European Union Money Transfer License

EU EMI License, API & SPI: The Complete Guide to E-Money & Payment Institution Licensing in the European Union

One authorization, thirty countries — but only if you choose the right license class. The European Union regulates money movement through three permissions, and the single most important fact in this guide is which of them travel: the EU EMI license (Electronic Money Institution) and the Authorised Payment Institution (API) both passport across the entire EU/EEA, covering roughly 450 million people from a single home-state authorization, while the Small Payment Institution (SPI) — the cheap, fast, registered entry route — is national-only, with no passport at all.

This guide covers the full landscape: how the two-layer regulatory system works, all three license classes in depth with capital and safeguarding mechanics, exactly how passporting works (and for whom), how to choose your member state, the application and registration processes with honest timelines, MiCA's reshaping of the market, the deepest license secondary market in the world, and the harmonized qualifying-holding rules that govern every acquisition of an authorised European institution.

How EU Payments Regulation Works: National Licenses, European Rules

Authorization is national; the rulebook is European. Each member state's regulator licenses institutions under two harmonizing directives, transposed into national law:

• The E-Money Directive (EMD2) governs the issuance of electronic money — stored monetary value issued on receipt of funds and accepted by third parties. EMD2 creates the EMI.

• The Second Payment Services Directive (PSD2) governs payment services — accounts, transfers, acquiring, remittance, card issuing, payment initiation (PIS), and account information (AIS) — and introduced open banking to the world. PSD2 creates the API, and its Article 32 lets member states operate the SPI exemption regime for small firms.

The European Banking Authority (EBA) coordinates supervision, maintains guidelines (including the joint guidelines on qualifying-holding assessments that standardize acquisitions), and keeps the central register of authorised and registered institutions — the register every buyer and counterparty should check before believing any license claim. On the horizon sits the PSD3/PSR package, the announced successor regime expected to apply toward the end of the decade, which consolidates the e-money and payments frameworks; licenses granted now transition into it.

Crypto-asset services are governed by MiCA, fully applicable since 2024–25. Two MiCA facts matter enormously for payments operators: fiat-referenced stablecoins are regulated as e-money tokens (EMTs) that only credit institutions and EMIs may issue, and crypto-asset service providers (CASPs) require their own authorization, with transitional grandfathering windows closed by mid-2026.

The Three EU License Classes Compared

The decision logic runs on three questions. First: does your product hold customer balances? Wallets and stored value mean e-money, which means the EMI. Second: how many countries? If the answer is more than one, only the EMI and API qualify — the SPI's missing passport is disqualifying for any pan-European ambition. Third: what volume? A single-country business under the national cap can enter through the SPI in months, then upgrade.

The Authorised Payment Institution (API) in Depth

The API is the EU's full payments license without e-money issuance: money remittance, operating payment accounts, executing transfers and direct debits, card issuing, merchant acquiring, payment initiation, and account information services — passportable across all 30 EU/EEA states from one home authorization.

Initial capital scales with the service set (harmonized under PSD2):

Ongoing own funds run under the familiar Methods A (overheads), B (payment volume), or C (income) as implemented by the home regulator; safeguarding is mandatory — relevant funds segregated at a credit institution or covered by insurance/guarantee, from receipt until payout.

Who chooses the API: corridor remittance operators, B2B payout and collections platforms, acquirers, and open-banking businesses whose model never stores customer value. The economics are meaningfully lighter than the EMI's — €20K–€125K versus €350K — and for pure money movement the EMI adds cost without capability. Two caveats: retrofitting e-money permissions later is a heavy variation process, and under MiCA only EMIs (and banks) can ever issue e-money tokens — so operators with wallet or stablecoin ambitions usually take the EMI from the start.

The Small Payment Institution (SPI) in Depth

The SPI is PSD2's Article 32 exemption made flesh: a registration regime for small payment firms that member states may (not must) operate, trading speed and cost against two hard limits.

What makes it attractive:

• No meaningful capital requirement and a lighter, faster process — realistically 3–9 months at a fraction of authorization cost.

