Fintech: licences, banking infrastructure, payments and stablecoins

Licensed operators and client funds

Client funds held by licensed operators rather than banks include EMI account balances, wallet float and cryptoassets held with custodians. The relevant legal issues concern asset protection, the operator's licence and product, and its accountability to the regulator for funds that do not belong to it.

Licensing jurisdictions are compared in Financial Licenses by Jurisdiction. The operator's need for a licence is assessed before authorisation. Subsequent operational topics include a bank account for the operator itself, the compliance stack, sanctions screening, card acquiring and stablecoin regimes. Profiles of existing companies show these arrangements in operation.

What falls inside the licensed perimeter

The defining feature of regulated activity is a firm's control over money or assets that do not belong to it. This underlies every regime, from a Hong Kong MSO to an ECB banking licence.

The choice of regime primarily depends on whether a client balance arises. A firm that only passes a payment from sender to recipient, holding no funds beyond settlement time, falls almost everywhere into the cheaper regime: the Hong Kong MSO, the Singapore standard payment institution, the Canadian PSP. Once a wallet with a balance appears, the regime becomes an issuance regime, with the associated capital, safeguarding and reporting requirements. Changes to the regulated perimeter and the reasons for its continued expansion are addressed in embedded finance, including the supervisory calendar for partner-led models. Once the firm comes to control other people's securities or deposits, investment, brokerage and banking licences take over — they are covered in a separate financial licences hub.

Licensing jurisdictions and operating models

Four jurisdictional comparisons address the choice of licensing country; three analyses cover operation without an independent licence and the limits of third-party authorisation. Assessing these alternatives at the outset is justified because a large share of licensing projects abandon independent licensing after the first detailed cost estimate.

• Financial Licenses by Jurisdiction — eighteen payment regimes against eight criteria: regulator and act, statutory capital, the timeline the regulator itself publishes, the safeguarding model, passporting, agents, the crypto overlay and reporting, plus a product-by-product choice table
• US Financial and Crypto Licenses — three criteria for selection: federal regulation, state licences and the crypto perimeter
• UAE Financial and Crypto Licenses — five regulators in one country: the central bank, VARA, DFSA, FSRA and SCA
• Kazakhstan: Financial and Crypto Licenses — AFSA, the National Bank and the Alatau City regime
• Licence for Rent — agency, white-label and BaaS: operation of a product under another firm's authorisation
• Embedded finance — why liability cannot be rented, and where the boundary of regulated activity is moving

Licensing capital, costs and timelines

Statutory minimum capital is a floor that almost never matches the budget of an application. On top of it come legal support, hiring the named persons (compliance officer, MLRO, risk manager), IT systems, audit, and the year of operating reserve the regulator counts separately. A realistic launch budget is usually a multiple of the regulatory minimum.

The statutory decision periods under PSD2, the CRD and MiCA, including when each clock starts, are set out in Financial licences. Preparing the business plan, the three-year financial forecast, AML policies and a description of the IT infrastructure comes before that clock starts, and that is the stage where most projects lose time; requests for information during the review extend the whole cycle well beyond the statutory period.

Licensing: United States and Canada

North American licensing has two levels; failure to distinguish them causes most costly errors. Federal registration covers AML only: FinCEN in the US and FINTRAC in Canada. Permission to transfer customer money requires state money transmitter licences in the US or registration under the Bank of Canada's RPAA regime in Canada. Vendors of "ready-made MSBs" usually omit these additional requirements.

In the US, MSB registration with FinCEN under 31 CFR 1022.380 is filed on Form 107 within 180 days of starting the activity and renewed every two years. It fixes the obligation to run an AML programme, appoint a compliance officer and file SARs. It confers no right to move money for a resident of Texas or New York; that comes from the state money transmitter licence, and there are more than fifty of them, each with its own net-worth requirement, surety bond and timetable.

Canada also operates a two-tier system: FINTRAC registration discharges AML obligations and is not a licence, while the right to provide retail payment services comes from PSP registration with the Bank of Canada under the Retail Payment Activities Act, which adds requirements on safeguarding end-user funds and on operational risk management.

