Concept
The programme of operations and the regulatory business plan are the two documents in a financial licence application in which the applicant describes its future business. The programme of operations answers the question "what exactly will the firm do": which services, through which flows of funds, for which clients and in which markets. The business plan answers the question "with what money and which people": a forecast of income, costs, capital and headcount for the first years of operation.
A regulator reads these documents as the core text of the application. It assesses policies, capital, proposed managers and outsourcing against the model they describe: whether there are enough people for the stated volume, whether capital covers the projected losses, whether the contracts match the described flow of funds. The Maltese regulator MFSA describes its review as consisting mainly of an assessment of the business plan, the qualifying shareholders, the management body and governance arrangements, and of the applicant's ability to comply on an ongoing basis in relation to its proposed business model.
Why it is a legal document
A licence is granted for the specific business described in the application. PSD2 ties the authorisation of a payment institution to the information under Article 5 being complete and the overall assessment of the application being favourable (Article 11(2)). The Hong Kong Securities and Futures Commission (SFC) checks whether structure, controls and staff are adequate for the "proposed business as detailed in your business plan" (Licensing Handbook).
Once the licence is granted, the description does not disappear into an archive. It becomes the benchmark against which supervisors compare the firm's actual activity.
Sets the perimeter
The list of services in the programme of operations defines the scope of the authorisation. A new service requires an extension of the licence with updated application information.
Sets the benchmark
Changes affecting the accuracy of the application information must be reported to the regulator. An unused licence and false statements are grounds for withdrawal.
Ties the numbers together
Headcount, control costs, capital and client flows must reconcile in one model. Regulators test forecasts for plausibility, including by comparing them with data from firms already operating.
Key parameters
Requirements for the plan are similar in structure across regimes and differ in detail: in some the horizon and scenarios are written into law, in others into guidance or the application form.
| Regime | Source of requirements | Forecast horizon | Scenarios |
|---|---|---|---|
| EU: payment institution and EMI | Art. 5 PSD2, EBA/GL/2017/09 | 3 financial years | target and stress |
| EU: CASP under MiCA | Art. 62 MiCA, Regulation (EU) 2025/305 | 3 years after authorisation | forecast with stress scenarios |
| United Kingdom: PI and EMI | PSRs 2017 Sch. 2, EMRs 2011 Sch. 1 | 3 financial years | — |
| United Kingdom: FSMA firms | business model threshold condition COND 2.7, FCA pages | 3 years (best practice) | stress testing in own format |
| Ireland: PI and EMI | Central Bank of Ireland expectations (April 2024) | 3 years | base, severe but plausible downside, plausible upside |
| Singapore: payment services | Form 1 under the Payment Services Act | years 1–3 | — |
| Hong Kong: SFC | Licensing Handbook | operating expenses for 6 months | — |
Three years is the common denominator for the European and UK regimes; for payment institutions and EMIs on both sides of the Channel the horizon is written into law. In Hong Kong the Licensing Handbook uses a different horizon: a projection of operating expenses for the first six months after licensing is compared with excess liquid capital, and a shortfall requires a plan for additional funding.
Programme of operations: what exactly the firm will do
The programme of operations is the legal characterisation of the business. The applicant breaks the product down into operations and shows which category of regulated service each one falls into. A mischaracterised service means an application for the wrong licence: the SFC returns applications that name the wrong types of regulated activity. The Central Bank of Ireland expects applicants to check for themselves whether their model needs a second authorisation.
Payment institutions and EMIs
For a payment institution, the EBA Guidelines EBA/GL/2017/09 (applicable since 13 January 2018; a separate section of the Guidelines covers EMIs) require a step-by-step description of each service mapped to the list in Annex I to PSD2. The applicant declares whether it will enter into possession of client funds and, for each service, attaches a flow-of-funds diagram, settlement arrangements, draft contracts with all parties including card schemes, and processing times.
To this are added the draft framework contract with clients, the number of premises, ancillary services, any intention to grant credit and its limits, plans to operate in other EEA states and third countries, and any other business activities for the next three years.
