Payment Institution licence in France — the ACPR application file

A Payment Institution licence in France — the Établissement de Paiement (EP) authorisation at the ACPR — covers PSD2 payment services without e-money issuance. The legal framework is the Code monétaire et financier (CMF), Articles L.522-1 and following, transposing PSD2 into French law. Capital floors are lower than for an EME, the file structure overlaps heavily, and the post-grant reporting catalogue is broadly the same. The real decisions are scope decisions: which of the eight PSD2 services you request determines your capital, your safeguarding obligation and your AML perimeter. This piece walks through the framework, the dossier, and worked examples of the scoping choices that make or break the file.

1. Who grants and who supervises

The ACPR is the competent authority for authorisation and ongoing prudential and conduct supervision. AML intelligence sits with TRACFIN, France’s FIU. Where the EP’s services touch investment products — for instance a PISP initiating payments into investment platforms — the AMF interfaces additionally. The public face of the regime is REGAFI, the ACPR’s register of authorised firms.

2. Legal basis

• Directive (EU) 2015/2366 (PSD2) — the EU framework
• Code monétaire et financier, Articles L.522-1 to L.522-19 — the French implementation
• Ordonnance n° 2017-1252 and Décret n° 2017-1313 — the substantive transposition instruments
• The ACPR’s authorisation notices and dossiers-type for Établissements de Paiement
• EBA Guidelines on authorisation under PSD2 — applied by the ACPR in assessing the file

3. The eight PSD2 services

Annex I of PSD2 lists the services an EP can be authorised to provide. In French CMF terms:

1. Dépôt d’espèces sur un compte de paiement et toutes opérations qu’exige sa gestion
2. Retrait d’espèces sur un compte de paiement et toutes opérations qu’exige sa gestion
3. Exécution d’opérations de paiement (virements, prélèvements, paiements par carte)
4. Exécution d’opérations de paiement couvertes par une ligne de crédit
5. Émission d’instruments de paiement ou acquisition d’opérations de paiement
6. Transmission de fonds (remittance)
7. Services d’initiation de paiement (PIS)
8. Services d’information sur les comptes (AIS)

4. Capital floors and ongoing own funds

PSD2 sets initial-capital thresholds by service mix:

Ongoing own funds must be the higher of the floor and the output of one of the three PSD2 Article 9 methods (A, B or C). The chosen method is documented in the dossier with projections; the ACPR expects the calculation to be shown, not asserted.

5. Worked example — a remittance-only applicant

Facts: a startup wants to offer money transfers from France to family recipients abroad. No payment accounts, no cards, no credit — customers hand over funds, the firm delivers them to the beneficiary. Projected monthly volume grows steadily over the three-year plan.

What the rule says: that is Service 6, transmission de fonds, with a €20,000 initial-capital floor — the lightest full-authorisation entry point. Ongoing own funds are the higher of that floor and the Article 9 method output, which for a volume-driven remittance model will overtake the floor as volumes grow. Funds in transit must be safeguarded under the CMF safeguarding provisions.

What the practitioner does: resists the temptation to also request Services 1–3 “for flexibility” — that would jump the floor to €125,000 and widen the programme of operations the ACPR must assess. The scope can be extended later by a variation once the account-based product is real.

6. AIS — registration, not authorisation

An AISP — Service 8 only — registers with the ACPR rather than seeking full authorisation. The file is shorter and the prudential requirements lighter, but conduct, ICT/security and professional-liability expectations remain, and the registration appears on REGAFI like any authorisation. The moment the firm adds any other service — most commonly PIS — it leaves the lite regime and needs full authorisation.

7. Worked example — an open-banking fintech adding PIS

Facts: a registered AISP aggregating French bank accounts wants to add a “pay by bank” button — initiating credit transfers from the accounts it already reads. It assumes the existing registration covers the upgrade.

What comes back: it does not. PIS is Service 7 and requires full authorisation with a €50,000 capital floor, professional-indemnity coverage for initiation activity, and PIS-specific documentation: the SCA position, dedicated-interface compliance, and consent management. The AIS registration cannot simply be stretched; the firm files for authorisation covering Services 7 and 8.

What the practitioner does: plans the upgrade as a genuine authorisation project — six-plus months, not a notification — and engages the ACPR’s pôle Fintech-Innovation before drafting. Launching the payment button on the back of the registration alone would mean providing a payment service without authorisation, which is a criminal-law problem in France, not a paperwork one.

8. What goes in the dossier

The structure mirrors the EME dossier — see the EMI licence in France piece for the section-by-section walkthrough. The EP-specific differences:

• Programme of operations anchored to the Services 1–8 selection, with volumes per service
• Safeguarding under Article L.522-17 CMF — the PSD2 counterpart of the EMD2 safeguarding rule, applied to funds received for payment transactions
• PIS-specific documentation where Service 7 is offered: SCA exemption position, dedicated-interface compliance, professional-indemnity coverage
• AIS-specific documentation where Service 8 is offered: access-to-account mechanism and customer-consent management
• French-language requirement — the file and key governance documents are expected in French, the same way as for an EME

9. Realistic timing

The statutory review period is three months from a complete file under PSD2 — but “complete” is the operative word, and the clock restarts with material supplements. End to end, with pre-application engagement, drafting and feedback rounds, a well-prepared applicant should plan six to nine months. Pre-application meetings through the ACPR’s pôle Fintech-Innovation are strongly encouraged and materially de-risk the first submission.

10. What switches on at grant

• SURFI — the ACPR’s supervisory reporting framework
• TRACFIN AML reporting
• CESOP — once cross-border payment thresholds are met
• IPR statistical reporting
• Conduct and complaints reporting to the ACPR
• Passporting notifications to host states

And on the horizon: the PSD3 / PSR package reshapes the regime materially — the Commission’s proposal merges the EME and EP categories into a single payment-institution licence with sub-categories, with existing PSD2 authorisations expected to be grandfathered under transitional provisions. Projects scoped now should track the file.

FAQ

What to do, today

• Founder / COO: fix the Services 1–8 selection against the three-year plan before any drafting — it drives capital, safeguarding and AML scope.
• Project lead: book the pre-application conversation with the ACPR’s pôle Fintech-Innovation early; it is free de-risking.
• AIS-only teams: plan against the registration regime, and treat any move into PIS as a full authorisation project.
• CFO: model ongoing own funds under the Article 9 methods, not just the initial floor — growth changes the binding constraint.
• Head of reporting: build the post-grant stack (SURFI, TRACFIN, CESOP, IPR) in parallel with the application, and watch the PSD3 / PSR file.

Related: EMI licence in France · PI licence in Spain · PSD3 and the PSR tracker · PI licence in Luxembourg · PSD2 agents and the Article 14 register · Own funds and initial capital for PIs and EMIs