Payment and Banking Licences by Jurisdiction: A Map of Regimes

When to Get a Licence — and When to Rent One

Not every product needs its own financial licence. While volumes are small, it is faster and cheaper to operate under someone else's regulation — as an agent, white-label, or on top of a BaaS provider; how that market works is set out in Licence for Rent and in the guide to BaaS and sponsor banks. An own licence becomes justified when the rental economics stop working, when the licensed partner constrains the product or its geography, and when counterparties need the regulated status to sit on the operator's own company.

This map is for the second scenario and for payment products: sixteen payment regimes and twelve banking licences, compared on regulator and act, capital, published timeline, safeguarding model, passport and territory, agent model, crypto overlay and reporting. The general logic of choosing, obtaining and maintaining a licence is in the financial licences hub; brokerage and asset-management licences are compared separately on the investment firm licence map. After the matrix come sections on Canada, Singapore, Hong Kong, Luxembourg and Dominica, the banking grid and the position of founders with Russian UBOs.

The Matrix: Sixteen Payment Regimes

Capital and timeline are separate questions, and so are the right to hold client money and the duty to protect it. The grid is therefore split into three tables over the same sixteen regimes: entry conditions, protection of money and territory, and the crypto overlay and reporting.

Entry conditions

The first table answers what entry costs and when the regulator decides: the capital in the act is the floor, and the timeline is what the regulator itself publishes.

Protection of money and territory

The second table covers what happens to client money, where the licence works and whether an agent route exists.

Crypto overlay and reporting

The third table shows what comes on top once the licence is granted: a separate permission for crypto services and the reporting cycle.

The European rows describe PSD2 and EMD2 as they stand. Their replacement is agreed but not adopted: on 5 October 2026 the PSD3 and PSR procedure stood in OEIL at "Awaiting Council's 1st reading position", with the plenary vote indicatively set for 14 December 2026, and the agreed text gives existing PIs and EMIs up to 27 months after entry into force to transition — see PSD3 and PSR.

What the grid actually decides

Capital is the smallest of the three numbers that matter. Several regimes have no statutory capital floor at all — Hong Kong's MSO, the Canadian MSB and PSP, the US federal MSB registration — yet none of them is cheap, because the money is tied up elsewhere. Canada takes it as a daily per-user ledger and a triennial independent safeguarding review. The United States takes it as a surety bond and net worth in each of forty-nine states. The headline figure comes closest to the real entry cost in the EU and the UK, where €350K buys an EMI and the rest of the requirement arrives through the own-funds method, explained in regulatory capital.

Timelines diverge from the statute more sharply than capital does, and the divergence is measurable because two regulators publish it. The UK statute gives the FCA three months from a complete application; the median case closed in Q1 2026/27 ran 219 days, the upper quartile 268. Ireland's published service standard is met in full — 90% of assessment phases inside 90 business days — while the average calendar time from application to authorisation in 2025 was 763 days, with the fastest case at 497. Both statements are true at once, because the standard measures a phase and the calendar measures a file. Lithuania promises three months from proper documents and says in the same breath that documents are almost never free of deficiencies. The other regulators on the grid — from Malta and Cyprus to Singapore, Hong Kong, the UAE, the AIFC and Switzerland — publish neither a target nor case statistics.

Safeguarding changes the answer most, although it is usually the last thing considered when choosing a jurisdiction. Four structures are in use, and they behave differently in an insolvency: segregation with a statutory pool and user priority (the EU and the UK), a trust (Hong Kong's SVF, the first Canadian option under s.20), insurance or a third-party guarantee (the second PSD2 method, the second Canadian option, the UAE alternative), and permissible investments held in trust by state statute (the United States). Two regimes protect nothing: Hong Kong's MSO creates no duty to segregate customer money, and the Swiss fintech licence states outright that on bankruptcy client assets are neither privileged nor covered by depositor protection. What each structure actually delivers to a client is set out on the client asset protection map.

The remaining three dimensions decide the shape of the company and barely touch the price. A passport exists in exactly one place: an EMI or PI authorisation in any EEA state reaches the other twenty-nine by notification, and nothing else on the grid travels — the UK lost it in 2020 and no equivalence replaced it. An agent model exists where the regulator deliberately offers a fast entry under someone else's liability: the EU and the UK register agents in days, while Singapore and Hong Kong have no such route, so a white-label partner there is a commercial arrangement inside the licensee's own perimeter. Crypto services need a separate permission almost everywhere: MiCA's CASP in the EU, VATP with the SFC in Hong Kong, DTSP for outbound Singapore services, state overlays in the United States, and in the United Kingdom a new FSMA regime for which the FCA accepts applications from 30 September 2026 to 28 February 2027 and which applies from 25 October 2027.

