🚪 When no authorization is required: exclusions from the scope of payment services

Possession of funds, and the exclusions that escape the rules

Directive (EU) 2015/2366 defines a payment service by reference to a closed list: the eight activities in its Annex I. They include acquiring payment transactions, executing credit transfers and direct debits, issuing payment instruments, money remittance, payment initiation, and account information. An activity missing from that list is not a payment service under the directive. Article 37 of the same directive prohibits anyone who is neither authorized nor excluded from providing these services. The authorization requirement is therefore triggered by a fact, providing one of those eight activities, and not by the intent of whoever carries it out. A business that receives money intended for someone else must show, text in hand, that it falls outside the scope. Otherwise it is carrying out an activity reserved for authorized institutions.

Article 3 lists 15 exclusions, from point (a) to point (o). Their effect is binary: an activity is either within the directive or entirely outside it, with no lighter intermediate regime. An excluded firm is not supervised, holds no passport to operate in another member state, and appears in no register of authorized firms. No presumption works in its favor. An exclusion has to be demonstrated activity by activity, and product by product. The same company can issue a gift card that sits outside the scope and, alongside it, run a payment collection gateway that brings the whole business back in.

Points (m) and (n) rest on the same idea: a flow of money that never leaves its original owner. A provider moving its own funds acts for no customer and holds no one else’s money. A cash pooling structure that sweeps subsidiaries’ balances up to the parent follows the same logic, as long as no provider from outside the group steps in between. The exact reach of that condition is still debated. The bank that actually executes the transfer is a third party to the group, so whether the exclusion applies depends on how that point is read. The exclusion clearly fails, however, as soon as a group entity collects payments for outside customers, because the funds then stop belonging to the group that handles them.

Article 32 of PSD2 provides an optional exemption, separate from the Article 3 exclusions. It lets a member state waive full authorization for firms whose average monthly payment volume over 12 months stays below a national cap. That cap cannot exceed €3 million. These firms are registered, not authorized, and Article 32 expressly denies them the EU passport. They do provide payment services, under a lighter regime that is strictly domestic. An exclusion, by contrast, takes the whole activity outside the directive. The distinction starts to matter when a firm expands into a second member state, which national registration does not cover.

The burden of proof lies with the party invoking the exclusion. A supervisor reviewing the case does not have to prove that the activity is regulated: it examines the proposed classification and rejects it if it does not hold up. The case is made on documents, assembled before any inspection. Supervisors expect the standard contract between the issuer and its merchants, an exact description of the goods or services the instrument can buy, and a record of amounts over a rolling 12 months. A business that cannot produce them on the day of an inspection has not shown that it meets the conditions, and its activity stays subject to the authorization regime the exclusion would have avoided.

The limited network: its three limbs and where they end

Point (k) of Article 3 excludes services based on payment instruments that can be used only in a limited way. The text sets out three limbs, and only one of them needs to be met. The European Banking Authority’s guidelines EBA/GL/2022/02 treat them as alternatives that cannot be combined. Published on February 24, 2022, the guidelines have applied since June 1, 2022. An issuer therefore cannot pair a slightly broad network with a slightly narrow range to piece together a full exclusion: each limb has to stand on its own. The analysis covers only the limb invoked.

The first limb covers instruments that can be used only on the issuer’s premises. It also covers instruments used within a limited network of service providers that have a direct commercial agreement with a professional issuer. Two conditions then apply together: the network must be limited, and the agreement must be direct. A card accepted in the stores of a single retail brand, branches and franchisees included, clearly meets both, provided the franchise agreement covers acceptance of the instrument. A card accepted at merchants signed up by an intermediary, with no contract with the issuer, fails the second condition however large or small the network.

Whether a network is limited is judged on a set of indicators, and no numerical threshold replaces them. The guidelines look at the number of providers accepting the instrument and the network’s geographic reach. They add whether there is a common store name or brand, and the nature of the commercial link between the merchants and the issuer. A shopping mall, a university campus, a train station, or a downtown area can all be defended before a national supervisor. Nationwide acceptance open to unrelated merchants cannot. The decisive criterion is how a merchant joins the network: the contractual route in carries more weight than the number of merchants.

The second limb excludes instruments used to buy a very limited range of goods or services. The word “very” is in the text, and it narrows how the criterion is read. The EBA guidelines require a functional link between the products available, not just a commercial grouping. A city transit ticket, a cafeteria or workplace meal card, or a fuel card restricted to petroleum products can be defended before a supervisor, because the shared function of the products can be described in one sentence. A range defined by a broad theme, such as mobility or wellness, is much harder to defend. It groups categories with no technical link between them. Fuel cards sit in the most contested area, since their scope naturally expands to tolls, car washes, and maintenance.

