Neobanks: Licensing Overview and Ratings

Regulation

Concept

“Neobank” is a market term used in different ways, not a single legal licence category. In this comparison it covers digital account providers: licensed banks, non-bank payment or e-money institutions, and services delivered through a partner bank. The legal entity, product and jurisdiction determine permissions and the protection of client funds. Banco de España explains the distinction between the label and the entity behind it.

The table compares banking with non-bank payment/e-money permissions; it is not a division between all banks and all neobanks. Particular services require the relevant permissions:

Trust administration, fund management, custody of assets, brokerage and securities dealing, and investment advice require a separate check of the entity’s permissions for the service and jurisdiction. Neither the “bank” nor the “neobank” label establishes those permissions.

Non-bank payment regimes emerged as regulators' response to the problem of serving small and medium-sized businesses. A full banking license is too heavy and expensive—high minimum capital, Basel III adequacy ratios, separate treasury and risk management functions, regular audited reporting and supervision, direct account with the central bank. This model does not pay off for a small client: compliance costs are comparable to the revenue from them.

The EU introduced the first such regime with Directive 2000/46/EC on electronic money institutions (2000); Directive 2007/64/EC (PSD1) added payment institutions in 2007. Both are lighter regimes with reduced requirements for capital, team, and reporting. Today they exist in the EU, UK, Singapore, Hong Kong, USA, and many other jurisdictions.

Under these regimes, several generations of companies have grown—from Wise and Revolut to Airwallex. Some later obtained banking licences of their own—Revolut holds one in Lithuania and in the UK—while others still run on a payment or e-money licence whose capital floor is €20,000–350,000 rather than the €5 million a bank needs.

For an operating account, compare payment functions and access to funds. For savings and reserves, check whether the actual product is an eligible bank deposit, who holds it and what protection limit applies; the “neobank” label does not answer those questions.

What is "lighter" in the payment regime

The following comparison concerns non-bank payment and e-money institutions. Their permissions and requirements differ from a bank’s; the main restrictions and settlement arrangements are outlined below.

First—client funds cannot be accepted as deposits on the company's own balance sheet. Client money is not recorded as the company's obligation to depositors and does not finance its active operations. Depending on the applicable safeguarding rules, it is held separately in designated bank accounts, invested in secure, liquid, low-risk assets, or protected by insurance/a comparable guarantee. This mechanism is called safeguarding and is enshrined in each regime separately: in the UK in regulation 20 of the Electronic Money Regulations 2011 and regulation 23 of the Payment Services Regulations 2017, in the EU in Article 7 of EMD2 and Article 10 of PSD2. The Hong Kong money service operator regime contains no comparable client-money safeguarding rule.

Second—lending from client funds is prohibited. Credit operations are either completely prohibited or permitted only from the company's own capital. This blocks the fundamental banking model—fractional reserve banking, where a bank lends more from accepted deposits than its own capital.

Third—settlement access depends on the jurisdiction and account type. A provider using a partner bank depends on that relationship for settlement. A banking licence is not universally required for direct central-bank access: the Bank of England allows eligible FCA-authorised payment and e-money institutions, subject to approval, to hold RTGS settlement or prefunding accounts. These are not reserves accounts; small payment and small e-money institutions are not eligible under that policy.

In exchange for these limitations, the regime has reduced requirements for capital, team, reporting, and supervision.

Operating models

A payment licence follows the client: authorisation is needed in every jurisdiction where the company has users, so a licence is either passported, as across the EEA, or collected country by country. That produces three working models.

The American model and its partner banks are set out under USA below, the FCA ladder under United Kingdom and the passport under European Union. Outside the EEA the plug & play model has no formal permission in the client's country: its reach rests on a licence there, on narrow exclusions, or on how hard cross-border service is to police. Reverse solicitation is the narrowest of those exclusions — for crypto services ESMA's guidelines on reverse solicitation under MiCA construe solicitation broadly: it covers promotion, advertising or an offer to clients in the Union by any means, and general brand advertising addressed to the public may also count as solicitation.

