EU payment rails in 2026: EMI, PI, CASP — and which one you actually need

Dit artikel is nog niet in het Nederlands vertaald; de vertaling volgt binnenkort. Hieronder leest u de Engelse versie.

Four licences dominate European fintech conversations: EMIEMI (electronic money institution)A licensed firm that can issue e-money and run payment accounts, such as many app-based business accounts., PI, CASPCASP (crypto-asset service provider)The EU's name for a licensed crypto business under MiCA, which can serve clients across the EU once authorised. and, for older crypto businesses, the national VASPVASP (virtual asset service provider)Any business dealing in crypto-assets for clients, such as exchanges and custodians. Registration or licensing is needed in most places. registration that's being retired. On a pitch deck they look interchangeable. They aren't. Each covers a different slice of activity, has different capital and governance rules, and decides which banks and card schemes will work with you.

Pick the wrong one and it can cost twelve to twenty-four months and most of a seed round.

Which licence do I need? Start from what your product does

Don't start with the licence. Start with what happens in your product. Write one sentence for each of these:

• Do you hold customer funds for any period? Then you're in EMI or safeguarded-PI territory, not in "we just move money".
• Do you issue a balance customers can spend or cash out? That's electronic money (digital money held in an account, like a wallet balance).
• Do you make payments on behalf of others without holding a balance they can redeem? That's payment services.
• Do you exchange, store, transfer or broker crypto-assets for clients? That's the CASP perimeter (CASP means Crypto-Asset Service Provider) under MiCAMiCAHet Europese regelkader voor cryptoactiva en de bedrijven die ze aanbieden, inclusief de vergunningplicht voor aanbieders van cryptodiensten., the EU's crypto rulebook.
• Do you only introduce customers to a licensed provider and take a fee? You may need no licence at all, but the agreement with the provider decides.

Most failed applications describe an ambition instead of what the product does today.

What does each licence let you do?

Each licence draws a line around what you're allowed to do. Here's where the lines sit.

Payment Institution (PI). This lets you provide payment services: executing payments, acquiring (taking card payments for merchants), initiation and account information. It needs less capital than an EMI. You can't issue e-money. It suits acquiring, PISP/AISP models (services that start payments or read account data with the customer's permission) and B2B payouts.

Electronic Money Institution (EMI). This lets you issue e-money plus the payment services that go with it. It needs more capital and stricter safeguarding (keeping customers' money separate and protected). But it's what you need to give customers a spendable balance or an IBAN (a bank account number) in their name. Most neobank and wallet models are EMI models.

Crypto-Asset Service Provider (CASP). This is the MiCA authorisation for exchange, custody, transfer, execution, placement, portfolio management and advice on crypto-assets. Authorisation in one EU country works across the whole EU. You send a notification under Article 65 rather than making a second application. National transitional arrangements for existing VASPs (the older crypto registrations) have been closing on different dates in different countries. So groups operating across borders need a calendar for each entity, not one deadline.

Stablecoin issuance (ART/EMT). This is a separate authorisation. Its reserve, redemption and disclosure rules are closer to banking law. For small teams it's realistically out of reach, so partner with an authorised issuer instead.

Waar zitten de grijze gebieden?

Most of this article describes settled rules. The weak spots are the points where the outcome depends on a bank, a regulator or a contract instead of a fixed rule.

Arguable doesn't mean off-limits. It means go in with your eyes open and get the bank and contract questions answered before you spend the fee.

What's changing with PSD3?

The PSD3/PSR package is the EU's next update to its payments rules. In plain terms: the rules become directly applicable law, so each country no longer writes its own version. Fraud-liability and IBAN-name-check obligations get tighter, and the e-money and payment-services regimes move closer together.

Here's what that means for your planning:

• Build confirmation-of-payee (checking the name matches the account) and fraud-monitoring into the product now. Adding them later is expensive.
• Assume authorisation files will be judged against a higher bar for operational resilience, also driven by DORA, the EU's rules on keeping digital systems running.
• Don't build a business model whose margin depends on weak rules about who pays when fraud happens.

Which country should you apply in?

The realistic short list for most founders is Lithuania, Ierland, the Nederland, Malta, Luxemburg, France and Germany. The rulebook is largely the same everywhere. What differs is:

• how long processing takes
• how the regulator engages with you
• whether you can find local senior staff who pass "fit and proper" (the regulator's test of whether people are suitable to run the firm)
• and, decisively, whether banks in that market will serve you

A licence in a country where no bank will hold your safeguarding account is a certificate with no business behind it.

Why does the safeguarding account stall so many fintechs?

This is where most licensed fintechs actually get stuck. Safeguarding means customer money must sit at a credit institution (a bank) or in qualifying liquid assets, kept apart from your own money.

The banks willing to offer safeguarding accounts to newly authorised EMIs are a small and shrinking group. They choose based on four things:

• the quality of your management team
• where your funding comes from
• how many high-risk merchant categories you serve
• whether they trust your regulator

So do things in the right order. Start safeguarding conversations before you file. Name the intended bank in the application where you can. And treat a soft indication from a bank as a make-or-break item for the whole plan.

Is it worth licensing outside the EU?

If EU revenue is a minority of your business, the honest answer is often to license elsewhere. VARA and ADGM in the UAE, FINMA in Zwitserland, the FCA in the UK and MAS in Singapore all produce licences that global counterparties accept.

We have restructured groups out of EU applications where the compliance cost was bigger than the EU revenue it protected. We said so before the fee was spent.

How long will it take, and what will it cost?

Total cost to authorisation, including people, is rarely under €400k and frequently more.

Any adviser quoting three months and €50k all-in is selling a shelf company with a registration. That is not an authorisation.

Veelgestelde vragen

Can I passport a CASP licence across the EU?

Yes. Article 59 gives you rights across the whole Union, and Article 65 is the notification that switches on cross-border operation. You send a notification instead of making a second application.

Is an agent or distributor model faster?

Yes, materially. Operating as an agent of a licensed principal gets you to market in months rather than years. The cost is margin and control. It's often the right first step.

Do I need local staff?

Yes. Regulators expect senior management, risk and compliance to be genuinely resident and available, so flying people in will not satisfy them.

Can one entity hold both an EMI and a CASP licence?

In principle yes, and some groups do. But it doubles the supervisory burden, so most keep them separate.

Meer om te lezen

• De meeste fintechvergunningen stranden bij de bank, niet bij de toezichthouder
• MiCA na een jaar: wat er veranderde voor cryptostructuren