €350,000 (Article 4) and ongoing own funds under Method D, 2% of average outstanding electronic money (Article 5). PSD2 (Directive (EU) 2015/2366) governs PI authorisation, with tiered initial capital of €20,000 (money remittance), €50,000 (payment initiation) or €125,000 (all other services) under Article 7, and ongoing own funds under Methods A, B or C. An EMI permission set is a superset of a PI set; most fintechs at any meaningful scale operate as hybrid EMIs that include the PI permissions, with own funds set at the higher of Method D (on the e-money float) and Method B (on the payment volume), without offsetting.

The framework is in its deepest transition since 2009. PSD3 and the directly applicable Payment Services Regulation (PSR) reached provisional agreement on 27 November 2025; the Council published final compromise texts on 23 April 2026, and Official Journal publication is anticipated at the end of Q2 2026. The PSR and PSD3 transposition each run 21 months, with existing authorisations grandfathered for up to 27 months. It is a structural reshape rather than a tightening: EMD2 is repealed and EMIs become a sub-category of payment institutions (Method D preserved); a third safeguarding option (a central-bank account) is added; no single safeguarding method may cover 100% of client funds; a stronger fraud framework adds PSP refund liability for impersonation fraud; and IBAN-and-name Verification of Payee becomes mandatory across the EU.

Three other regimes shape what an EMI or PI file looks like in 2026. DORA (Regulation (EU) 2022/2554) has applied to every EU EMI and PI since 17 January 2025. The EU AML Reform Package (the AMLR, the AMLA Regulation and AMLD6) applies from 10 July 2027, with AMLA operational in Frankfurt since 1 July 2025. And MiCA (Regulation (EU) 2023/1114) Article 48(1) requires every e-money token (EMT) issuer to be a credit institution or an EMI under EMD2.

An EMI or PI licence is not a single product. The fourteen EU EEA-passport regulators all offer single-market access, but supervisory intensity diverges sharply, and the decision is rarely which jurisdiction has the lowest application fee. It is which jurisdiction the safeguarding banks, scheme operators, correspondent network and target markets will all accept. Getting that call right is the difference between a licence that works and a certificate on the wall, and it is the first thing we do with you.

Who Needs an EMI or PI Licence?

An EMI or Payment Institution licence is required by any business that issues electronic money or provides payment services to clients. The trigger is the activity, not the volume: accepting client funds, holding them as a stored monetary claim, executing payment orders against those funds, or providing payment initiation or account information services. Different profiles map to different licence categories and capital tiers, and the category is set by the activity, not the brand label.

In short: the population splits into pure e-money issuers, hybrid EMI/PI fintechs and neobanks, PI-only operators (remittance, acquiring, FX, payroll), open-banking PISPs and AISPs, MiCA Article 48 EMT issuers, CASPs adding fiat rails, and embedded-finance or BaaS platforms.

Electronic money issuers are the core EMI population. Electronic money under EMD2 Article 2(2) is stored monetary value, a claim on the issuer, issued on receipt of funds and accepted by third parties: prepaid cards, e-wallets, gift and benefit programmes, B2B payout cards, in-app balances and electronic vouchers. Initial capital is €350,000; ongoing own funds under Method D are 2% of average outstanding e-money.

Hybrid EMI/PI fintechs are the largest category by count. A neobank offering a euro IBAN wallet, a stored-value account, a debit card, SEPA Instant payments and currency conversion is hybrid by definition: the stored value is e-money under EMD2, the payments on top are PSD2 services under Annex I. Hybrids must present both Method D and Method B own-funds figures separately, with no offsetting. Misclassifying a hybrid as a pure EMI is one of the most common reasons a regulator sends a file back, so we classify the model correctly before drafting a line of the application.

Payment Institutions without e-money are the PI-only population: cross-border payment processors, money remittance houses, card acquirers, FX specialists, payroll providers and payment facilitators. The licence is PSD2-only with the lower tiered capital floor; many later upgrade to EMI authorisation as the model develops stored-value features.