CASPs under MiCA
For crypto-asset services MiCA requires a programme of operations listing the services and stating where and how they will be marketed (Article 62(2)(d)). Delegated Regulation (EU) 2025/305 specifies this requirement and sets the horizon: the programme covers the three years following authorisation. The list is noticeably wider than for payments:
- the applicant's place in the group strategy and the impact of regulated group entities on it;
- jurisdictions of operation in the EU and third countries, with the targeted number of clients in each;
- websites and applications, languages, marketing channels;
- human, financial and ICT resources and where they are located;
- the outsourcing policy and the list of providers;
- crypto-asset activity on own account, including interaction with DeFi applications.
The procedure itself and the choice of member state are covered in The MiCA CASP Licence.
The section on target territories is linked to the local presence requirement. According to the EBA follow-up review of December 2025, almost all European regulators use the target-market section of the business plan to check whether a payment institution will carry out part of its activity in the licensing state.
The business plan: numbers that have to reconcile
The business plan proves one proposition: the applicant will have the systems, resources and procedures to operate soundly. That is how Article 5(1)(b) PSD2 puts it, and the other regulators' requirements are built the same way. The forecast serves as evidence; its job is to show that the model withstands its own assumptions.
What it consists of
Under the EBA Guidelines a payment institution's business plan includes an analysis of its competitive position, a description of clients and distribution channels, a budget for the first three financial years with an income statement and balance-sheet forecast under target and stress scenarios, the base assumptions (volume and value of transactions, number of clients, pricing, average transaction, expected increase in the profitability threshold), a breakdown of cash flows and a three-year projection of own funds under the chosen calculation method and under the other methods. Headcount is forecast separately for three years.
The UK regulator, the FCA, publishes a sample business plan and warns that the plan cannot be generic: it describes the specific model, the customer journey, marketing, compliance, staff incentives and capitalisation.
For payment institutions and EMIs a budget for the first three financial years is required by the UK Payment Services Regulations 2017 and Electronic Money Regulations 2011. For all applicants, under the FCA's requirements the financial section is mandatory: income statement, balance sheet and cash-flow statement, with three years of forecasts in Excel as best practice, supported by notes and assumptions and aligned strictly with the applicant legal entity.
What the regulator tests in the numbers
The FCA business model threshold condition (COND 2.7) names what the regulator looks for behind the tables: the assumptions and their justification, competitive advantage, viability and longer-term profitability, risks to consumers, growth strategy and the impact of the macroeconomic environment. The model must allow the firm's affairs to be conducted, and continue to be conducted, in a sound and prudent manner.
In its 2023 peer review the EBA described the test in more detail: whether the target and stress scenarios are plausible, whether they reflect the costs of internal control and outsourcing, and whether capital will suffice on the day of authorisation and for three years. It faulted the Swedish regulator precisely for superficiality: it checked only that forecasts were "not obviously unrealistic".
Among good practices the EBA named in 2023 comparing an applicant's forecasts with data from payment institutions and EMIs already in operation. In its 2025 review it noted that Sweden had strengthened its scrutiny of business plans and upgraded its score, although full alignment with the Guidelines had not yet been achieved.
The regulators' wording differs in detail, and it shows what each of them tests first.
| Regulator | What it requires | What it looks at |
|---|---|---|
| EBA (PSD2) | 3-year budget, target and stress scenarios, cash flows, own funds | plausibility of assumptions, control costs, capital over 3 years |
| MiCA, Regulation 2025/305 | forecast accounting plan with stress scenarios, at entity and group level | intra-group loans in the forecast |
| Central Bank of Ireland | 3 years: base, severe but plausible downside and plausible upside cases; business model template | assumptions lacking credibility preclude authorisation |
| MAS (payment services) | revenue and profit for years 1–3, share of revenue by service | how projected losses are funded, assumptions |
| SFC | operating expenses for the first 6 months | whether excess liquid capital covers them |
The common denominator of all five is a test of whether there will be enough money for the stated model: the European and Singapore regulators look three years ahead, the SFC six months.
The Central Bank of Ireland puts it directly: assumptions which are lacking in credibility will preclude an application from progressing to authorisation. The Irish regulator also expects evidence that capital will be injected before the decision and that capital requirements will be met for three years, including under stress. The capital thresholds themselves are covered regime by regime in Regulatory Capital.
Why three years
The three-year horizon is written into PSD2, the UK PSRs 2017 and EMRs 2011 and Regulation 2025/305; for FSMA firms the FCA calls it best practice; the Central Bank of Ireland and MAS build it into their forms. For the regulator this is the period over which capital adequacy is tested: the EBA asks supervisors to check from the forecast that the applicant will meet its capital requirements on the day of authorisation and throughout the first three years.
