Fintech: licences, banking infrastructure, payments and stablecoins

How this cluster is organised

This domain is built around one question: what happens to money that sits not with a bank but with a licensed operator. One side of it is the balance in an EMI account, the wallet float, the coins with a custodian and whatever protects them. The other is the licence, the product and the operator's answerability to a regulator for other people's money.

The neighbouring map, Financial Licenses by Jurisdiction, answers exactly one question: where to get licensed. This page covers the whole domain — what is decided before a licence (whether the operator needs one at all) and everything that begins after it: a bank account for the operator itself, the compliance stack, sanctions screening, card acquiring, stablecoin regimes, and profiles of the companies where all of this already runs.

What falls inside the licensed perimeter

One circumstance makes an activity regulated: the firm acquires control over money or assets that do not belong to it. Every regime grows out of that, from a Hong Kong MSO to an ECB banking licence.

The main fork in choosing a regime is whether a client balance arises at all. A firm that only passes a payment from sender to recipient, holding no funds beyond settlement time, falls almost everywhere into the cheaper regime: the Hong Kong MSO, the Singapore standard payment institution, the Canadian PSP. Once a wallet with a balance appears, the regime becomes an issuance regime, with everything that follows for capital, safeguarding and reporting. Where that boundary is moving, and why it keeps widening, is covered in embedded finance, which also carries the supervisory calendar for partner-led models.

Maps and navigators

Four pages pick a jurisdiction; three explain when the operator needs no licence of its own and where renting one hits its ceiling. Starting here is rational: a large share of licensing projects turn into no-licence projects at the first serious costing.

• Financial Licenses by Jurisdiction — eighteen payment regimes on eight axes: regulator and act, statutory capital, the timeline the regulator itself publishes, the safeguarding model, passporting, agents, the crypto overlay and reporting, plus a product-by-product choice table
• US Financial and Crypto Licenses — three axes of choice: the federal layer, state licences and the crypto perimeter
• UAE Financial and Crypto Licenses — five regulators in one country: the central bank, VARA, DFSA, FSRA and SCA
• Kazakhstan: Financial and Crypto Licenses — AFSA, the National Bank and the Alatau City regime
• Licence for Rent — agency, white-label and BaaS: how a product lives under someone else's authorisation
• Embedded finance — why liability cannot be rented, and where the boundary of regulated activity is moving

What a licence costs and how long it takes

Statutory minimum capital is a floor that almost never matches the budget of an application. On top of it come legal support, hiring the named persons (compliance officer, MLRO, risk manager), IT systems, audit, and the year of operating reserve the regulator counts separately. A realistic launch budget is usually a multiple of the regulatory minimum.

The statutory decision periods are short on paper: three months from a complete application under PSD2 (art. 12); six months from a complete application, and twelve at most from filing, under the CRD (art. 15); 25 working days for the completeness check plus 40 working days for the assessment of a complete application under MiCA (art. 63). Preparing the business plan, the three-year financial forecast, AML policies and a description of the IT infrastructure comes before that clock starts, and that is the stage where most projects lose time; requests for information during the review extend the whole cycle well beyond the statutory period.

Licensing: United States and Canada

North America is two-layered, and that is where most expensive mistakes originate. Federal registration covers AML only — FinCEN in the US, FINTRAC in Canada. The right to actually move customer money comes from the second layer: state money transmitter licences in the US, the Bank of Canada's RPAA regime in Canada. Vendors selling "ready-made MSBs" are usually silent about that second layer.

In the US, MSB registration with FinCEN under 31 CFR 1022.380 is filed on Form 107 within 180 days of starting the activity and renewed every two years. It fixes the obligation to run an AML programme, appoint a compliance officer and file SARs. It confers no right to move money for a resident of Texas or New York; that comes from the state money transmitter licence, and there are more than fifty of them, each with its own net-worth requirement, surety bond and timetable.

Canada repeats the same two-tier logic in different words: FINTRAC registration discharges AML obligations and is not a licence, while the right to provide retail payment services comes from PSP registration with the Bank of Canada under the Retail Payment Activities Act, which adds requirements on safeguarding end-user funds and on operational risk management.