Open banking providers sit in two categories. Payment Initiation Service Providers (PISPs) initiate payment orders from a customer’s account at another PSP and need €50,000 initial capital. Account Information Service Providers (AISPs) aggregate account data under registration rather than authorisation, holding professional indemnity insurance in place of capital. PSD3 reshapes this regime, making dedicated data-access interfaces mandatory and requiring customers to be able to revoke access at any time.

E-money token issuers under MiCA Article 48 are the newest population. A euro-denominated stablecoin issuer cannot operate in the EU under MiCA alone; it must be a credit institution or an EMI under EMD2. The EMI holds the issuance permission; MiCA Title IV governs the white paper, 1:1 reserve backing, the prohibition on interest to holders (Article 50) and the EBA significant-token regime (Article 56). France has become the credible domicile for serious euro-stablecoin issuance.

Crypto-asset service providers adding fiat rails are a growing subset. A MiCA CASP authorisation does not include payment services or e-money issuance, so a CASP offering euro IBAN wallets, fiat deposits and withdrawals, or fiat-denominated payments typically needs an EMI overlay. Many run both from the same home regulator with shared governance, AML and risk documentation, and we sequence the two together through our crypto licensing work.

Embedded finance and Banking-as-a-Service operators are the fourth band. A marketplace holding buyer funds in escrow, a platform paying contractors from a stored balance, or a vertical-SaaS product offering card programmes is typically issuing e-money or providing payment services, depending on the funds flow. The CJEU judgment in Case C-661/22 ABC Projektai UAB v Lietuvos bankas clarified the border: where funds are received without an immediate payment order, the activity is a payment service rather than e-money issuance unless the customer has contractually agreed to e-money issuance. Several operators that classified themselves as EMIs may need to re-classify, and we test for that at the outset.

Where to Get Licensed

Seventeen jurisdictions cover the practical universe of EMI and Payment Institution options. They split into two tiers: fourteen EU EEA-passport jurisdictions, where a single home authorisation extends to all 30 EEA Member States, and three non-EU European jurisdictions (United Kingdom, Gibraltar, Switzerland) that run independent regimes with selective bilateral access. The right choice depends on your target markets, banking tolerance, capital position and the substance you can credibly put on the ground. We tell you where you will actually get authorised, not where it looks cheapest on paper.

Tier 1: EU EEA-passport (14 jurisdictions)

The EU tier is where MiCA EMT issuance, SEPA access and pan-European passporting live, and where supervisory intensity has risen materially since 2023. All fourteen share the EMD2 Article 4 initial capital of €350,000; what divides them is supervisory credibility and speed.

France (ACPR) is the credible domicile for serious euro-stablecoin and EMT issuance: the first global stablecoin issuer to comply with MiCA Article 48 did so via an ACPR EMI authorisation in July 2024, and it is our default when the goal is a euro stablecoin unless a banking, substance or market reason points elsewhere. Ireland (Central Bank of Ireland, CBI) is the gold-standard domicile for embedded finance, BaaS and large-float businesses; the CBI’s January 2023 “Dear CEO” letter drove a step-change in the safeguarding bar. It is not fast, but it is credible. The Netherlands (DNB, with the AFM on conduct) is the rising beneficiary of the flow away from Lithuania and the UK, and the most pragmatic of the large EU regulators, with a credibility-and-speed balance close to Ireland’s at shorter timelines.

Lithuania (Bank of Lithuania) remains the largest EMI cluster in the EU by count, but the cycle has changed: between 2022 and Q2 2026 the regulator revoked at least nine EMI and PI licences, fined more than 20 firms, and recorded effectively no new greenfield authorisations through 2025. CENTROlink is still the broadest EU SEPA gateway. For greenfield applicants chasing a fast passport, the gate is operationally closed; for an established operator with a substantive Lithuanian team and a strong AML record, it still works, and we will say plainly which side of that line your file sits on. We do not file applications we do not expect to clear.

