🇪🇺Financial Licences: How to Choose, Obtain and Maintain One

Concept

A financial licence is the state's permission to do specific things with money and assets that do not belong to the company: hold them, transfer them, exchange them, execute orders on them, manage them or lend against them. The regulator licenses the activity; the brand and the corporate form matter far less. The same product can therefore require a different set of permissions in each country, and two firms with similar apps can operate under regimes whose capital requirements differ a hundredfold.

Licensing exists because the client hands over money before receiving the service and, in that interval, has the whole balance at risk. Every regime answers that risk with four recurring requirements:

• own capital able to absorb losses;
• managers and owners whom the regulator has vetted and can remove;
• rules on client assets that hold up in insolvency;
• ongoing supervision through reporting and inspections.

The more control over other people's money a regime allows, the higher each of the four requirements. Three properties follow, and they shape practice.

For the founder of a financial business the licence is both the main asset and the main constraint on the product. For the client of a bank, broker, EMI or crypto platform, the provider's licence shows what happens to the money if the provider fails. Payment infrastructure — accounts, cards, BaaS, stablecoins — is covered in the hub on fintech licences, banking infrastructure and payments.

Detailed answers to the common questions about licences are collected in separate articles.

What is licensed: the product selects the regime

Choosing a licence starts with what the company actually does with client money. Three forks separate the regimes.

The first is whether the company holds value that the client will use later. A payment institution may hold payment accounts, but only for executing payment transactions, and the funds on them are neither deposits nor electronic money (Art. 18(2)–(3) PSD2). A wallet with a stored balance, a prepaid card or a token redeemable on demand is e-money issuance and needs the EMI regime.

The second is whether the company takes risk on its own balance sheet: a broker that only transmits orders and a dealer trading on own account are governed by the same directive, yet their capital differs tenfold. The third is whether the company takes deposits and lends from them: that is bank territory, where requirements are an order of magnitude stricter than anywhere else.

The table below matches each product with the regimes that cover it in the main jurisdictions and with the model for entering without a licence of one's own.

The table implies a simple rule: first describe how money moves through the product, then choose the regime, and only then the country. A project that starts with the country risks ending up with a licence that does not cover part of the product.

Payments and e-money

A payment institution executes payments and holds client funds only for that purpose; an EMI issues electronic money — a claim of the client on the issuer that can be stored and spent. In the EU both licences rest on the same protection principle: client money is kept apart from the company's funds and out of reach of its creditors in insolvency, or covered by insurance or a guarantee (Art. 10 PSD2). This is not deposit insurance. Regimes by country are collected in financial licences by jurisdiction, UK regimes in the FCA authorisation map.

Crypto-assets and stablecoins

Since 30 December 2024 the EU has a single CASP licence under MiCA; the procedure and the choice of country are covered in the CASP licence guide. In the EU the issuer of a stablecoin referencing a single currency must be a credit institution or an EMI (Art. 48 MiCA). In Hong Kong, issuing a fiat-referenced stablecoin has required an HKMA licence since 1 August 2025 (HKMA). In the US the federal regime for payment stablecoin issuers was introduced by the GENIUS Act, Public Law 119-27 of 18 July 2025 (GovInfo). The twelve main crypto-asset regimes are compared in crypto licences by jurisdiction.

Brokers, investment firms and managers

Brokerage and management business is governed by securities law. In the EU that means a MiFID II investment firm with a passport to the whole market; the Cyprus version is covered in the article on the CySEC licence. In the UK it is an FCA investment firm.

In Hong Kong SFC licences are granted by type of regulated activity under Schedule 5 to the SFO: Type 1 dealing in securities, Type 4 advising on securities, Type 9 asset management (SFC). In the US a broker registers as a broker-dealer with the SEC and FINRA, an adviser as an RIA. The choice of country for a fund manager is covered in where the fund manager sits.

Lending, insurance and trust services

From 20 November 2026 consumer lending in the EU follows the new CCD2 directive: creditors and credit intermediaries go through admission, registration and supervision by an independent authority; banks are exempt from admission and registration, as are EMIs for credit linked to their payment services, while payment institutions are exempt only for payments covered by a credit line (PSD2 Annex I, point 4) (Art. 37(2) CCD2). In the UK, lenders offering deferred payment credit (BNPL) have been under FCA regulation since 15 July 2026 (FCA PS26/1). Licensing regimes for non-bank lenders are compared in lending licences by jurisdiction.

Direct insurance and reinsurance in the EU require prior authorisation by the regulator of the head-office state (Art. 14 Solvency II); captives are often placed in cells of Maltese cell companies, and the insurance wrapper for a portfolio is covered in the article on PPLI. Trust and corporate service providers are supervised too: in Singapore every corporate service provider has had to register with ACRA since 9 June 2025 (ACRA). Trust regulators are compared in the trust jurisdictions map, and the family alternative is the private trust company.