Client fund protection: safeguarding

Deposit protection depends on the product and legal entity, not the neobank label. UK FSCS, US FDIC, Singapore SDIC and European national DGS protect eligible bank deposits under their respective rules. A non-bank payment/e-money balance is different. For UK authorised payment and e-money institutions, FCA safeguarding may use a separate account or insurance/a comparable guarantee; it is not FSCS deposit protection. Small payment institutions need not safeguard funds. In the UK, for example, safeguarded funds form an asset pool from which e-money holders are paid in priority to all other creditors if the institution becomes insolvent (EMRs 2011, reg. 24).

Segregation separates client funds from the payment institution’s own money; it does not by itself insure a partner bank’s failure or prevent an intermediary’s operational collapse. In a US partner-bank arrangement, FDIC pass-through coverage depends on funds being deposited at an insured bank and the applicable conditions being met. It covers the insured bank’s failure, not the fintech’s failure.

Synapse (2024): where the ledger failed. Synapse Financial Technologies sat between fintech apps and partner banks such as Evolve Bank & Trust, AMG National Trust Bank and Lineage Bank. It filed for Chapter 11 on 22 April 2024. End users then had no access to their money for weeks or months while the partner banks reconciled their records with Synapse's and distributed funds, and the banks found that together they held less for end users than Synapse's records showed: the Chapter 11 trustee estimated the shortfall at $60–90 million (CFPB complaint against Synapse). Many end users have not received their full balances. FDIC insurance pays when an insured bank fails; it did not reach a gap in the intermediary's ledger.

Regulatory trends 2024–⁠2026

European Union: PSD3 + PSR and MiCA. The PSD3 package (licensing directive) and PSR (Payment Services Regulation—directly applicable regulation on conduct rules) reached a provisional political agreement on 27 November 2025, and the European Parliament's ECON committee approved the agreed texts on 5 May 2026; the plenary vote is forecast for 14 December 2026 (OEIL 2023/0209(COD)). Neither act is adopted or in force. Under the agreed PSR text most rules apply 21 months after entry into force, and PSD3 must be transposed and applied within the same period, so no application date exists until the acts are published in the Official Journal. Payment institution and electronic money institution licences are merged into one; the name-and-IBAN matching check (verification of payee) is extended to all credit transfers, consumers get a refund right when a fraudster impersonates their payment service provider, and safeguarding rules are tightened. In parallel, MiCA (Regulation 2023/1114) regulates crypto-assets: rules for CASP apply from December 30, 2024; the transitional period for previously operating companies expired on 1 July 2026 at the latest (member states could shorten it).

United Kingdom: safeguarding reform. Following consultation CP24/20, the FCA adopted rules in PS25/12: from 7 May 2026 payment and e-money firms reconcile safeguarded funds every business day, file a monthly regulatory return, and certain payment and e-money institutions have their safeguarding audited annually. The end-state regime with a statutory trust over client funds is deferred to a second stage. Separately, since 7 October 2024 victims of authorised push payment fraud on Faster Payments or CHAPS can claim reimbursement of up to £85,000, with the cost split 50:50 between the sending and receiving firms (PSR).

USA: after Synapse. In October 2024 the FDIC proposed a Recordkeeping for Custodial Accounts rule for banks holding custodial deposit accounts with transactional features; no final rule has been published. Supervisors also act against sponsor banks directly: in June 2024 the Federal Reserve issued an enforcement action against Evolve Bank & Trust over risk management of its fintech partnerships, anti-money-laundering and consumer compliance.

Singapore and Hong Kong: stablecoins. MAS finalised its stablecoin framework in August 2023; it requires issuers to redeem at par within five business days. In Hong Kong, since 1 August 2025 issuing fiat-referenced stablecoins has been a regulated activity that requires an HKMA licence; the first two licences took effect on 10 April 2026 (HKMA register of licensed stablecoin issuers).