• FinCEN MSB registration — the registration that does not replace a state licence, though it is often sold as if it does
• Money transmitter licensing in the US — fifty licences instead of one: surety bonds, net worth, state-by-state timelines
• NYDFS: BitLicense and the trust charter — New York's two doors into US crypto and when each is the cheaper one
• The OCC national trust charter — a bank without deposits: the federal route around the state patchwork
• Federal Reserve payment accounts — the skinny master account and the end of the sponsor-bank monopoly
• The 2026 ILC wave — industrial bank charters as the entry route for non-financial corporates
• Canada in the licence map — the AML layer: FINTRAC registration confers no licence, and the C-12 reform raised penalties roughly fortyfold
• RPAA: Bank of Canada oversight — the operational layer: safeguarding, operational risk, and a regulator that can halt a business without a hearing

Licensing: Europe, the UK and Switzerland

The European perimeter is being rebuilt wholesale: the agreed but not yet adopted PSD3 would merge EMIs and PIs into a single licence, MiCA has closed the transitional window for legacy VASP registrations, and the AML package adds AMLA as a directly supervising authority. A 2026 application is filed under current rules but has to be designed against texts that are agreed and not yet in force.

The dates matter. Provisional political agreement on the PSD3 and PSR package was reached on 27 November 2025; Parliament's ECON committee approved the agreed texts on 5 May 2026, and the plenary vote is indicatively scheduled for 14 December 2026. Neither act is adopted or in force. Under the Commission's proposal the EMI ceases to be a licence type of its own and becomes a sub-category of payment institution, and existing firms have to apply for authorisation again.

On the crypto side the MiCA transitional periods ended on 1 July 2026: national VASP registrations stopped conferring the right to serve clients in the EU, and ESMA, in its statement on the end of the transitional periods, required unlicensed firms to wind down in an orderly way, transferring client assets to licensed providers or to self-custody. ESMA separately restated that reverse solicitation is a narrow exemption which does not rescue a third-country firm that solicits European clients.

In the UK the FCA published interim client-money safeguarding rules in PS25/12 on 7 August 2025 and they took effect on 7 May 2026, tightening record-keeping, reconciliations, reporting and the return of funds on insolvency; the next step replaces the EMR and PSR requirements with a CASS-style regime.

Switzerland stands apart: the 1b regime under the Banking Act allows a firm to accept up to CHF 100 million of public deposits without a full banking licence, and the DLT Act supplies a separate construction for tokenised rights.

• PSD3 and PSR — the single PI licence, the end of the EMI regime and the reauthorisation calendar
• Lithuania: EMI and specialised bank — the second door into the EEA after the supervisory clean-up
• Luxembourg: EMI and payment licence — the premium CSSF route: slower and dearer, but no questions from correspondents
• Bulgaria's financial licences — the map of the country's regimes: bank, EMI and PI at the BNB; CASP, investment firm, management company and insurer at the FSC
• EMI and payment institutions in Bulgaria — the BNB regime: €350,000, the three-month clock of Art. 11 ZPUPS and a presence test written into the statute
• The CASP licence in Bulgaria — the FSC under MiCA: capital by class, the published tariff and the end of the old national register
• Investment firm in Bulgaria — the FSC licence under MiFID II: initial capital by tier, IFR own funds and the investor compensation cover
• AML in Bulgaria — what the ZMIP asks of a Bulgarian licensee: a specialised AML service, CDD thresholds, reports to the DANS Financial Intelligence Directorate and supervision by the BNB or FSC
• EMI in Lithuania or Bulgaria — capital and the statutory clock are identical, so the choice runs on fees, rails and register depth
• EU passporting — how one member state's licence reaches the rest of the EEA: services or branch, the notification clocks under PSD2, MiFID II, MiCA and CRD, and what the host state keeps
• An EU banking licence through the ECB — when an EMI should become a bank: route, capital, timeline
• MiCA — the base framework: token classes, issuers, perimeter
• The CASP licence under MiCA — procedure, cost and choosing which member state to file in, plus the ceiling on running a crypto service under someone else's MiCA licence
• UK: the FCA Authorisation Map — EMI, API, PI and the Small Regimes — which FCA permission a payments or e-money firm actually needs: thresholds, timelines and the patterns behind refusals
• UK 2026–2028 — safeguarding for EMIs and the FCA and Bank of England crypto regime
• Appointed representatives and regulatory hosting — the UK entry route without the firm's own FCA authorisation
• Swiss fintech and crypto licences — the 1b regime, the DLT Act and FINMA's stablecoin requirements