The mid-tier EU options each suit a profile. Luxembourg (CSSF) is the hub for large institutional operators and fund-services overlays, with heavy weight on substance. Malta (MFSA) serves the MiCA-adjacent population under a single regulator covering crypto, payments and securities. Cyprus (Central Bank of Cyprus) overlaps with the forex broker population. Estonia (Finantsinspektsioon, our home jurisdiction) suits operators with a genuine Estonian team and deep AML capability; post-Danske the FI is cautious, and foreign promoters without substance rarely succeed. Belgium (NBB) and Latvia (Latvijas Banka) are mid-tier, Latvian banking constrained by the post-ABLV de-risking cycle. Germany (BaFin) is the highest-supervision-intensity option, with a hard post-Wirecard line on remote substance, so choose it only if the business is genuinely German-run. Spain (Banco de España) offers deep Iberian and LatAm access, Italy (Banca d’Italia, EMIs as “IMEL”) remains a difficult application with high cancellation rates, and Poland (Komisja Nadzoru Finansowego) is the largest non-Baltic Central European market and a growing fintech hub.

Tier 2: Non-EU European (United Kingdom, Gibraltar, Switzerland)

The non-EU tier offers independent regimes with selective bilateral access: EU passporting is not available, and UK and Swiss licensees reach EU markets via local establishment or reverse solicitation.

United Kingdom (FCA) is recoupling rather than decoupling; initial capital for an Authorised EMI is €350,000. The major event is FCA Policy Statement PS25/12, introducing the CASS 15 safeguarding regime from 7 May 2026: daily reconciliations, a resolution pack, an annual reasonable-assurance audit, and a monthly return, with an exemption where safeguarded funds never exceeded £100,000 over a 53-week period. CASS 15 is the most credible safeguarding regime in Europe and likely the baseline PSD3 reference, so a file built to it ages well. Gibraltar (Gibraltar Financial Services Commission, GFSC) is the UK gateway and one of our serviced formation jurisdictions, preserving UK access through the Gibraltar Authorisation Regime with transitional passporting extended to 31 December 2026.

Switzerland (FINMA), one of our serviced formation and crypto-licensing jurisdictions, has no direct EMI equivalent; three options fit: the FinTech licence under Article 1b BankA (public deposits up to CHF 100 million; minimum capital CHF 300,000 or 3% of deposits), a full banking licence (minimum CHF 10 million), and the Article 1 sandbox exemption (up to CHF 1 million). The Federal Council has proposed replacing the Article 1b licence with Payment Institution and Crypto Institution categories from 2027 at the earliest. The fintech licence is the only Western European option giving direct Swiss Interbank Clearing access via a Swiss National Bank sight account, a structural advantage no EU EMI can match.

Jurisdiction comparison

All fourteen EU jurisdictions share the EMD2 Article 4 initial capital of €350,000 and offer EU passporting. Non-EU rows carry their own capital floors (€350,000 in the UK, £350,000 in Gibraltar, CHF 300,000 or 3% of deposits in Switzerland) and operate outside the passport. The columns below carry the variation that drives the choice.

JurisdictionRegulatorLicence TypeTimelineCorporate Tax
FranceACPREMI / PI / EMT issuer (MiCA Article 48)13–18 months25.83%
IrelandCBIEMI / PI16–24 months12.5% (trading)
LithuaniaBank of LithuaniaEMI / PI / Small EMI15–22 months (gate operationally tight)15–16%
NetherlandsDNB / AFMEMI / PI13–21 months25.8% / 19%
LuxembourgCSSFEMI / PI16–24 months24.94%
MaltaMFSAEMI / PI (Class 3/4)12–16 months35% headline / ~5% effective
CyprusCBCEMI / PI12–18 months15% from 2026 (12.5% FY25)
EstoniaFIEMI / PI15–24 months (selective)22% distributed / 0% retained
BelgiumNBBEMI / PI15–22 months25%
LatviaLatvijas BankaEMI / PI15–22 months20% distributed / 0% retained
GermanyBaFinEMI / PI (ZAG)18–27 months~30% all-in
SpainBanco de EspañaEMI / PI15–22 months25%
ItalyBanca d’ItaliaIMEL / PI18–27 months27.9% (IRES+IRAP)
PolandKNFEMI / PI15–22 months19% (9% small)
United KingdomFCAAuthorised EMI / Small EMI / API / PISP / AISP9–16 months25% (19% small)
GibraltarGFSCEMI / PI (FSA 2019)12–18 months15% (from 1 July 2024)
SwitzerlandFINMAFinTech licence (Article 1b BankA)13–22 months11.9–21% canton-dependent