Choosing by product

The licence follows the product, and five products cover most of the practical range.

Individual jurisdictions are covered in more depth: US MSB and MTLs — FinCEN plus the state map; the UK — FCA EMI/PI, the safeguarding reform and the FSMA crypto regime; Lithuania — EMI/PI and the specialised bank; Bulgaria — EMI/PI under the BNB, with a presence test written into the statute, while CASPs there are licensed by the FSC (Bulgarian CASP licence); the two Eastern European options are compared in EMI: Lithuania or Bulgaria; Switzerland — the 1b licence and the DLT Act; the UAE — five regulators and their perimeters; Kazakhstan — AFSA, the National Bank and Alatau City.

The crypto column of this grid only signals that a second permission is needed: the token leg carries its own regulator, its own capital and its own custody rules in each jurisdiction. Those regimes — the MiCA CASP, Dubai's VARA, the ADGM FSRA, the DFSA, the SFC's VATP, MAS DPT and DTSP, the US state regimes, the FCA, FINMA and the AIFC — are compared on capital, published fees, custody and segregation, substance, retail access and the travel rule in the map of crypto licences; second-league offshore options are covered in offshore crypto licences.

Canada: MSB/FMSB + PSP

Canada is no longer the land of the "light MSB registration." A payment product here lives in a dual perimeter: MSB/FMSB with FINTRAC covers AML/CFT — who moves the money, where funds come from, what to report — while PSP registration with the Bank of Canada under the Retail Payment Activities Act covers operational risk and safeguarding of client funds; the statute itself is covered in RPAA. A foreign company falls under the FMSB regime if it effectively directs services at Canadian clients: no office in Canada is required. MSB registration is free with no minimum capital, but that does not make entry fast: a product that holds end-user funds also needs PSP registration, and the queue at the Bank of Canada is measured in months.

RPAA and the 2026 tightening

The RPAA has been in full force since 8 September 2025: safeguarding via a trust account or segregation plus insurance, an operational risk management system, an annual report, and a public PSP registry — on 6 October 2026 it showed 1,712 registered and 427 applications in review. The screening is real: the Bank has refused 57 applications and revoked 15 registrations, and 225 applications from the November 2024 window are still awaiting a decision — almost two years on. In spring 2026 the PCMLTFA amendments (Royal Assent 26 March 2026) sharply raised penalties — up to C$20M or 3% of gross global revenue for companies.

An MSB registration brings no OSFI banking licence, no CDIC insurance and no direct access to Payments Canada — without a bank partner the product will not move, and finding one is a separate problem covered in banking for MSBs. For crypto, add virtual currency dealer status, provincial securities, custody and the Travel Rule (since June 2021 for transfers of C$1,000 and above).

Singapore: PSA — SPI, MPI, e-⁠money and DPT

The Payment Services Act 2019 covers seven services with a single licence: account issuance, domestic and cross-border transfers, merchant acquiring, e-money issuance, digital payment token operations and currency exchange. The class is set by volume: SPI holds as long as turnover stays under S$3M per month per service (S$6M for two or more, average daily e-money float up to S$5M) with S$100K base capital; MPI operates without limits with S$250K capital and a security deposit of S$100–200K with MAS. The narrow Money-Changing Licence covers only cash currency exchange. The thresholds, section 23 safeguarding and the MAS register numbers are unpacked in the guide to Singapore's PSA payment licences.

A launch requires a Singapore company with a permanent place of business, at least one resident director, an appointed AML/CFT officer and fit-and-proper clearance for controllers and management. MAS publishes no target for determining applications. There is no agent entry as in the EU: either an own licence, or white-label on top of a licensed MPI, with responsibility to MAS resting on the licence holder.

Crypto: DPT at home and DTSP outbound

Crypto within Singapore is a DPT service under the PSA and needs no separate licence. Token services from Singapore to clients outside it require a DTSP licence under Part 9 of FSMA 2022 from 30 June 2025 (S$250K capital, S$10K annual fee, a compliance officer on the island), and MAS grants these only in exceptional cases. The retail segment is tightly restricted: mandatory segregation of client assets, no leverage or referral incentives. MAS rules for single-currency stablecoins (100% reserves, redemption at par within five business days) were finalised in August 2023, and on 1 September 2026 MAS put PSA amendments for a full stablecoin regime out to consultation — compared with the neighbours in Asian stablecoin regimes.

