PI licence in Luxembourg — the CSSF payment institution authorisation and its capital tiers

A Luxembourg payment institution licence is authorised by the CSSF under the Law of 10 November 2009, and the capital you need is decided by exactly which payment services you tick. A payment institution (PI) is the lighter cousin of the e-money institution: it may execute and acquire payments, initiate them, or move money remittance, but it may not issue electronic money. That single distinction changes the capital floor, the safeguarding design and the reporting perimeter. This piece walks through the CSSF authorisation for a PI — authority, legal basis, the three capital tiers, the file, substance, the AISP registration side-door, realistic timing and what switches on at grant — with worked examples showing how the service scope drives everything else.

1. Who grants and who supervises

The CSSF — the Commission de Surveillance du Secteur Financier — is the competent authority for payment institutions in Luxembourg. No person established in Luxembourg may provide payment services without a written CSSF authorisation as a PI (or the lighter registration for account information services). The CSSF examines the file, runs the supervisory dialogue, and on grant enters the institution on its public register and on the EBA’s central register of payment and e-money institutions. AML/CFT supervision also sits with the CSSF; suspicious-activity reporting goes to the Cellule de Renseignement Financier (CRF), Luxembourg’s FIU, through goAML.

2. Legal basis

• Directive (EU) 2015/2366 (PSD2) — the EU payment-services framework
• Law of 10 November 2009 on payment services (the “PSL”) — the Luxembourg act transposing PSD1 and PSD2; the payment-institution authorisation and the catalogue of payment services live here
• Law of 12 November 2004 on the fight against money laundering and terrorist financing, and CSSF Regulation 12-02 — the AML/CFT framework
• EBA Guidelines on authorisation and registration under PSD2 — directly applied to the CSSF’s assessment
• Regulation (EU) 2024/886 (Instant Payments) and Regulation (EU) 2015/751 (interchange) where the services in scope engage them

3. The three capital tiers — services drive the floor

PSD2 sets the initial-capital floor by service, and the PSL applies it directly. What you may do decides what you must hold:

Where a firm requests more than one category, the highest applicable floor applies to the whole authorisation. The capital is initial capital, fully paid up at grant; ongoing own funds are then the higher of the floor and the calculated requirement (see §6).

4. Who can apply

• A legal person established in Luxembourg, with its head office and genuine central administration in the country — decision-making, key functions and infrastructure located in Luxembourg, not a nameplate
• Initial capital at the tier set by the services requested, fully paid up
• Directors and effective managers of good repute with adequate knowledge and experience, resident and effective in Luxembourg, with the four-eyes principle applied from day one
• Shareholders holding qualifying holdings (10% or more) that are fit and proper

5. What goes in the file

• Programme of operations — the exact payment services sought (mapped to the PSD2 list), the customer journey, geographies and passporting plan
• Business plan — three-year projections with capital and own-funds planning
• Fund-flow and data-flow diagrams — the CSSF expects to see precisely how money and data move, and the role of every business partner and contract
• Safeguarding — segregation of user funds in a separate account at a credit institution, or an insurance / comparable guarantee, evidenced contractually
• Governance and internal control — authorised management, board, organisational chart, four-eyes evidence, and risk, compliance and internal-audit functions proportionate to scale
• AML/CFT programme — risk appetite, policies, and the named officers: the responsable du respect des obligations (RR) at management level and the responsable du contrôle (RC) operationally, under CSSF Regulation 12-02
• ICT and operational resilience — aligned with DORA, PSD2 operational-security expectations and the CSSF outsourcing circular 22/806

6. Ongoing own funds — Methods A, B and C

Beyond the initial floor, a PI’s ongoing own funds are calculated under one of the PSD2 methods, chosen with the CSSF against the business plan:

• Method A — a percentage of the prior year’s fixed overheads
• Method B — a scaled percentage of total payment volume
• Method C — a multiplier applied to a defined income indicator

The requirement is the higher of the initial-capital floor and the chosen method. The CSSF expects a capital-planning narrative that holds under stress, not a snapshot that just clears the floor at grant.

