⚖️ Payment licenses and authorizations around the world

The trigger: taking possession of funds

A payment license is the authorization by which a public authority allows a company to take possession of funds that belong to someone else. Holding those funds is what triggers the licensing requirement. The technology used plays no part in the analysis. The regulator has two goals. It protects customers against the failure of the intermediary holding their money, and it protects the system against money laundering and terrorist financing. License categories, capital requirements, and reporting obligations all flow from these two goals, with priorities that vary from country to country.

Classifying a payment collection project starts with a physical fact: how long the funds sit in an account the provider controls. A company that only routes a message stays out of scope in most jurisdictions. One that holds a balance, even overnight, falls within scope almost everywhere. Between the two lies the gray zone of payout timelines, where licensing disputes cluster.

European Union: PIs, EMIs, and the passport

The European passport is the mechanism that lets a license granted by a single national authority apply across the whole European Economic Area. One license opens 30 markets, either through a local establishment or through the cross-border provision of services. Two nonbank statuses benefit from it. PSD2 created the payment institution (PI), and EMD2 the e-money institution (EMI). A national authority reviews the application, grants the license, and then supervises the firm. No other regional bloc has this mechanism, and it shapes the actual geography of the European payments industry.

The passport sets regulators competing with one another. Applicants choose which authority to file with, and the license it grants is then valid everywhere. Lithuania built its position on an infrastructure decision rather than on a light prudential touch. CENTROlink, launched by Lithuania's central bank, Lietuvos bankas, in 2016, gives PIs and EMIs direct access to SEPA without a sponsor bank. The authority that grants the license therefore also runs the rail the licensee connects to. At the end of 2024, 119 such institutions were operating in Lithuania. Those processing more than €1 billion accounted for 92% of the sector's revenue (Lietuvos bankas, 2024).

Ireland is the passport's other magnet, offering both English and the euro. The Central Bank of Ireland aims to complete its assessment phase in 90 business days in 90% of cases. The final authorization letter follows within 10 business days of satisfactory answers to the Minded to Authorise letter. The same regulator notes that applicants often need more than 12 months to gather all the information it requests. The two durations cover different periods, since the regulatory clock only runs on a complete application.

• Agents and distributors: a PI distributes through agents and an EMI through distributors, all registered with the national regulator. This is the legal foundation of European banking-as-a-service, and the fastest way in for a company that does not want to hold a license itself.
• Narrowly construed exemptions: limited networks, a commercial agent acting for only one of the two parties, intragroup transactions. National regulators monitor them closely and reclassify the arrangements that rely on them.
• DORA (Regulation (EU) 2022/2554) has applied to EMIs and PIs since January 17, 2025: a register of IT service providers, resilience testing, and incident reporting. Build it into the license application from the start, not afterward.
• MiCA Titles III and IV have governed e-money tokens since June 30, 2024. Ireland cut the transitional period from 18 to 12 months, making CASP authorization mandatory by December 29, 2025.
• PSD3 and the PSR: on June 28, 2023, the European Commission proposed a package that separates licensing and supervision (a directive) from conduct rules (a directly applicable regulation). The PI/EMI structure stays; the compliance burden shifts.

United States: licensing state by state

The US regime for nonbank payments has two stacked tiers and no federal equivalent of the European payment institution. A nonbank provider that moves third-party funds falls under both tiers at once. At the federal level, it registers with FinCEN as a money services business, which comes with a Bank Secrecy Act compliance program and reporting obligations. At the state level, it obtains a license from the banking department of each state where its customers live. Federal registration never replaces a state license.

The money transmitter license is that license to operate, granted state by state to anyone who transmits other people's money. It is the barrier to entry into the US market, since each state sets its own net worth, surety bond, and permissible investment requirements. Applications go through the NMLS, a shared portal that pools filing but not decisions. A single application can still produce 50 separate decisions. Timelines are measured in quarters. Nationwide coverage is built in successive waves of states rather than all at once.

The Money Transmission Modernization Act is a model law promoted since 2021 by the Conference of State Bank Supervisors. It is gradually harmonizing state regimes through common definitions, aligned net worth requirements, and mutual recognition of examinations. As of February 26, 2026, 31 states had adopted it in whole or in part, with Louisiana joining the list that year and Virginia's version taking effect on July 1, 2026 (CSBS, 2026). Harmonization is advancing, but it is neither complete nor uniform. A product launch timeline has to account for that gap, since a given state may have adopted the act only in part.

India: PA-O, PA-P, PA-CB, and the escrow account

In India, the payment aggregator is the entity that collects funds from payers on behalf of multiple merchants and then pays them out. It is the legally decisive link in a chain that runs from the merchant to the payer's bank: merchant → payment aggregator or acquiring bank → PSP bank → NPCI → payer's bank. A foreign merchant never connects to this chain directly. The aggregator regime was overhauled by the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, published on September 15, 2025, which replace the 2020 guidelines. The activity is now split into three categories, each requiring its own authorization.

