PSD2 in Europe

What is PSD2?

PSD2 is an abbreviation for the 2nd Payment Services Directive, which is a European Union Directive governing payment services and payment service providers in the EEA. The Second Payment Services Directive (PSD2), Directive (EU) 2015/2366, was adopted on 25 November 2015 and became applicable through national implementing legislation from 13 January 2018.

PSD2 replaced Directive 2007/64/EC (PSD1) and introduced a revised regulatory framework aimed at strengthening payment security, consumer protection, competition and innovation.

The directive established requirements concerning the authorisation and supervision of payment institutions, access to payment accounts by regulated third-party providers, strong customer authentication and the rights and obligations of payment service users.

In June 2023, the European Commission proposed a further reform consisting of a Third Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation (PSR).

On 27 November 2025, the European Parliament and the Council reached a provisional political agreement on the proposed legislation. The European Parliament’s Committee on Economic and Monetary Affairs approved the negotiated texts on 5 May 2026.

As of 22 October 2026, PSD3 and PSR have not completed the EU legislative procedure and are not yet applicable law.

Consequently, PSD2 and the existing Electronic Money Directive (Directive 2009/110/EC), together with applicable amendments and national implementing legislation, continue to govern the relevant payment and electronic money activities. To a great extent, it had replaced the original Payment Services Directive and provided a number of key changes, one of which is the obligation of certain payment service providers to obtain a license according to PSD2.

The European regulatory framework distinguishes between several categories of financial institutions authorised or registered to provide payment-related services.

The principal categories include:

Payment Institution (PI): Authorised under Directive (EU) 2015/2366 (PSD2) to provide specified regulated payment services, such as money remittance, payment transactions, acquiring and payment initiation.

Electronic Money Institution (EMI): Authorised under Directive 2009/110/EC (EMD2), together with applicable PSD2 provisions, to issue electronic money and provide permitted payment services.

Account Information Service Provider (AISP): A business providing exclusively account information services that is subject to the registration framework under Article 33 of PSD2 rather than the ordinary full payment institution authorisation procedure.

Credit Institution: An authorised bank that may provide payment services and issue electronic money within the scope of its banking authorisation.

The regulatory requirements differ according to the institution’s permitted activities, capital requirements, safeguarding arrangements and supervisory framework.

Although PI and EMI authorisations are frequently marketed as “PSD2 licences”, they are distinct legal authorisations with different statutory foundations.

Both a PI licensee and an EMI license can offer a broad span of activities, including but not limited to:

• Perform a variety of payment transactions, such as credit transfers, direct debits, and card payments
• Provide money remittance services – the transferring of funds nationally and across borders
• PISP: provide services for the initiation of payment orders by customers for online payments without the usage of a credit or debit card
• AISP: provide customers with an overall view of their account information from various financial institutions
• Currency exchange services
• Issuance of payment instruments, including pre-paid cards and digital wallets
• Settle and receive merchant/e-commerce payments on behalf of merchants, hence enabling card and other electronic forms of payments
• Provide mobile payment services to enable similar transactions between the owner of the phone and other parties
• Provide peer-to-peer payment services that would enable people to send money to other people

The principal distinction between Payment Institutions (PIs) and Electronic Money Institutions (EMIs) concerns the right to issue electronic money.

Under Directive 2009/110/EC, electronic money is electronically or magnetically stored monetary value representing a claim on the issuer, issued on receipt of funds for the purpose of making payment transactions and accepted by persons other than the issuer.

EMIs may issue electronic money and provide authorised payment services. Examples of electronic money products include eligible prepaid payment balances, stored-value payment accounts and certain electronic wallet arrangements.

PIs may provide payment accounts used for executing payment transactions but do not have the general right to issue electronic money solely on the basis of their payment institution authorisation.

Electronic money must not be automatically equated with cryptocurrencies, central bank digital currencies or every form of digital asset.

In particular, e-money tokens (EMTs) falling within Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA) are subject to additional requirements under Title IV of that regulation.

Neither an ordinary PI authorisation nor an EMI authorisation independently permits unrestricted banking activities or the acceptance of conventional bank deposits. This is their main activity. They may also store electronic money on behalf of customers and give electronic wallets or accounts for users to access and manage their funds.