• National implementations with real markets around them: Poland's MIP (mała instytucja płatnicza) is the best-known, with a cap of €1.5M in average monthly payment transactions; Lithuania offers limited-activity licenses on similar national-only logic; several other states run variants. The PSD2 ceiling for any national regime is €3M/month.

• A genuine secondary market: registered SPI-class entities trade actively (see values below), and for single-country entries they are the cheapest regulated seat in Europe.

What the constraints are — and they define the class:

• No passport. None. An SPI registered in Poland serves Poland; crossing a border means authorization. This is the structural difference from the UK's SPI, where post-Brexit nothing passports anyway — inside the EU, the SPI's missing passport is the whole price of its cheapness.

• No AIS or PIS under the exemption.

• National volume caps (€3M/month maximum, frequently lower — Poland's €1.5M) that growing firms hit quickly.

• Not every member state offers the regime, so the SPI decision is also a member-state decision.

Who chooses the SPI: operators proving a model in one market, groups establishing an EU foothold ahead of a full application, and businesses whose volumes genuinely stay national and small. The classic lifecycle is SPI first, API or EMI later — and the upgrade is a full authorization application in which a clean SPI operating record is visible credit.

The EU EMI License in Depth

The EMI is the flagship: e-money issuance plus every payment service, passportable EU/EEA-wide, and since MiCA the only non-bank gateway to fiat-referenced stablecoin issuance in Europe.

• Initial capital: €350,000, paid in and evidenced.

• Ongoing own funds: 2% of average outstanding e-money (Method D), with payment-services own funds layered on where relevant.

• Safeguarding is mandatory — segregation at credit institutions or investment in secure liquid assets, or insurance/guarantee — with national nuances and, everywhere, the same operational bottleneck: a safeguarding bank willing to hold the account. An EMI with tested safeguarding banking, or better, CENTROlink settlement, carries real scarcity value.

• The MiCA premium: e-money tokens (single-fiat stablecoins) may only be issued by credit institutions and EMIs, with issuance, par-redemption, and reserve rules layered onto the e-money framework. Any European stablecoin ambition requires an EMI, full stop — a durable strategic premium on full EMI authorizations, visible in every valuation below.

Passporting: How One License Covers Thirty Countries

Passporting is the payoff of the single market, and its mechanics deserve precision because they apply to authorised institutions only — the EMI and the API. The SPI is excluded.

• Two modes. Freedom of services: providing services cross-border into a host state without local establishment. Freedom of establishment: operating through a branch or through agents/distributors located in the host state (the agent-network model that powers much of European remittance).

• The process. The institution notifies its home regulator of the intention to operate in named host states, with the service list and, for establishment, branch/agent details. The home regulator reviews and transmits the notification to the host regulators — for branch and agent passports within a three-month framework, with services passports typically faster in practice. No re-authorization anywhere; host states supervise conduct, the home state supervises prudentially.

• Practical planning: budget weeks per state, run in parallel, immediately after authorization; a well-run program notifies its entire target list at once. Agent onboarding in host states carries its own registration flow through the home regulator.

• Coverage: the EU 27 plus the EEA states (Norway, Iceland, Liechtenstein). Not the UK — that requires a separate UK license — and not Switzerland.

Passporting is also the honest answer to "why pay for authorization when the SPI is cheap": one API authorization plus thirty notifications costs a fraction of thirty national anything-elses, and there is no other legal route to pan-European coverage short of a bank.

Choosing Your Member State

Where you license determines your regulator relationship, your rails access, your talent pool, and how counterparties perceive you — for the EMI and API alike (the SPI decision is narrower: it is simply the state whose market you want).

For most EMI and API applicants, Lithuania remains the rational default: the deepest regulator experience with fintech files, the EU's most liquid license secondary market, and CENTROlink removing the single most dangerous dependency in European payments — a commercial bank's continued willingness to serve you.

Substance, every class: the era of the Baltic letterbox is over. Expect local executive management, a locally resident AML officer, board meetings held where the license lives, and operations genuinely run from the licensing state — tested at authorization, at every qualifying-holding review, and at inspection.

