🇪🇺Payment Agents and Passporting in the EU/UK

Concept

In EU and UK payments, regulated activity can be conducted under someone else's license—as an agent of a payment institution (PI) or an e-money issuer (EMI). The agent acts on behalf of the principal licensee (PSD2, Art.4(38)); the license remains with the principal, and the principal files the agent's registration with the regulator. This is the payment vertical of embedded finance.

Roles differ. EMI agents and PI agents provide payment services on behalf of the principal. E-money distributors distribute e-money (sell and redeem) on the EMI's behalf and do not provide payment services; they are not registered as agents, but where an EMI distributes e-money in another member state through such a person, the PSD2 passport procedure applies to it (EMD2, Art. 3(4)). In investment services, the analogue is a tied agent under MiFID.

Legally, the construction rests on PSD2 (in application since 2018), which carried over from the first Payment Services Directive of 2007 the figure of the agent and the principle of single authorization with a passport, and on that foundation the embedded finance market rose—fintechs embed an account, a card, and a payment into a non-core product under someone else's license. Economically it is a close relative of license for rent from adjacent verticals, while who actually stands behind embedded finance in practice is covered in a separate analysis.

How It Works

The agent route: the principal EMI/PI conducts due diligence on the candidate, then submits it to the national regulator as its agent. After registration, the agent operates under the principal's license—in its home country and in countries where the principal has obtained a passport. The agent does not need its own authorization or capital.

The diagram below shows where the licence and the client money sit in this construction: both stay with the principal, while the agent only provides services in its name.

Client funds are protected through safeguarding: they are ring-fenced in a separate account at a credit institution or in secure, liquid, low-risk assets, or covered by insurance/guarantee (PSD2, Art. 10). Commingling with the principal's own funds is prohibited. This is the same fund segregation discipline as in correspondent banking and safeguarding.

What You Need to Launch

Through the agent model—no capital, no own license: you need to meet the principal's requirements (AML policies, fit-and-proper for management, operational readiness) and register through it. Launch—within weeks: the home regulator has two months to enter the agent in the register (PSD2, Art. 19(2)), six weeks under the agreed PSD3 text. For your own license, minimum capital depends on the regime.

Timelines for your own license should be read from what each regulator publishes rather than from market lore. The Bank of Lithuania undertakes to decide within three months of receiving proper and sufficiently informative documents, and two months for an EMI licence limited in scope, while noting that documents almost never arrive without deficiencies. The FCA has three months from a complete application under reg 9 PSRs, and its own metrics for the fourth quarter of 2025/26 put the median at 207 days with an upper quartile of 269. The Central Bank of Ireland meets its published standard — 90% of assessment phases inside 90 business days — while its Authorisations and Gatekeeping report gives an average of 763 calendar days per file in 2025, the fastest case at 497. The figures are compared side by side in the map of financial licence regimes. Therefore, many start as agents and arrange their own authorization—for example, an EMI in Luxembourg or PSA payment licenses in Singapore—later, when volumes justify the capital and compliance staff.

Compliance

Basic set: AML/KYC under AMLD (CDD, monitoring, suspicious transaction reporting), sanctions screening, safeguarding reconciliation of client funds, reporting to the principal and regulator. From 10 July 2027 most obliged-entity rules move into the AML Regulation (EU) 2024/1624, whose awareness, training and integrity-assessment duties expressly cover the principal's agents and distributors (Arts 12–13). The agent operates within the principal's compliance perimeter: the principal is obliged to monitor the agent, conduct periodic reviews, and disconnect it in case of violations. Responsibility before the regulator remains with the principal.

How It's Done in the Market

Principals are BaaS EMIs and payment institutions, alongside banks—in the EU and UK these include, for example, the electronic money institutions Swan, Treezor and Modulr and the UK banks ClearBank and Griffin. They give agents access to accounts, cards, and payments via API and take on the license and safeguarding; the card part of the program is usually built through BIN sponsorship. The principals' market has gone through notable consolidation and stress: Railsr, following its rescue, merged with Equals Money (2025), and Solaris operates under heightened BaFin supervision and with restrictions on onboarding new clients. The principal's condition is therefore checked in advance, at the selection stage.

