Contents

I. Background and Legal Framework

II. Scope of services provided by PI license

III. Detailed requirements and procedures for applying for a PI license

IV. Supervision and Continuous Compliance of PI Licenses
5. Actual Cases

I. Background and Legal Framework

  1. Evolution of the Payment Services Directive :

    • PSD1 (2007/64/EC) :
      • Enacted in 2007, it unified the regulatory framework of the EU payment market for the first time, introduced the concept of payment institutions (PIs), and allowed non-bank institutions to provide payment services.
      • The goal is to break up banks' monopoly on payment services, promote competition and reduce costs for consumers.
    • PSD2 (2015/2366/EU) :
      • 2015年发布，2018年1月13日起实施，取代PSD1。
      • The concept of Open Banking was introduced, requiring banks to open customer account data to third-party payment institutions through APIs (with customer consent).
      • New Payment Initiation Service (PIS) and Account Information Service (AIS) have been added, and Strong Customer Authentication (SCA) requirements have been strengthened.
      • Improved anti-money laundering (AML) and data protection (GDPR) standards, and increased payment security measures (such as two-factor authentication).
    • Future Trend: PSD3 :
      • 2023年6月，欧盟委员会提出PSD3草案，预计2025-2026年逐步实施。
      • PSD3 will further integrate the regulatory framework for PIs and electronic money institutions (EMIs), simplify license classification, and strengthen supervision of non-bank payment institutions.

  2. Passporting :

    • PI license holders can provide services in 31 countries of the EEA (27 EU countries + Iceland, Liechtenstein, Norway) without having to apply for a separate license in each country.
    • Application process: Submit a "passport" application to the Home State Regulator to notify the regulatory authority of the target country (Host State).
    • After Brexit, the UK's PI license will no longer apply to the EEA and must be reapplied in EU member states.

  3. Interaction with other regulations :

    • GDPR (General Data Protection Regulation): PI licensed institutions must comply with strict data privacy requirements to protect customer payment data.
    • AML/CTF (Anti-Money Laundering and Counter-Terrorist Financing): Customer due diligence (KYC), transaction monitoring and suspicious activity reporting are required.
    • MiFID II (Markets in Financial Instruments Directive): If investment-related payment services are involved, additional compliance with MiFID II may be required.
    • EBA Guide：The European Banking Authority (EBA) regularly publishes technical standards (such as RTS on SCA) to guide PI compliance.

  4. Regulatory agencies overview :

    • The competent authority in each country is responsible for licensing and supervision. For example:
      • 卢森堡: CSSF (Committee on Financial Supervision), known for being strict but efficient.
      • 立陶宛: The Bank of Lithuania has fast approval speed and low cost, attracting a large number of financial technology companies.
      • 马耳他: MFSA, flexible supervision and tax benefits.
      • 荷兰: DNB (Dutch Central Bank), suitable for large payment institutions.
      • 德国: BaFin, with strict supervision, is suitable for companies pursuing high credibility.

II. Scope of services provided by PI license

  • According to PSD2, the PI license allows the provision of the following eight types of payment services, the details of which are as follows:

    1. Cash deposit and withdrawal service :

      • Allows customers to deposit or withdraw money from their payment accounts.
      • Application scenarios: ATM services, bank counter deposits and withdrawals, retail point cash services.

    2. Payment transaction execution :

      • Processing transactions based on payment accounts, including:
        • Direct Debit(Direct Debit): such as regular deductions (rent, subscription).
        • Bank Transfer(Credit Transfer): such as SEPA transfer.
        • Card Payment: Debit card, credit card transactions.
      • Application scenarios: e-commerce payment, P2P transfer.

    3. Payment instrument issuance :

      • Issue and manage payment instruments such as:
        • Physical cards (e.g., prepaid cards, debit cards).
        • Digital wallets (such as mobile payment apps).
      • Application scenario: Enterprises issue branded prepaid cards and virtual cards.