When a neobank is suitable—and when it is not

Digital account services can be useful as an operational tool for businesses and sole traders. Opening time, KYC requirements, currency support and marketplace integrations depend on the provider and client profile. Compare these features for the following scenarios:

• incoming revenue from clients and marketplaces—Amazon, eBay, Shopify, Etsy, AliExpress;
• payments to contractors and suppliers in several currencies simultaneously;
• currency conversion between several currencies inside one account;
• corporate cards for team with expense separation;
• B2B settlements in Southeast Asia without opening a local company;
• project and one-time payments where opening a bank account takes longer than the project lasts.

A payment or e-money account alone does not establish suitability for reserves, credit lines and letters of credit, prime brokerage and securities settlements, long-term capital management or family office services. Check the actual provider’s permissions and products for each task. For reserves, also check eligible deposit coverage and any amount above its limit; these questions apply to digital and other banks alike.

Jurisdictions and licenses

European Union — Payment Institution and e-⁠money license (PSD2 + EMD2)

Single license passport: a national competent authority of one country issues authorization, it is valid in all 27 EU countries and, under the EEA agreement, in Iceland, Liechtenstein and Norway as well. Licenses are divided into three types.

One EU e-money authorization passported across the EEA means one regulator and thirty markets; the route is set out in EMI licence in Luxembourg.

PSD2 payment institution licence. Covers transfers, merchant acquiring, payment processing, open banking services. Minimum capital—from €20k to €125k depending on the services (PSD2, Art. 7).

EMD2 e-money license. Covers issuance of electronic money (e-money) plus payment services permitted under the applicable authorisation. Minimum capital—€350k.

Crypto-Asset Service Provider (MiCA, Regulation 2023/1114). Covers crypto-asset operations—exchange, custodial storage, transfer. Rules for CASP apply from December 30, 2024; the transitional period for previously operating companies expired on 1 July 2026 at the latest (member states could shorten it). Can be a separate license or addition to e-money license.

Where it's heading. The PSD3 + PSR package was provisionally agreed on 27 November 2025; the ECON committee approved the agreed texts on 5 May 2026 and the plenary vote is forecast for 14 December 2026, so neither act is adopted or in force. Once in force, the rules apply after 21 months. PSR is a directly applicable regulation (conduct rules), PSD3 is a directive (licensing); payment institution and e-money licences are merged into one.

Examples under different legal regimes. Among neobanks with an EU banking licence are Revolut Bank UAB, licensed by the Bank of Lithuania, and N26 Bank SE, supervised by BaFin; France's Qonto runs on a payment-institution authorisation from the ACPR (no. 16958).

United Kingdom — FCA (Authorised Payment Institution / e-⁠money license)

After Brexit, the UK maintained a parallel regime, separate from the European one. Regulator—FCA, main structures under Payment Services Regulations 2017 and Electronic Money Regulations 2011.

Authorised payment institution (API). Minimum capital—€20k for money remittance only, €50k for payment initiation and €125k for account-based payments, issuing and acquiring (PSRs 2017, Sch. 3). Without the right to issue electronic money.

Authorised Electronic Money Institution (e-money license). Minimum capital—€350k (EMRs 2011, Sch. 2). Covers issuance of electronic money plus everything permitted to API.

In both cases, safeguarding of client funds is mandatory—either through a segregated account at an approved bank or through an equivalent mechanism (insurance, investment in approved instruments).

Where it's heading. Under PS25/12, from 7 May 2026 firms reconcile safeguarded funds every business day, file a monthly regulatory return, and certain institutions have their safeguarding audited annually; the statutory trust over client funds is deferred to a second stage. Since 7 October 2024, APP fraud reimbursement applies up to £85,000.

Examples under different legal regimes. Wise Payments Limited is authorised by the FCA as an e-money institution (FRN 900507). Revolut Bank UK Ltd, Monzo Bank Limited and Starling Bank Limited are on the PRA's list of banks it regulates; Revolut's UK bank launched as a full bank on 11 March 2026. The same list includes the SME lenders Allica Bank and OakNorth.