• FinCEN MSB registration — the registration that does not replace a state licence, though it is often sold as if it does
• Money transmitter licensing in the US — fifty licences instead of one: surety bonds, net worth, state-by-state timelines
• NYDFS: BitLicense and the trust charter — New York's two authorisation routes into the US crypto market and when each is less costly
• The OCC national trust charter — a bank without deposits: the federal alternative to separate state regimes
• Federal Reserve payment accounts — the skinny master account and the end of the sponsor-bank monopoly
• The 2026 ILC wave — industrial bank charters as the entry route for non-financial corporates
• Canada in the licence map — AML requirements: FINTRAC registration confers no licence, and the C-12 reform raised penalties roughly fortyfold
• RPAA: Bank of Canada oversight — operational requirements: safeguarding, operational risk, and a regulator that can halt a business without a hearing

Licensing: Europe, the UK and Switzerland

The European perimeter is being rebuilt wholesale: the agreed but not yet adopted PSD3 would merge EMIs and PIs into a single licence, MiCA has closed the transitional window for legacy VASP registrations, and the AML package adds AMLA as a directly supervising authority. A 2026 application is filed under current rules but has to be designed against texts that are agreed and not yet in force.

Provisional political agreement on the PSD3 and PSR package was reached on 27 November 2025; Parliament's ECON committee approved the agreed texts on 5 May 2026, and the plenary vote is indicatively scheduled for 14 December 2026. Neither act is adopted or in force. Under the Commission's proposal the EMI ceases to be a licence type of its own and becomes a sub-category of payment institution, and existing firms have to apply for authorisation again.

On the crypto side the MiCA transitional periods ended on 1 July 2026: national VASP registrations stopped conferring the right to serve clients in the EU, and ESMA, in its statement on the end of the transitional periods, required unlicensed firms to wind down in an orderly way, transferring client assets to licensed providers or to self-custody. ESMA separately restated that reverse solicitation is a narrow exemption which does not rescue a third-country firm that solicits European clients.

In the UK the FCA published interim client-money safeguarding rules in PS25/12 on 7 August 2025 and they took effect on 7 May 2026, tightening record-keeping, reconciliations, reporting and the return of funds on insolvency; the next step replaces the EMR and PSR requirements with a CASS-style regime.

Switzerland stands apart: the 1b regime under the Banking Act allows a firm to accept up to CHF 100 million of public deposits without a full banking licence, and the DLT Act supplies a separate construction for tokenised rights.

• PSD3 and PSR — the single PI licence, the end of the EMI regime and the reauthorisation calendar
• Lithuania: EMI and specialised bank — the second entry route into the EEA after the supervisory clean-up
• Luxembourg: EMI and payment licence — the CSSF route: longer timelines and higher costs, but no questions from correspondent banks
• Bulgaria's financial licences — the map of the country's regimes: bank, EMI and PI at the BNB; CASP, investment firm, management company and insurer at the FSC
• EMI and payment institutions in Bulgaria — the BNB regime: €350,000, the three-month clock of Art. 11 ZPUPS and a presence test written into the statute
• The CASP licence in Bulgaria — the FSC under MiCA: capital by class, the published tariff and the end of the old national register
• Investment firm in Bulgaria — the FSC licence under MiFID II: initial capital by tier, IFR own funds and the investor compensation cover
• AML in Bulgaria — what the ZMIP asks of a Bulgarian licensee: a specialised AML service, CDD thresholds, reports to the DANS Financial Intelligence Directorate and supervision by the BNB or FSC
• EMI in Lithuania or Bulgaria — capital and the statutory clock are identical, so the choice depends on fees, payment infrastructure and the extent of the licensing register
• EU passporting — how one member state's licence reaches the rest of the EEA: services or branch, the notification clocks under PSD2, MiFID II, MiCA and CRD, and what the host state keeps
• An EU banking licence through the ECB — when an EMI should become a bank: route, capital, timeline
• MiCA — the base framework: token classes, issuers, perimeter
• The CASP licence under MiCA — procedure, cost and choosing which member state to file in, plus the ceiling on running a crypto service under someone else's MiCA licence
• UK: the FCA Authorisation Map — EMI, API, PI and the Small Regimes — which FCA permission a payments or e-money firm actually needs: thresholds, timelines and the patterns behind refusals
• UK 2026–2028 — safeguarding for EMIs and the FCA and Bank of England crypto regime
• Appointed representatives and regulatory hosting — the UK entry route without the firm's own FCA authorisation
• Swiss fintech and crypto licences — the 1b regime, the DLT Act and FINMA's stablecoin requirements

