Five hubs, one passport
The European passport is the mechanism by which a license granted by a single national authority lets its holder operate across the European Economic Area. For payments, two directives set the framework: PSD2 created the payment institution (PI) status, and EMD2 created the e-money institution (EMI) status. A single national authority reviews the application, grants the license, and then supervises the institution. The license covers both ways of operating: freedom of establishment and freedom to provide services. Applicants can therefore choose their authority. That choice determines how long authorization takes, the annual cost of compliance, and how much local presence is required, as well as the reputation the institution will carry with its correspondent banks.
Five jurisdictions attract most applications from firms based outside them: Luxembourg, Ireland, Malta, Lithuania, and the Netherlands. None earned its position by advertising a light prudential touch. Each built a distinct advantage. Lithuania offers a public settlement rail open to nonbank institutions. Ireland offers an English-speaking working environment, Luxembourg a long banking track record, and the Netherlands proximity to the card schemes. These advantages are not interchangeable. A pan-European e-money issuer and a marketplace acquirer will not value the same one.
| Hub | Authority | Number of licenses | Observed processing time | What built its position |
|---|---|---|---|---|
| Luxembourg | CSSF | 15 payment institutions and 11 e-money institutions as of Dec. 31, 2024 | Not published per institution | Long banking track record, fund industry hub, European headquarters of US groups |
| Lithuania | Lietuvos bankas | 119 licensed institutions at end-2024, including 76 EMIs | Not published per institution | CENTROlink: direct SEPA access without a sponsor bank since 2016 |
| Ireland | Central Bank of Ireland | 6 licenses granted in 2024, from 3 applications received | 688 calendar days on average in 2024 | English-speaking, euro, post-Brexit European headquarters |
| Malta | MFSA | 2.7% of the 2,380 entities licensed in 2024, or about 60 financial institutions | Not published by sector | Single framework under the Financial Institutions Act, specialized in online gaming and forex |
| Netherlands | De Nederlandsche Bank | Dominant model: a full banking license rather than an EMI license | Not published per institution | Adyen, iDEAL, equensWorldline: where the rails are |
Luxembourg: few licenses, large volumes
Luxembourg’s nonbank payments sector consists of payment institutions and e-money institutions licensed by the Commission de Surveillance du Secteur Financier (CSSF), the country’s financial regulator. As of December 31, 2024, the CSSF supervised 15 payment institutions and 11 e-money institutions, 26 entities in all, compared with 119 in Lithuania at the end of 2024. The first number has been stable since 2023. The second rose by one, after two new registrations and one removal following a bankruptcy. These 26 institutions processed about €348 billion in transactions in 2024, up 18%. Their combined balance sheet reached €12.6 billion, up 11%. They employ 869 people in Luxembourg, including branches.
A single institution can be licensed for several of the services listed in the annex to the Law of November 10, 2009. How those licenses are spread across institutions shows what the hub actually does. Of the 26 institutions, 15 are licensed to acquire payment transactions and 16 to execute them, six provide money remittance, and 11 issue e-money. Only two hold a payment initiation license, and only one an account information license. Luxembourg has therefore not captured the two open banking services created by PSD2. It grew on acquiring and e-money issuance, two businesses whose activity is measured in transaction volume.
| Service (annex to the Law of November 10, 2009) | Institutions |
|---|---|
| Execution of payment transactions, including transfers of funds | 16 |
| Acquiring of payment transactions | 15 |
| Issuing, distributing, and redeeming e-money | 11 |
| Issuing of payment instruments | 7 |
| Money remittance | 6 |
| Execution of payment transactions covered by a credit line | 3 |
| Payment initiation service | 2 |
| Cash withdrawals from a payment account | 1 |
| Account information service | 1 |
| Cash deposits to a payment account | 0 |
Four names show what those 26 licenses cover. Payconiq International S.A. is a Luxembourg payment institution, entered in the CSSF register under number Z00000005. It was the first entity in the country to obtain a payment initiation license. The EPI group acquired it in 2023 and is migrating its user base to Wero. Amazon Payments Europe S.C.A., Satispay Europe S.A. (register number W00000010), and Mangopay S.A. are among the e-money institutions licensed by the CSSF. Luxembourg hosts few entities, but the ones it hosts serve entire markets.
The CSSF: the 2009 law, then Circular 26/906
The core statute is the Law of November 10, 2009, on payment services, which transposes PSD2 and EMD2. No one may provide payment services or issue e-money from Luxembourg without written authorization from the CSSF. Applications are filed electronically through the regulator’s Managed File Transfer channel and must include a detailed business plan and diagrams of the flows of funds and data. They must also identify every partner (agents, intermediaries, third parties) and the nature of each contractual relationship.