    4. Remittance Services :

      • No payment account required, transfer funds directly.
      • Application scenarios: cross-border remittances (such as Western Union model), person-to-person transfers.

    5. Payment Initiation Service (PIS) :

      • Initiate payments on behalf of customers from their bank accounts.
      • Accounts must be accessed via bank API (based on PSD2 Open Banking).
      • Application scenario: E-commerce platforms directly deduct funds from customers’ bank accounts.

    6. Account Information Service (AIS) :

      • Consolidate data from multiple customer bank accounts to provide a financial overview.
      • Customer authorization is required to access bank account information.
      • Application scenario: Personal finance apps (such as Mint and Yolt).

    7. Merchant Acquiring Services :

      • Processing payment transactions for merchants, including:
        • Online payment gateways (such as Stripe, Adyen).
        • POS terminal (like Square).
      • Need to cooperate with payment networks such as Visa and Mastercard.

    8. Other services (depending on the country) :

      • Some countries allow PIs to provide additional services, such as currency exchange (additional permission required).
    limit :
    • The PI license does not allow the issuance of electronic money (such as digital currency, prepaid card balances), and an EMI license must be applied for.
    • PI institutions cannot hold client funds for longer than a certain period (usually the time required for payment processing).

III. Detailed requirements and procedures for applying for a PI license

There are many requirements to apply for a PI license. The following is a breakdown of them one by one:

  1. Company Establishment :

    • Register a legal entity in an EEA country, usually a Limited Liability Company (LLC).
    • It is necessary to have a physical office (not a virtual address) in the country of registration and employ local employees.
    • Some countries, such as Lithuania, allow remote management, but require at least one local executive.

  2. Minimum capital requirements :

    • Depending on the type of service, the capital requirements are as follows:
      • Remittance service: 2 Euros.
      • Issuance of payment instruments or execution of transactions: EUR 5.
      • Acquiring services or integrated payment services: EUR 12.5.
    • The capital needs to be deposited into a designated bank account and proof must be submitted.
    • Regulators may require additional capital to cover operational risks.

  3. business plan :

    • Submit a detailed business plan including:
      • Business model: target market, type of service, revenue source.
      • Market analysis: competitors, customer groups, market size.
      • Financial forecast: 3-5 year revenue, expenditure, and profit forecast.
      • Risk management: Identify market, operational, and technological risks and their responses.

  4. Governance and Compliance :

    • Executive and shareholder scrutiny :
      • All senior executives and shareholders holding more than 10% of the shares must pass a "suitability and integrity" review.
      • Submit resume, criminal record certificate, and financial status certificate.
    • AML/CTF Policy :
      • Develop detailed anti-money laundering and anti-terrorist financing processes, including KYC, transaction monitoring, and reporting mechanisms.
      • A compliance officer (MLRO, Money Laundering Reporting Officer) needs to be appointed.
    • Internal Control :
      • Establish risk management, internal audit and data protection mechanisms.
      • Submit an organizational chart to clearly define the division of responsibilities.

  5. Technical and safety requirements :

    • The payment system must meet the following standards:
      • PCI-DSS: Keep payment card data safe.
      • ISO 27001(Optional): Information Security Management Certification.
      • SCA: Implement strong customer authentication (such as two-factor authentication).
    • Submit IT system architecture diagram, disaster recovery plan, and network security measures.
    • For PIS/AIS services, the ability to connect to the bank's API must be demonstrated.

  6. application process :

    • Step 1: Pre-application :
      • Conduct initial communication with regulatory authorities to confirm eligibility for the application.
      • Some countries (such as Lithuania) offer pre-application consulting services.
    • Step 2: Submit your application :
      • Prepare documents including business plans, compliance policies, financial statements, shareholder information, etc.
      • Submit to the regulatory authority, usually via an online platform or paper document.
    • Step 3: Review :
      • Regulators review the application and may request additional documents or interview executives.
      • 审核时间：3-12个月（立陶宛6-9个月，卢森堡9-12个月）。
    • Step 4: Brand Hotels.com (similar to Tripadvisor) to provide travel advice and information:
      • Step 5: License issuance :
        • After the review is passed, a PI license will be issued and the organization can start operations.
        • Through the “single passport” mechanism, notify other EEA national supervisory authorities and expand the scope of services.