Hong Kong: MSO, SVF, VATP and Stablecoins

Hong Kong splits its licences along one question: does the firm hold the client's money.

MSO

An MSO (Customs and Excise Department, AMLO Cap. 615) is the licence for money changing and remittance without holding balances: no formal capital minimum (the regulator checks "sufficient resources"), a real office and an AML officer as director are required, and the licence runs 2 years with mandatory renewal; see the MSO licence. Exchanging virtual assets for money is outside the MSO perimeter: the licence covers only the cash leg of an OTC trade, while the crypto side is virtual asset dealing, for which a licensing bill is expected in Q4 2026; how that regime will work is covered in virtual asset dealing and custody. Operating without an MSO licence is a criminal offence: on conviction on indictment, up to a HK$1M fine and 2 years' imprisonment.

SVF

An SVF (HKMA, Cap. 584) is needed the moment a client stores a balance with the issuer: wallets, prepaid cards, B2B programmes with real monetary value. The bar is bank-grade: paid-up capital from HK$25M, maintained continuously and scaling with the float, a CEO and CRO approved by the HKMA, and trust-based float protection. The register is narrow — 11 non-bank licensees on the HKMA register on 5 October 2026, among them Octopus, Alipay HK, WeChat Pay HK, PayPal HK, HKT Payment and UniCard Solution Limited (SVF0009); the regime is covered in the SVF licence.

VATP and stablecoins

A crypto exchange is licensed by the SFC as a VATP — mandatory since June 2023. Issuance of fiat-referenced stablecoins has been licensed by the HKMA under the Stablecoins Ordinance since 1 August 2025 at the same HK$25M capital threshold: the first two licences went to HSBC and Anchorpoint Financial on 10 April 2026, and of the 36 first-round applications only those two have succeeded — see the Stablecoins Ordinance. Asset management (Type 9) and the other SFC activities sit outside the payments map: responsible officer and capital requirements are covered in SFC licensing, and the comparison with Singapore's CMS in a separate analysis.

Luxembourg: PI, EMI and CASP Under One Regulator

In Luxembourg payment, e-money and crypto licences are all granted by one regulator, the CSSF. A PI under PSD2 requires €20–125K of capital depending on services; an EMI under EMD2 requires €350K, paid into an account with a Luxembourg bank. The CSSF's main attention goes to substance: real presence, local management, dedicated compliance and AML functions (what regulators treat as presence is covered in licensee substance). Any licence passports to 30 EEA countries by notification. The EMI regime is covered in detail in Luxembourg: EMI and payment licence (CSSF).

MiCA CASP and the EMI pairing

A MiCA CASP is the single crypto licence with an EU-wide passport; in Luxembourg it is issued by the same CSSF, and the regulation as a whole is covered in MiCA. Capital by class: €50K (advice, reception-transmission and execution of orders), €125K (plus custody and exchange), €150K (trading platform); with several classes the highest threshold applies.

The fixed-overheads test runs alongside it from the first day of services. The CASP must hold the higher of that figure and a quarter of the preceding year's fixed overheads; until it has been providing services for a full year, it uses the projected fixed overheads for its first 12 months of service provision, as submitted with the licence application (MiCA Art. 67(1)–(2)).

The formal Article 63 clock is 25 working days for completeness and 40 for a decision, but the CSSF expects a preliminary presentation meeting, so in practice the process runs longer; the procedure, budget and choice of jurisdiction are set out in the guide to the MiCA CASP licence. The transitional period for VASPs operating under national registrations ended on 1 July 2026 at the latest. Crypto services in the EU are now provided only by CASPs and by institutions that have notified their regulator under MiCA Art. 60 — credit institutions, investment firms, EMIs and certain other supervised entities; a third-country firm may serve an EU client only at that client's own exclusive initiative (Art. 61). Each Member State sets the maximum fine for such breaches itself, but at no less than €5M or 5% of annual turnover (MiCA Art. 111(3)).

Luxembourg's strength is the pairing. Under MiCA a stablecoin referencing a single official currency is an e-money token (referencing a basket of currencies or assets makes it an asset-referenced token), and only a credit institution or an EMI may issue an EMT. An issuer therefore needs an EMI licence, plus a CASP for trading and custody of the tokens, and holding both under one regulator is simpler; EMT and ART issuance is covered in token issuance under MiCA. Ripple, for example, received a full EMI licence from the CSSF on 2 February 2026.