Licensing: Asia, the Middle East and the large emerging markets

Asia splits its regimes on a single question — does the operator hold a customer balance. Hong Kong separates MSO from SVF, Singapore separates SPI from MPI, and both licence crypto on a separate track. The UAE takes the opposite approach: one country, five regulators, and the door you pick determines everything downstream, from capital to which banks will talk to the operator. North-east Asia and the two largest emerging payment markets run on their own logic.

Hong Kong draws the line at the balance: transfers and currency exchange without holding balances sit under the MSO licence, the working format for OTC desks, while a wallet with a balance requires an SVF licence from the HKMA.

In Singapore the Payment Services Act regulates seven payment services under three licence types: a money-changing licence and, for the other services, the standard and the major payment institution licence, the tier set by transaction volumes and by the amount of stored e-money value held. A separate Singapore development is the DTSP regime: since 30 June 2025 a company incorporated in Singapore that provides digital token services exclusively to clients outside the country must hold a licence, and MAS stated plainly that it will generally not issue such licences, with no transitional period.

The UAE is the most complex of them, with five regulators for one country — CBUAE onshore, VARA in Dubai, DFSA in the DIFC, FSRA in ADGM and the SCA at federal level — and the door chosen determines both the cost and the range of clients that can be served.

• Singapore: PSA payment licences — money-changing, SPI, MPI and seven regulated services under one framework
• Singapore's DTSP regime — why a crypto firm domiciled in Singapore must license or leave
• The Hong Kong MSO licence — remittance and currency exchange without holding balances; the working format for OTC
• The Hong Kong SVF licence — stored value, wallets and the line where a bank begins
• Hong Kong: the Stablecoins Ordinance — the HKMA issuer licence and the limits of the regime
• UAE Financial and Crypto Licenses — how to choose between the central bank, VARA, DFSA, FSRA and SCA
• The map of crypto licences — the token leg across twelve regimes and twelve axes: MiCA CASP, VARA, the ADGM FSRA, the DFSA, the SFC's VATP, MAS DPT and DTSP, the US trio of state MTL, BitLicense and OCC trust charter, the FCA regime from 25.10.2027, FINMA, the AIFC, Japan and Korea — on capital, published fees, custody, substance, retail access and the travel rule
• Japan and Korea: payment and crypto licences — north-east Asia, where payments and crypto services are licensed on separate tracks
• India and Brazil: the RBI and BCB payment regimes — the RBI's PA/PG regimes and Banco Central do Brasil around PIX: the two largest growth markets

The operator side

A licence is the starting line, not the finish. What follows is where operators actually fail: no bank will open an account for the licensee itself, sanctions screening catches the wrong names or misses the right ones, safeguarded funds sit concentrated in a single bank, the ICT framework does not survive inspection. This block is the infrastructure a regulator will test roughly a year after granting the licence.

Four of those requirements carry hard dates and citations of their own:

None of those dates matters as much as where the money physically sits. Concentration of safeguarded money in a single bank remains the most underrated operational risk an operator carries: when that one account closes the operator stops entirely, and recovery takes months because a new bank begins onboarding from zero.