  7. Application costs :

    • direct cost :
      • Application fee: 5000-2 Euros (varies by country).
      • Legal consultation fees: 5-20 Euros (depending on complexity).
      • Minimum capital: 2-12.5 EUR.
    • Indirect costs :
      • Office leasing, employee salaries, and system development.
      • Ongoing compliance costs (auditing, reporting, IT maintenance).

IV. Supervision and Continuous Compliance of PI Licenses

  • Ongoing regulatory requirements :

    • Reporting obligations :
      • Submit financial statements, AML/CTF reports and risk management reports regularly.
      • Major events (such as changes in senior management and system failures) must be reported in a timely manner.
    • audit :
      • We undergo annual external audits to review our financial, compliance, and technology systems.
    • Client Funds Protection :
      • Client funds must be kept in a segregated account and must not be misappropriated.
    • Data protection :
      • Comply with GDPR to ensure customer data is secure and prevent leaks.

  • Penalties and revocation :

    • Violations of regulatory requirements may result in fines, restrictions on operations or license revocation.
    • Common violations: AML/CTF failures, failure to report suspicious transactions, data breaches.

5. Actual Cases

  1. Table tennis :

    • back ground：A Chinese cross-border payment platform that focuses on providing payment and remittance services to e-commerce companies (such as Amazon and eBay).
    • License History :
      • In September 2017, it obtained the Luxembourg PI license, becoming the first Chinese company to obtain this license.
      • In December 2020, it was upgraded to the Luxembourg EMI license, adding the ability to issue electronic money.
    • Services :
      • Cross-border payment, currency exchange, and VAT tax services.
      • Supports 100+ countries and 10+ currencies.
    • success factors :
      • The high credibility of the Luxembourg license and the “single passport” mechanism.
      • In-depth cooperation with e-commerce platforms such as Amazon.
      • Efficient KYC and compliance system.

  2. Revolut :

    • back ground: A British fintech unicorn that provides multi-currency accounts, payment and investment services.
    • License History :
      • In 2018, it obtained the Lithuanian PI license, which was later upgraded to a banking license.
      • Serving the entire EEA through a “single passport”.
    • Services :
      • Digital bank accounts, instant transfers, PIS/AIS, cryptocurrency trading.
    • success factors :
      • Fast approval and low costs in Lithuania.
      • Powerful technology platform and user experience.

  3. Adyen :

    • back ground: A Dutch payment giant that provides payment gateway and acquiring services to merchants around the world.
    • License History :
      • Holding the Dutch PI license, serving the global market.
    • Services :
      • Online payment, POS terminals, risk management.
      • Supports emerging payment methods such as Apple Pay and WeChat Pay.
    • success factors :
      • Close cooperation with Visa and Mastercard.
      • Highly customizable payment solution.