The column the table cannot show is supervisory intensity, and it decides most mandates. France and the Netherlands lead the credible-and-fast tier, Ireland is credible-and-slow, Germany credible-and-very-slow, and Lithuania historically fast but now gated. We weight that intensity into the recommendation, because it is what determines whether your file clears. For a serious EU mandate the choice between France and Ireland comes down to two questions: issuing a euro stablecoin or EMT? France. Building a BaaS or embedded-finance platform with large client floats? Ireland. Anything else is a banking-and-substance call, which we make with you on the first consultation.

Key Requirements

Requirements vary by jurisdiction and tier, but six categories appear in every regulated regime: initial capital and ongoing own funds, corporate substance and key persons, safeguarding of client funds, AML and CFT controls, operational resilience under DORA, and reporting and governance. The depth, evidence standard and enforcement intensity of each vary sharply across the seventeen jurisdictions.

In short: every regulated EMI or PI file turns on six pillars: capital and own funds, substance and key persons, safeguarding, AML and CFT, DORA, and reporting and governance. Tier-1 regulators expect a 12-month operating-cost cushion above the regulatory floor and locally hired key-function holders before the application is filed.

Initial capital and ongoing own funds

Initial EMI capital is €350,000 under EMD2 Article 4; ongoing own funds for the e-money activity use Method D (2% of average outstanding e-money). Non-e-money payment services within a hybrid use one of three PSD2 methods: Method A (10% of the prior year’s fixed overheads), Method B (payment-volume, with a k-factor of 0.5 to 1), or Method C (a composite indicator on interest and commissions). Hybrids must present both Method D and Method B figures, calculated separately with no offsetting; the binding figure is the higher of the two. A capital cushion of 12 months of operating expenditure on top of the floor is now the de facto Tier-1 expectation; six months is no longer credible. We structure and evidence the position so it holds up.

Corporate substance and key persons

Substance is the most common cause of application failure. Every regime requires a locally incorporated company with a registered office, a board of fit-and-proper directors with at least one locally resident, and an experienced senior management team, with mandatory roles for the Money Laundering Reporting Officer (MLRO), Chief Compliance Officer (CCO), Chief Risk Officer (CRO) and Chief Finance Officer (CFO). Expectations differ sharply: Ireland’s CBI applies the Pre-Approval Controlled Function regime with local residency, Germany’s BaFin scrutinises remote-substance files closely post-Wirecard, and Lithuania’s recent enforcement cycle was driven largely by substance failings. Hiring the MLRO, CCO and CFO in the licensing jurisdiction before filing is the single most impactful step on credibility, so we form the company and place those roles before the application goes in.

Safeguarding of client funds

Under EMD2 Article 7, three methods are available: segregation in a separate account at a credit institution (used by around 95% of EMIs), investment in low-risk liquid assets meeting the secure-asset criteria, and insurance or comparable guarantee from a third party. Daily reconciliation is the universal expectation. The FCA’s CASS 15 regime (from 7 May 2026) sets the most detailed standard yet: daily reconciliations, a resolution pack, an annual reasonable-assurance audit, and a monthly return. Under PSD3, no single method may cover 100% of client funds, forcing most EMIs to add a second arrangement during the transposition window. The operators who land their grant cleanly are those whose safeguarding bank was confirmed before the regulator opened its substantive review, which is why we arrange that account first, not last.

