Fintech Company Formation & Licensing

What We Build for a Fintech Company

A fintech company needs five things that fit together: a regulated operating entity in the licensing jurisdiction, the initial capital the regime requires, a payment institution or electronic-money institution authorisation, banking for both client funds and treasury, and a live compliance stack covering AML/CFT, DORA and PSD2 reporting. We deliver all five, and we deal with the regulator directly to do it.

The licence is the gate. Inside the EU these are the PI authorisation under PSD2 and the EMI authorisation under EMD2; in the UK, authorised PI and authorised EMI under the FCA regime; in the UAE, one of three regulators (the CBUAE onshore, the ADGM FSRA, or the DIFC DFSA). We identify the right route before a single fee is paid, set the capital structure to meet the regulator’s minimum and the ongoing own-funds requirement, and build the compliance function before launch so it survives the first supervisory contact, not just the application.

What We Deliver

Choosing the Right Jurisdiction

We pick the jurisdiction with you before anything else, because it sets the regulatory framework, the capital requirement, the market access, the corporate tax treatment and the realistic timeline. We deliver formation and licensing principally across the EU, the UK and the UAE. Inside the EU, Estonia and Cyprus offer PSD2/EMD2 authorisation with full EEA passporting at materially lower cost and timeline than the larger Member States, which is why we route most pan-EU plays there. The UK FCA runs a comparable regime but holds no EU passport post-Brexit. The UAE has three regulators with three distinct frameworks. One thing to be clear about: e-money issuance requires authorisation in a jurisdiction with an EMI-equivalent framework, so it cannot route offshore the way a crypto VASP can. Canada and Australia accommodate remittance-led payment services with no prudential capital floor, but do not issue an e-money licence in the European sense.

Fintech Licensing Jurisdictions Compared

We recommend Estonia when the priority is EU passporting at the credible floor on cost and timeline. Licensing capital sits at the PSD2/EMD2 minimum, the regulator runs a fast review cycle, and the distribution-based corporate tax leaves retained earnings untaxed at the entity level. See our Estonia licensing page for the operational detail.

We recommend Cyprus when the priority is a Mediterranean base with English-speaking professional infrastructure and a regulator that has actively built EMI capacity. Throughput is healthy rather than closed. The headline corporate tax rate understates effective economics once the GHS levy is in, and we model that for you.

We recommend the United Kingdom when the target market is sterling-denominated and the value of an FCA-grade institutional brand outweighs the loss of EU passporting. The Small EMI and Small PI categories give early-stage operators below the €3m monthly average payments threshold a low-friction start. The trade-off is real: a UK EMI cannot passport into the EU.

We recommend the UAE when the target market is the MENA region or an institutional base served from ADGM and DIFC. The three regulators are not interchangeable, and we identify the right one and file accordingly. The federal corporate tax is offset by 0 percent free-zone treatment for Qualifying Free Zone Persons that meet the substance tests.

For purely remittance-led models without e-money issuance, Canada and Australia operate AML-anchored registration regimes with no prudential capital floor. These sit outside the routes we deliver; if your model points there, tell us and we will be candid about whether we are the right firm for it.

We Form the Company

Formation is the first thing we do for you, because capital, the licence application and banking all need a registered entity. The most common mistake we see is a founder who has already incorporated in a tax-optimised jurisdiction that does not host the chosen licensing regulator, then faces restructuring once the file opens. We do not let that happen.

We use the right vehicle for each jurisdiction (set out below) and handle the share-capital timing, which differs: Estonia and Cyprus accept paid-in contributions before the licence file progresses, while the UAE typically requires the licensing capital paid up before the application is submitted. Director and management substance matters more for fintech than for most regulated activities, because the regulator assesses the firm’s risk-management depth as part of the review. EU regulators apply fit-and-proper tests to directors and substantial shareholders, and substance tests to the management function: a registered office that is in fact occupied, executive management that is in fact resident, an MLRO who is in fact accountable in the jurisdiction. We build the structure to meet those tests rather than to fail them later.

Formation Snapshot by Jurisdiction

e-Residency in Estonia is useful for non-resident founders managing the entity remotely, but it does not substitute for the substantive presence the regulator expects from the management function during the licence file, and we tell you so plainly. We favour a simple structure, the operating entity in the licensing jurisdiction with one layer of holding above and real substance in both places, because it survives the fit-and-proper review rather than triggering an indirect-parent substance assessment mid-application.

We File the Licence

This is the core of what we do. A fintech operating in the EU needs either a payment institution (PI) authorisation under PSD2 or an electronic-money institution (EMI) authorisation under EMD2. We draft the application, assemble the file, and deal with the regulator directly through to grant. Outside the EU, the route depends on the jurisdiction’s framework, and we map it for you before you commit.

EMI or PI follows the product. A PI may provide payment services but cannot issue electronic money; an EMI may issue e-money and provide payment services. So an e-wallet, prepaid card, tokenised balance or euro stablecoin that holds customer balances needs an EMI; a money-remittance app, payment-initiation service or card-acquiring business that does not hold balances is a PI. EMI initial capital is €350,000; PI capital runs €20,000 to €125,000 by service scope, with an ongoing own-funds requirement on top. We size this with you, then file the right category the first time. PSD3, once in force, collapses the two into a single payment-institution framework with e-money issuance as an authorised sub-service.