• The operator compliance stack — what must physically exist inside an EMI, MSB or CASP: people, policies, systems
• Banking for a licensed operator — how MSBs, MSOs, EMIs and PSPs open accounts, which banks actually onboard licensed financial firms, and why applications get declined
• Wolfsberg questionnaires — the FCCQ a bank sends a financial-institution client and the CBDDQ for respondent banks: what the sections ask and how the answers are tested
• Correspondent banking and safeguarding — where client money physically sits and what actually protects it
• Sanctions screening at an operator — the discipline that keeps payments moving and, when absent, closes the business
• Corporate KYC — how the operator checks a company client: ownership chain and UBO thresholds, documents, risk rating, review intervals and refusal
• The Travel Rule — two regimes, different thresholds and the data that travels with a transfer
• DORA — what operational resilience costs the holder of an EU licence
• Outsourcing by licensed firms — what an EU-licensed EMI, payment institution, investment firm or CASP may hand to a provider: the EBA rules, critical functions, notice to the regulator, providers outside the EU and the letterbox test
• The EU AML package — AMLR, AMLD6 and AMLA: what genuinely changes in 2027–2028
• The FATF — the global AML standard behind those rules: the 40 Recommendations, mutual evaluations and the black and grey lists
• When the bank closes the operator's account — de-risking from the other side of the table: timelines and an orderly exit
• Change of Control and Buying a Licensed Company — regulatory consent for a new owner: notification thresholds, how long approval takes and what a licensed shell really costs
• Qualifying holdings and fit & proper — how a regulator vets the owners and managers of a licensee: the notification thresholds, the criteria and the source of the capital
• Licence Withdrawal and Wind-Down: What Happens to Client Money — the wind-down plan a regulator expects in advance, and how safeguarded funds are returned when an EMI or CASP fails
• Regulatory capital — why the figure in the statute is the smallest one: Methods A–D, IFR own funds, MiCA and what gets deducted

Payments, cards and acquiring

A separate layer that runs on card-scheme rules and sponsor contracts rather than licensing logic. The question is always the same: who carries chargeback risk and whose BIN is on the card. The licence matters less here than the contract.

• PayFac, ISO and merchant of record — three platform models and how risk is allocated between them
• Card programmes: roles and risks — BIN sponsor, processor, programme manager: who owns what
• Card Scheme Rules: Chargebacks, Interchange and Merchant Monitoring — the Visa and Mastercard rulebooks themselves: dispute cycles, interchange and the high-risk merchant monitoring programmes
• Agents and passporting in payments — entering the EU and UK through the agency model
• Payment fraud liability — who refunds the customer: PSD2 refunds and the €50 cap, gross negligence, euro Verification of Payee and UK APP reimbursement
• Open banking: AISP and PISP — registration or licence, €50,000 of capital, indemnity insurance, access to bank APIs and what PSD3, the PSR and FIDA would change
• BaaS: banking products without a licence — the sponsor bank, its risk appetite and the price of dependency
• Agentic payments — protocols and liability when an AI agent is the one paying

Stablecoins and digital money

Three jurisdictions wrote their regimes almost simultaneously and arrived at different constructions: the US built a fully reserved payment stablecoin, the EU folded the instrument into MiCA as an e-money token, Hong Kong created an HKMA issuer licence. Central bank money in digital form runs as a separate line. The difference is not technical — it is who the holder has a claim against if the issuer fails.

• Stablecoins: types and regulation — the base map: what backs them, who issues them, how redemption works
• The GENIUS Act — the US federal regime for payment stablecoins
• Issuing ARTs and EMTs under MiCA: the Token Issuer Regime — the EU side: issuer status, reserve composition, redemption rights and what changes once a token is significant
• The digital dollar in four legal forms — deposit token, stablecoin, EMT and tokenised fund, and how holder rights differ
• Stablecoins in Asia — Hong Kong, Singapore, Japan, Korea and the renminbi question
• CBDCs in 2026 — the digital euro, the digital rouble and the American fork in the road
• Real-world asset tokenisation — the digital wrapper around real assets and its legal nature
• The OCC national trust charter — the federally supervised custodian for an issuer's reserves
• Federal Reserve payment accounts — where an issuer holds reserves if not at a commercial bank

The three regimes an issuer picks between most often, side by side:

Five more perimeters license the same product — the UK, Singapore, Japan, the UAE and the AIFC in Kazakhstan — and the eight-regime matrix that carries them all, on capital, reserve composition and custody, redemption window, the interest ban, retail access, territory and status on the date, is maintained by stablecoins: types and regulation, which also holds the issuer-by-issuer table of the tokens a holder actually uses. This hub keeps the operator's route into each of the three regimes above.