Advantages of Holding a PSD2

Holding one of the above-mentioned licenses has many other serious advantages, which you should consider if your aim is to provide payment services for EU customers. It may open a great and diverse market to your business, and it will establish your firm as one that is trustworthy and compliant, in a very closely regulated industry, which is key to developing long-term growth, innovation, and success in the European financial industry.

By acquiring a license under PSD2, one may gain a number of important advantages, including:

• A license from PSD2 may serve to engender trust and confidence in your business from its customers and other partners because it has met the stringent requirements necessary to operate as a legitimate and trustworthy payment service provider.
• Payment Institutions and Electronic Money Institutions authorised in an EU Member State may provide permitted services in other European Economic Area (EEA) countries through the applicable passporting framework.

  The EEA comprises the 27 EU Member States together with Iceland, Liechtenstein and Norway.

  However, obtaining authorisation in one Member State does not automatically permit a financial institution to commence unrestricted operations across the entire EEA.

  Under PSD2, the institution must complete the applicable notification procedures through its home competent authority before providing services in another Member State.

  Cross-border operations may be conducted through the freedom to provide services, the establishment of branches or the appointment of agents, subject to the relevant regulatory requirements.

  Passporting rights are limited to the activities covered by the institution’s authorisation and do not automatically extend to banking, investment services, cryptocurrency activities or other separately regulated services.

  The EEA has approximately 455–460 million residents, rather than more than 500 million.

  Payment institutions must also comply with relevant host-state obligations, including applicable anti-money laundering, consumer protection and reporting requirements.

• PSD2 fosters innovation in the sense that it prompts open banking, allowing third-party providers to access customer account information, and therefore, license holders are effectively supported in the development of innovative financial products and services.
• PSD2 introduced a regulated open banking framework allowing eligible third-party providers to access payment account information or initiate payments on behalf of customers, subject to strict legal and technical conditions.

  However, holding a Payment Institution or Electronic Money Institution authorisation does not automatically grant unrestricted access to customers’ banking information.

  Under the applicable framework:

  Account Information Service Providers (AISPs): May access specified payment account information where the customer has provided the required explicit consent.

  Payment Initiation Service Providers (PISPs): May initiate payment transactions from eligible customer payment accounts in accordance with the applicable statutory and authentication requirements.

  Account Servicing Payment Service Providers (ASPSPs): Must facilitate lawful access through appropriate secure communication arrangements.

  Access is subject to PSD2, the regulatory technical standards concerning Strong Customer Authentication and Common and Secure Communication, and applicable data protection legislation.

  Third-party providers may access only the information necessary for the authorised service and must not use customer data for unrelated purposes.

  Under the General Data Protection Regulation (GDPR), personal data processing must also satisfy the relevant requirements concerning lawful processing, purpose limitation, data minimisation and security.

  Open banking authorisation therefore does not constitute a general permission to collect, analyse or commercially exploit customers’ financial information.

• The licensed payment service providers may have access to the payment settlement systems, enabling them to process and settle transactions in an efficient manner.
• Operating with a PSD2 license provides clarity regarding regulatory compliance, which reduces uncertainty and potential legal risks.
• A PSD2 license can serve as a stepping stone for global expansion, as EU regulations and standards are recognized and valued worldwide.

Payment Services Regulations in the EU

As the name of the license suggests, PSD2 licensees are essentially regulated by the PSD2. It was, of course, built upon the PSD, which is worth taking into consideration in its own right since not everything from it was superseded by PSD2. Together with other applicable regulations, these directives form a single EU framework promoting secure, innovative, and competitive financial services within the member countries. This has harmonized and integrated single cross-border payments in the European Union at less cost for consumers and businesses in making transactions across all member countries.

Main Provisions of the PSD:

• The original Payment Services Directive (PSD1), Directive 2007/64/EC, established a harmonised European authorisation framework for
  Payment Institutions
  (PIs).

  
  Electronic Money Institutions
  (EMIs) are governed by a separate legislative framework, principally Directive 2009/110/EC (EMD2), alongside applicable payment services legislation.

  PSD2 subsequently replaced PSD1 and extended the regulatory framework to additional payment services, including payment initiation and account information services.

