When a large fintech enters the European Union, it almost always chooses between three doors: fast and cheap Lithuania, the Irish hub with Stripe and Payoneer — and Luxembourg. Luxembourg is more expensive and slower than both, yet the heaviest players come here. Here is what the local regulator grants and why the 'premium' licence often beats the fast one.
What the CSSF grants
The regulator is the Commission de Surveillance du Secteur Financier (CSSF). The menu is the standard EU one: a neobank (PI) under PSD2 — transfers, acquiring, open banking — with initial capital of €20k, €50k or €125k depending on the services; the e-money licence (neobank) under EMD2, which adds the right to issue electronic money on top of everything a PI may do, at €350k; and AISP registration for account-information services. Any of these passports across all 30 EEA states: one regulator, thirty markets.
Timing and cost are not Lithuanian: the application runs about €30k and the process takes 6 to 12 months, and the CSSF is known for its thoroughness. But that thoroughness is the product: a CSSF licence and a Luxembourg bank account raise no questions with correspondents and counterparties.
What it takes to qualify
The CSSF authorises only a Luxembourg public limited company — a société anonyme — with its head office and central administration in the country: real premises, real staff, not a brass plate. Capital is the visible part. A neobank needs €20k, €50k or €125k of initial capital depending on the services it runs; an neobank needs €350k, paid up in cash at a local credit institution. Beyond that floor, own funds scale with the activity — an e-money issuer holds capital against roughly 2% of the electronic money in circulation, so the balance sheet grows with the float. Firms that would rather not carry any of this rent capacity from a licensed institution through banking-as-a-service; the names in this article want the licence itself.
Client money must stay separate from the firm's own. Funds taken in for payment services or held against issued e-money have to be safeguarded — ring-fenced in a segregated account at a credit institution, or covered by an insurance policy — so that the failure of the institution never reaches customer balances. Governance is checked just as closely: the CSSF expects two resident executive directors, a local compliance and risk function, independent internal audit and a documented three-lines-of-defence model, held to the same AML and CFT standard the country applies to its banks.
Why Luxembourg specifically
Lithuania wins on speed and price, Ireland on its English-speaking environment and large players such as Stripe. Luxembourg wins on institutional trust. It is a financial centre with Europe's largest fund industry, depositaries, private banks and a reputation built over decades. For an issuer that needs to be accepted by tier-1 banks and institutional partners, that is decisive.
After Brexit, Luxembourg deliberately assembled a payments hub: firms losing their UK passport moved their European subsidiaries here. The CSSF turned from a largely fund-focused regulator into one of the EU's key supervisors of payment and e-money institutions.
Who is based here
The anchor examples are long-standing: PayPal has run from Luxembourg under a full CSSF banking licence since 2007, and Amazon Payments Europe holds an neobank here. Alongside them sit J.P. Morgan Mobility Payments Solution and names familiar in cross-border settlement — LianLian Europe, PingPong Europe, 3S Money Luxembourg and Vivid Money.
The 2026 crypto wave: neobank plus MiCA
In 2026 Luxembourg became the entry point for regulated crypto. Ripple's full EU e-money licence from the CSSF was finalised in early February 2026 — preliminary clearance had come in January — letting it issue its RLUSD stablecoin and run EEA-wide payments from one base. Coinbase had moved first on the trading side: in June 2025 it took a MiCA crypto-asset service provider licence from the CSSF and shifted its European hub from Ireland to Luxembourg. The logic underneath is the same in both cases: a euro- or dollar-pegged stablecoin is an e-money token under MiCA, and only a bank or an authorised neobank may issue one.
So crypto businesses that need a European stablecoin or a regulated wallet come for the 'neobank + CASP under one regulator' combination. A MiCA CASP licence can be standalone or an add-on to an e-money licence, and Luxembourg lets you hold both under one CSSF roof. This is precisely the dual-licensing without which an EMT is illegal in the EU.
The timing tracks the rulebook closely. MiCA's regime for e-money and asset-referenced tokens has applied since 30 June 2024, and the one for crypto-asset service providers since 30 December 2024, with a transitional window for established firms that runs into 2026. Anyone who wants to issue or settle a regulated stablecoin in the EU needs the authorisation in hand before that window closes, which is what turned 2025 and 2026 into a licensing race across the friendlier jurisdictions.
How it fits with funds and a holding company
A payment licence is rarely taken in a vacuum. In Luxembourg it sits naturally next to a holding company (a SOPARFI) or a fund structure: one jurisdiction, one regulator, one expert ecosystem and the same correspondents. An neobank here is part of a broader picture rather than a standalone product.
The framework is still moving. The EU is preparing to replace PSD2 with a Payment Services Directive 3 and a directly applicable Payment Services Regulation, tightening authorisation, fraud liability and open-banking access across the bloc; the package is not yet in force (to be verified as it lands). For the rules as they stand, the primary references are the CSSF and, for the crypto overlay, ESMA's MiCA framework.
How it works in practice
- Scope. We pin down what you actually need: a PI, an neobank, or the neobank + CASP pairing for a stablecoin. This is also where the honest question gets asked — whether you need your own licence at all, or whether renting capacity through banking-as-a-service is the smarter start (see BaaS and neobank).
- Preparing the file. Business plan and financial model, programme of operations, safeguarding arrangements, two resident executive directors, compliance, risk and internal audit functions — the parts the CSSF reads most closely. Initial capital sits here too: €20–125k for a PI, €350k for an neobank, paid up in cash at a local credit institution.
- Filing and dialogue with the CSSF. Rounds of regulator questions, tuning substance, governance and the risk model.
- Result. A CSSF licence, ongoing supervision, and notification-based passporting to the EEA markets you need.
Timeline: the CSSF review runs 6 to 12 months.
Cost: the regulatory reference points are published above — around €30k for the application plus initial capital from €20–125k (PI) to €350k (neobank); we quote our fee after a short scoping call.
Discuss your case — use the form below or telegram.
Q/A
How is an neobank different from a bank?
An neobank may not take deposits or pay interest on them. Client money is safeguarded — ring-fenced in a segregated account at a credit institution or covered by an insurance policy — so protection rests on segregation and full coverage rather than a deposit guarantee scheme. Enough for a payments business; not a place to warehouse reserves.
PI or neobank — which one?
A PI is lighter on capital (€20k, €50k or €125k depending on the services) and covers transfers, acquiring and open banking. An neobank needs €350k but adds the right to issue electronic money — apart from a banking licence, the only route to an e-money token under MiCA.
Why pay for Luxembourg when Lithuania is faster and cheaper?
For institutional trust: a CSSF licence and a Luxembourg bank account raise no questions with correspondents and tier-1 counterparties. And for the stack under one regulator — an neobank or PI, a MiCA CASP, the bank account and a SOPARFI holding, all supervised by the CSSF.
Can you issue a stablecoin with a CASP licence alone?
No. Under MiCA an e-money token may be issued only by a bank or an authorised neobank; a CASP licence covers trading and custody. That is the logic behind the dual set-up: Ripple finalised its CSSF e-money licence in February 2026, while Coinbase runs its European hub from Luxembourg under a MiCA CASP licence.
Sources
Contact information
If you have questions or need a consultation, our experts will be glad to help.