AML and CFT controls

The EU AML Reform Package applies from 10 July 2027, with AMLA operational in Frankfurt since 1 July 2025. It comprises the AMLR (the single rulebook), the AMLA Regulation (establishing the EU-level supervisor) and AMLD6. For EU EMIs and PIs it brings a single rulebook replacing the national AMLD5/6 patchwork, direct AMLA supervision of the first selected entities from 2028, a harmonised €10,000 EU-wide cash limit, due diligence triggered at €3,000 occasional transactions, and a 25% beneficial-ownership threshold across all Member States. Non-EU regulators have moved in parallel: the FCA’s financial-crime expectations have intensified since 2023, and the CBI’s “Dear CEO” programme has set the practical EU baseline. We build the AML framework to that bar from the start.

Operational resilience under DORA

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to every EU EMI and PI. It mandates an ICT risk-management framework (Articles 5 to 14), an incident-reporting cadence for major incidents (Articles 17 to 19), a maintained Register of Information for ICT third-party providers (Article 28), periodic resilience testing including threat-led penetration testing (Articles 26 to 27), and direct ESA oversight of critical ICT third-party providers (Article 31). The European Supervisory Authorities designated the first 19 critical providers in November 2025, and they face penalty payments of up to 1% of average daily worldwide turnover under Article 35(8). DORA is where most weak files come undone: a 2024 supervisory dry-run found only around 6.5% of firms passed all the Register of Information data-quality checks. We produce the Register and ICT inventory in the format the regulator expects on first request.

Reporting and governance

Every regulated EMI/PI submits a regular flow of returns and notifications: quarterly prudential returns (own funds, capital ratio, fixed overheads, payment volume), an annual audited financial statement plus an annual safeguarding audit where required, DORA major-incident reports and AML suspicious activity reports as they arise, and ad-hoc notifications for material changes in shareholders, key persons, business model or outsourcing. The FCA’s CASS 15 monthly return adds a UK layer from 7 May 2026, and AMLA’s selection of the first directly supervised cross-border groups from 1 July 2027 adds a parallel EU layer for any EMI passporting into six or more Member States. The common mistake is treating a six-country footprint as a growth metric rather than the AMLA direct-supervision trigger it now is. We model that burden into the passporting plan, so the footprint is a decision, not an accident.

How We Work

We run an EMI or Payment Institution licence as a single mandate and do the work ourselves. Corporate formation, the licence application, safeguarding banking, the capital structure and the AML and DORA programmes run in parallel, not in sequence, so capital, substance and banking are all in place before the regulator asks for them. You deal with one accountable firm. We deliver through a controlled network of vetted in-country lawyers, accountants and licensed specialists we work with directly, alongside our own in-house team, and never offload your file to an unverified third party.

Jurisdiction selection

The first thing we do is the jurisdiction call, mapping four things together: your regulated activities (e-money issuance, PSD2 Annex I payment services, PISP, AISP, MiCA Article 48 EMT issuance), the markets you actually target, the product and risk profile you intend to offer, and the safeguarding banks you can realistically reach in each candidate jurisdiction. A euro-stablecoin issuer with European institutional ambitions needs a different answer from a B2B payments operator targeting Latin America. Lithuania is no longer the default for new entrants; France for stablecoin and EMT issuance, Ireland for embedded finance and BaaS, and the Netherlands for pragmatic credibility are the credible EU defaults today.

Corporate formation in parallel with the licence application

Once the jurisdiction is set, we run corporate formation in parallel with the application; the substance work is jurisdiction-specific:

  • France: a French SAS or SA with locally resident senior managers and registered office before the ACPR file is submitted, with management interviews scheduled.
  • Ireland: an Irish DAC or PLC with at least one EU-resident director, the PCF stack identified, and CBI pre-application engagement booked.
  • United Kingdom: a UK limited company with FCA-approved persons identified, the CASS 15 architecture documented, and FCA pre-application contact opened.

We form the company through our company formation work, at the depth the licence requires rather than the cheapest available.

