Choosing a jurisdiction for your payment institution. 6 chapters and a final quiz.

Chapter 1. Determining your status before choosing a country.

The country of authorization comes late in the process. Three decisions come first: the service, as defined in Annex I; whether the firm holds funds; and who holds the authorization. A founder who starts with jurisdictions is comparing regimes they do not yet need to choose between. Capital thresholds, application content, and the statutory decision deadline are set at EU level. The authority, its doctrine, and its fee schedule are what vary from one country to the next.

Four statuses, four capital regimes

The agent route, and what it costs

• A payment institution distributes through agents; an e-money institution, through distributors. Both are notified to the home country authority, which enters them in its register.
• An agent carries no regulatory capital. The principal is liable for its agent's acts to users and to the supervisor, which explains why its onboarding due diligence is so strict.
• The safeguarding account belongs to the principal. A termination cuts off access to the funds and the account identifiers, with no meaningful notice for a customer base already in service.
• A host member state may require a central contact point where the business is conducted there through establishments other than a branch, including agents and distributors, under Delegated Regulation (EU) 2018/1108 of May 7, 2018.
• Moving from agent to your own authorization takes two years of preparation: a compliance track record, audited accounts, a local team in place, and a banking relationship opened in your own name.

Chapter 2. Comparing five jurisdictions on what can be verified.

Jurisdiction rankings circulate widely and rarely cite sources, yet a useful comparison keeps only facts that can be verified and relied on: the authority, its governing law, its published service standards, its fee schedule, and its recent decisions. Everything else is jurisdiction marketing. The table below does not rank the five. It shows what each one requires and what each one publishes.

What does not set the five apart

• The passport is the same. A Luxembourg authorization and a Maltese authorization open up the same European Economic Area, through the same notification procedure.
• Capital thresholds are set at EU level. No authority can lower them. The own funds required above initial capital, however, depend on the supervisor's assessment of the business plan.
• DORA has applied everywhere since January 17, 2025, under Regulation (EU) 2022/2554: a register of ICT providers, resilience testing, and incident reporting.
• Access to designated systems is open in all five countries. Regulation (EU) 2024/886 on instant credit transfers, published in the Official Journal on March 19, 2024, amends Directive 98/26/EC to admit payment institutions and e-money institutions.
• TARGET has been open to nonbank providers since April 9, 2025, under European Central Bank Decision (EU) 2025/222 of January 27, 2025. The account remains capped at the funds needed for that day's settlement.

Four institutions and the authority that supervises eachMangopayStripeRevolutAdyen

Chapter 3. Building the substance the authority checks.

Article 11(3) of PSD2 sets a short and demanding requirement. An institution must have its central administration in the member state of its registered office and conduct at least part of its payment services business there. The whole debate turns on two words, “central administration.” They mean neither an address nor a registered-office service agreement. They mean the place where decisions are made and controls are exercised.

The six areas the supervisor examines first

Luxembourg has made the same turn by a different route. CSSF Circular 26/906 is dated January 20, 2026 and applies from June 30, 2026. It consolidates the rules on central administration, internal governance, and risk management. It covers payment institutions, e-money institutions, and account information service providers, and repeals older texts, including Circular IML 98/143 on internal control. A registered office is not enough: the circular requires a decision-making and administrative center in Luxembourg, including the management bodies and control functions. Outsourcing remains possible, within the framework of CSSF Circular 22/806.

• Build the evidence as you go, never at the end: employment contracts, board minutes, access logs, local invoices, leases. Supervisors read dates.
• Have the key structural decisions signed by the local managers from the pre-launch phase onward. A resolution signed at group headquarters six months before filing stays in the record.
• Map intragroup dependencies service by service, with the price charged and the exit clause. An undocumented dependency will be read as an uncontrolled one.
• Prepare for the interviews. Proposed managers are interviewed separately. A manager who cannot describe their own company's safeguarding arrangements sinks the application in 20 minutes.
• Check the actual workload of the people appointed to control functions. A part-time compliance officer for a cross-border business is an immediate red flag.

Chapter 4. Understanding the passport and its real limits.

An authorization granted in one EEA state is valid in all the others. The mechanism is real and has no equivalent anywhere else in the world, but it is also slower and narrower than the brochures suggest. The passport carries the right to operate. It does not carry access to local rails, compliance with host country law, or a banking relationship.