The projected losses of those years have to be covered by something: the Central Bank of Ireland expects confirmed funding for three years, and MAS invites applicants to explain in the form how projected losses will be funded.
Stress scenario and wind-down plan
The stress scenario in the business plan and the wind-down plan tell one story from two ends. The first shows under which assumptions the model stops reconciling; the second shows what the firm does once that happens. The FCA expressly expects firms to consider the scenarios leading to financial stress, explore recovery options and, as a last resort, wind down.
Regimes differ in who prepares such a plan and when: in the application or after authorisation.
| Regime | Who and when | Main focus |
|---|---|---|
| Central Bank of Ireland | all PI and EMI applicants — in the application | escalation, triggers, resources and staff retention, communication |
| FCA | some applicants, depending on the business — in the application | for PIs and EMIs, identifying client funds and returning them promptly |
| MiCA, Art. 74 | CASPs providing custody, a platform, exchange, order execution or placing — after authorisation | continuity of critical activities, wind-down without undue harm to clients |
| PSD3, agreed text | applicants for services 1–5 and 8 of Annex I — in the application | return of client funds in a disorderly wind-up |
A CASP application under MiCA requires a business continuity plan (Article 62(2)(i)); the Article 74 wind-down plan becomes an obligation of the operating firm. What happens to client money when a licensee leaves the market is covered in Licence Withdrawal and Wind-Down. For the business plan one point matters: the severe scenario should end where the wind-down plan begins, and the figures in the two documents should match.
The plan's path: from application to supervision
MiCA sets out the path of an application in working days (Article 63), and this example shows the moment at which the plan turns from a draft into a commitment.
- The regulator acknowledges receipt of the application within 5 working days.
- Within 25 working days it checks completeness and sets a deadline for missing information. It may refuse to review an application that remains incomplete after that deadline.
- It assesses a complete application within 40 working days. A request for further information sent no later than the 20th working day suspends the period for up to 20 working days. Later requests do not stop the clock.
- The decision is fully reasoned. The regulator must refuse where there are objective and demonstrable grounds that the applicant fails, or is likely to fail, to meet the requirements of Title V of MiCA.
- The authorisation lists the services permitted. A service can be added only by extending the authorisation, complementing and updating the application information (Article 59(6) and 59(8)).
- The authorisation is withdrawn if it has not been used for 12 months, if no services have been provided for nine consecutive months, or if it was obtained through false statements (Article 64(1)).
For payment institutions PSD2 sets three months for a decision from receipt of a complete application (Article 12). Since January 2026 the FCA has targeted four months for a complete application from an FSMA firm and three months for payments and e-money firms.
In practice timing depends on the quality of the application: according to the EBA review of 2025, authorisation of payment institutions and EMIs in the EU takes from 4–6 months to 27 months in Cyprus, with a median of 9.5 months excluding Cyprus. The Central Bank of Ireland notes that applicants can take more than twelve months to provide all the information needed.
What the plan means after authorisation
The applicant writes the plan to obtain a licence. The regulator reads it as a set of commitments to which it later ties supervision. The Central Bank of Ireland issues a letter stating it is minded to authorise "on the basis of the information provided" in the application, and the same letter lists conditions to be met after authorisation.
What binds and what serves as a measure
The commitments in the plan bind in different ways. The list of services, the flow of funds, including whether client money is received, and any intention to grant credit describe what the authorisation covers. A change to them is a change to the application information that must be reported to the regulator (Article 16 PSD2), and a new service requires an extension of the authorisation: in the UK, a variation under regulation 8 of the PSRs 2017.
The forecast figures work differently: until the firm has a track record, the regulator uses them as a measure. The own funds of an EMI that has not completed a sufficient period of business are calculated on the projected outstanding e-money in its business plan, subject to any adjustment required by the regulator (Article 5 EMD2). A payment institution's eligibility for the small-institution regime under Article 32 PSD2 is assessed on the projected volume of transactions in its business plan.
