Executive Summary
The Second Payment Services Directive (PSD2, Directive 2015/2366/EU) created the legal foundation for payment services across the European Union, promoting innovation, transparency, and competition while ensuring consumer protection. Within this framework, firms must choose between two core legal statuses — operating as a Payment Institution (PI) with full authorization or acting as a Payment Agent (Agent) under the supervision of an authorized PI. This comparison highlights the regulatory, operational, and strategic implications of both approaches under PSD2.
I. Legal Foundations and Structural Definitions
Under PSD2, all entities performing regulated payment activities are subject to supervision. A Payment Institution (Article 4(4)) is a legal entity authorized by a Member State’s competent authority to provide payment services independently. Conversely, a Payment Agent (Article 4(38)) is a natural or legal person acting on behalf of a PI, without independent authorization, and fully dependent on the PI’s license.
The European Banking Authority (EBA) maintains a public register of all authorized and registered entities, including Agents and PIs. This ensures market transparency, regulatory oversight, and consumer confidence, as each Agent is explicitly linked to its sponsoring PI in the central register.
II. Authorization and Entry Requirements
The regulatory gateway into the EU payment market diverges sharply between PIs and Agents.
Payment Institution Authorization
PIs undergo a comprehensive authorization process, submitting governance, risk management, and control frameworks to the National Competent Authority (NCA). The process ensures that financial and operational capacities are adequate for the proposed activities.
Initial Capital Requirements
- Money Remittance Only (Service 6): €20,000
- Payment Initiation Services (Service 7): €50,000
- Other Payment Services (Services 1–5): €125,000
These thresholds reflect the relative financial risk of each service. Services involving fund custody require higher solvency buffers.
Small Payment Institutions (Exempted PIs)
Small PIs (Article 32 PSD2) may operate under lighter conditions but face strict limits:
- Average monthly transaction volume < €3 million
- No passporting rights across the EEA
This model suits firms testing a local market, while growth or cross-border ambitions require full authorization.
Payment Agent Registration
Agents operate through a notification system—the PI submits registration details to its Home NCA, which informs the Host NCA. The Agent itself is not independently authorized but inherits regulatory oversight and liability from the PI.
| Criteria | Payment Institution (PI) | Payment Agent (Agent) |
|---|---|---|
| Legal Status | Authorized legal entity | Delegate of a PI |
| Entry Process | Full authorization (Article 11) | Notification via PI |
| Capital Requirement | €20k–€125k | None directly required |
| Right to Passport | Yes (EEA-wide) | N/A |
III. Prudential and Operational Obligations
Safeguarding of User Funds
Article 10 PSD2 mandates strict segregation of client funds from company assets. Even when an Agent handles funds, they are legally considered to be held by the PI, which bears full safeguarding responsibility. Funds must be stored in separate safeguarding accounts or secure assets.
AML/CFT Compliance
The PI is the “obliged entity” under EU AML/CFT law, responsible for implementing risk controls, CDD procedures, and reporting to Financial Intelligence Units. Agents perform delegated KYC duties but must report suspicious activity to the PI. The PI remains fully liable for compliance breaches by its Agents.
Auditing and Reporting
All PIs must undergo annual external audits and periodic regulatory reporting (e.g., quarterly XBRL returns). They must also maintain ICT and security frameworks, including Strong Customer Authentication (SCA). Agents must follow the PI’s central procedures to ensure consistent compliance.
| Obligation Area | Payment Institution (PI) | Payment Agent (Agent) |
|---|---|---|
| Safeguarding | Mandatory segregation under Article 10 | Operates under PI’s framework |
| AML/CFT Responsibility | Full legal responsibility | Performs delegated checks |
| Audit | Mandatory annual audit | Covered under PI’s audit |
| Professional Indemnity | Required for PIS/AIS | Covered by PI |
IV. Cross-Border Activity and Supervision
Passporting Rights
Authorized PIs can operate across the EEA via the passporting mechanism. They may establish Agents or branches in Host Member States. Small PIs cannot passport, restricting them to domestic markets.
Dual Supervisory Regime
Agents are subject to a dual oversight model:
- Home NCA: Oversees prudential supervision and authorization.
- Host NCA: Exercises local investigative powers and may request a Central Contact Point (CCP) for communication and control.
| Criteria | Home NCA Role | Host NCA Role |
|---|---|---|
| PI Oversight | Authorization and prudential control | Limited supervision |
| Agent Notification | Processes and forwards to Host NCA | Investigative authority |
| Infringement Response | License enforcement | Direct local action possible |
| Central Contact Point | Monitors compliance | May require appointment |
V. Liability and Risk Management
Absolute Liability
The PI bears full liability for all losses or unauthorized transactions caused by its Agents or employees. This ensures that consumers are protected even if failures occur at the Agent level. Consequently, PIs must establish rigorous governance and internal controls to manage this decentralized risk.
Professional Indemnity Insurance (PII)
For services such as Payment Initiation (PIS) and Account Information (AIS), PSD2 mandates Professional Indemnity Insurance or equivalent guarantees. The EBA defines criteria for minimum coverage based on transaction volume and operational risk, ensuring proportional protection against professional negligence or data breaches.
VI. Strategic Recommendations
Balancing Regulatory Burden and Flexibility
The Payment Institution model entails a higher compliance burden but enables unrestricted EEA expansion, ideal for large-scale operations. The Payment Agent model, while easier and faster to implement, limits independence and exposes the PI to aggregated risk from delegated entities.
Strategic Options
- Small PI Status: Best for testing business models domestically before scaling.
- Full PI License + Agent Network: Suitable for rapid pan-European expansion with robust compliance controls.
- Governance Focus: PIs using Agents must invest in real-time compliance monitoring and training, given their absolute liability for Agent conduct.
In conclusion, the choice between becoming a Payment Institution or acting as a Payment Agent under PSD2 is a strategic trade-off between regulatory investment and operational agility. Firms should assess their long-term ambitions, risk appetite, and compliance capacity to determine the most suitable path to sustainable EU market participation.