Applying for a License in the EU: The Processes, Step by Step

Authorization (EMI and API)

1. Member-state selection and pre-application engagement (months 0–2). Most serious regulators — Lithuania formally so — offer pre-application meetings; a pre-socialized file moves faster.

2. The build (months 1–6). Regulatory business plan with three-year projections and the passporting strategy (which states, services or establishment, agent plans); program of operations mapping every service to PSD2/EMD2 definitions; safeguarding methodology with the bank or CENTROlink arrangements identified; AML/CFT framework aligned to the AMLD framework and local law; ICT and security risk management aligned to DORA, now a first-class assessment pillar; governance, outsourcing register, wind-down plan.

3. Submission and assessment (months 6–14). Statutory three-month windows run from completeness, and completeness is iterative: two to four rounds of questions, fit-and-proper interviews, challenge on projections and safeguarding.

4. Authorization, registration in the national and EBA registers, then passporting notifications — filed for the whole target list at once.

Honest totals: EMI, 12–14 months and €120,000–€250,000 in professional build costs plus €350K capital; API, 9–12 months and somewhat lighter builds, plus the service-based capital.

Registration (SPI)

The national registration route compresses everything: business description, fitness-and-propriety of managers, AML arrangements, volume projections against the national cap. Realistic end-to-end: 3–9 months depending on the state, at build costs commonly in the €20,000–€60,000 range.

Buying an Existing EU Licensed Institution

Because fresh authorization takes a year, operating licenses command premiums, and Europe — Lithuania at the center, Poland for the SPI class — runs the deepest license secondary market in the world. Assets span four tiers:

Add €120,000–€250,000+ in deal costs at authorization scale (lighter at SPI scale). Dormant licenses of any class trade at 40–60% discounts and deserve them; several regulators have canceled long-dormant authorizations outright. And always verify the exact license class and permissions on the EBA and national registers — "EMI" in a sale deck is sometimes an API, and occasionally an SPI, in the register.

Change of Control: The Qualifying-Holding Regime

For authorised institutions (EMI and API), EU rules harmonize the process across all member states:

• Threshold: acquiring a qualifying holding — 10% of capital or voting rights, or significant influence — requires prior approval from the national regulator, with further bands at 20%, 30%, and 50%, assessed up the chain to ultimate beneficial owners.

• The clock: a harmonized 60-working-day assessment from acknowledgment of a complete notification, interruptible once (20–30 working days). Practical elapsed time including preparation: 3–4 months on license-class assets, 4–6 months on operating EMIs, where the regulator re-underwrites the client book and safeguarding alongside the buyer.

• The file: built to the EBA/ESMA joint guidelines — acquirer identity and structure to UBOs, reputation, financial soundness, source of funds with documentation, the business plan for the target, fitness of proposed management. Regulated financial-group buyers clear fastest, and sellers price approval probability.

• Closing discipline: approval precedes completion; unapproved acquisitions risk suspended voting rights, forced unwinding, and sanctions.

• Passporting survives the acquisition — the notifications belong to the institution, not the owner — but expect host regulators to be informed and the home regulator to test whether the buyer's plans change the passported footprint.

For registered SPIs, transfers run through the national regulator's notification and fitness assessment of incoming owners and managers — lighter and faster (commonly 2–4 months end to end), with careful buyers pre-clearing before completion anyway.

Apply vs. Acquire vs. Partner in the EU

A sequencing pattern worth naming: acquire or register an SPI in your first market for immediate capability, run the API or EMI authorization in parallel, and passport the moment it lands.

EU Licensing Cost Summary

Common Mistakes in the EU Market

• Building a multi-country plan on an SPI, then discovering the missing passport one border into it.

• Taking the EMI "to be safe" when the model never stores value — €350K capital and wallet-grade scrutiny for an API business (unless stablecoins are on the roadmap, in which case the EMI is exactly right).

• Choosing a member state on application speed alone, then paying the correspondent-banking perception cost at every counterparty review.

• Filing without DORA-grade ICT documentation — the newest reliable source of regulator questions.