• Net worth: ₹15 crore when applying and ₹25 crore by the end of the third financial year, maintained thereafter. Banks can act as aggregators without a separate authorization.
• Safeguarding: amounts collected on behalf of merchants flow through an *escrow account with a Scheduled Commercial Bank in India*. The account takes no other flows, and the aggregator's own funds have no place in it.
• Merchant due diligence: checks under the 2016 Master Direction on KYC, a search of the central registry, background checks, and ongoing transaction monitoring.
• Reporting: monthly statistics to the RBI, a quarterly auditor's certificate on the operation of the escrow account, an annual net worth certificate, and a cybersecurity audit report.
• Transition timeline: applications were due by December 31, 2025, at the latest; aggregators that did not apply had to cease aggregation by February 28, 2026.

Payout timelines are set by rule, which is what sets the Indian regime apart from simple safeguarding. Under the 2020 guidelines, collected funds were to be credited to the escrow account on Tp+0 or Tp+1, depending on the collection method. Settlement to the merchant then followed a schedule based on who was responsible for delivery: Ts+1 when the aggregator was responsible, Td+1 when the merchant was, and Tr+1 when funds were held until the refund period expired. The regulator sets this schedule. The aggregator does not decide it; it executes it.

Southeast Asia: MAS, BSP, SBV, Bank Indonesia

Payments regulation in Southeast Asia is strictly national; regional cooperation takes the form of memoranda of understanding between central banks. Each country has its own national operator, its own licensing regime, and its own API standard, and often mandates domestic routing too. Yet the retail rails share the same basic design. Thailand launched PromptPay in 2017, run by National ITMX under a mandate from the Bank of Thailand. Bank Indonesia imposed QRIS in 2019 together with ASPI, ending the war between private QR codes by fiat. Malaysia runs DuitNow and DuitNow QR through PayNet, and Singapore has operated PayNow on FAST since 2017. Merchants go live country by country, and each connection requires its own license application and its own technical integration.

• Check the license, not the regional brand. The Singapore entity Grablink Pte. Ltd. holds the MAS Major Payment Institution license; the Grab brand's presence in other markets rests on separate entities and separate licenses, which must be checked country by country.
• A wallet is not a bank. GCash, operated by G-Xchange, Inc., is an e-money issuer supervised by the BSP, with no banking status: balances left in it are not covered by Philippine deposit insurance. Sweeping funds to a bank account daily is the right reflex. Maya is different. The group holds two licenses: Maya Philippines, Inc. for payments and Maya Bank, Inc. for digital banking.
• Pricing can be set by the regulator. Bank Indonesia sets the QRIS MDR by merchant category, puts it on the merchant, and prohibits passing it on to the consumer. Charging a QRIS surcharge is a violation, not a commercial choice. Check that your provider does not do so on the merchant's behalf.
• Instant rails have no chargebacks. On PromptPay, BI-FAST, DuitNow, InstaPay, or NAPAS 247, payment is final and irrevocable. A refund is a new transfer, initiated by the merchant, with its own fees and timing. Any dispute logic has to live in the application, not in the rail.

Gulf, Egypt, and the Levant: SAMA, CBUAE, CBK, CBE

Licensing regimes in the Gulf, Egypt, and the Levant are strictly national. There is no passport, either within the Gulf Cooperation Council or between the Gulf and Egypt or the Levant. Each jurisdiction grants its own licenses and usually requires a local entity. The service categories it defines do not match those of its neighbors. A provider operating in Saudi Arabia and the UAE holds two licenses from two regulators, with two sets of reporting obligations. That duplication is the first line item in any regional expansion budget, and entry plans underestimate it.

One organizational feature sets the region apart from Europe and North America: the central bank is very often the rail operator as well as the licensing authority. Saudi Payments, which runs mada, is a subsidiary of SAMA, and Al Etihad Payments, which runs Aani and Jaywan, is a 100%-owned subsidiary of the CBUAE. In Qatar and Oman, the central bank operates the systems directly. Licensing and connection then sit with the same counterpart. That rarely speeds things up, and there is no way around it, since there is no alternative operator to connect to.

Egypt's PSO/PSP distinction separates running a system from providing a service, and it has no direct equivalent in European terminology. The Payment System Operator runs a payment system. The Payment Service Provider serves customers. A single group can fall under both and must then file two separate applications. The scope is broad: cash deposits and withdrawals on a payment account, execution of transactions and transfers, and issuance of instruments and electronic acceptance channels. It also covers accepting, sending, and receiving remittances in local currency, and initiating payment orders.