The governance regime for these institutions changed fundamentally on January 20, 2026, with the publication of CSSF Circular 26/906, “Central administration, internal governance and risk management.” It applies to payment institutions, e-money institutions, and account information service providers. It repeals four older texts: Circulars IML 95/120, IML 96/126, IML 98/143, and CSSF 04/155. Institutions had to comply by June 30, 2026.
- At least two authorized managers, permanently present at the Luxembourg office, with remote work allowed only as an exception.
- A supervisory body that meets at least quarterly, without a majority of executive members, and chaired by someone with no executive role.
- Three lines of defense: compliance, risk management, and internal audit, each independent of the others.
- Ban on outsourcing the compliance and risk management functions.
- An annual attestation of compliance with the circular, signed by every member of the management body and sent to the CSSF.
- An annual ICT and security risk assessment, supplemented by summary reports from the compliance and internal audit functions.
Substance: what regulators actually check
Substance means the people and decision-making capacity that a licensed institution actually keeps in the country that licensed it. It is where applications fail. Authorities look beyond the registered address and reported headcount to find where decisions are really made. The Central Bank of Ireland calls it “heart and mind”: the institution’s heart and mind must be in Ireland. It requires a management team and a board with independent directors based in the country, and almost all senior executives must live there. The CSSF pursues the same goal through its concept of central administration, which Circular 26/906 now spells out in detail.
The most telling test concerns safeguarding accounts. These accounts hold customer funds, kept separate from the institution’s own funds. The Irish regulator requires the authority to approve movements on these accounts to sit within the Irish entity, not with another group company or a service provider. The check covers who can authorize an outflow of funds on their own, and from which country they sign. An arrangement that gives that authority to a headquarters outside Europe does not meet the requirement.
According to the same review, the median time to authorization in the EEA is 9.5 months, and the main cause of delay is incomplete applications. That median hides wide variation. The Central Bank of Ireland targets 90 business days of assessment in 90% of cases, with the final letter following within 10 business days. Yet its average processing time in 2024 was 688 calendar days, up 74 days year over year. The two figures measure different things. The 90 business days count the authority’s assessment time, which stops each time it requests more information. The observed average covers total calendar time, including the applicant’s response times.
Passporting: how Article 28 works, and where it stops
Passporting is the procedure by which a licensed institution extends its business to another country of the European Economic Area under Article 28 of PSD2. The institution notifies its home authority, which has one month to forward the notification to the host country authority. The host authority assesses the plan, particularly from an anti-money laundering and counter-terrorist financing standpoint. The home authority decides within three months of receiving the complete notification. Business can start only after the agent or branch is entered in the register provided for in Article 14.
Two regimes coexist. The freedom to provide services lets an institution serve a market from its home country, with no local presence. The freedom of establishment covers branches, agents, and, for e-money institutions only, distributors. The second regime triggers reporting obligations to the host country and, above a certain size, the appointment of a central contact point. The distinction turns on actual presence in the host country. Hiring a salaried salesperson on the ground and selling into the same country from Vilnius fall under different regimes.
| Area | Covered by the passport | Still to obtain locally |
|---|---|---|
| Right to operate | Yes, in all 30 EEA countries after notification | Nothing, but each country and each service is notified separately |
| Anti-money laundering | No: the host country supervises agents and branches | Procedures compliant with local law; a central contact point above a threshold |
| Consumer protection and contract law | No | Terms and conditions compliant with host country law, in the local language, with the competent ombudsman |
| Card scheme access | No | An acquiring or issuing license from each network, each with its own requirements |
| Settlement rail access | No | Direct or indirect participation: CENTROlink, TIPS through a central bank, or a sponsor bank |
| IBAN acceptance by third parties | Legally yes, under Article 9 of Regulation (EU) No 260/2012 | In practice, ongoing work with billers and employers to get the IBAN accepted |
| Deposit guarantee | Not applicable: a payment institution’s safeguarded funds are not deposits | Clear customer disclosure that no guarantee applies and of what safeguarding actually covers |
A bigger limit is the scope of deposit insurance, which Directive 2014/49/EU restricts to deposits held with credit institutions. Funds held by a payment or e-money institution are safeguarded but not covered by that guarantee. Safeguarding protects against the institution’s failure, but not against the failure of the bank holding the funds or a freeze on accounts during liquidation. Operating cash left in an e-money account therefore remains exposed to both risks.
Lithuania, Ireland, Malta, the Netherlands: four distinct strategies
Lithuania has the highest concentration of licenses in Europe, with 119 institutions licensed at the end of 2024: 76 e-money institutions and 43 payment institutions. The sector earned €622 million in revenue from licensed activities in 2024, up 25%. It served 2.2 million active customers, up 30%. Revenue is highly concentrated. The top 10 institutions take in nearly €386 million, more than 60% of revenue, while the other 109 share the rest.
