Updated: August 2026. PSD2 (Directive 2015/2366/EU) remains the law in force for EU payment services. Its successor package, PSD3 and the Payment Services Regulation, is still moving through the EU legislative process, so the framework below is the one firms are authorised and supervised under today.
The short answer: a Payment Institution (PI) is a company holding its own PSD2 authorisation from a national regulator, with its own capital requirements, safeguarding duties and EEA passporting rights. A Payment Agent acts under someone else’s licence: it is registered by a sponsoring PI, needs no capital of its own, cannot passport independently, and the PI carries full legal liability for everything the agent does. The choice is a trade-off between regulatory investment and speed to market.
What PSD2 Defines: Payment Institution and Payment Agent
Under PSD2, all entities performing regulated payment activities are subject to supervision. A Payment Institution (Article 4(4)) is a legal entity authorised by a Member State’s competent authority to provide payment services independently. A Payment Agent (Article 4(38)) is a natural or legal person acting on behalf of a PI, without independent authorisation, and fully dependent on the PI’s licence.
The European Banking Authority (EBA) maintains a public register of all authorised and registered entities, including Agents and PIs. This ensures market transparency, regulatory oversight, and consumer confidence, as each Agent is explicitly linked to its sponsoring PI in the central register.
How Do the Entry Requirements Compare?
The regulatory gateway into the EU payment market diverges sharply between PIs and Agents.
Payment Institution authorisation
PIs undergo a comprehensive authorisation process, submitting governance, risk management, and control frameworks to the National Competent Authority (NCA). The process ensures that financial and operational capacities are adequate for the proposed activities.
Initial capital requirements
- Money Remittance Only (Service 6): €20,000
- Payment Initiation Services (Service 7): €50,000
- Other Payment Services (Services 1-5): €125,000
These thresholds reflect the relative financial risk of each service. Services involving fund custody require higher solvency buffers.
Small Payment Institutions (exempted PIs)
Small PIs (Article 32 PSD2) may operate under lighter conditions but face strict limits:
- Average monthly transaction volume below €3 million
- No passporting rights across the EEA
This model suits firms testing a local market, while growth or cross-border ambitions require full authorisation.
Payment Agent registration
Agents operate through a notification system: the PI submits registration details to its Home NCA, which informs the Host NCA. The Agent itself is not independently authorised but inherits regulatory oversight and liability from the PI. Commercially, agent status is how many fintechs, paying agents and white-label partners enter the market quickly; Chern & Co supports both routes through its EU payment institution licensing service.
| Criteria | Payment Institution (PI) | Payment Agent (Agent) |
|---|---|---|
| Legal Status | Authorised legal entity | Delegate of a PI |
| Entry Process | Full authorisation (Article 11) | Notification via PI |
| Capital Requirement | €20k to €125k | None directly required |
| Right to Passport | Yes (EEA-wide) | N/A |
What Are the Prudential and Operational Obligations?
Safeguarding of user funds
Article 10 PSD2 mandates strict segregation of client funds from company assets. Even when an Agent handles funds, they are legally considered to be held by the PI, which bears full safeguarding responsibility. Funds must be stored in separate safeguarding accounts or secure assets.
AML/CFT compliance
The PI is the “obliged entity” under EU AML/CFT law, responsible for implementing risk controls, CDD procedures, and reporting to Financial Intelligence Units. Agents perform delegated KYC duties but must report suspicious activity to the PI. The PI remains fully liable for compliance breaches by its Agents.
Auditing and reporting
All PIs must undergo annual external audits and periodic regulatory reporting (e.g., quarterly XBRL returns). They must also maintain ICT and security frameworks, including Strong Customer Authentication (SCA). Agents must follow the PI’s central procedures to ensure consistent compliance.
| Obligation Area | Payment Institution (PI) | Payment Agent (Agent) |
|---|---|---|
| Safeguarding | Mandatory segregation under Article 10 | Operates under PI’s framework |
| AML/CFT Responsibility | Full legal responsibility | Performs delegated checks |
| Audit | Mandatory annual audit | Covered under PI’s audit |
| Professional Indemnity | Required for PIS/AIS | Covered by PI |
How Do Passporting and Supervision Work Across Borders?