Safeguarding banking

We arrange the safeguarding banking alongside the application, not after, because EMI safeguarding is a high-risk category at every credit institution; approaching institutions that hold an active EMI safeguarding programme is the difference between a four-week banking timeline and a four-month one. A mandate typically needs three account types: the segregated client-money account under EMD2 Article 7, the operating account for working capital, and the regulatory capital account holding initial capital and own funds. We handle this through our high-risk business accounts work. Under PSD3’s prohibition on any single method covering 100% of client funds, we now build a two-bank or bank-plus-secure-assets structure by default for any EMI authorised near transposition, and secure it before the regulator opens its substantive review.

DORA, AML and post-launch compliance

DORA readiness, the AML manual, KYC tooling, the risk-management framework and reporting infrastructure are sequenced into the timeline so the operator can go live on grant day, not start a three-month build. The pre-grant programme places the MLRO, CCO, CFO and CRO in the licensing jurisdiction before filing, builds the AML risk-based approach at customer-segment level, documents sanctions-screening tooling with regulator-grade evidence trails, and produces the DORA Register and ICT inventory in the format Tier-1 regulators expect on first request. Post-launch we handle compliance reporting, annual safeguarding audits, key-person changes, and the milestones that fall due: AMLA selection from 1 July 2027, FCA CASS 15 returns from 7 May 2026, and PSD3 transposition during 2027 and 2028.

MiCA EMT and CASP overlays

For stablecoin and EMT issuance under MiCA Article 48, we coordinate the EMI authorisation with the MiCA Title IV obligations through our crypto licensing service: the EMI holds the issuance permission, while the white paper, reserve composition, redemption framework and significant-token compliance run in parallel. For CASPs adding fiat rails, we sequence the EMI overlay alongside the MiCA CASP authorisation under the same home regulator where possible, with shared governance, AML and risk documentation.

Agentic payments and AI-agent commerce

AI agents now initiate payments autonomously, settling in stablecoins or e-money tokens via protocols such as x402 and Google’s Agent Payments Protocol. No jurisdiction has created a dedicated agent-payments licence: the activity is regulated by what the payment does, not by what initiates it. Issuing the EMT an agent spends is EMT issuance, requiring an EMI authorisation under MiCA Article 48 and EMD2 or a bank, so the EMI licence becomes the load-bearing permission for agentic-payment infrastructure. A MiCA CASP authorisation alone does not cover moving those tokens for clients: that is a payment service needing a payment or e-money institution permission under PSD2 (US money-transmitter licensing, which we do not service, where relevant). We scope the EMI authorisation as the issuance and settlement spine, paired with our work for stablecoin issuers.

A licence without banking access is a certificate on the wall. An EMI needs both safeguarding accounts at a credit institution and correspondent banking for the operating side, both high-risk categories at every institution. We arrange that banking ourselves, alongside the licence, working with a licensed EU EMI and credit-institution partners through our controlled network rather than leaving you to find banking after grant. See banking for regulated businesses.

Banking is a core part of the EMI mandate. The banking is sequenced to land with the licence. We give you a clear scope and price for the whole mandate at the consultation stage, so you know what you are committing to before any work begins.

Frequently Asked Questions

Regulatory landscape

What is the difference between an EMI and a Payment Institution?

An Electronic Money Institution (EMI) is authorised under EMD2 (Directive 2009/110/EC) to issue electronic money, with minimum initial capital of €350,000 and ongoing own funds under Method D (2% of average outstanding e-money). A Payment Institution (PI) is authorised under PSD2 (Directive (EU) 2015/2366) to provide the payment services in Annex I, with tiered initial capital of €20,000, €50,000 or €125,000 and ongoing own funds under Methods A, B or C. Most fintechs are hybrid, holding an EMI authorisation that includes the PI permissions because the EMI set is a superset of the PI set. Under PSD3, EMD2 is repealed and EMIs become a sub-category of payment institutions, with Method D preserved.

Stablecoin and crypto overlap

Do I need an EMI licence to issue a euro stablecoin?