• Buying an "EMI" that the EBA register reveals to be an API, or an SPI. Verify permissions on the register, never the sale deck.

• Underestimating substance in Lithuania on five-year-old anecdotes; the Bank of Lithuania of 2026 tests what it once waved through.

• Forgetting that passporting covers the EU/EEA only — not the UK, not Switzerland.

Frequently Asked Questions

What is the difference between an EMI, an API, and an SPI in the EU?
An EMI issues electronic money plus all payment services and passports EU/EEA-wide; an API provides all payment services without e-money and also passports; an SPI is a national-only registration for small payment firms under volume caps (≤€3M/month, often lower), with no passport and no AIS/PIS. Balances mean EMI; multi-country means EMI or API; one small market can mean SPI.

Which EU licenses can passport?
Authorised institutions only: the EMI and the API, via freedom of services or establishment (branches and agents), through home-regulator notifications covering the EU 27 plus the EEA. The SPI cannot passport — that is the price of its cheapness.

How long does each license take?
EMI: 12–14 months. API: 9–12 months. SPI registration: 3–9 months depending on the member state. Acquisitions: 2–4 months for SPI-class transfers, 3–4 months change-of-control on license-class assets, 4–6 on operating EMIs.

How much capital does each class require?
EMI: €350,000 plus 2% of average outstanding e-money ongoing. API: €20,000 (remittance only), €50,000 (PIS), or €125,000 (fuller sets), plus Methods A/B/C ongoing. SPI: none or minimal, by national implementation.

Which member state is best?
Lithuania for most EMI and API applicants — deepest fintech-licensing experience, English-language process, the most liquid secondary market, CENTROlink. Poland leads the SPI class with the MIP. Ireland suits future credit-institution ambitions.

What is CENTROlink and why does it matter?
The Bank of Lithuania's payment gateway giving licensed institutions direct access to SEPA schemes, including instant payments, through the central bank — removing the commercial-bank dependency that sinks more European payment firms than any regulation.

Can an SPI upgrade?
Yes — the classic lifecycle is SPI first, API or EMI later, with the clean operating record as visible credit in the authorization file. File before the national volume cap bites, not after.

Can an API issue stablecoins?
No. Under MiCA, e-money tokens may only be issued by credit institutions and EMIs — the strongest strategic argument for taking the EMI when digital-asset ambitions are anywhere on the roadmap.

What is a qualifying holding?
10% or more of capital or voting rights in an authorised institution (or significant influence), at any level of the chain. Crossing it requires prior regulator approval under the harmonized 60-working-day assessment; unapproved acquisitions risk unwinding.

Does passporting survive an acquisition?
Yes — notifications belong to the institution, not the owner — though the home regulator will test whether the buyer's plans change the passported footprint, and host regulators are informed.

Are dormant licenses worth buying?
Only at the 40–60% discounts the market applies, in any class; regulators treat reactivation as quasi re-authorization and several have canceled long-dormant licenses outright.

What happens with PSD3?
The announced PSD3/PSR package consolidates the e-money and payments regimes toward the end of the decade. Licenses granted now transition; incumbency ahead of a regime change is historically the cheap seat.

How Faisal Khan LLC helps with EU Licensing

Faisal Khan LLC advises on EU licensing strategy across all three classes — SPI registrations and upgrades, API and EMI authorizations with passporting rollout, member-state selection, and buy-side acquisitions through the qualifying-holding process.

We work with payment and e-money firms entering the EU end-to-end — starting with which class of authorization you actually need (an SPI registration, or a full API or EMI authorization), which member state to establish in, and whether to apply fresh, upgrade an existing SPI as you scale, or acquire an authorized entity through the qualifying-holding process. From there we support the build — from compliance scoping and local incorporation to passporting rollout — and connect you with the right partners to get your project started.

This guide is published by Faisal Khan LLC for general informational purposes. It does not constitute legal, tax, accounting, or investment advice, and no regulatory outcome is guaranteed. Figures are indicative as of July 2026; confirm current requirements with the relevant national regulator and qualified EU counsel before acting.