Passporting rights
Authorised PIs can operate across the EEA via the passporting mechanism. They may establish Agents or branches in Host Member States. Small PIs cannot passport, restricting them to domestic markets.
Dual supervisory regime
Agents are subject to a dual oversight model:
- Home NCA: Oversees prudential supervision and authorisation.
- Host NCA: Exercises local investigative powers and may request a Central Contact Point (CCP) for communication and control.
| Criteria | Home NCA Role | Host NCA Role |
|---|---|---|
| PI Oversight | Authorisation and prudential control | Limited supervision |
| Agent Notification | Processes and forwards to Host NCA | Investigative authority |
| Infringement Response | Licence enforcement | Direct local action possible |
| Central Contact Point | Monitors compliance | May require appointment |
Who Is Liable When Something Goes Wrong?
Absolute liability
The PI bears full liability for all losses or unauthorised transactions caused by its Agents or employees. This ensures that consumers are protected even if failures occur at the Agent level. Consequently, PIs must establish rigorous governance and internal controls to manage this decentralised risk.
Professional Indemnity Insurance (PII)
For services such as Payment Initiation (PIS) and Account Information (AIS), PSD2 mandates Professional Indemnity Insurance or equivalent guarantees. The EBA defines criteria for minimum coverage based on transaction volume and operational risk, ensuring proportional protection against professional negligence or data breaches.
Which Model Should a Firm Choose?
Balancing regulatory burden and flexibility
The Payment Institution model entails a higher compliance burden but enables unrestricted EEA expansion, ideal for large-scale operations. The Payment Agent model, while easier and faster to implement, limits independence and exposes the PI to aggregated risk from delegated entities.
Strategic options
- Small PI status: Best for testing business models domestically before scaling.
- Full PI licence + Agent network: Suitable for rapid pan-European expansion with robust compliance controls.
- Governance focus: PIs using Agents must invest in real-time compliance monitoring and training, given their absolute liability for Agent conduct.
The choice between becoming a Payment Institution or acting as a Payment Agent under PSD2 is a strategic trade-off between regulatory investment and operational agility. Firms should assess their long-term ambitions, risk appetite, and compliance capacity to determine the most suitable path to sustainable EU market participation.
Frequently Asked Questions
Can a payment agent operate without its own licence?
Yes. A payment agent operates entirely under the sponsoring Payment Institution’s authorisation. The PI registers the agent with its Home NCA, the agent appears in the EBA register linked to that PI, and the PI carries full legal liability for the agent’s conduct.
How much capital does a payment institution licence require?
Initial capital under PSD2 depends on the services provided: €20,000 for money remittance only, €50,000 for payment initiation services, and €125,000 for the other payment services (Services 1-5). Ongoing own-funds requirements then scale with transaction volumes.
Can a small payment institution passport its services across the EEA?
No. Small PIs under Article 32 PSD2 are limited to their home market and to an average monthly transaction volume below €3 million. EEA-wide passporting requires full authorisation.
Who is responsible if a payment agent breaches AML rules?
The Payment Institution. It is the obliged entity under EU AML/CFT law and remains fully liable for compliance failures by its agents, which is why PIs must run continuous monitoring and training across their agent networks.
Chern & Co Ltd, a licensed Irish TCSP, assists fintechs and paying agents on both routes: our EU payment institution licensing service covers scoping, incorporation and the authorisation file, while intermediaries who resell or white-label services can join our partner programme. Contact us to map which PSD2 route fits your model.
Disclaimer: This article is general information on the EU regulatory framework, not legal advice. Authorisation practice varies by national competent authority; obtain professional advice before acting.