| What the plan says | What follows from it | Rule |
|---|---|---|
| List of services | Scope of authorisation; a new service requires an extension | Art. 59(6), 59(8) MiCA; reg. 8 PSRs 2017 |
| Any application information | Changes affecting its accuracy are reported to the regulator without undue delay | Art. 16 PSD2 |
| Projected volumes | Measure for capital and small regimes until there is a track record | Art. 5 EMD2, Art. 32 PSD2 |
| Launch timetable | The licence may be withdrawn (under MiCA, must be) if unused for 12 months | Art. 13(1)(a) PSD2, Art. 64(1)(a) MiCA |
| Accuracy of information | False statements in the application are grounds for withdrawal | Art. 13(1)(b) PSD2, Art. 64(1)(d) MiCA |
| No client assets held | Licensing condition and lower capital requirements (Types 4 and 5) | SFC Licensing Handbook |
| Limited launch | Restrictions on client numbers or volumes in the authorisation itself | FCA practice |
A gap between plan and reality therefore becomes a regulatory matter. Under PSD2 a licence may be withdrawn if the institution no longer meets the conditions for granting it or fails to inform the regulator of major developments in this respect (Article 13(1)(c)).
In June 2019 the Bank of Lithuania reported that nearly 30% of the EMIs and payment institutions granted a licence had not yet started operating, although most had been licensed less than a year earlier. The current shape of the Lithuanian market is covered in Lithuania: EMI, Payment Institution and Specialised Bank Licences.
When a licensed firm is acquired, a separate procedure assesses the acquirer; it is covered in Change of Control and Buying a Licensed Company.
What PSD3 will change
As of 5 October 2026 the EU payments reform has not been adopted: the agreed text of PSD3 was approved by the ECON committee on 5 May 2026 and is awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026. Under the agreed text PSD3 repeals PSD2 and the E-Money Directive, and EMIs become a type of payment institution.
The programme of operations and the business plan with a budget for three financial years remain in Article 3, joined by a winding-up plan in case of failure for services 1–5 and 8 of Annex I, including the return of client funds, and by an overview of applications by the group in other EU states over three years with the reasons for any refusal. The EBA will set the application requirements in regulatory technical standards instead of guidelines.
Existing institutions will not need a new licence, but within 27 months of PSD3 entering into force they will submit information for assessment against the new points of Article 3, including the winding-up plan. Those that do not comply will be suspended until they do. The reform is covered in PSD3 and PSR: EU Payment Services Reform.
Why applications come back
Regulators that publish findings on applications name the same causes of requests for information (RFIs) and refusals, and the consequences are similar too.
| Regulator | Typical problems | Consequence |
|---|---|---|
| FCA (September 2025) | templated policies, restated rules, reliance on consultants, unclear IT plans, inaccurate financial information | information requests, withdrawal, refusal |
| Central Bank of Ireland (April 2024) | incomplete applications, unclear or changing business models, slow responses, group risk frameworks instead of local ones | prolonged assessment, dormant application, refusal |
| MFSA (July 2025) | incomplete and piecemeal responses, incomplete disclosure of the model and finances | refusals, withdrawals, delays |
| SFC | insufficient information on the proposed business and operational workflow, wrong activity types | application returned |
| EBA (EU review, 2025) | incomplete and low-quality applications, changes to the model during assessment | timelines up to 27 months (Cyprus) |
Most of the causes in the table relate to the preparation of the application: completeness, consistency of the documents with each other and stability of the model described.
Readiness on the day of filing
The FCA frames its expectation as being ready, willing and organised: all documents are final versions, and drafts are not reviewed. A poor application cannot be submitted in the expectation of fixing it together with the regulator (FCA). The FCA rejects without assessment a submission lacking the minimum information, and among the common reasons applicants withdraw it names not being ready and an expected refusal. Substantive changes during the assessment can end in a request to withdraw and reapply.
A model that can be explained
The Central Bank of Ireland ranks among its top five problems the inability to describe the business model and customer offering clearly, and substantial changes to the model during the assessment. An application with no response to a query within 60 business days becomes dormant, and on re-engagement the assessment may restart.
In its September 2025 good and poor practice review the FCA points to policies that do not fit together and to risk analysis focused on the firm instead of on its customers. The roles and policies regulators expect to see are covered in Compliance Stack for a Licensed Operator.
Documents written for the applicant
In its letter to applicants' advisors of 22 July 2025, the MFSA lists the business plan among the main subjects of the assessment and stresses that the regulator does not advise on how to modify a proposal to meet the requirements. The FCA expressly names as a problem applicants who cannot explain their own obligations without their consultant. A consultant's template provides structure, but the regulator checks the content of the plan against the real firm.