Yes. Under MiCA Article 48(1), an electronic money token (EMT) may be issued only by a credit institution or an EMI authorised under EMD2. There is no standalone MiCA route. The EMI holds the issuance permission; MiCA Title IV governs the white paper, 1:1 reserve backing, the prohibition on interest under Article 50 and the EBA significant-token regime under Article 56. The first global stablecoin issuer to comply did so via an ACPR EMI authorisation in July 2024, making France the de facto MiCA EMT domicile. The EBA Opinion of 12 February 2026 narrowed but did not eliminate the additional CASP authorisation requirement for issuers that also custody, exchange or transfer EMTs as a service. We obtain the EMI authorisation and coordinate the MiCA overlay as one mandate.

Jurisdictions and costs

Is Lithuania still a viable EMI jurisdiction in 2026?

For greenfield opportunistic applicants, no. The Bank of Lithuania revoked at least nine EMI and Payment Institution licences between 2022 and Q2 2026, mostly for serious AML and own-funds failings, and fined more than 20 firms in aggregate; new greenfield authorisations through 2025 were effectively nil. There is no formal moratorium, but the gate is operationally closed for new entrants. For an established operator with a strong AML track record and a substantive Lithuanian team, Lithuania remains the broadest SEPA access point in the EU via CENTROlink. The choice should rest on banking and substance, not perceived speed, and we will tell you honestly which side of that line your file sits on.

How long does an EMI authorisation take?

Realistic application-to-licence timelines, including pre-application preparation, run 16 to 24 months for Ireland and Luxembourg, 15 to 22 for Lithuania, 13 to 21 for the Netherlands, 13 to 18 for France, 12 to 18 for Cyprus, 18 to 27 for Germany, 12 to 16 for Malta, 9 to 16 for the United Kingdom, and 13 to 22 for the Swiss FINMA Article 1b licence. Variance is driven by beneficial-owner complexity, source-of-funds evidence quality, the regulator’s interview round, safeguarding bank confirmation, and whether banking and DORA readiness run in parallel, which saves three to four months on Tier-1 mandates. We run them in parallel as standard.

What will it cost to obtain an EMI licence?

The all-in cost of a greenfield EMI is driven by the €350,000 regulatory initial capital, the operating-cost cushion every Tier-1 regulator now expects on top of it, the senior team and external audit, and the AML and DORA programme build. It varies widely with jurisdiction, complexity and whether you build hybrid EMI/PI permissions. Rather than quote a misleading range, we give you a clear, fixed scope and price for the whole mandate once we understand your model and target markets. Book a free consultation and we will set it out.

Transitions and categories

Will my existing EMI licence still be valid after PSD3?

Yes. PSD3’s transitional provisions let existing EMIs and PIs operate under their current authorisations for up to 27 months from entry into force (a 21-month transposition window plus a six-month grandfathering tail), and competent authorities will convert existing EMI licences to the new unified payment-institution authorisation with the e-money sub-category preserved. Existing licensees do not need to re-apply, but should expect updated reporting templates, an extended safeguarding arrangement (no single method may cover 100% of client funds), DORA-aligned governance documentation, and re-papering of customer agreements for the new Verification of Payee and refund framework.

What is the difference between an Authorised EMI and a Small EMI?

Member States may waive certain authorisation requirements for small EMIs where average outstanding electronic money does not exceed €5 million (in the UK, £5 million monthly average). Small EMIs face simplified own-funds and governance requirements but do not benefit from the EEA passport. Most fintechs at any meaningful scale operate as Authorised EMIs under the full regime; Small EMI status is a starting category, not an end state. The transition to full EMI requires a fresh authorisation file with a full capital, governance and safeguarding build-out, which is why we usually advise applying for full EMI authorisation from day one if scaling beyond the threshold is plausible within 18 months.

Start Your EMI or Payment Institution Mandate

Tell us your model and your target markets. We will tell you which EMI or PI authorisation fits, then form the company, structure the capital, arrange safeguarding banking and file the application across the EU and non-EU European jurisdictions, dealing with the regulator directly. One accountable firm, start to finish.

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Tomberg & Partners

Tell us what you need to build.

Speak with our team about formation, licensing, banking, or the operating structure your business needs.

Book a free consultation