What the passport does not cover

• Host country conduct rules, including pre-contractual disclosures and consumer protection. Ireland has applied a revised Consumer Protection Code since March 24, 2026.
• Language. Contracts, complaints, and often customer support are handled in the language of the market served, whatever the language of the authorization.
• Access to local payment methods. iDEAL is operated by Currence iDEAL B.V., a subsidiary of EPI Company since April 2023, and is due to be decommissioned on December 31, 2027 in favor of Wero. No authorization gives a right to that connection: it has to be secured by contract.
• The banking relationship. The safeguarding account is opened with a credit institution that runs its own due diligence, regardless of the passport.
• Local tax and invoicing, which follow the place of establishment and the place of consumption, not the place of authorization.
• Enhanced supervision by the host country of a firm that has become significant in its market, including under the freedom to provide services.

Chapter 5. Designing safeguarding that passes inspection.

Article 10 of PSD2 offers two routes, and only one can be chosen per business line. The first keeps funds received from users separate from all other assets. If they have not been paid out to the payee by the end of the business day after receipt, they go into a separate account at a credit institution. Investing them in safe, liquid, low-risk assets is the other option under this first route. The second route covers the same amount with insurance or a guarantee from a third party outside the group. Regulatory capital absorbs operating losses, while safeguarding protects customers' money. One does not replace the other.

What a thematic inspection actually found

• The reconciliation process was not described in the safeguarding policies and procedures.
• No segregation of duties between performing and overseeing the reconciliation, with the second line of defense carrying out operational tasks.
• No documented escalation threshold for safeguarding incidents, and incomplete incident logs.
• Safeguarded funds concentrated at a single credit institution, with no formal credit risk appetite or counterparty limits.
• Poor understanding of the insurance policies within the local entity, because the group had carried out the due diligence on the insurer without oversight by the institution.
• Policies taken out in the name of a group entity, forcing the institution to claim the funds from the group instead of receiving them directly.
• Negative customer balances included in the reconciliation, which skews the calculation and underfunds the safeguarding account.

These seven findings come from a thematic inspection. The Central Bank of Ireland published them in December 2025 in its first newsletter for payment and e-money institutions. The authority states that it will tolerate no weakness in safeguarding and expects a board-approved framework. Annual compliance testing must cover the safeguarding calculations and the account designation letters. On top of that come annual training, active management of counterparty risk, and a wind-down plan detailing how funds will be returned in both solvent and insolvent scenarios. A designated role arrives in 2026, PCF-56 Head of Safeguarding, which every Irish institution will have to fill.

Chapter 6. Budgeting time and cost, and avoiding application mistakes.

The statutory deadline is three months from a complete application, a phrase that is quick to read and easy to misunderstand. The authority decides what is complete, and an applicant can spend a year before the three-month clock starts without being late in legal terms. The real duration is measured differently, and the European Banking Authority has done so twice.

The Irish process shows the mechanics clearly because it is published in detail. An exploratory phase opens with a Key Facts Document, submitted at least five business days before the initial meeting. Acknowledgment follows within three business days in at least 95% of cases, then a check of the key information, completed within 10 business days. Next comes the assessment phase, with its clock of 90 business days, paused at every request for information. Then the decision, notified within 10 business days of a satisfactory reply to the Minded to Authorise letter. The same regulator writes that applicants often take more than 12 months to gather the information requested. The two statements do not contradict each other: they measure two different clocks.

• Filing before the bank has opened the safeguarding account. The two reviews take about as long as each other and should run in parallel. Running them one after the other doubles the timeline.
• Building a business plan that the own funds calculation contradicts. Projected volumes determine the own funds requirement above initial capital. An optimistic plan becomes a capital requirement the shareholder had not budgeted for.
• Acquiring a qualifying holding before notifying it. In Ireland, any acquisition or increase that reaches 10%, 20%, 30%, or 50% must be notified in advance, and an unnotified acquisition is null and void. The assessment takes 60 business days, which can be suspended for up to 20 business days within the EU and 30 outside it.
• Letting requests for information slide. After 60 business days without an adequate reply, an Irish application is deemed withdrawn. The count restarts from zero, screening included.
• Presenting intragroup outsourcing as substance. The authority sees a services contract between two companies, with a price and a termination clause. It does not see a central administration.
• Having the application written by a firm whose work the managers have not reviewed. Separate interviews with the senior managers expose the gap within a few questions on safeguarding and the AML framework.
• Forgetting the reporting deadlines that follow authorization. Irish institutions had to submit the DORA register of information by April 4, 2026 and an instant credit transfer report by April 6, 2026. A new authorization lands in a calendar that is already running.