Hong Kong — Money Service Operator and Stored Value Facility

The Hong Kong regime consists of two independent tracks with different regulators and different weight.

Money Service Operator (MSO). Regulator—Customs and Excise Department under Anti-Money Laundering and Counter-Terrorist Financing Ordinance, Cap. 615. The C&ED licensing guide sets no minimum capital and a normal licence validity of two years. The licence covers money changing and remittance; it does not cover deposit-taking, stored value issuance or lending. Details — MSO licence Hong Kong.

Stored Value Facility (SVF). Regulator—Hong Kong Monetary Authority under Payment Systems and Stored Value Facilities Ordinance, Cap. 584. License for e-wallets, prepaid cards, stored-value products. Details — SVF licence Hong Kong.

SVF is much heavier than MSO. The HKMA register of SVF licensees lists mainly consumer wallets and payment platforms, such as Octopus Cards, Alipay Financial Services (HK), WeChat Pay Hong Kong and HKT Payment.

Digital banks. The HKMA list of digital banks names eight as at 31 August 2026: ZA Bank, livi bank, Mox Bank, WeLab Bank, Ant Bank, Ele Bank (formerly Airstar Bank), Fusion Bank and Ping An Digital Bank (International) (formerly PAO Bank). These are licensed digital banks rather than non-bank payment institutions: deposits up to HK$800,000 are protected by the Hong Kong Deposit Protection Scheme. The eight are compared bank by bank in Hong Kong virtual banks.

Stablecoins. Since 1 August 2025 issuing fiat-referenced stablecoins has required an HKMA licence; the first two licences, for Anchorpoint Financial and HSBC, took effect on 10 April 2026.

Singapore — Payment Services Act 2019 (SPI / MPI)

The Payment Services Act 2019 sets three classes of licence (s. 6(2)); the regulator is the Monetary Authority of Singapore.

Money-Changing Licence—currency exchange only.

Standard Payment Institution (SPI)—for smaller operators.

Major Payment Institution (MPI)—for larger operators.

Within the license, MAS specifies specific permitted services: account opening and maintenance, domestic transfers, cross-border transfers, merchant acquiring, e-money issuance, digital payment token (DPT) services, currency exchange. "The provider has MPI" is insufficient fact; need to check the specific service set in the registry.

DPT is a regulated service, not a licence class. Crypto services are authorised as a digital payment token service inside an SPI or MPI licence, so the register entry, not the licence name, shows whether a provider may offer them.

Stablecoins. MAS finalised its stablecoin framework in August 2023; it requires issuers to redeem at par within five business days.

USA — money transmitter licences and partner banking

In the USA, non-bank payment firms are licensed at state level: nationwide coverage needs a money transmitter licence in each state that requires one, plus federal registration with FinCEN as a money services business. That is why some larger players go straight for a charter of their own.

Partner bank model. The fintech company has neither money transmitter license nor banking license. It operates as an interface on top of one or more real US banks that have master accounts at the Federal Reserve. The client formally has an account at the partner bank; FDIC insurance covers at least $250,000 per depositor, per insured bank, for each ownership category (FDIC). Externally the client sees a regular neobank account. Legally it is a bank deposit arranged through the fintech company's interface. Business finance super-apps such as Ramp sit on the same rails, layering cards and spend management on top of partner banks.

Who on which bank. Mercury's banking services are provided through Choice Financial Group and Column N.A. (Mercury); Brex's checking account is provided by Column N.A. (Brex), and Brex has been part of Capital One since 7 April 2026 (Capital One).

The partner bank model does not insure against a failure of the intermediary. In the Synapse case end users lost access for weeks or months and the trustee estimated a $60–90 million shortfall, although no partner bank failed. The FDIC's October 2024 custodial-accounts proposal has not been finalised, and supervisors have acted against sponsor banks directly, as in the Federal Reserve's June 2024 action against Evolve.