7. Worked example — a remittance startup that under-scopes

Facts: a founder plans a euro remittance corridor to a handful of countries and applies for a money-remittance-only PI at the €20,000 tier. Six months into the CSSF dialogue, the commercial team wants to add prepaid-card acquiring for merchants.

What the rule says: money remittance is PSD2 service 6 (€20,000). Acquiring of payment transactions sits in services 1–5, which carries the €125,000 floor. Adding acquiring is not a variation at the margin — it lifts the whole authorisation to the top tier and pulls in card-scheme, interchange and safeguarding obligations that the €20,000 file never addressed.

What the practitioner does: either freezes scope to remittance and launches on the €20,000 file, adding acquiring later as a formal extension, or re-scopes now to a €125,000 full-PI file before grant. Trying to bolt acquiring onto a remittance authorisation after the fact means re-opening safeguarding, capital and programme-of-operations sections the CSSF has already reviewed — slower than scoping it right once.

8. Worked example — an open-banking PISP

Facts: a fintech builds a pay-by-bank checkout that initiates credit transfers from the customer’s bank but never touches the funds. It debates whether it needs the €125,000 full-PI licence.

What the rule says: initiating a payment without holding client funds is payment initiation — PSD2 service 7 — with a €50,000 initial-capital floor and a mandatory professional indemnity insurance covering PIS liability. It is a lighter authorisation than a fund-holding PI, but it is still a full CSSF authorisation, not a registration.

What the practitioner does: files for a service-7 PI at €50,000, sizes and evidences the PII cover, and builds the strong-customer-authentication and secure-communication interfaces PSD2 requires of a PISP. It does not over-buy the €125,000 licence it does not need — but it also does not mistake PIS for the registration-only AIS regime.

9. The AISP registration side-door

Account information services (PSD2 service 8) are the one payment service that does not require a full authorisation. An AISP is registered rather than authorised: no initial-capital floor, but professional indemnity insurance is mandatory, and the AML, governance and security expectations still apply in proportion. If your product only reads account data and never initiates or executes payments, the registration route is faster and cheaper — but the moment you add initiation, you are into the €50,000 authorisation.

10. Realistic timing

PSD2 sets a three-month decision period once the file is complete — but the clock turns on when the CSSF deems the file complete, and question rounds extend the substantive dialogue. Realistic end-to-end for a first-time PI applicant is six to twelve months, including pre-application engagement, drafting and two or more feedback rounds. The file may be prepared in English, French or German. Early contact with the CSSF’s Innovation, Payments, Market Infrastructures and Governance department is worth taking, particularly to confirm the service mapping before it hardens the capital tier.

11. PI or EMI — which do you actually need

The test is simple: if customers load a balance they can spend later, that is e-money and you need the EMI licence. If you only move money for specific transactions, a PI is the right — and cheaper — perimeter.

12. What switches on at grant

• Passport notifications to host member states — branch or Freedom of Services
• Your own Luxembourg IBAN range under the LU country code
• AML reporting to the CRF through goAML, plus ongoing CSSF prudential and statistical returns
• Instant Payments Regulation obligations, including verification of payee, where you send or receive euro credit transfers
• CESOP once cross-border payment thresholds are met

13. FAQ

14. What to do, today

• Map your product to the PSD2 service list first — the service mapping fixes the capital tier and the safeguarding design.
• Take a pre-application meeting with the CSSF to confirm the mapping before you draft the file.
• Draw the fund-flow and data-flow diagrams; the rest of the file follows the flows.
• Decide PI vs EMI early — if there is any stored-value element, price in the €350,000 EMI file instead.
• Design the safeguarding and AML stack (RR/RC, goAML) at build time, not post-grant.

Related: EMI licence in Luxembourg · How to issue Luxembourg IBANs · PI licence in France