Bank

In the EU only a credit institution may take deposits from the public (Art. 9 CRD). In the euro area the banking licence is granted by the ECB through the national regulator — the mechanics are in the article on the EU banking licence; US tracks are covered in the review of bank charter applications and the OCC trust charter. Switzerland offers an intermediate option: the FINMA FinTech licence allows public deposits of up to CHF 100 million, provided they are not invested and no interest is paid (FINMA); details in the article on Swiss fintech licences.

Where to obtain it: jurisdictions

The country of the licence decides three things: which clients the permission reaches, which regulator will supervise the company, and which banks will agree to serve it. The first determines the market, the second speed and predictability, the third whether the business can operate at all. The table sets out the regulators and the territorial reach of the licence.

The table shows that only the EU has a passport: the other licences work within their own territory, and entering neighbouring markets requires a new licence or a partner.

European Union

An authorisation from one EEA state works in all the others by notification — through freedom to provide services or a branch (Art. 34 MiFID II, Art. 28 PSD2); the mechanics are in the article on EU passporting. Capital is harmonised by directives, so countries compete on regulator speed, staff costs, the attitude of banks and tax.

For payments and e-money the traditional choice is Lithuania: according to the EBA central register, 70 EMIs were active there as of 24.09.2026 (EMIs, PIs and specialised banks in Lithuania). Other options are Luxembourg and, since adopting the euro, Bulgaria (Bulgaria's financial licences, EMIs in Lithuania versus Bulgaria). A fund manager need not be licensed itself if it works through a third-party management company.

United Kingdom and Switzerland

A UK authorisation gives no passport into the EEA, and an EU licence gives no access to the UK. Crypto-asset services in the UK become a licensed activity on 25 October 2027 (SI 2026/102); the FCA takes applications from 30 September 2026 to 28 February 2027, and registration under the money laundering regulations (MLRs) does not convert automatically into authorisation (FCA). More in the article on the UK crypto regime and safeguarding. Switzerland is in neither the EEA nor MiCA and keeps its own regimes: the FinTech licence, DLT trading facilities and the FINMA banking licence.

Asia and the Middle East

In Hong Kong the activity determines the regulator: securities and crypto platforms go to the SFC; banks, SVFs and stablecoin issuers to the HKMA; MSOs for remittance and money changing to the Customs and Excise Department. New SFC licences for virtual-asset dealing and custody are being prepared. Singapore keeps everything with MAS: PSA payment licences, the DTSP regime, CMS dealing and financial adviser's licences, fund management and the VCFM class.

On the UAE mainland, Federal Decree-Law No. 6 of 2025 on the Central Bank and financial institutions has applied since 16 September 2025; it does not apply in the financial free zones (CBUAE Rulebook). Virtual assets across Dubai, including the free zones, except the DIFC, are regulated by VARA (VARA); ADGM and the DIFC have their own regulators, and securities on the mainland fall to the SCA — the division is set out in the UAE licence map.

United States and Canada

In the US, FinCEN registration as a money services business is a federal AML registration on Form 107, renewed every two years (FinCEN). The right to transmit money comes from state licences, and operating without a licence where a state requires one is a federal crime (18 U.S.C. § 1960); the levels are covered in the US licence map and the article on MSB and state licences.

Canada is built in a similar way. FINTRAC states expressly that MSB registration is neither a licence nor an endorsement (FINTRAC); payment service providers additionally register with the Bank of Canada under the RPAA (Bank of Canada, RPAA).

Kazakhstan and offshore centres

Kazakhstan offers two venues: the AIFC with its regulator AFSA and English law, and the domestic market supervised by the National Bank and the ARDFM; the crypto-asset regimes of both are compared in the article on Kazakhstan's crypto licences, and their broker licences in the article on the Kazakhstan broker licence. Offshore licences — banking in Dominica (Dominica offshore banks), crypto and investment in the Cayman Islands and the BVI (offshore broker licences) — operate within their own territory.

Cost and timing

Capital in the law and capital in practice

The statutory minimum capital is the smallest of the figures an applicant will have to hold. Above it sit the ongoing own funds formula, which grows with turnover or expenses, deductions from capital and the buffer the regulator expects on top of the minimum. The mechanics are covered in the article on regulatory capital. The entry threshold in the EU looks like this.

Within a single regime the threshold depends on the services: an investment firm that holds no client money and does not deal on own account starts at €75,000, a dealer at €750,000. A narrow list of services in the application therefore makes the licence directly cheaper.