The third limb covers instruments valid in a single member state and issued at the request of a business or a public sector entity. A national or regional public authority must regulate them for specific social or tax purposes. The suppliers that accept them must have a commercial agreement with the issuer. France’s titre-restaurant (meal voucher) is the textbook case, with its own legal framework, its network of approved merchants, and a purpose set by law. Several countries have similar vouchers with a social or cultural purpose. This limb differs from the other two under Article 37, whose notification requirement covers only limbs (i) and (ii).

National transposition adds formalities that the EU exclusion does not contain. France wrote the regime into Articles L. 521-3 and L. 525-5 of its Monetary and Financial Code, with a filing to the ACPR, France’s banking supervisor, above €1 million over 12 months. Germany placed it in Section 2 of the Zahlungsdiensteaufsichtsgesetz, the Payment Services Supervision Act, with a filing to BaFin, which reviews it before ruling on the classification claimed. The EBA guidelines call for notification in each member state where the activity is carried out, with the threshold assessed market by market. An issuer active in six countries therefore prepares six separate filings, each with the local supervisor and on that supervisor’s own timetable.

Commercial agents, mandates, and marketplaces

Point (b) of Article 3 excludes payment transactions from payer to payee made through a commercial agent. The agent must be authorized, under an agreement, to negotiate or conclude the sale or purchase of goods or services. It must act on behalf of the payer only, or the payee only. The word “only” decides how the text applies, since it reserves the exclusion for an intermediary that represents just one side of the transaction. The 2007 directive did not say this, and online marketplaces had relied on that broad reading for a decade, collecting payments for sellers they did not exclusively represent.

The 2015 tightening is explicit. The PSD2 recitals expressly target platforms that sit between buyers and sellers without any real room to negotiate or conclude. They specify that the exclusion applies only to an agent acting solely for the payer or solely for the payee. For that one-sided agent, whether it holds the customer’s funds is irrelevant, whereas point (j) makes it the central condition. The same recital, however, sets aside separate treatment for an intermediary that serves both sides: it stays outside the scope only if it never, at any point, takes possession or control of the funds. The analysis therefore turns on whether a mandate exists, what it covers, and whether it is one-sided.

Classifying an arrangement comes down to three checks. The first is whether a written, enforceable mandate exists, separate from the terms of use a seller accepts when signing up on a website. The second is what it covers, because a mandate simply to introduce parties confers neither the power to negotiate nor the power to conclude. The third is which side the intermediary has chosen, since the same intermediary cannot represent both parties to the same sale. A platform that negotiates and concludes in the seller’s name meets the first two conditions. It fails the third as soon as it offers the buyer a guarantee that binds it to the buyer.

The exclusion keeps two solid areas of application, which the marketplace debate tends to overshadow. The first is agency distribution. Here an intermediary sells in the name and on behalf of a single supplier, like an agency selling a carrier’s services. The second is procurement, where an agent buys on behalf of a principal without ever representing the sellers it deals with or taking a commission from them. Both share one decisive feature. The end customer knows who the principal is, because the sales contract names it expressly.

An ordinary marketplace fits neither model. It recruits sellers, protects buyers, arbitrates disputes, and takes a commission on every sale. National supervisors read that combination as acting for both sides, which rules out point (b) as soon as the platform collects the funds. A platform that never touches the funds keeps the carve-out left open by the recital, but it then executes no payment transaction at all, and the exclusion question largely falls away. What this means for collecting payments on behalf of third parties is covered elsewhere on this site. A platform relying on point (b) gives up one of the two sides, in its contracts as well as its user flows, and the unrepresented party has no recourse against it.

• Does the mandate exist in writing? Terms of use accepted online are not a sales mandate, and the supervisor will ask for the contract signed with the principal.
• Does it cover negotiating or concluding the sale? A listing, an introduction, or a display of offers confers neither power.
• Is only one side represented? A buyer protection program, dispute mediation, and a money-back guarantee all commit the intermediary to the other party.
• Does the end customer know whom the intermediary acts for? The principal’s name must appear in the sales contract and on the invoice, not just in a legal notice.
• Does the arrangement hold up in every target country? The exclusion is set at EU level, but how the agency contract is classified depends on the national law governing the mandate.

Technical service providers and digital content

Point (j) excludes technical service providers that support the provision of payment services without ever taking possession of the funds being transferred. The text gives its own examples: processing and storing data, authenticating data and entities, providing IT networks, and maintaining terminals. It then adds an express reservation. Payment initiation and account information are not technical services, however the contract dresses them up.

Possession is judged by the account the funds pass through, not by how the service contract labels the arrangement. A provider that receives funds into an account in its own name controls them, even if it commits contractually to pay them out the next day, because its own creditors could seize that account. A provider that technically triggers a payment order on an account held in the merchant’s name, with no power to dispose of the funds, stays on the technical side. The wording shuts the door on short holding periods, since it covers coming into possession at any time. Holding the funds for 24 hours is enough to take a provider out of the exclusion.