  PIs and EMIs are generally authorised by the competent authority of their home Member State.

  Following authorisation and completion of the applicable passporting notification procedures, eligible institutions may provide permitted services in other EEA Member States without obtaining a separate full authorisation in each destination country.

  Certain smaller payment institutions, electronic money institutions and account information service providers may qualify for alternative registration or exemption regimes under the applicable statutory conditions.

  The availability of cross-border passporting rights depends on the type of authorisation or registration held. Nationally restricted or exempted institutions do not automatically benefit from full EEA passporting rights.

• The original Payment Services Directive (PSD1) established harmonised rules concerning payment transactions, transparency, execution times, liability and consumer protection.

  PSD2 subsequently strengthened these protections and introduced additional requirements, including Strong Customer Authentication (SCA) for qualifying payment account access and electronic payment transactions.

  Under Article 97 of PSD2, payment service providers must apply SCA in circumstances prescribed by the legislation, subject to the exemptions established by the applicable regulatory technical standards.

  SCA generally requires authentication based on at least two independent elements from the categories of knowledge, possession and inherence.

  For qualifying remote electronic payment transactions, authentication must also include dynamic linking to the transaction amount and the intended payee.

  Commission Delegated Regulation (EU) 2018/389 establishes detailed requirements concerning SCA, permitted exemptions and secure communication.

  The requirements do not mean that every payment must be authenticated using the same procedure or that every transaction must involve an additional verification step.

  Applicable exemptions may include certain low-value transactions, recurring payments and transactions meeting specified risk-based conditions.

  SCA reduces payment fraud risks but does not guarantee that all unauthorised or fraudulent transactions will be prevented. The payment service providers were to implement the needed security measures for protecting customers’ data and information on all transactions, including SCA methods for online transactions.

• PSD defined the relevant rights and responsibilities of payment service users and payment service providers with regard to respective obligations concerning dispute resolution and liability.

Strong points of the PSD2:

• PSD2 extends the scope of payment services against the backdrop of the emergence of new types of payment services, like mobile payments and currencies, and brings them into the scope of regulation.
• PSD2 allows licensed third-party providers, including AISPs and PISPs, with the customer’s explicit consent, to access customer account information. This encourages open banking and the creation of new financial services.

Regulatory Technical Standards: The EBA drafted the demands for those special aspects of PSD2, including SCA and secure communication between TPPs and banks. The PSD2 requires that payment service providers should monitor fraudulent activities occurring in transactions and report them to the authorities.

Payment Institutions and Electronic Money Institutions are subject to applicable European Union and national anti-money laundering and counter-terrorist financing (AML/CFT) legislation.

Referring collectively to compliance with the “1st–6th Anti-Money Laundering Directives” is insufficient to identify the actual legal requirements applicable to a payment institution in 2026.

• Customer Due Diligence: To undertake customer due diligence and, where necessary, enhanced customer due diligence, the licensees of PSD2 should have the identification and verification of customers. Reporting suspicious transactions is also included in their work.
• It’s also essential to maintain accurate records of customer transactions and communications for a minimum period of at least five years after the end of a business relationship or after the completion of a transaction.
• Identifying and monitoring politically exposed persons (PEPs) is a must for every PSD2 licensee.
• The employees have to be given training and awareness programs on how to identify suspicious activities and report them by the PSD2 license holder.
• Identifying and managing the risks of money laundering and terrorist financing within the licensed operations is equally important and has to be done continuously.

Best Available Jurisdictions for a PSD2 License

Among all countries, Lithuania has become a very attractive destination for payment service providers to obtain a PSD2 license within the EU. During the period 2017-2021, the Bank of Lithuania – the regulator of the Lithuanian financial industry – had issued the largest number of fintech licenses compared to other EU countries. Today, it continues to rank first in serving innovative businesses with its modern business infrastructure, talented and multilingual manpower, streamlined process of setting up a business and licensing, and competitive regulatory fees. Lithuania regulates Payment Institutions and Electronic Money Institutions through the Bank of Lithuania (Lietuvos bankas).

The minimum initial capital requirements depend on the authorisation category and services to be provided.