• Sequence by market, not by region. Saudi Arabia and the UAE account for the largest share of Gulf volume, and Egypt for the largest share outside the Gulf. The four smaller GCC markets open faster through a local acquirer that is already connected than through a license of your own.
• Check a partner's status on the regulator's register, not on its marketing website. Several operators in the region have recently changed their name, status, or owner.
• Budget for reporting. Periodic reporting to SAMA and the CBUAE requires a full-time local compliance function long before volumes can pay for it.
• Domestic routing is mandatory. In Saudi Arabia, SAMA requires transactions at online stores established in the Kingdom to be processed through the national system. A European acquiring license will capture tourists' cards and miss almost all local volume.

Africa: CBN, Bank of Ghana, BCEAO, SARB

African payment licenses are granted country by country, with one exception. No passport spans the continent, whether across ECOWAS, SADC, or the East African Community. WAEMU is the exception, and only within its borders: a single review by the BCEAO, the regional central bank, covers eight countries. Elsewhere, an issuer licensed by the Central Bank of Kenya has no right to operate in Tanzania or Uganda. Applications are filed with each central bank, under its own governing text, schedule of requirements, and review timeline.

• Kenya: the framework rests on the 2011 National Payment System Act, implemented through 2014 regulations that govern provider authorization and system oversight. The CBK's National Payments Strategy 2022-2025 sets the direction.
• East Africa: five markets, five central banks, no regional license. A Kenyan e-money issuer must file a complete new application in Tanzania and in Uganda.
• Regulatory risk does not look like a license withdrawal. In April 2024, the CBN barred OPay, PalmPay, Kuda, and Moniepoint from opening new accounts while it audited their KYC procedures. The ban lasted about two months and froze customer acquisition at four companies at once.
• Identity is national and cannot be substituted: BVN in Nigeria, the Ghana Card in Ghana, country-by-country authorization in WAEMU. No KYC database crosses a border. Onboarding flows are designed country by country, not as variants of a single regional flow.

Safeguarding customer funds and data localization

Safeguarding (known in French as cantonnement) is the arrangement that ring-fences third-party funds from the provider's own assets. It differs from regulatory capital, which absorbs operating losses but does not protect customer money. The logic is the same everywhere: customer funds must remain out of reach if the institution fails. The rules differ from one jurisdiction to another, however, to the point that they dictate the treasury architecture of a multi-country group.

India is the best-documented case of mandatory localization among several comparable regimes. A number of Gulf jurisdictions require data residency and in-country hosting of processing systems, in addition to a local entity. Indonesia takes a different approach, with constraints on ownership and on technical standards. It requires majority Indonesian ownership of nonbank providers and mandatory interconnection through the SNAP standard maintained by ASPI. The logic is the same in both cases: the regulator wants to be able to seize, audit, and shut down operations without going through a foreign jurisdiction.

• Map your data flows before choosing a provider: where data is collected, stored, processed, and backed up. Backup is the one people forget, and it is often the one that leaves the country.
• Distinguish localization from sovereignty: a data center located in the country but operated by a foreign entity satisfies some regimes but not others. The answer depends on each statute.
• Check tokenization and authentication where they are mandatory: in India, card data tokenization and two-factor authentication with one dynamic factor are required on top of PCI DSS. They do not replace it.
• Treat safeguarding as a treasury issue, not a compliance one: a non-interest-bearing dedicated account, a requirement to invest in short-term government securities, and a mandated payout deadline all change a multi-country group's working capital needs.

How long licensing really takes, and what slows it down

Licensing time breaks down into two periods that the rules treat differently: preparing the application and the authority's review. The rules promise short timelines; practice produces different ones. The gap stems from one constant rule, not from any failing on the authorities' part. The regulatory clock only starts once the application is complete. The authority itself decides whether the application is complete. An applicant can spend 18 months before a three-month clock even starts, without ever being late in legal terms. A launch plan should budget for the preparation phase, not the review phase.

• Open the bank application on the same day as the regulatory application. The two reviews are independent and take about as long. Running them one after the other doubles the timeline.
• Check the transition period deadline, not just the date of the text. Egypt gave incumbents 12 months from June 2025; WAEMU extended its deadline to May 1, 2025; India set February 28, 2026, as the date to cease activity. These dates extinguish grandfathered rights.
• Plan for rejection. Synch Payments, set up in 2020 by AIB, Bank of Ireland, Permanent TSB, and KBC Ireland to launch an account-to-account service, was abandoned in November 2023 after its AISP and PISP applications stalled at the Central Bank of Ireland. A national market was left without a bank-led mobile payment solution.
• Don't confuse a license with access. In Canada, RPAA registration is a precondition for access to the Payments Canada rails; in Lithuania, direct SEPA access goes through CENTROlink; in Nigeria, there is no way around NIBSS. A license grants a right, not a connection.
• Sequence US states by customer volume, not alphabetically. Nationwide coverage is built in several waves, and the Money Transmission Modernization Act does not yet make state reviews interchangeable.