A payment product can look commercially ready long before it is legally ready. The deciding issue is often whether the business is carrying out regulated payment services, holding client funds, or controlling the movement of money. Payment authorisation requirements therefore need to be addressed before merchant onboarding, processor contracts, marketing campaigns, or a planned launch date create obligations that the business cannot yet meet.
For founders building payment institutions, e-money businesses, marketplaces, crypto-adjacent payment products, or payment rails for high-risk merchants, authorisation is not a box to tick. It shapes the operating model, banking access, investor confidence, geographic reach, and eventual exit value. A weak application can delay launch. A poorly scoped model can place an otherwise promising group on the wrong side of regulatory expectations.
What payment authorisation actually covers
Within the EU framework, payment services are principally regulated under PSD2, while the issuance of electronic money falls under the Electronic Money Directive and local implementing law. In Cyprus, an applicant will generally deal with the Central Bank of Cyprus for payment institution or electronic money institution authorisation. The exact route depends on what the business does in practice, not what it calls itself.
A business may require authorisation if it executes payment transactions, acquires card payments for merchants, remits funds, initiates payments, provides account information services, or issues e-money. Receiving money into an account and paying it onwards can be a regulated activity even where the commercial product is presented as a wallet, platform balance, loyalty solution, settlement service, or treasury tool.
The distinction between a payment institution and an electronic money institution is commercially significant. A payment institution can provide specified payment services but cannot generally issue e-money. An EMI can issue electronic money as well as provide payment services, subject to its authorisation. If customers receive stored value that is electronically held, accepted by parties other than the issuer, and redeemable at par value, the EMI route may be required.
There are limited exemptions, including certain technical service provider, commercial agent, limited network, and group exemptions. These are narrow and fact-sensitive. They should not be used as a branding exercise to avoid regulation. Supervisors will assess the full payment flow, contractual allocation of responsibility, control of funds, customer journey, and how the product is marketed.
Payment authorisation requirements begin with scope
The strongest applications start with a detailed regulatory perimeter assessment. This maps each entity, product feature, payment flow, source of funds, destination of funds, customer type, and third-party provider. It also tests where the group is established, where clients are targeted, and which activities are outsourced.
This work often identifies an important strategic choice. A founder may build a new regulated entity from the ground up, acquire an existing authorised business, operate as an agent or distributor of an authorised institution, or partner with a bank or EMI while validating the market. Each option offers a different balance of speed, control, capital commitment, and regulatory exposure.
An agency or programme-management model may enable a faster launch, but it will not provide the same autonomy as holding the authorisation. A direct licence creates more control over product, customer relationships, and expansion, but requires greater investment in governance, capital, systems, and ongoing compliance. For a high-volume or high-risk proposition, that investment may be the foundation of a more valuable business rather than merely a cost of entry.
The application must reflect the real operating model
Regulators do not authorise presentation decks. They authorise a credible, controlled business. The business plan must explain how the company will generate revenue, acquire clients, process transactions, manage fraud, prevent financial crime, safeguard funds, respond to complaints, and remain viable under pressure.
A generic compliance manual is rarely enough. If the business intends to serve online gaming, digital assets, cross-border merchants, affiliates, or other higher-risk sectors, its risk framework must show that it understands those sectors. This means realistic merchant due diligence, transaction monitoring scenarios, source-of-funds procedures where appropriate, sanctions screening, chargeback controls, and escalation routes.
The corporate structure matters just as much. Regulators will expect transparency over shareholders, beneficial owners, group entities, funding sources, and intra-group arrangements. Offshore companies are not inherently problematic, but unclear ownership, unexplained payment flows, and artificial decision-making structures will create friction. A structure must support a genuine regulated presence, not obscure who controls it.
Core requirements for a payment institution or EMI
The final requirements vary by jurisdiction, service scope, and application route, but a serious applicant should expect to demonstrate the following:
- Appropriate initial capital and an ongoing own-funds calculation proportionate to the proposed services and transaction volumes.
- A clear programme of operations, including forecasts, financial assumptions, client segments, payment flows, and outsourcing arrangements.
- Fit and proper shareholders, directors, and senior managers with transparent source-of-wealth and source-of-funds evidence.
- Effective governance, including local substance, clear reporting lines, independent oversight, and management with relevant payments experience.
- Safeguarding arrangements that protect customer funds, alongside reconciliation, segregation, and contingency processes.
- A proportionate compliance framework covering AML, counter-terrorist financing, sanctions, fraud, data protection, complaints, operational resilience, and security.
Capital deserves particular attention. Minimum capital thresholds are only the starting point. The business must also show it can fund operations through the build phase, absorb slower-than-expected revenue, and meet its ongoing own-funds obligations. An optimistic forecast without credible working capital can undermine confidence in the application.
Safeguarding is equally central. Customer funds must be protected from the institution’s own creditors through recognised safeguarding methods. The practical mechanics need to work every day: client-money records, reconciliations, designated accounts, exception management, and management oversight. A safeguarding policy that cannot be operated by finance and operations teams will not protect customers or the authorisation.
Governance, substance and outsourcing
Many payment businesses are built through specialist vendors. Core banking providers, card processors, cloud providers, identity-verification tools, fraud systems, customer support teams, and compliance technology can all sit outside the regulated entity. Outsourcing is accepted, but responsibility cannot be outsourced.
The authorised firm must retain control, understand its dependencies, and be able to monitor performance. Material outsourcing arrangements should include clear service levels, audit rights, data-access provisions, business continuity measures, subcontracting controls, and orderly exit planning. If a critical provider fails, the board must know how payments will continue, how customer funds remain protected, and how clients will be informed.
Substance is often misunderstood as a headcount target. It is better understood as evidence that the regulated business is genuinely directed and controlled from its authorised location. Key decisions, risk ownership, records, governance meetings, and senior management accountability should align with that reality. A nominal local director paired with all material decisions made elsewhere creates a difficult position.
Do not confuse payments regulation with MiCA
A crypto business may need more than one regulatory analysis. MiCA authorisation for crypto-asset services does not automatically permit regulated payment services, and a payment institution or EMI authorisation does not automatically permit crypto-asset services. The answer depends on the exact asset, custody model, settlement path, and whether fiat funds or e-money are involved.
This is especially relevant for businesses offering crypto cards, fiat on-ramps, wallets, payment accounts, stablecoin-linked products, or merchant settlement. A legally sound structure may require separate permissions, separate entities, or carefully defined partnerships. Attempting to force all activities into one entity can make governance, safeguarding, risk management, and banking relationships harder rather than simpler.
A practical route from concept to authorisation
The most efficient route is to settle the regulatory perimeter before committing to technology architecture and customer terms. Once the scope is clear, the group structure, capital plan, ownership documentation, board composition, policies, and supplier contracts can be designed around the intended licence.
Preparation should then move in parallel. Management should be ready for fitness and propriety review; financial projections should reconcile with the operating plan; safeguarding arrangements should be negotiated early; and the compliance programme should match the product’s real risk profile. A well-managed application is consistent across every document. The numbers, narrative, contracts, policies, and governance model should tell the same story.
Authorisation is only the beginning. After launch, the business must maintain capital, report accurately, review risks, oversee outsourcing, manage incidents, and adapt as services expand. New corridors, new merchant categories, new group companies, and new products can all change the regulatory analysis.
For ambitious payment founders, the right structure is not the one that merely gets through an application. It is the one that protects client funds, gives banks and partners confidence, and leaves room to build the next stage of the business without having to rebuild its regulatory foundation.