Payment Institution (PI):

EUR 20,000: For institutions providing only money remittance services.

EUR 50,000: For institutions providing only payment initiation services.

EUR 125,000: For institutions providing payment services such as cash deposits and withdrawals, execution of credit transfers, direct debits and card-based payment transactions.

Electronic Money Institution (EMI):

– EUR 350,000: Minimum initial capital for an institution holding an unrestricted EMI licence.

In addition to initial capital, payment institutions must maintain sufficient own funds calculated under the applicable statutory methodology.

Electronic money institutions must also satisfy ongoing own funds requirements, including requirements based on the average outstanding electronic money.

Lithuania also provides restricted activity authorisation frameworks for qualifying institutions, subject to specific limitations. Such authorisations do not provide the same EEA passporting rights as unrestricted licences.

According to the Bank of Lithuania’s published licensing information, the state application fee is EUR 898 for an ordinary Payment Institution licence and EUR 1,463 for an unrestricted Electronic Money Institution licence.

These fees are separate from legal, corporate, operational, technology and compliance preparation expenses.

A minimum capital range of EUR 20,000–25,000 should therefore not be presented as sufficient for every Lithuanian payment or electronic money institution.

The Netherlands has also been very open-handed with regard to fintech licenses, including PSD2 licenses. Just as much as it tries to focus on the stability, integrity, and safety of the Dutch financial system, the Dutch Central Bank, being the regulator for financial institutions, tries to stimulate innovative business. Within the context of the financial crisis, it is important to mention that the industry of financial services in the Netherlands is exceptionally resilient and highly developed; hence, it provides a really alluring international financial hub with such a strong economy, strategic location, and open business culture. In the Netherlands, Payment Institutions and Electronic Money Institutions are authorised and supervised by De Nederlandsche Bank (DNB), subject to the applicable allocation of regulatory responsibilities.

The initial capital requirements depend on the institution’s regulated activities.

Under the applicable European framework:

Payment Institutions providing money remittance services generally require at least EUR 20,000 in initial capital.

Payment Institutions providing only payment initiation services generally require at least EUR 50,000.

Payment Institutions providing other specified payment services, including execution of payment transactions, generally require at least EUR 125,000.

Electronic Money Institutions generally require minimum initial capital of EUR 350,000.

The actual ongoing own funds requirement may exceed the initial capital requirement, depending on the institution’s business volume and the applicable prudential calculation method.

Applicants must also demonstrate suitable governance, appropriate management, financial resources, internal controls, safeguarding arrangements, AML/CFT compliance and operational resilience.

Licensing and supervisory charges are determined under the applicable Dutch statutory fee framework and may vary according to the application category and the regulatory work involved.

A fixed application fee of EUR 5,000–10,000 should therefore not be presented as universally applicable without confirming the current tariff for the specific authorisation. The precise figures are naturally going to differ depending on the specifics of your business.

Estonia offers a regulated environment for payment and electronic money institutions, supported by digital corporate administration and established financial services legislation.

The competent authority responsible for authorising Payment Institutions and Electronic Money Institutions is the Estonian Financial Supervision and Resolution Authority (Finantsinspektsioon).

Applicants must comply with the Estonian Payment Institutions and E-money Institutions Act (Makseasutuste ja e-raha asutuste seadus) and applicable European Union legislation.

The licensing process involves an assessment of the proposed business model, shareholders, management, capital, safeguarding arrangements, governance, AML/CFT procedures and operational infrastructure.

Estonia’s digital public services may facilitate company administration and electronic communication, but they do not establish a statutory fast-track licensing procedure.

According to Finantsinspektsioon, the regulator must generally decide whether to grant or refuse authorisation within three months after receiving all required compliant documentation and information, but no later than six months after receiving the original application.

The actual preparation period depends on the applicant’s business model, readiness and the completeness of its documentation.

Applicants should therefore not assume that Estonia provides guaranteed accelerated authorisation. With the advanced e-government infrastructure and pervasiveness of digital identity in Estonia, it is easy to comply with the requirements of SCA. The country, with considerable benefits accruing from that position, has emerged as a vibrant fintech hub with a number of fintech startups, innovation centers offering opportunities for networking, collaboration, and sharing of knowledge. In Estonia, the minimum initial capital requirements for payment and electronic money institutions depend on the activities to be authorised.