Clients and owners from Russia
The programme of operations names target clients and territories, and for applicants with a Russian-speaking audience this section has to be precise. Under Article 5b(2) of Regulation (EU) 833/2014 it is prohibited to provide crypto-asset services, issue payment instruments, acquire payment transactions, provide payment initiation and issue electronic money to Russian nationals, residents of Russia and entities established in Russia. Article 5b(3) exempts nationals of the EU, the EEA and Switzerland and holders of residence permits there (European Commission FAQ).
The prohibition covers only the services listed. Where an applicant intends to provide those services to a Russian-speaking audience, the programme of operations describes it through clients falling within the Article 5b(3) exemption, and the onboarding procedure shows how this is checked. How the regulator assesses owners with Russian citizenship is covered in Qualifying Holdings and Fit & Proper.
Q/A
Contents of the plan
How does a programme of operations differ from a business plan?
The programme of operations describes the activity: services, flow of funds, clients, markets, contracts. The business plan describes resources and economics: a forecast of income, costs, capital and headcount. PSD2 lists them as separate items of Article 5(1); MiCA combines the financial forecast with the programme of operations in Regulation 2025/305.
Is a three-year forecast mandatory?
For payment institutions and EMIs in the EU, yes: it is written into Article 5(1)(b) PSD2. In the UK the same applies to them by law (PSRs 2017 Sch. 2, EMRs 2011 Sch. 1); for FSMA firms the FCA calls three years best practice. For CASPs under MiCA the programme of operations covers the three years after authorisation. The Central Bank of Ireland and MAS build three years into their requirements. The SFC Licensing Handbook refers to a projection of operating expenses for the first six months.
Is a stress scenario needed if the business is simple?
The EBA Guidelines and Regulation 2025/305 require stress scenarios from all applicants; under the EBA Guidelines the level of detail is proportionate to the applicant's size and the riskiness of its services. The Central Bank of Ireland expects three cases: base, severe but plausible downside, and plausible upside.
Procedure
How long does the assessment take?
By law, three months from a complete application for a payment institution and 25 plus 40 working days for a CASP. Since January 2026 the FCA targets four months for a complete application from an FSMA firm and three months for payments firms, and ten months for an incomplete one. In practice the EBA counted in 2025 from 4–6 to 27 months (Cyprus) across the EU, with a median of 9.5 months excluding Cyprus, and the main cause of delay is the quality of applications.
Can the model be changed during the assessment?
It can, but at a cost. The Central Bank of Ireland names changes to the model during the assessment as a cause of prolonged reviews, and after substantive changes the FCA may ask the applicant to withdraw and reapply.
Can a firm start with a restricted licence?
The FCA allows restrictions and requirements in the authorisation itself, for example on the number of clients or transaction volumes, including at the applicant's request. The SFC links licensing conditions to the model, for example a condition not to hold client assets, on which the capital requirements depend.
After authorisation
What happens if the business does not follow the plan?
A payment institution must inform the regulator without undue delay of changes affecting the accuracy of its application information (Article 16 PSD2). If the firm no longer meets the conditions of its authorisation or fails to report major developments, the licence may be withdrawn (Article 13(1)(c) PSD2).
Will the licence be withdrawn if the firm does not start operating?
Under MiCA, yes, mandatorily, if the authorisation has not been used for 12 months or no services have been provided for nine consecutive months. PSD2 allows withdrawal of a licence unused for 12 months, or where business has ceased for more than six months, if national law does not provide for the authorisation to lapse automatically in these cases.
Does the plan have to be updated to add a service?
For a CASP, yes: an extension of the authorisation is made by complementing and updating the Article 62 information and goes through the same assessment procedure (Article 59(8) MiCA). For a payment institution the procedure is set by national law: in the UK it is a variation of the authorisation under regulation 8 of the PSRs 2017, for which the FCA re-checks the conditions for authorisation. A notification of changed information under Article 16 PSD2 is not enough for a new service.
Will PSD3 change the business plan requirements?
The programme of operations and the three-year business plan remain. Under the agreed text the application will add a winding-up plan in case of failure for most payment services and an overview of the group's applications in other EU states, and the EBA will set the application requirements in technical standards. Existing institutions will be assessed against the new points within 27 months of PSD3 entering into force. As of 5 October 2026 PSD3 has not been adopted.