The American calendar is worth carrying precisely: under section 20 of the GENIUS Act, the Act takes effect on the earlier of two dates: eighteen months after the Act was signed on 18 July 2025, or 120 days after the primary federal payment stablecoin regulators issue final rules. Those regulators missed their own one-year rulemaking deadline of 18 July 2026, so the eighteen-month trigger now governs and the working start date is 18 January 2027.

Hong Kong moved from text to practice first. The HKMA granted its first two issuer licences on 10 April 2026, to Anchorpoint Financial and HSBC.

Projects and infrastructure

Company profiles are the fastest test of whether a regime works in practice. If a jurisdiction has no live licensee running the operator's model, the licence exists on paper only. These pages also show who banks with whom and whose rails carry the settlement — a dependency map rather than a showcase.

Stablecoin rails and issuers

• Bridge — Stripe's stablecoin bank with a federal charter
• BVNK — the stablecoin rails Mastercard bought
• Conduit — settlement corridors for trade with Latin America and Africa
• Zerohash — the invisible crypto back end behind Wall Street
• SoFi and SoFiUSD — the first stablecoin issued by a US national bank
• Anchorpoint Financial — the first HKMA stablecoin issuer licence
• Custodia and Vantage — tokenised deposits and the fight over a master account

Custody and crypto infrastructure

• Fireblocks — the custody infrastructure sitting behind everyone else
• Anchorage Digital — crypto custody under a federal bank charter
• HashKey Group — Hong Kong's licensed crypto infrastructure
• Morgan Stanley Digital Trust — Wall Street enters crypto custody
• Coinbase Prime — prime brokerage built for institutional size

Banks and correspondents for fintech

• Clear Junction — banking infrastructure for payment companies
• BCB Group — payment infrastructure for the crypto industry
• ClearBank — the clearing bank behind UK fintechs and EMIs
• Cross River Bank — the sponsor bank of American fintech
• Column N.A. — a bank built for developers and BaaS programmes

Payment accounts and neobanks

• Airwallex — a corporate neobank for cards and payouts across MSO, SVF and MPI licences
• Aspire — the Singapore platform for SME accounts and APAC spend
• FOMO Pay — a Singapore MPI with a DPT licence for merchant and crypto flow
• Neobanks: the licensing overview — how corporate neobanks differ by licence and by what protects the balance, Currenxie's Hong Kong account for cross-border trade and marketplaces among them

Settlement infrastructure and new charters

• Wholesale DLT settlement — Fnality, Partior, deposit tokens and wholesale CBDCs compared by settlement asset
• Thunes — a direct payout network that bypasses correspondent chains
• Erebor Bank — a new US bank aimed at crypto and defence technology
• US bank charter applications — the queue for new charters: PayPal returning to the banking system through an ILC, Klarna entering the US at state level, and Nubank's foreign de novo application

Banks built for digital assets

• FV Bank — a Puerto Rico IFE bank with digital asset custody
• Pave Bank — Georgia's programmable bank for stablecoin treasury
• Offshore banks of Dominica — EQIBank for digital assets and OTC settlement, Nodabank as an offshore bank and family office under the same regime
• Banks of Puerto Rico — how the IFE jurisdiction works end to end

Where to go next: adjacent domains

Fintech borders private capital exactly where money stops being operational. These pages live in other clusters of the wiki but are needed here constantly, particularly once the subject shifts from operating money to personal capital.

• Crypto for private capital — custody, tax and structures for personal capital rather than for an operating perimeter
• OTC crypto settlement and USDT — how crypto becomes fiat and what the receiving bank makes of it
• CARF in practice — what tax authorities will see about the holder's crypto holdings from 2027
• AML/KYC for the private client — the same discipline seen from the customer's side of the desk
• Source of funds and source of wealth — the documentation without which nothing opens anywhere
• Banks by jurisdiction — the banking domain map: accounts, deposit protection, private banking
• Private banking — jurisdiction, entry thresholds and how capital origin is tested
• Hong Kong · Singapore · UAE · Kazakhstan — jurisdiction hubs where licensing sits alongside company formation, accounts and residency