Licensing: Asia, the Middle East and the large emerging markets

Asia splits its regimes on a single question — does the operator hold a customer balance. Hong Kong separates MSO from SVF, Singapore separates SPI from MPI, and both licence crypto on a separate track. The UAE takes the opposite approach: one country, five regulators, and the door you pick determines everything downstream, from capital to which banks will talk to the operator. North-east Asia and the two largest emerging payment markets run on their own logic.

Hong Kong draws the line at the balance: transfers and currency exchange without holding balances sit under the MSO licence, the working format for OTC desks, while a wallet with a balance requires an SVF licence from the HKMA.

In Singapore the Payment Services Act regulates seven payment services under three licence types: a money-changing licence and, for the other services, the standard and the major payment institution licence, the tier set by transaction volumes and by the amount of stored e-money value held. A separate Singapore development is the DTSP regime: since 30 June 2025 a company incorporated in Singapore that provides digital token services exclusively to clients outside the country must hold a licence, and MAS stated plainly that it will generally not issue such licences, with no transitional period.

The UAE is the most complex of them, with five regulators for one country — CBUAE onshore, VARA in Dubai, DFSA in the DIFC, FSRA in ADGM and the SCA at federal level — and the door chosen determines both the cost and the range of clients that can be served.

• Singapore: PSA payment licences — money-changing, SPI, MPI and seven regulated services under one framework
• Singapore's DTSP regime — why a crypto firm domiciled in Singapore must license or leave
• The Hong Kong MSO licence — remittance and currency exchange without holding balances; the working format for OTC
• The Hong Kong SVF licence — stored value, wallets and the line where a bank begins
• Hong Kong: the Stablecoins Ordinance — the HKMA issuer licence and the limits of the regime
• UAE Financial and Crypto Licenses — how to choose between the central bank, VARA, DFSA, FSRA and SCA
• The map of crypto licences — cryptoasset services across twelve regimes and twelve criteria: MiCA CASP, VARA, the ADGM FSRA, the DFSA, the SFC's VATP, MAS DPT and DTSP, the US trio of state MTL, BitLicense and OCC trust charter, the FCA regime from 25.10.2027, FINMA, the AIFC, Japan and Korea — on capital, published fees, custody, substance, retail access and the travel rule
• Japan and Korea: payment and crypto licences — north-east Asia, where payments and crypto services are licensed on separate tracks
• India and Brazil: the RBI and BCB payment regimes — the RBI's PA/PG regimes and Banco Central do Brasil around PIX: the two largest growth markets

Post-authorisation operations

Obtaining a licence must be followed by operational implementation. Operators fail when no bank will open an account for the licensee, sanctions screening produces false matches or misses sanctioned parties, safeguarded funds are concentrated in a single bank, or the ICT framework fails inspection. The regulator examines this infrastructure roughly a year after granting the licence.

Four of these requirements have specific application dates and legal bases:

None of those dates matters as much as where the money physically sits. Concentration of safeguarded money in a single bank remains the most underrated operational risk an operator carries: when that one account closes the operator stops entirely, and recovery takes months because a new bank begins onboarding from zero.