FAQs

  • The application time varies by country, usually 3-12 months:
    • 立陶宛: 6-9 months, the process is faster.
    • Luxembourg: 9-12 months, with stricter review.
    • Malta: 6-12 months, depending on the complexity of the application.
  • Influencing factors include the completeness of the documents, the speed of response from the regulatory agency and whether the applicant needs additional information.
  • The total cost is approximately 10-30 Euros, including:
    • Application fee: 5000-2 Euros (depending on the country).
    • Legal and consulting fees: 5-20 Euros, depending on the law firm and the complexity of the application.
    • Minimum capital requirements: 2 Euros (remittance service) to 12.5 Euros (comprehensive service).
    • indirect costs: Office rent, employee salaries, IT system development (tens of thousands of Euros per year).
  • Ongoing compliance costs (audits, reporting, system maintenance) are approximately €5-10 per year.
Yes, the PI license allows licensed institutions to provide services in 31 countries in the EEA (27 EU countries + Iceland, Liechtenstein, Norway) through the "single passport" mechanism. A passport application must be submitted to the primary regulator and the regulator of the target country must be notified, which usually takes 1-3 months to complete.
    • PI License: Focus on payment services (such as transaction processing, remittances, PIS/AIS) and cannot issue electronic currency.
    • EMImississippi (Electronic Money Institution License, EMI): Allows the issuance of electronic money (such as prepaid cards, digital wallet balances) and provides all the services of PI.
    • If a PI licensee needs to issue electronic money, it must upgrade to an EMI license or cooperate with an EMI licensee.
  • Example: PingPong first obtained the Luxembourg PI license (2017) and later upgraded it to an EMI license (2020) to support e-money services.
The PI license allows the provision of foreign exchange exchange directly related to payment services (such as currency conversion in cross-border payments), but if it involves independent foreign exchange transactions or speculative foreign exchange services, an additional application for the Markets in Financial Instruments Directive (MiFID II) license or related license is required.
PI licensees must keep client funds inSegregated Accounts(Safeguarded Account), which is separated from the company's own funds to ensure the safety of customer funds. Regulators regularly review segregated accounts for compliance.
Yes, regulators may impose fines, restrict operations or revoke licenses if regulatory requirements are breached (such as AML/CTF failures, failure to report suspicious transactions, inadequate segregation of funds). Example: In 2021, a small payment institution was fined by the Bank of Lithuania and had some of its operations suspended due to AML vulnerabilities.
The PI license itselfNot directly allowed to process virtual currency transactions, because virtual currencies (such as Bitcoin and Ethereum) are generally regarded as "assets" rather than "currencies" or "electronic currencies" in the EU. If a PI licensee wishes to provide virtual currency related services, please note the following points:
  • Virtual currency exchange in payment services: If virtual currency exchange is part of a payment service (such as exchanging Bitcoin for Euros to complete a payment), it may be within the scope of a PI license, but clear regulatory approval is required.
  • Virtual currency custody or trading: Additional Virtual Asset Service Provider (VASP) registration or licensing is required, according toFifth Anti-Money Laundering Directive (5AMLD)and the upcomingMiCA (Markets in Crypto-Assets Regulation).
  • Instance：Revolut (Lithuanian PI and banking license) provides Bitcoin buying and selling services, but its virtual currency business is regulated by local VASPs rather than relying solely on the PI license.
  • Stablecoins (such as USDT, USDC) are generally regarded as electronic currencies or similar assets, soPI license cannot directly support the issuance of stablecoins. Issuing stablecoins requires:
    • EMI License：If the stablecoin meets the definition of electronic money (such as being pegged 1:1 to a fiat currency).
    • MiCA License: According to the MiCA regulations passed in June 2023 (expected to be fully implemented by the end of 6 or 2024), stablecoin issuers need to apply for a special crypto asset issuance license.
  • Example: Circle (USDC issuer) needs to comply with MiCA when operating in the EU and work with EMI licensees to meet e-money requirements.
  • According to5AMLD(Effective January 2020), PI licensees involved in virtual currencies must comply with the same AML/CTF requirements as traditional payments, and additionally implement the following measures in view of the high-risk nature of virtual currencies:
    • KYC: Verify customer identity, especially in relation to virtual currency wallet addresses.
    • Transaction monitoring: Track virtual currency transactions and identify unusual patterns (such as large anonymous transfers).
    • Suspicious Activity Report (SAR): Report potential money laundering or terrorist financing activity to regulators.
  • Challenges: The anonymity of virtual currencies (such as Bitcoin’s blockchain transactions) increases the difficulty of KYC and monitoring, requiring investment in blockchain analysis tools (such as Chainalysis and Elliptic).
  • Example: In 2022, a European PI agency was fined €10 by the Luxembourg CSSF for failing to effectively monitor virtual currency transactions.
  • The PI license does not cover hosting or management services for virtual currency wallets (such as storing customers’ Bitcoin private keys). To provide a virtual currency wallet:
    • Register asVASP(Virtual Asset Service Provider), pursuant to 5AMLD.
    • To be followed in the futureMica, apply for a crypto asset custody license.
  • Non-custodial wallets (such as customers controlling their own private keys) may not require VASP registration, but they still need to be evaluated whether they involve payment services.
  • If blockchain payments fall within the scope of payment services (such as using XRP for cross-border remittances), a PI license may be applicable, but the following conditions must be met:
    • Blockchain transactions meet the definition of payment services under PSD2 (such as remittance or trade execution).
    • Comply with AML/CTF and SCA (Strong Customer Authentication) requirements.
    • Clearly disclose the application of blockchain technology to regulators.
  • Example: Ripple works with European PI licensees to provide XRP-based cross-border payments, but requires additional registration as a VASP to process XRP transactions.
  • When PI licensees provide virtual currency services, they must comply with the tax requirements of the EU and the country where they are located:
    • Value Added Tax (VAT): Virtual currency exchange services may be exempt from VAT (refer to the 2015 EU Court of Justice case Skatteverket v Hedqvist), but other services (such as transaction fees) may be taxable.
    • corporate income tax: Profits from virtual currency transactions are subject to general corporate income tax.
    • Client Tax Report: Some countries require PI institutions to report customers’ virtual currency transactions (such as capital gains) to tax authorities.
  • Challenges: Tax rules vary from country to country (e.g., Germany considers virtual currencies as private assets, while France considers them as movable property), so professional tax advice is required.
  • PI licensees can accept virtual currencies as a payment method (e.g. customers pay for goods with Bitcoin), but they must:
    • The immediate conversion of virtual currency into legal tender (such as the Euro) to complete payment falls within the scope of payment services under the PI license.
    • Comply with AML/CTF requirements and trace the source of virtual currency.
    • Disclose business models of virtual currency payments to regulators.
  • Restrictions: If an institution holds virtual currency as an asset or engages in speculative transactions, it is beyond the scope of the PI license and requires a VASP or MiCA license.
21X obtains EU license | Launches first blockchain securities tokenization exchange | Reshapes financial market