The principal requirements include:

EUR 20,000: Payment Institutions providing only money remittance services.

EUR 50,000: Payment Institutions providing only payment initiation services.

EUR 125,000: Payment Institutions providing specified payment services such as execution of payment transactions, direct debits and credit transfers.

EUR 350,000: Electronic Money Institutions holding an unrestricted authorisation.

Institutions must also satisfy ongoing own funds requirements, which may exceed the statutory initial capital minimum.

According to the official information published by Finantsinspektsioon and updated on 18 March 2026, the application processing fee for a Payment Institution licence is EUR 3,000, rather than EUR 3,300.

The licensing assessment covers the institution’s business plan, funding, ownership, management suitability, financial crime prevention measures, customer fund safeguarding and operational arrangements.

Applicants must also budget for ongoing supervision, personnel, technology, compliance and professional advisory expenses.

Germany is considered one of the most important destinations in the field of financial services, but also one with relatively well-structured legislation and regulations, thus very popular among financial institutions and recipients eager to obtain a PSD2 license. The country has a reputation for financial stability, supporting business environment, and promotion of innovation, therefore generally being attractive for enterprises establishing a business in the payment services industry. Lastly, the Federal Financial Supervisory Authority is committed to protecting Germany’s good name and ensuring that licensees are reputable and act in a trustworthy manner. It heavily depends on the specific business scale, and the decision will be made case by case. In Germany, the minimum initial capital requirement depends on the financial activities covered by the institution’s authorisation.

The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) administers the relevant licensing framework under the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG).

Under the current framework:

Payment Institutions providing only money remittance services generally require at least EUR 20,000 in initial capital.

Payment Institutions providing only payment initiation services generally require at least EUR 50,000.

Payment Institutions providing specified other payment services generally require at least EUR 125,000.

Electronic Money Institutions generally require at least EUR 350,000.

These statutory initial capital amounts must be distinguished from ongoing own funds requirements.

Applications are subject to an assessment of corporate governance, management suitability, ownership, internal controls, safeguarding arrangements, AML/CFT procedures and operational resilience.

BaFin’s licensing fees are determined under the applicable statutory fee schedule and depend on the relevant type of authorisation and administrative procedure.

Therefore, EUR 125,000 should not be described as an average minimum capital requirement for all German payment and electronic money institutions, nor should a general application fee of EUR 5,000–10,000 be assumed for every licensing procedure.

Requirements for Applicants for a PSD2 License

Although the exact requirements may vary from one jurisdiction to another, and we can advise you on this in a personalized consultation, there are several general but equally important legal requirements that are prevalent in most of the EU countries. You will most probably be required to start with establishing a local entity in a jurisdiction where you will apply for a PSD2 license. Usually, you are supposed to select a very specific legal form, such as Private Limited Liability Company in Lithuania, have a local registered office, and possess appropriate minimum capital.

Once you have established an entity, at least the following compliance will be required:

• Show how they apply the SCA to reduce the fraud risk
• Show firm’s AML/CFT policies and procedures to prevent financial crime effectively
• If one intends to hold customer funds, prove appropriate safeguarding arrangements such that the customer funds can be protected once the firm becomes insolvent
• Internal control systems and risk management procedures for operational and financial stability
• Demonstrate the capability to keep records and report specific financial and operational information to the supervisory authority
• Ensure appropriate security measures and IT infrastructure cover customer data protection, secure payment transactions, and cybersecurity

In general, as an applicant for a PSD2 license, you would have to submit a number of documents which are as follows:

• Company Incorporation Certificate
• Memorandum of Association
• A fully written business plan that details the nature and scope of the proposed payment services, including type of transactions and customers served
• Financial statements: including balance sheets, income statements, and cash flow statements
• Evidence that the application fee has been paid
• A business continuity plan describing how your company will manage and recover from a disruption such as system failure or cyber-attack
• Corporate structure of the firm, including ownership structure, board of directors, and key personnel
• Evidence of internal AML/CFT policies and procedures
• Full risk management framework, including identifying and mitigating operational and compliance risks
• * Professional Indemnity Insurance or Comparable Guarantee: Evidence of professional indemnity insurance or an equivalent guarantee is required for applicants providing payment initiation services and for providers offering account information services, in accordance with Articles 5(2), 5(3) and 33 of PSD2 and the applicable regulatory technical standards and guidelines.