Statutory deadlines and published statistics

Statutory review periods are short, but they run from a complete application, and completeness is decided by the regulator. PSD2 gives three months (Art. 12), MiFID II six months from a complete application (Art. 7(3)), CRD six months from a complete application and no more than twelve from submission (Art. 15), MiCA 25 working days for the completeness check and 40 working days for the assessment (Art. 63).

The UK FCA shows the real picture by publishing the distribution of processing times each quarter. In January–March 2026 it closed 44 payment and e-money authorisation cases with a median of 207 days from submission to decision; a quarter of cases took longer than 269 days (FCA).

The first statutory figure applies to a complete application, the second to an incomplete one. These remain the statutory deadlines; the FCA works to shorter targets of 4 and 10 months voluntarily, and putting them into law has so far only been proposed by the Government (FCA). The gap between the law and the median is the time spent on regulator queries and reworking documents.

One project from start to finish

A wallet with a card for clients in several EU states follows a path that ties together all of the requirements above:

1. The product holds a client balance, so it needs the EMI regime.
2. Lithuania is chosen; initial capital is €350,000 (Art. 4 EMD2), and the decision is due within three months of a complete application under the PSD2 rules that EMD2 applies to EMIs (Art. 3(1) EMD2).
3. A bank account for segregated client money is opened in parallel with the application.
4. Once licensed, the firm notifies the regulator of business in other EEA states.
5. If crypto services are needed later, an EMI can only hold and transfer its own EMTs by notification (Art. 60(4) MiCA); exchange and other services require a CASP licence.

What it takes besides money

Capital is the simplest requirement: it can be paid in. The other three take time, and money cannot substitute for them.

Thresholds and criteria for vetting owners are collected in the article on qualifying holdings and fit & proper, the banking side in banking for licensed operators and correspondent banking and safeguarding. Without an account for segregated funds, a licensee cannot start operating even once licensed.

Entry without a licence of one's own

Lawful entry without one's own licence exists in almost every regime, and in every model responsibility stays with the licence holder. An EU payment institution remains fully liable for the acts of its agents (Art. 20 PSD2); a UK principal is responsible for its appointed representative as if it had expressly permitted each of its acts (s.39(3) FSMA). The principal therefore decides which clients, countries and amounts the agent may serve.

In all four models the product is limited by the partner's licence, and the partner's regulatory risk becomes the business's risk. Firms that already hold a licence have a separate route: an EU bank, investment firm, UCITS management company or AIFM may provide crypto-asset services equivalent to its licence after notifying its regulator at least 40 working days in advance, without a separate CASP licence (Art. 60 MiCA).

Life after the licence

A licence marks the start of ongoing supervision. The licensee runs a working AML and sanctions framework (compliance stack), files reports, is audited and reconciles segregated client funds. Three events change its position the most.

What a provider's licence tells the client

For the client, a provider's licence answers one question: what protects the money if the provider goes bankrupt. The answer depends on the regime, and the differences between regimes are larger than those between countries.

Limits and payout times by country, including UK and US schemes, are collected in the client asset protection map.

Founders with Russian UBOs

For a company whose ultimate beneficial owner is a Russian national, EU Regulation 833/2014 is decisive. It prohibits providing a range of financial services to Russian clients and owning some EU licensees; outside the crypto sector there is no direct ownership ban, but the regulator and the bank assess such an owner under the general criteria, including source of funds.

The extension of the 5b(2a) ban to all crypto-asset service providers was introduced by Regulation 2026/1848, which also inserted Art. 5bc — a ban on transactions with crypto-asset providers established in third countries listed in Annex LVII. The provisions are cited from the consolidated text as of 24.07.2026. An intermediate company or trustee between the beneficial owner and the licensee does not lift the ban: it is framed in terms of direct and indirect ownership and control. Licences outside the EU are subject to local sanctions regimes and the requirements of correspondent banks; resilient set-ups are covered in the article on sanctions-resilient structures.

The second league

Beyond the main venues, this group includes second-tier jurisdictions and licences with a narrow scope.

The common denominator of the second league is that the licence works within its own territory, while marketing rules keep it away from clients in the major markets. A third-country crypto firm may serve an EU client without authorisation only at the client's own exclusive initiative, and any solicitation in the EU removes that exemption (Art. 61 MiCA); investment services have a similar exemption under Art. 42 MiFID II (MiFID II). Payments have no such exemption: in the EU only payment service providers may provide payment services (Art. 37 PSD2).

Popular, but ends badly

Several practices are regularly sold as a fast entry. All of them worked lawfully for a while or look lawful on paper.

All seven practices end the same way: the business stops just as it grows, when a bank, a regulator or a partner first checks on what basis it operates.