Ireland receives few applications and reviews them with high substance requirements. The Central Bank of Ireland received three applications in 2024 and granted six licenses, the same number as in 2023. On April 9, 2024, it published Expectations for Authorisation of Payment and Electronic Money Institutions, with the stated goal of reducing the share of applications filed prematurely. Its January 20, 2023, letter to the industry had required every institution to commission an external audit of its safeguarding. The auditor’s opinion and the board’s response were due by July 31, 2023.
Malta holds a niche position in the European licensing market. The regulator supervised 2,380 licensed entities across all sectors in 2024, up from 2,304 a year earlier. Financial institutions under the Financial Institutions Act make up 2.7% of them. Two data points show the supervisory burden. Of the 64 applications for money laundering reporting officers received in 2024, 32 concerned financial institutions: half the total, from 2.7% of licensed entities. The MFSA also devoted one of its thematic reviews that year to their compliance with passporting rules.
When a license is revoked: the PayrNet case
License revocation is the decision by which the home authority ends an institution’s right to operate, and with it its European passport. UAB PAYRNET, a Lithuanian e-money institution, provided white-label accounts and cards to dozens of European fintechs. Lietuvos bankas revoked its license on June 22, 2023, citing serious, systematic, and repeated violations of Lithuanian law on e-money, payments, and money laundering. The programs offered by its fintech clients all depended on that one license. When a license falls, every program running under it falls too.
- Insist on reading the license holder’s annual accounts, especially intragroup flows: PAYRNET’s insolvency was triggered by paying other group companies’ expenses.
- Check where safeguarded funds are held: the bank holding them, the country, the segregation mechanism, how often they are reconciled, and who approves movements.
- Negotiate a portability clause in the distribution agreement from the start: access to customer data, cooperation on migration, notice periods, and what happens to balances if the license is revoked.
- Keep a second license holder on standby, under contract and technically integrated, even with no volume. A switchover cannot be improvised in two weeks.
- Monitor the home supervisor’s decisions, which are public and dated: an activity restriction and the appointment of a temporary representative usually come several months before revocation.
Comparing the two setups comes down to how risk and control are allocated. An institution with its own license bears the regulatory risk directly and keeps control of its business. One that operates under a third party’s license avoids the cost of licensing and, in exchange, depends on an outside entity. The trade-off depends on volume, margin, and time horizon. All three change over time. A setup chosen at one point can therefore stop fitting the business if it is not reviewed periodically.
Choosing a jurisdiction: a decision grid
The cost of a payment license combines regulatory capital, application fees, and annual running costs. Commercial comparisons focus mostly on the first item. A payment institution needs €20,000, €50,000, or €125,000 in capital depending on its services, and an e-money institution €350,000. These amounts are a tiny share of the total cost. What really drives it is the number of managers who must be based locally, how long the entity has to be funded before it earns revenue, and access to a settlement rail.
| Project profile | Hub to look at first | Key point to check before deciding |
|---|---|---|
| Pan-European e-money issuer, accounts and cards, no sponsor bank | Lithuania | Dependence on a single connection: a suspended CENTROlink participation halts the business |
| European subsidiary of an English-speaking group, with strong group governance | Ireland | Timing: 688 days on average in 2024, and a substance requirement that rules out running the entity from headquarters |
| High-volume acquiring and e-money issuance, backed by a banking center | Luxembourg | Circular 26/906: two authorized managers permanently on site; compliance and risk cannot be outsourced |
| Specialized vertical that other regulators won’t take on | Malta | How correspondent banks and card schemes view the hub, which determines real access |
| Acquiring for large merchants, direct access to card schemes and local payment methods | Netherlands | The gap between an e-money license and a banking license, in both cost and capabilities |
| Account aggregation only, with no funds held | The country where the customers are | AISP registration is enough: there is no point paying for a full license for a service that never touches funds |
- First, establish whether the project will hold funds. If not, AISP registration is enough; if it does, everything else follows.
- Cost out substance before capital. Two authorized managers, in-house compliance and risk management, and an internal audit function: that is a recurring annual budget, not an entry cost.
- Confirm settlement access. Direct participation, a sponsor bank, or access to a public rail: without a firm answer, the license generates no revenue.
- Test how local banks will treat you. Opening a safeguarding account and securing a correspondent relationship are separate hurdles from licensing, and sometimes longer ones.
- Map host countries during the review. Each country, each service, and each agent is notified separately, with one month for forwarding and three months for a decision.
- Plan the exit. The application must include an orderly wind-down plan, and it will be read on the day it is needed.
A reform now being adopted will change this framework. The European Parliament and the Council reached a provisional political agreement on the PSD3 / Payment Services Regulation package on November 27, 2025. Coreper endorsed the compromise texts on April 22, 2026. The key structural change is already known: the e-money institution will no longer be a standalone status and will become a subcategory of payment institution. The entities concerned will have to be reauthorized. Reauthorization will be handled by the home country authority, the same one an applicant chooses in 2026.