  The amount and territorial coverage must satisfy the applicable regulatory requirements, taking into account the nature and scale of the services provided.

  Professional indemnity insurance is not a universal licensing requirement for every Payment Institution or Electronic Money Institution.

  For institutions providing other regulated services, the applicant must demonstrate the appropriate capital, own funds, safeguarding and operational risk management arrangements applicable to its business model.

• CVs of firm directors and other key people, together with evidence of their financial qualifications and relevant experience
• Copies of the passports of key personnel and shareholders

How to Apply for a PSD2 License?

The application process may take anything from three months up to a year, depending on your chosen jurisdiction, the quality of your application, and also the responsiveness of regulatory authorities. The specific application stages and milestones are also different, although there are certain general steps you will have to go through almost in any jurisdiction.

Following are the major steps towards applying for a PSD2 license:

Ongoing Requirements for PSD2 License Holders

From the moment you become a license holder under PSD2, there are scores of requirements and standards to observe. Our continued support will make you confident that your payment services company will at all times stay compliant with the ever-changing regulatory framework of the EU and relevant national regulations, an important factor in avoiding associated risks and ensuring uninterrupted operations.

For the purpose of this text, know that holding a PSD2 license comes with other obligations, such as:

• * Regulatory Reporting and Digital Operational Resilience: Payment Institutions, Electronic Money Institutions and other relevant payment service providers must comply with applicable prudential, financial, operational and payment fraud reporting obligations.

  Since 17 January 2025, Regulation (EU) 2022/2554 on Digital Operational Resilience (DORA) has established harmonised requirements for ICT risk management, operational resilience testing, ICT third-party risk management and reporting of major ICT-related incidents for financial entities within its scope.

  On 17 January 2025, the European Banking Authority repealed its previous Guidelines on major incident reporting under PSD2 because the relevant ICT incident reporting obligations had been superseded by DORA.

  Institutions must also maintain appropriate security and fraud prevention controls, including Strong Customer Authentication where applicable under PSD2.

  Periodic financial, prudential and statistical reporting obligations remain subject to the relevant EU and national legislation.

  Compliance policies and regulatory reporting procedures should distinguish between requirements under PSD2, DORA, AML/CFT legislation and other applicable rules.

• Respecting the GDPR and national legislations on protection of personal data
• Implementing safeguarding measures in case of insolvency, related to customer funds
• Continuously monitor and enforce internal control in pursuance of the appropriate functioning of your payment services and conformity to regulatory standards

If you need a PSD2 license, the team of professionals here at Regulated United Europe will be glad to support you with the establishment of a company and
the licensing process
in an EU jurisdiction that would suit your business needs. Our legal team may also assist clients considering the acquisition of an existing authorised Payment Institution or Electronic Money Institution in the European Union.

However, a financial services authorisation is granted to a specific legal entity and cannot be treated as an independently transferable asset automatically included with the purchase of a company.

The acquisition of a licensed payment or electronic money institution may require prior notification to, or approval by, the competent supervisory authority, particularly where the transaction involves acquiring or increasing a qualifying holding or changing control of the institution.

The regulatory assessment may include the proposed shareholders’ fitness and propriety, financial soundness, source of funds, corporate governance, business model and the institution’s ability to maintain compliance after the transaction.

Changes to management, regulated activities, outsourcing arrangements or operational structures may also trigger additional regulatory procedures.

Before proceeding with an acquisition, investors should conduct comprehensive legal, financial and regulatory due diligence covering the institution’s authorisation, permitted services, supervisory history, capital position, customer liabilities, safeguarding arrangements and outstanding compliance obligations.

Purchasing an authorised company does not guarantee unrestricted continuation of its licence or approval of the proposed ownership changes. With experienced lawyers, business development professionals, and financial accountants by your side, you will find the processes of a PSD2 business start-up to be easy, seamless, and transparent. Contact us now to arrange for a personalized consultation and set the stage to create sustainable success.