21X, a Frankfurt-based fintech focused on supporting institutional adoption of securities tokenization technology, has received a block

02
June
Crypto Payments Firm MoonPay Receives MiCA Approval in the Netherlands

December 12 marked the end of the implementation phase of the Regulatory Framework for Markets in Crypto-Assets (MiCA), which now allows authorities to regulate some cryptocurrencies operating in the EU.

31
June
Bitget announces return to UK market, launches compliant crypto services

Victoria, Seychelles, November 2024, 11 - Bitget, a leading cryptocurrency exchange and Web12 company, has signed a

12
June
Bankhaus Scheich’s digital asset unit Tradias receives BaFin Series A license

Today, Germany’s Tradias announced that it has been granted a securities trading banking license by the German Financial Supervisory Authority. Until now, the company has been using its parent company

08
June
Dutch regulator warns of cryptocurrency pump and dump risks before MiCA

The Netherlands AFM has issued a warning about cryptocurrency market manipulation, focusing on pump and dump schemes ahead of the implementation of MiCA in December. Netherlands Financial Market

02
June
Wallet in Telegram app temporarily disabled for UK users due to reorganization

Due to financial regulatory reasons, US Telegram users are also restricted from using wallets in the Telegram app. According to the wallet provider

26
June
Gate Group advances European presence to prepare for 2025 MiCA regulations

As a leader in the cryptocurrency industry, Gate Group is strengthening its strategic layout in the European market through its platform Gate.MT. G

11
June
French Financial Authority: Starts accepting CASP license applications under MiCA Act, Bybit withdraws from French market due to lack of license

Cryptocurrency exchange Bybit announced Thursday that it will cease its services in France in response to regulatory developments. The company said in a statement that it “complies with

03
June
more articles