The distinction applies to each service provided, not to the company as a whole. A gateway formats an authorization message, an orchestration layer picks an acquirer, a tokenization provider replaces the card number with a substitute value. All of them stay technical as long as settlement does not flow through them. The same company crosses the line the day it collects sales proceeds and then pays them out to the merchant, however briefly the funds sit on its books. Many providers run both businesses side by side, one under the exclusion and the other under an authorization or as an agent. Classification follows the actual flow of funds, not the service’s marketing description.

Point (l) excludes transactions carried out by a provider of electronic communications networks or services for a subscriber, in addition to those services. Only two uses are covered. The first is the purchase of digital content and voice-based services charged to the subscriber’s bill, whatever device is used. The second is charitable donations and ticket purchases made from an electronic device and charged to the bill in the same way. Article 4 of the directive defines digital content as goods or services produced and supplied in digital form whose use is restricted to a technical device, excluding any physical goods.

The caps are written into the text, which limits each individual transaction to €50. The monthly total per subscriber cannot exceed €300, and the same limit applies when the subscriber prefunds an account with the operator. Exceeding either cap takes the activity out of the exclusion, with no tolerance and no grace period to fix it. An operator that charges physical goods to the subscriber’s bill, for its part, was never within this exclusion, whatever the amount billed to the subscriber.

Notification, reclassification, and the planned tightening

Article 37 requires notification to the competent authority for two of the Article 3 exclusions, and it provides the only public visibility they get. Paragraph 2 covers providers operating under limb (i) or (ii) of the limited network exclusion, or both. The threshold is triggered once the total value of transactions executed over the preceding 12 months exceeds €1 million. The notification describes the services offered and states which of the two limbs the provider relies on for its instrument. Paragraph 3 requires notification and an annual audit opinion for the electronic communications exclusion. The other Article 3 exclusions carry no reporting formalities at all.

What happens next follows a sequence set by the directive. The competent authority reviews the notification. If the activity does not meet the limited network criteria, it adopts a duly reasoned decision and informs the provider. It also reports the notified services and the exclusion claimed to the European Banking Authority. Under paragraph 5, the description of the activity is then made public in the national register and in the EBA’s central register. A notified exclusion is thus visible to competitors and banking partners alike, which makes it a routine item in onboarding due diligence.

Each national authority keeps its own register, and the formats vary widely from country to country. The ACPR publishes French filings, BaFin German ones, De Nederlandsche Bank Dutch ones, and the Banca d’Italia Italian ones. The EBA’s central register aggregates what national authorities send it, with each country’s own reporting lag. The UK, now outside the EEA, keeps its own register under the Payment Services Regulations 2017. Declared volumes are not published anywhere. None of these sources can measure the actual economic weight of the exclusions.

Reclassification is the decision by which the authority finds that an activity does not meet the conditions of the exclusion claimed. Its consequences go beyond a fine. The business must stop the activity, obtain authorization, or become the agent or distributor of an institution that is already authorized. The decision reaches back to the funds held, which should have been safeguarded. Customer due diligence obligations that went unperformed during the period resurface at the same time. Contracts with merchants and cardholders become hard to honor during remediation, because the business has no legal basis to collect funds. National law attaches penalties to the unauthorized provision of payment services, and their nature and severity vary by member state, from administrative measures to criminal offenses.

Individual reclassification decisions are rarely published. Supervisors readily publicize authorizations granted, withdrawals, and their heaviest sanctions. They say much less about classifications rejected after a notification. Practitioners therefore have no searchable body of administrative guidance, comparable to what exists for anti-money laundering. They work from the text, the EBA guidelines, and the positions published by their national supervisor. With no public precedent to rely on, the soundness of a structure rests on a written analysis, dated and reviewed every year.

The package the European Commission presented on June 28, 2023, moves these exclusions into a directly applicable regulation. The directive would keep authorization and supervision. The change of legal instrument matters more than the detail of the criteria. A list transposed into some 30 legal systems yields some 30 readings, whereas a regulation applies everywhere in the same words. The Commission’s explanatory memorandum lists divergent application of the exclusions among the flaws it aims to fix. A difference in interpretation between two member states, which an issuer can exploit today, would disappear once a regulation takes effect.

Two changes affect which activities the exclusions cover. Independent ATM deployers currently fall outside the scope under point (o). They would move into a registration regime with transparency requirements on withdrawal fees. Merchants without authorization could offer cash in stores without a purchase, within limits set by the text itself. The final timetable has not been set, and the application date will depend on the text finally adopted and its transition period. A product architecture designed today will be assessed under the current regime, then under whichever one replaces it.

• Confusing notification with authorization. A filing opens a review, it does not settle the classification, and the authority keeps the final say.
• Measuring the threshold at group level. The EBA guidelines apply the €1 million test per member state where the activity is carried out, not on a consolidated basis.
• Forgetting limb (iii). Its exemption from notification does not exempt it from oversight by a public authority or from the single-member-state limit.
• Letting the network grow without review. Adding merchants shifts the classification without any internal decision ever being labeled as such.
• Treating a gateway as a technical provider when it collects funds. Possession of funds is determined by who holds the account, not by the title of the service contract.