Four licences dominate European fintech conversations — EMI, PI, CASP and, for legacy operators, the national VASP registration being retired. On a pitch deck they look interchangeable. They are not. Each authorises a specific perimeter, carries different capital and governance requirements, and — most importantly — determines which banks and card schemes will work with you.
Choosing wrongly costs twelve to twenty-four months and most of a seed round.
Start from the activity, not the licence
Write down, in one sentence each, what actually happens in your product:
- Do you hold customer funds for any period? If yes, you are in EMI or safeguarded-PI territory, not in "we just move money".
- Do you issue a balance that customers can spend or redeem? That is electronic money.
- Do you execute payments on behalf of others without holding a redeemable balance? That is payment services.
- Do you exchange, custody, transfer or broker crypto-assets for clients? That is the CASP perimeter under MiCA.
- Do you only introduce customers to a licensed provider and take a fee? You may need no licence at all — but the agreement with the provider decides.
Most failed applications come from teams describing an ambition rather than a perimeter.
The licences
Payment Institution (PI). Authorises payment services: execution, acquiring, initiation, account information. Lower capital than an EMI. Cannot issue e-money. Suits acquiring, PISP/AISP models and B2B payouts.
Electronic Money Institution (EMI). Authorises issuing e-money plus the payment services attached to it. Higher capital and heavier safeguarding, but it is what you need to give customers a spendable balance or an IBAN in their name. Most neobank and wallet models are EMI models.
Crypto-Asset Service Provider (CASP). MiCA authorisation for exchange, custody, transfer, execution, placement, portfolio management and advice on crypto-assets. Authorisation in one member state passports across the EU on an Article 65 notification, not a second application. National transitional arrangements for existing VASPs have been closing on member-state-specific dates, so cross-border groups need an entity-by-entity calendar rather than a single deadline.
Stablecoin issuance (ART/EMT). A separate authorisation with reserve, redemption and disclosure requirements closer to banking law. Realistically out of reach for small teams; partner with an authorised issuer instead.
PSD3 and the direction of travel
The PSD3/PSR package continues the move from directive to directly applicable regulation, tightens fraud-liability and IBAN-name-check obligations, and brings the e-money and payment-services regimes closer together. Practical planning consequences:
- Build confirmation-of-payee and fraud-monitoring capability into the product now; retrofitting is expensive.
- Assume authorisation files will be assessed against a higher operational-resilience bar (also driven by DORA).
- Do not architect a business model whose margin depends on weak fraud-liability allocation.
Where to authorise
The realistic short list for most founders is Lithuania, Ireland, the Netherlands, Malta, Luxembourg, France and Germany. The differentiators are not the rulebook — that is largely harmonised — but processing time, regulator engagement style, availability of local senior staff who satisfy fit-and-proper, and, decisively, whether banks in that market will service you.
A licence in a jurisdiction where no bank will hold your safeguarding account is a certificate, not a business.
The safeguarding-account problem
This is where most licensed fintechs actually stall. Safeguarding requires client funds to be held at a credit institution or in qualifying liquid assets, segregated from own funds. Banks that offer safeguarding accounts to newly authorised EMIs are a small and shrinking set, and they choose on: quality of the management team, source of funding, concentration of high-risk merchant categories, and whether the regulator is one they trust.
Sequence accordingly. Start safeguarding conversations before filing, name the intended bank in the application where you can, and treat a soft indication from a credit institution as a gating item for the whole plan.
Non-EU alternatives
Where EU revenue is a minority of the business, the honest answer is often to license elsewhere. VARA and ADGM in the UAE, FINMA in Switzerland, the FCA in the UK and MAS in Singapore all produce licences that global counterparties accept. We have restructured groups out of EU applications where the compliance cost exceeded the EU revenue it protected — and said so before the fee was spent.
A realistic timetable and budget
- Pre-application preparation: three to five months (business plan, financial model, governance, policies, key-person recruitment).
- Regulator assessment: six to twelve months in the faster jurisdictions.
- Own funds: from €50k for some PI categories to €350k for EMI, plus ongoing own-funds calculations.
- Total cost to authorisation, including people: rarely under €400k, frequently more.
Any adviser quoting three months and €50k all-in is selling a shelf company with a registration, not an authorisation.
FAQs
Can I passport a CASP licence across the EU?
Yes — Article 59 gives Union-wide rights and Article 65 is the notification that switches on cross-border operation. It is a notification, not a second authorisation.
Is an agent or distributor model faster?
Yes, materially. Operating as an agent of a licensed principal gets to market in months rather than years, at the cost of margin and control. It is often the right first step.
Do I need local staff?
Yes. Regulators expect the senior management, risk and compliance functions to be genuinely resident and available, not fly-in.
Can one entity hold both an EMI and a CASP licence?
In principle yes, and some groups do, but it doubles the supervisory burden. Most separate them.