• The operator compliance stack — the resources an EMI, MSB or CASP must maintain: people, policies, systems
• Banking for a licensed operator — how MSBs, MSOs, EMIs and PSPs open accounts, which banks actually onboard licensed financial firms, and why applications get declined
• Wolfsberg questionnaires — the FCCQ a bank sends a financial-institution client and the CBDDQ for respondent banks: what the sections ask and how the answers are tested
• Correspondent banking and safeguarding — the location of client funds and the safeguards applying to them
• Sanctions screening at an operator — the discipline that keeps payments moving and, when absent, closes the business
• Corporate KYC — how the operator checks a company client: ownership chain and UBO thresholds, documents, risk rating, review intervals and refusal
• The Travel Rule — two regimes, different thresholds and the data that travels with a transfer
• DORA — what operational resilience costs the holder of an EU licence
• Outsourcing by licensed firms — what an EU-licensed EMI, payment institution, investment firm or CASP may hand to a provider: the EBA rules, critical functions, notice to the regulator, providers outside the EU and the letterbox test
• The EU AML package — AMLR, AMLD6 and AMLA: changes applying in 2027–2028
• The FATF — the global AML standard behind those rules: the 40 Recommendations, mutual evaluations and the black and grey lists
• When the bank closes the operator's account — de-risking as experienced by the operator: timelines and an orderly exit
• Change of Control and Buying a Licensed Company — regulatory consent for a new owner: notification thresholds, how long approval takes and what a licensed shell really costs
• Qualifying holdings and fit & proper — how a regulator vets the owners and managers of a licensee: the notification thresholds, the criteria and the source of the capital
• Licence Withdrawal and Wind-Down: What Happens to Client Money — the wind-down plan a regulator expects in advance, and how safeguarded funds are returned when an EMI or CASP fails
• Regulatory capital — why the figure in the statute is the smallest one: Methods A–D, IFR own funds, MiCA and what gets deducted

Payments, cards and acquiring

Card services are governed by card-scheme rules and sponsor contracts. The central issues are allocation of chargeback risk and identification of the BIN holder. Contractual terms have greater significance here than the licence.

• PayFac, ISO and merchant of record — three platform models and how risk is allocated between them
• Card programmes: roles and risks — BIN sponsor, processor, programme manager: who owns what
• Card Scheme Rules: Chargebacks, Interchange and Merchant Monitoring — the Visa and Mastercard rulebooks themselves: dispute cycles, interchange and the high-risk merchant monitoring programmes
• Agents and passporting in payments — entering the EU and UK through the agency model
• Payment fraud liability — who refunds the customer: PSD2 refunds and the €50 cap, gross negligence, euro Verification of Payee and UK APP reimbursement
• Open banking: AISP and PISP — registration or licence, €50,000 of capital, indemnity insurance, access to bank APIs and what PSD3, the PSR and FIDA would change
• BaaS: banking products without a licence — the sponsor bank, its risk appetite and the costs of dependence on the sponsor bank
• Agentic payments — protocols and liability when an AI agent is the one paying

Stablecoins and digital money

Three jurisdictions wrote their regimes almost simultaneously and arrived at different constructions: the US built a fully reserved payment stablecoin, the EU folded the instrument into MiCA as an e-money token, Hong Kong created an HKMA issuer licence. Digital central bank money forms a separate category. The distinction concerns the party against whom the holder has a claim if the issuer fails, rather than technology.

• Stablecoins: types and regulation — the base map: what backs them, who issues them, how redemption works
• The GENIUS Act — the US federal regime for payment stablecoins
• Issuing ARTs and EMTs under MiCA: the Token Issuer Regime — the EU side: issuer status, reserve composition, redemption rights and what changes once a token is significant
• The digital dollar in four legal forms — deposit token, stablecoin, EMT and tokenised fund, and how holder rights differ
• Stablecoins in Asia — Hong Kong, Singapore, Japan, Korea and the renminbi question
• CBDCs in 2026 — the digital euro, the digital rouble and the alternative approaches in the US
• Real-world asset tokenisation — the digital wrapper around real assets and its legal nature
• The OCC national trust charter — the federally supervised custodian for an issuer's reserves
• Federal Reserve payment accounts — where an issuer holds reserves if not at a commercial bank

The three regimes an issuer picks between most often, side by side:

Five further jurisdictions license the same product — the UK, Singapore, Japan, the UAE and the AIFC in Kazakhstan — and the eight-regime matrix that carries them all, on capital, reserve composition and custody, redemption window, the interest ban, retail access, territory and status on the date, is maintained by stablecoins: types and regulation, which also holds the issuer-by-issuer table of the tokens a holder actually uses. The three regimes above provide distinct authorisation routes for operators.