Dominica: Offshore Banking Licence (FSU)

The most unusual regime on this map is a full banking licence under the Offshore Banking Act No. 8 of 1996, supervised by the Financial Services Unit at the Ministry of Finance. The regime covers banking in currencies other than the East Caribbean dollar, for non-residents: deposits, cards, lending, custody. Minimum paid-up capital is US$1M in liquid form at the start, but the real project budget is noticeably higher: compliance team, IT, audit, correspondent relationships. For comparison: the CRD sets minimum initial capital for an EU bank at €5 million, while real authorisations are capitalised at €20–50 million and above, because the ECB tests own funds against the losses of the first three business-plan years; the dual national-regulator-then-ECB procedure runs 12–24 months, as the ECB route sets out.

The bottleneck is the bank's ability to move payments: international transfer chains from Dominica pass through heightened compliance scrutiny at receiving banks in the EU, Hong Kong and Singapore. There is no deposit insurance; Dominica participates in CRS, and a FATCA Model 1 IGA applies with the US. Banks operating in this regime include EQIBank and Nodabank; their products and terms are covered in Dominica offshore banks.

Bank Licences Side by Side

The sixteen regimes in the matrix stop short of deposit-taking. When a product needs deposits, lending on its own balance sheet or a deposit guarantee for its clients, the choice moves to banking licences, and those differ by an order of magnitude in capital and in where the licence works. Lending without deposit-taking is licensed separately: the regimes for non-bank lenders are compared in lending licences by jurisdiction.

The first table is the price of entry: regulator, initial capital and the clock set by statute or published by the regulator.

The second table is what the licence gives a depositor and where it works.

The grid splits into three groups. The EU, the UK, the United States and Switzerland sell the full package — deposit guarantee, access to the central bank and the right to lend — and charge for it in capital that nobody publishes as a single figure: the ECB tests own funds against three years of planned losses, which puts real projects at €20–50m against a €5m floor, the OCC and FDIC set capital case by case, and the Bank of England's new bank unit authorises with restrictions first, letting a new bank take no more than £50,000 of deposits during a mobilisation of up to twelve months. Of the four, only an EU licence travels: it passports across the EEA, while a Swiss, UK or US bank serves its own market and reaches Europe only through a separately licensed subsidiary.

The second group is the non-resident bank. A Puerto Rico IFE and a Dominican offshore bank are both barred from serving local residents and both come without deposit insurance; the difference is the dollar. An IFE sits inside the US system and may apply for a Federal Reserve account, and since the 2024 reform it costs US$10m of paid-in capital and eight people on the island. The Dominican licence costs US$1m and settles through correspondents, which is where its real constraint lies. The third group — Georgia, the UAE and Kazakhstan — are domestic licences: a Georgian digital bank goes through the ordinary prudential regime on a staged timetable, the UAE has effectively stopped issuing universal licences, and Kazakhstan's 2026 banking law introduced a basic licence with lower capital, while the fastest entry there has been buying an existing bank.

For a founder with a Russian ultimate owner, a banking licence is the hardest entry on the grid. The qualifying-holding review in the EU, the UK, the US and Switzerland looks at the origin of capital and the sanctions exposure of every owner — how it works is set out in qualifying holdings and fit and proper, and buying an existing licensee triggers the same review as a change of control. In addition, Article 5b(1) of Regulation (EU) No 833/2014 bars an EU bank from accepting deposits above €100,000 from Russian nationals and residents, so a business plan built on Russian-speaking clients resident in Russia does not work in the EU at all. Non-resident banks are not open by default either: Dominican banks depend on their correspondents, and IFE correspondents apply the full set of OFAC checks. That leaves Georgia and Kazakhstan, where the regulator reviews owners under its own rules, while access to the dollar and the euro still depends on correspondent compliance.

How to Choose

Does the product hold client money

For transfers or FX without balances, the light regimes suffice: Canada's MSB/FMSB and Hong Kong's MSO run without a formal capital minimum. The moment a client stores a balance — wallet, prepaid, float — the perimeter changes: Singapore MPI (S$250K), Luxembourg EMI (€350K), Hong Kong SVF (HK$25M) or Canadian PSP registration with safeguarding.