Canada — FINTRAC MSB and RPAA

Federal registration with Financial Transactions and Reports Analysis Centre as money services business (AML). Payment service providers must also register with the Bank of Canada under the Retail Payment Activities Act (RPAA): since 8 September 2025 they must have risk-management and funds-safeguarding frameworks in place and file an annual report, and the Bank publishes a registry of PSPs (Bank of Canada). The RPAA is not a deposit-insurance scheme.

Puerto Rico — International Financial Entity

Regulator—Office of the Commissioner of Financial Institutions (OCIF). An international financial entity is licensed under Act 273-2012, as amended, most recently by Act 44-2024. It may not accept deposits from domestic persons (s. 11), needs paid-in capital of at least $10 million (s. 4(b)(3)), and income from its permitted activities under a decree is taxed at a flat 4% (s. 23(a)).

Georgia — National Bank of Georgia (bank or PSP)

National Bank of Georgia issues two different types of licenses that are often confused.

Commercial banking licence—full banking functionality, deposits, loans. Deposits insured by Georgian Deposit Insurance up to 50,000 lari per depositor from 1 April 2026.

Payment Service Provider—transfers and payments without deposit-taking. No insurance.

The NBG register of licensed commercial banks lists the digital banks JSC Pave Bank Georgia (licence No. 305 of 14 December 2023) and JSC Hash Bank (licence No. 260 of 3 November 2023); both therefore sit under the bank regime rather than the PSP one. Hashbank is profiled separately.

Australia — ASIC AFSL

Australian Securities and Investments Commission issues Australian Financial Services Licence (AFSL). Under this license operate neobanks, acquirers, FX businesses (plus AUSTRAC registration). Full banking license—Authorised Deposit-taking Institution (ADI)—issued separately by Australian Prudential Regulation Authority.

Mainland China — PBOC + SAFE

External access to the Chinese banking system is restricted by foreign exchange control through State Administration of Foreign Exchange, special rules for non-residents, and strict international transfer control regime. Non-bank payment institutions are licensed by the PBOC. Foreign providers typically operate through licensed Chinese partners.

Offshore banking centers

Dominica, Saint Lucia, Saint Vincent, Bahamas, British Virgin Islands issue banking licenses, but regulatory supervision is weaker, correspondent relationships are limited, and most tier-1 banks worldwide treat them with caution. Such charters suit niche tasks and do not replace a tier-1 bank.

Crypto 2026: the second licensing contour

Banking, payment/e-money and crypto-asset services require separate checks of the entity and permissions. In the EU, MiCA permits crypto-asset services through CASP authorisation or, for eligible financial entities and services, the Article 60 notification route; the information must be notified at least 40 working days before the first provision of services. An incomplete notification bars commencement, and Article 60(8) provides for suspension of the notification period while missing information is supplied. For an EMI that route is limited to custody and transfer of the e-money tokens it issues. Revolut, for example, holds a CASP authorisation through Revolut Digital Assets (Europe) Ltd in Cyprus, and N26 Bank SE appears in the same register.

Where this contour came from. Before MiCA, crypto worked under a patchwork of national VASP registrations (per AMLD5): a separate registration in each country with different requirements. MiCA replaced this with a single CASP authorisation passported across the EU — the same logic as the e-money licence.

The rules apply from 30 December 2024; the transitional period for legacy VASPs expired on 1 July 2026 (Article 143(3) of the regulation is a hard ceiling, and member states could shorten the window). National windows closed on different dates, so this has to be checked against the provider's country of registration: in the Czech Republic a legacy operator that had applied for a CASP authorisation by 31 July 2025 could keep operating until the decision, but no later than 1 July 2026 — § 26 of Act No. 31/2025 Sb.. The current standing of a Czech entity is checked in the Czech National Bank register.

A legacy provider could not rely on its old VASP registration after the applicable transition ended. It needed a valid MiCA basis for its services, including the Article 60 route where available; otherwise it had to cease those services and arrange the return or transfer of client assets. A missing standalone CASP licence alone does not establish that a bank’s crypto service has been switched off.