Passporting and the agent model. An EU-authorised PI or EMI passports across the EEA by notification to the home regulator. Before its own licence is granted, an early-stage fintech can also operate as an agent of an authorised principal (registration typically takes two to three months), the standard time-to-market shortcut. Agents cannot themselves issue e-money: only the principal EMI may. We set up whichever route fits your launch.

Euro stablecoins. Under MiCA, only credit institutions and EMIs may issue e-money tokens, which are treated as electronic money. A founder building a euro stablecoin therefore needs an EMI licence as a prerequisite, plus MiCA Title IV authorisation, plus a PSD2 capital overlay if any crypto-asset service activity sits inside the operating entity. We structure the entity so those requirements stack cleanly rather than colliding.

Beyond the EU. In the United Kingdom, the FCA regime mirrors PSD2 in substance, with the practical difference that there is no EU passport and the FCA operates Small EMI and Small PI categories for firms below the €3m monthly average payments threshold. In the United Arab Emirates, three regulators apply and we identify the right one: the CBUAE for onshore retail payments and stored-value facilities, the ADGM FSRA for Money Services Business permissions, and the DIFC DFSA for Providing Money Services and Stored Value Issuer permissions.

For the full EMI and payment-institution service, see our EMI and payment licensing page; for the UK route under Brexit conditions, see our licensing overview.

Banking, as Part of the Build

Banking is the most underestimated component of a fintech launch, and we treat it as one of our core services, delivered alongside the formation and licensing work. A licensed fintech needs two arrangements: a safeguarding arrangement for client funds, which is the regulator’s gate, and an operational account for treasury, payroll, FX and vendor payments, which is the firm’s runway. We arrange both alongside the licence.

Safeguarding is the binding constraint. The credit institution issues a safeguarding acknowledgement letter confirming trust status, off-balance-sheet treatment, no set-off and exemption from the general lien, and the regulator wants the executed letter, not a draft, so we secure it early. A generic template adapted from another fintech will not survive the first information request. Because we secure that letter before the file goes in, the regulator’s safeguarding question is answered when the file is read, not after, which in our experience shortens the path to authorisation by four to ten weeks. We know which institutions hold credible appetite for fintech profiles and approach them directly on your behalf rather than handing you a list. We never name a bank in public and we never offload this work to an unverified third party.

We Build the Compliance Stack

Compliance is a permanent operating function, not a one-time licensing event, and we set it up so it works from day one rather than scrambling after the first supervisory contact. For an EU-authorised EMI or PI the perimeter runs across AML/CFT, PSD2 conduct and reporting, safeguarding audit, complaints handling, passporting notifications and DORA. We build each into the application file and hand you a function that runs.

AML/CFT. EU PIs and EMIs are obliged entities, with the new AML Regulation applying in full from 10 July 2027 and AMLA already operational in Frankfurt. We stand up the MLRO function as a permanent senior-management appointment and write the AML/CFT manual as a living document the regulator can request at any time.

Operational resilience. DORA has applied to PIs, EMIs and CASPs since 17 January 2025. We build the ICT risk-management controls, the incident-reporting process and the Register of Information on ICT third-party arrangements that it requires, so the firm is resilient from launch rather than retrofitting later.

Reporting, safeguarding audit and conduct. We set up the PSD2 fraud and incident reporting cycles, the annual independent safeguarding audit required across all EU and UK regimes, the complaints-handling perimeter, and the passporting and material-change notifications to the home regulator. Capital adequacy is reviewed annually against the higher of the initial capital and the own-funds requirement, and we keep the firm on the right side of it.

Realistic Timeline

The realistic end-to-end timeline from formation to operational launch is six to eighteen months. The variance comes from the jurisdiction, the completeness of the file at first submission, and whether safeguarding is sequenced alongside licensing or after it. We sequence it alongside, which is the single biggest lever on speed. We do not publish fees here, because every fintech launch is scoped differently; we give you a firm quote once we understand your model.

End-to-End Timeline by Phase

What we do to compress it: pre-qualify safeguarding before capital is locked, pre-draft the compliance documentation, present a clean fit-and-proper file, and choose a regulator with a track record of moving files. What expands it, and what we steer you away from: safeguarding left until after the application, a late MLRO appointment, a parent-company structure the regulator assesses for indirect substance, and an over-engineered scope that triggers several service-line authorisations at once. Timeline guidance is current as of May 2026.

Frequently Asked Questions

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related Services

• EMI & Payment Institution Licensing: we obtain PSD2 PI and EMD2 EMI authorisation across the EU, UK and adjacent markets
• Banking for Fintech & High-Risk: safeguarding and operational banking arranged directly alongside your licence
• Multi-Currency Accounts & IBANs: dedicated and virtual IBANs, foreign exchange and multi-currency business accounts
• Estonia Crypto & Fintech Licensing: our Finantsinspektsioon route under MiCA and PSD2/EMD2
• European Company Formation: EU and EEA entity formation including PSD2/EMD2 passporting routes