What to look for when choosing a principal: stability and reputation (license revocation of the principal stops agents too), where it has a passport, which safeguarding bank and how reconciliation is organized, economics (revenue share, access fees, minimums), and the right to transfer the program. When volumes and desire for control outweigh—they transition to their own EMI/PI license.

Applicable Regulation

PSD2 (agent—Art.4(38)) and EMD2 (EMI and capital) grant a passport across EU/EEA based on a single authorization—the legal foundation of the entire agent model. They are being replaced by PSD3 and PSR. Political agreement on the package was reached on 27 November 2025 (the Commission lists it on its Payment services page as "Political agreement — PSD2 review"), and the final compromise texts are dated 17 April 2026 (Council documents 8221/26 for the PSR and 8222/26 for PSD3). Ahead lie the Council's first-reading position, a Parliament plenary vote forecast for 14 December 2026 and publication in the Official Journal, with application approximately 21 months after entry into force; as of September 2026 neither text has appeared in the OJ. Key points for agents: the EMI regime merges into PI (becoming its subcategory; existing payment and e-money institutions may keep operating on their current authorisation until 27 months after PSD3 enters into force, and a competent authority may exceptionally extend that by up to three months where it could not process a timely filing: Arts 44, 45 and 45a of the agreed text), the commercial agent exemption is narrowed, e-money distributors still do not count as agents unless they provide payment services (distributing e-money in another member state through them keeps following the passport procedure, Art. 19(7a)), starting capital is indexed to inflation, and the settlement-finality status that lets non-bank PIs and EMIs take part directly in payment systems such as T2—granted by the Instant Payments Regulation from 9 April 2025—is carried into PSD3 (Art. 46). The primary source on the reform is the European Commission's Payment services page.

Neighboring models and the perimeter boundary

The same logic—operating under someone else's authorization—repeats in adjacent niches. In crypto it is the white-label CASP: a service under a provider's license under MiCA. In the US, the role of the European principal is played by sponsor banks and BaaS middleware such as Unit or Treasury Prime. In the investment industry the analogue is a tied agent under MiFID and host structures, while in Singapore payment activity is built on PSA licenses. The motive is the same everywhere: regulatory access is rented, while responsibility remains with the license holder. An operator can also complement its licensed payment activity with a bank settlement service funded by its own collateral. At bank level, distinguish customer-money protection from funding the operator’s settlements. ClearBank separates safeguarding and operating accounts. The former supports the relevant customer-money arrangement; the latter holds the business’s own working funds. An operator’s cash deposit securing a payment limit is assessed against its liquidity needs and collateral agreement. At British Atlantic Bank, the agent’s deposit secures third-party payments and supports a revolving limit: unsettled instructions reserve capacity, which is restored as obligations are discharged. Transfers retain customer, beneficiary and purpose data whether made in the bank’s or customer’s name. The cycle fee is 0.75%; the club rate is 0.3% at aggregate balances from $3 million, plus third-party charges. The operator’s registration and agency appointment continue to follow the principal’s applicable regime.

The perimeter boundary keeps shifting. PSD3/PSR narrows the commercial-agent exclusion and keeps the principal answerable for its e-money distributors' AML compliance, MiCA closes off crypto, and the course toward direct access for non-bank PSPs to payment systems reduces dependence on sponsor banks. Therefore a model for which agent status is enough today may tomorrow require its own license, so the compliance buffer is worth building in advance.

The agent model brings you to the payments market in weeks and without your own capital—at the price of a place in someone else's compliance perimeter and a share of turnover. It pays off while speed matters and volumes are small; as they grow, your own EMI/PI license outweighs it. The PSD3/PSR reform will narrow the gray zones, so it is worth building in a compliance buffer from the start.