Payment Institution (PI) License in 2026: The Complete Guide

What a Payment Institution licence authorises

A Payment Institution (PI) licence is the EU authorisation that lets a non-bank firm provide regulated payment services under the Payment Services Directive. It is the most common fintech licence in Europe, sitting between a bank charter and a simple agent registration. The licence is issued by the home-state competent authority and, once granted, can be passported across the entire EEA.

Under Annex I of PSD2 a PI can offer any combination of the following services, and the capital requirement scales with the mix you choose.

A PI cannot take deposits and cannot issue e-money. Funds held in a payment account must be ring-fenced (safeguarded) and cannot be used for lending except short credit tightly linked to a payment transaction.

From PSD2 to PSD3 and the PSR in 2026

The legal backbone of the PI licence is Directive (EU) 2015/2366 (PSD2), in force across the EEA since January 2018. The 2026 picture is dominated by the transition to the next regime.

1. PSD3 (Directive). Replaces PSD2 on authorisation, supervision and prudential rules. The Commission proposal was published in June 2023, the Council and Parliament reached a provisional agreement in 2025, and national transposition is expected 18 months after entry into force. Plan for applicability around 2026 to 2027.
2. PSR (Payment Services Regulation). Directly applicable across the EU, it moves conduct rules (fraud, authentication, refunds, open finance access) from a directive into a regulation so they apply uniformly without national transposition.
3. Single licensing regime. PSD3 merges the PI and EMI licences into a single authorisation, with e-money treated as a sub-category of payment services. Existing EMIs will be grandfathered.
4. Fraud and SCA upgrades. Mandatory IBAN-name check, expanded liability for authorised push payment fraud, refined strong customer authentication rules and clearer API performance obligations on ASPSPs.
5. FIDA (Financial Data Access). Extends data sharing beyond payment accounts into investments, pensions, insurance and mortgages, with a compensation model for data holders.

If you apply for a PI licence today, you apply under PSD2 and transition automatically. Regulators are already reviewing new files with one eye on PSD3 expectations, especially around fraud monitoring, incident reporting and outsourcing.

PI vs EMI vs bank

The three main European licences look similar from the outside but behave very differently on capital, scope and customer funds.

Rule of thumb: if you only move money, pick PI. If you store value in a wallet or issue prepaid cards, pick EMI. If you take deposits and lend them, you need a bank.

Minimum capital and ongoing own funds

Article 7 of PSD2 (carried into PSD3) ties initial capital to the services you plan to provide. PSD3 keeps the same thresholds while clarifying own-funds methods.

Account information services alone (AISP) do not require initial capital but do require professional indemnity insurance. Initial capital must be paid up in cash at the time of licensing and is only the starting point. From day one, the PI must hold ongoing own funds calculated by one of four methods, and the competent authority picks the method:

• Method A - 10% of the previous year's fixed overheads. Used mostly for new entrants.
• Method B - a scaling percentage of payment volume (from 4.0% down to 0.25% across tranches) multiplied by a scaling factor k depending on services.
• Method C - a percentage of the sum of interest income, commissions and other operating income, again scaled by k.
• Method D - introduced for account information and payment initiation services, based on transaction volumes or a fixed floor.

Own funds are reported quarterly. The regulator can require up to 20% more or allow up to 20% less depending on risk profile. Skimping here is the fastest way to a Pillar 2 add-on and a cap on licensed activities.

The authorisation process, step by step

The procedure is highly standardised across the EU thanks to the EBA authorisation guidelines. The differences are in speed, flexibility and how hands-on the regulator is.

1. Choose the home Member State. You must apply where your head office and main activities sit. Substance matters: regulators look at local directors, employees, risk and compliance staff, and real office presence.
2. Prepare the authorisation file. Programme of operations, three-year business plan with stressed projections, structural organisation, governance arrangements, internal control framework, AML/CFT manual, safeguarding plan, ICT and security risk assessment, business continuity plan, and fit-and-proper questionnaires for shareholders with qualifying holdings and management.
3. Pre-application meeting. Almost every regulator now expects an informal meeting before filing. Bring the business model, capital plan and safeguarding design.
4. Formal submission. Statutory clock is three months of complete file for decision under PSD2. In practice, stop-the-clock questions push real timelines to 9 to 18 months.
5. Conditions precedent. Once minded-to-approve, the regulator issues conditions: capital paid up, key hires on board, systems tested, safeguarding account live.
6. EU passport. After authorisation, notify the home regulator of the Member States where you want to operate under freedom of services or freedom of establishment. Passporting is a notification, not a second licence.
7. Agents and distributors. PIs can work through agents listed in the home register. Agents do not need their own licence but must meet fit-and-proper standards and appear in the EBA central register.

A lighter small PI regime exists in several jurisdictions (notably the UK and Lithuania) for firms below an average EUR 3 million monthly payment volume. Lower capital, lighter reporting, but no EU passport.

Popular PI jurisdictions in 2026

All EU regulators apply the same directive, but the experience of getting licensed varies enormously.

Germany, France, Luxembourg and the Netherlands are also frequent homes for PIs with institutional clients. They are slower and more expensive, but pair well with banking partners and corporate customers that value a tier-1 regulator stamp.

Safeguarding customer funds

Safeguarding is the single most important operational rule of the PI regime. Because a PI is not a deposit taker, customer funds must never be comingled with corporate funds and must remain retrievable on insolvency.

Two methods are allowed under PSD2:

1. Segregation method. Customer funds are held at the end of each business day in a segregated account with a credit institution, or invested in secure, liquid, low-risk assets approved by the regulator. The account must be legally ring-fenced so no creditor of the PI can claim it.
2. Insurance or guarantee method. An insurance policy or guarantee from a credit institution for an amount equivalent to the funds that would otherwise have been segregated. Less common because premiums are high.

PSD3 tightens this further: mandatory diversification across at least two credit institutions above a threshold, explicit recognition of central-bank accounts for safeguarding where available, and clearer rules on reconciliation frequency. Daily reconciliation with full audit trail is the new baseline.

PI or EMI: how to choose

The two licences overlap, but the choice is rarely ambiguous once you describe the product in one sentence.

Note that under PSD3 the two licences will merge, with e-money treated as a sub-activity. Firms already authorised as PI or EMI will be grandfathered, but new applicants should architect the business plan around the future unified regime.

Launch your PI programme with Crassula

A PI licence is the legal layer. You still need technology: ledger, KYC, onboarding, safeguarding reconciliation, card program, payment orchestration, admin back office and reporting. Building all of that in-house takes 18 months and a team of 30. Crassula ships it as a white-label core.

We work alongside your legal counsel on the authorisation file and plug the technology into your chosen home regulator. Teams launching with Crassula go live in 3 to 6 months once the licence is granted, versus 12 to 18 months for an in-house build.

FAQ