Client geography

A licence from any EEA state passports to 30 countries by notification: one application covers the whole European market, with the mechanics set out in the EEA passport. Singapore, Hong Kong and Canadian licences are point solutions — they cover their own market and demand local substance: a Singapore company with a resident director, a real office and an AML officer in Hong Kong. Canada's FMSB is the entry exception: it reaches Canadian clients without an office in the country.

The crypto component

In the EU after 1 July 2026 crypto services are provided only by CASPs and by institutions that have notified their regulator under MiCA Art. 60, and an issuer of a stablecoin in the form of an EMT needs an EMI or bank licence, with a CASP added for trading and custody of the tokens. In Hong Kong an MSO covers only the cash leg of an OTC trade, and crypto dealing awaits its own regime; an exchange operates under VATP, stablecoin issuance under the HKMA. In Singapore domestic DPT services sit inside the PSA, while outbound services (DTSP) are licensed by MAS only in exceptional cases. In the United Kingdom crypto services need a standalone FSMA authorisation, which a payments permission does not extend to: the FCA accepts applications from 30 September 2026 to 28 February 2027, the regime applies from 25 October 2027, and a qualifying stablecoin is expressly not electronic money, so an issuer that also wants to issue e-money needs both permissions.

Budget and horizon

The range is wide: from a free MSB registration to an SVF with HK$25M of capital or a banking licence from US$1M in Dominica. The horizon is best read from what the regulator publishes, because the statute is a poor guide: three months in the UK regulations against a 219-day median, a met 90-business-day service standard in Ireland against an average file of 763 days, a free Canadian registration against 225 PSP applications awaiting a decision since November 2024. Capital and timeline are only part of the bill: what owning a licence costs after it is granted is set out in licence total cost of ownership. When the economics do not close at these numbers, renting is the rational choice: an agent scheme, white-label or BaaS.

Popular, but Ends Badly

A few practices appear in projects constantly and break just as regularly — usually on a rule change or at the first inspection.

Founders with Russian UBOs

None of the payment regimes on the grid bars an applicant or its ultimate owner by nationality. The filter sits in the fit-and-proper test and the qualifying-holding procedure, where the regulator looks at reputation, origin of capital and sanctions lists, and in the onboarding at the bank that will hold the safeguarding account itself. The exception is crypto services in the EU: Article 5b(2a) of Council Regulation (EU) No 833/2014 bars Russian nationals and residents from owning, controlling or sitting on the governing bodies of an EU company providing crypto-asset wallet, account or custody services (since 18 January 2024), and from 25 August 2026 any crypto-asset services under MiCA.

Beyond that, the main EU restriction concerns the client base. Article 5b(2) of the same Regulation, as in force since 24 October 2025, bars crypto-asset services, issuing payment instruments, acquiring, payment initiation services and e-money issuance for Russian nationals, natural persons residing in Russia, and legal persons established in Russia. Article 5b(3) lifts these prohibitions for nationals of an EU or EEA state or Switzerland and for holders of a temporary or permanent residence permit there (consolidated text of the Regulation). In other words, an EEA EMI can be obtained, but serving retail clients without a European status from it is prohibited — and this usually breaks the business model before the regulator ever refuses the licence.

The second restriction concerns corporate services around the application itself. Article 5n of the same Regulation bars legal advisory, accounting, auditing, tax and business consulting services to legal persons established in Russia, and Article 5m bars registering or managing trusts whose settlor or beneficiary is a Russian national, resident or Russian company. In practice an application cannot be assembled by European advisers for a Russian legal entity: a holding structure outside Russia comes first (approaches are covered in sanctions-resilient structures), and only then the work with the regulator.

Practice differs across the three destinations that review applicants with Russian UBOs under general rules. In the AIFC the AFSA money services rules have applied since 13.10.2025, fees are published, and English-law procedure in a Russian-speaking environment reduces onboarding friction. The UAE offers three different regulators — the CBUAE onshore, the FSRA in ADGM, the DFSA in DIFC — and all three look at the source of capital and at the bank it came through; the bottleneck there is a settlement account for capital and float. Hong Kong is formally open: an MSO requires no capital and ignores nationality, but it requires a real office and an AML officer as director and gives client money no protection at all.

On profit distributions to an owner resident in Russia for tax purposes, Decree of the President of the Russian Federation No. 585 of 8 August 2023 suspended key provisions of the double tax treaties with most European states, so withholding tax applies without treaty relief there, while the treaties with Kazakhstan and the UAE continue to apply. The licence jurisdiction and the holding country are therefore chosen as one decision.