The effective date of the US regime is determined as follows: under section 20 of the GENIUS Act, the Act takes effect on the earlier of two dates: eighteen months after the Act was signed on 18 July 2025, or 120 days after the primary federal payment stablecoin regulators issue final rules. Those regulators missed their own one-year rulemaking deadline of 18 July 2026, so the eighteen-month trigger now governs and the working start date is 18 January 2027.

Hong Kong was the first to begin practical licensing. The HKMA granted its first two issuer licences on 10 April 2026, to Anchorpoint Financial and HSBC.

Projects and infrastructure

Company profiles are the fastest test of whether a regime works in practice. If a jurisdiction has no live licensee running the operator's model, the licence exists on paper only. Banking relationships and settlement infrastructure establish the companies' operational dependencies.

Stablecoin rails and issuers

• Bridge — Stripe's stablecoin bank with a federal charter
• BVNK — the stablecoin rails Mastercard bought
• Conduit — settlement corridors for trade with Latin America and Africa
• Zerohash — cryptoasset infrastructure for Wall Street institutions
• SoFi and SoFiUSD — the first stablecoin issued by a US national bank
• Anchorpoint Financial — the first HKMA stablecoin issuer licence
• Custodia and Vantage — tokenised deposits and the dispute over access to a master account

Custody and crypto infrastructure

• Fireblocks — custody infrastructure used by all the other participants
• Anchorage Digital — crypto custody under a federal bank charter
• HashKey Group — Hong Kong's licensed crypto infrastructure
• Morgan Stanley Digital Trust — Wall Street enters crypto custody
• Coinbase Prime — prime brokerage built for institutional size

Banks and correspondents for fintech

• Clear Junction — banking infrastructure for payment companies
• BCB Group — payment infrastructure for the crypto industry
• ClearBank — the clearing bank behind UK fintechs and EMIs
• Cross River Bank — the sponsor bank of American fintech
• Column N.A. — a bank built for developers and BaaS programmes

Payment accounts and neobanks

• Airwallex — a corporate neobank for cards and payouts across MSO, SVF and MPI licences
• Aspire — the Singapore platform for SME accounts and APAC spend
• FOMO Pay — a Singapore MPI with a DPT licence for merchant and crypto flow
• Neobanks: the licensing overview — how corporate neobanks differ by licence and by what protects the balance, Currenxie's Hong Kong account for cross-border trade and marketplaces among them

Settlement infrastructure and new charters

• Wholesale DLT settlement — Fnality, Partior, deposit tokens and wholesale CBDCs compared by settlement asset
• Thunes — a direct payout network that bypasses correspondent chains
• Erebor Bank — a new US bank aimed at crypto and defence technology
• US bank charter applications — the queue for new charters: PayPal returning to the banking system through an ILC, Klarna entering the US at state level, and Nubank's foreign de novo application

Banks built for digital assets

• FV Bank — a Puerto Rico IFE bank with digital asset custody
• Pave Bank — Georgia's programmable bank for stablecoin treasury
• Offshore banks of Dominica — EQIBank for digital assets and OTC settlement, Nodabank as an offshore bank and family office under the same regime
• Banks of Puerto Rico — how the IFE jurisdiction works end to end

Related areas of private wealth

Fintech intersects with private wealth when funds cease to serve operational purposes. The related issues concern custody, tax, ownership structures, conversion into fiat and private banking.

• Crypto for private capital — custody, tax and structures for personal capital rather than for an operating perimeter
• OTC crypto settlement and USDT — how crypto becomes fiat and what the receiving bank makes of it
• CARF in practice — what tax authorities will see about the holder's crypto holdings from 2027
• AML/KYC for the private client — the requirements applying to a private client
• Source of funds and source of wealth — the documentation without which nothing opens anywhere
• Banks by jurisdiction — the banking domain map: accounts, deposit protection, private banking
• Private banking — jurisdiction, entry thresholds and how capital origin is tested
• Hong Kong · Singapore · UAE · Kazakhstan — jurisdiction hubs where licensing sits alongside company formation, accounts and residency

Questions and answers