Where the licences landed. Our count from ESMA's CASPS.csv, downloaded on 26 September 2026, includes 352 rows with a recorded start date on or before that day and no effective withdrawal by then. Germany has 92 qualifying rows, followed by France (35), the Netherlands (28), Cyprus (24) and Malta (22). These are register records, including authorisations and notifications, not an official aggregate or a count of unique companies. Future-dated and undated starts are excluded from the calculation; actual permission should be checked with the national authority. Large exchanges chose different home states: Coinbase is authorised through Coinbase Luxembourg S.A., Kraken through two Payward entities in Ireland, and OKX through OKX Europe Limited in Malta.

Stablecoins are the most telling plot. Under MiCA, a euro- or dollar-pegged 1:1 stablecoin is an e-money token (EMT), and only its issuer, authorised as a credit institution or an e-money institution, may offer it to the public or seek its admission to trading in the Union, or another person with the issuer's written consent (Article 48). An EMT issuer therefore needs a banking or e-money licence on top of the MiCA requirements.

Choosing a provider, check the banking or payment/e-money entity and, separately, the entity and MiCA basis for any crypto service: CASP authorisation or the Article 60 notification route with its scope and timing conditions met, as outlined above. The mechanics of how a third-party brand embeds crypto trading under a partner's licence are covered separately — in the guide to operating under someone else's CASP licence.

B2B stablecoin infrastructure: who carries the rail behind the app

A neobank or payment company that offers stablecoin pay-ins, payouts or a dollar balance rarely runs the rail itself. It rents it from an infrastructure provider, and the choice of provider decides whose licence the flow sits under, where the fiat leg is held and who can freeze it. The main models are covered in the profiles of BVNK, Bridge (Stripe), Conduit, Zerohash, Thunes and Fireblocks. The check before routing volume is the same for each: the contracting entity, the regime over the fiat balance, the issuer that can freeze the token, and what happens to a payment in transit if the provider stops.

Provider licences and protection of funds

The name on the app is not the counterparty: within one group different currencies are often served by different legal entities under different regulators, so "what licence does the provider hold" is meaningless without "which entity holds my account" and "what protects the balance if that entity fails".

Read down the protection column and the providers split into three legally different positions. A licensed bank puts a statutory scheme behind the balance: £120,000 under the FSCS, €100,000 under a national deposit guarantee. An e-money or payment institution safeguards client money at third banks or in low-risk assets, which gives a claim in an insolvency rather than a scheme payout. A US partner-bank platform offers FDIC cover that belongs to the partner banks and is stretched by a sweep: up to $5 million at Mercury, $6 million at Brex. The cap is per depositor per institution, so a balance above it has to be split between institutions or kept at a bank through private banking.

Company eligibility filters as hard as protection. bunq Business takes companies registered in the Netherlands, Belgium, France, Germany, Austria, Spain, Italy, Ireland or Portugal, and no UBO or non-executive may live outside the EEA (bunq). The American entity that Mercury and Brex serve is covered in US LLC for non-residents, and what segregation does and does not protect in correspondent banking and safeguarding.

Neobank ratings

The ranking runs on the legal perimeter first, not on product quality: licence type and the statutory protection behind the balance. Product quality then sorts providers inside a tier rather than across tiers, which is why an e-money institution with a strong product still sits below a licensed bank, and why Revolut — a bank in two jurisdictions with FSCS and DGS behind it — cannot sit in the same tier as a Dominica charter.

Tier I — a banking licence of its own with a statutory deposit scheme behind the balance. Tier II — its own payment or e-money licence in one or several jurisdictions: safeguarding instead of a scheme; a licensed bank in a jurisdiction that has no deposit scheme lands here as well. Tier III — the partner-bank model without a licence of its own: the protection belongs to the partner bank, and settlement and compliance depend on it. Tier IV — an offshore charter with no compensation scheme, where the correspondent chain is the only real safeguard.

Regional and specialised providers run through the same test: a provider sits in Tier II where the licence is its own and in Tier III where the balance rests on a partner. Private banking and capital storage — in the Banks and Private banking hubs.