Payment Institution licence in Spain — the BdE application file
Payment Institution authorisation at Banco de España covers PSD2 payment services without e-money issuance. The legal framework is Royal Decree-Law 19/2018 transposing PSD2 into Spanish law, supplemented by Royal Decree 736/2019 and Banco de España Circular 3/2019. Capital is lower than for an EMI; the file structure overlaps; the post-grant reporting catalogue is largely the same. This piece walks through what differs.
1. Who grants and who supervises
The competent authority is Banco de España. AML supervision sits with BdE and SEPBLAC. Where the PI offers AISP or PISP services that touch investment products, CNMV interfaces additionally. The split is the same as for an EMI; the difference is in what activities the licence covers.
2. Legal basis
- Directive (EU) 2015/2366 (PSD2) — the EU framework
- Royal Decree-Law 19/2018 — transposition of PSD2 in Spain
- Royal Decree 736/2019 — implementing regulation
- Banco de España Circular 3/2019 — operational and supervisory rules for payment institutions
- EBA Guidelines on authorisation under PSD2 — directly applicable
3. The capital floors
PSD2 sets different capital thresholds depending on the payment services covered:
- €20,000 — for money-remittance-only PIs (Payment Service 6)
- €50,000 — for Payment Initiation Service (PIS) providers (Payment Service 7)
- €125,000 — for PIs offering Services 1–5 (account-servicing, deposits, transfers, card issuing, acquiring)
- €50,000 — for Account Information Service (AIS) providers (Payment Service 8), which are subject to a registration regime rather than full authorisation
Ongoing own funds must be the higher of the floor and the result of one of three methods (A, B or C in PSD2 Article 9). The chosen method is documented in the file with worked examples.
4. Which Services does my licence cover?
PSD2 Annex I lists eight services. The application must specify which ones the PI will offer:
- Cash deposits and account-servicing operations
- Cash withdrawals from a payment account
- Execution of payment transactions (including transfers, direct debits, card payments)
- Execution of payment transactions where the funds are covered by a credit line
- Issuing of payment instruments or acquiring of payment transactions
- Money remittance
- Payment initiation services (PIS)
- Account information services (AIS)
The selection drives the capital floor, the safeguarding requirement, the conduct rules, and the AML perimeter. PIs offering PIS or AIS face specific operational requirements around access to payment-account data and SCA exemptions.
5. What goes in the application file
The structure mirrors the EMI file. The differences are scope-related, not procedural:
- Programme of operations — anchored to the Services 1–8 selection
- Business plan — three-year projections, capital, profitability
- Governance map — board, senior management, key function holders, fitness-and-properness
- Internal-control framework — risk, compliance, internal audit
- ICT and operational-resilience framework aligned with DORA
- Safeguarding model — different from EMI’s Article 7 safeguarding; PSD2 Article 10 covers PIs, with the same segregation or insurance options
- AML / CTF programme with the designated SEPBLAC representative
- Outsourcing register
- Conduct framework — complaint-handling, marketing communications, fees and charges
- For PIS / AIS: documentation of the SCA exemption position, the dedicated interface to account servicing PSPs (or modified customer-interface compliance), and PII coverage where required
- Shareholder structure — direct and indirect, with fitness-and-properness on qualifying shareholders
6. AIS — registration, not authorisation
7. PSD3 on the horizon
The PSD3 / PSR package will reshape this regime. The Commission’s proposal includes merging the EMI and PI categories into a single Payment Institution licence with sub-categories. Existing PSD2 authorisations are expected to be grandfathered with transitional provisions. Projects scoped now should track the file.
8. Realistic timing
Statutory review is three months from a complete file under PSD2. End-to-end with pre-application engagement, drafting and feedback rounds runs four-to-six months for a well-prepared applicant. Pre-application engagement with BdE is encouraged.
9. What switches on at grant
The reporting catalogue is broadly the same as for an EMI:
- FTF — monthly to SEPBLAC where the PI offers account-servicing
- DMO — monthly systematic AML reporting
- DTE — balance-of-payments where cross-border
- Banco de España statistical returns specific to PIs
- CESOP — once cross-border payment thresholds are met
- IPR statistical report — annual
- Passport notifications to host states where activity is offered cross-border
10. FAQ
Should I apply for a PI or an EMI?
If the business model involves issuing electronic money (stored-value accounts in your name from which the customer can spend) — EMI. If the business model is purely payment services (transfers, acquiring, card issuing, remittance, PIS, AIS) — PI. The choice is not reversible without re-licensing.
Can I combine PI services with investment services?
Yes, but additional CNMV-side authorisations are needed for the investment-services component. The licensing tracks run separately.
Is the PSD3 / PSR package likely to require re-licensing?
The Commission’s proposal includes transitional provisions for existing authorisations. Current PSD2 licences are expected to be grandfathered with a defined window to align with new requirements. Final terms will be set in the adopted text.
Does an AISP need to issue Spanish IBANs?
No. AIS providers do not hold customer funds and do not issue accounts. They aggregate account-information from other PSPs under PSD2 access rights.
What about Crypto-Asset Service Provider activity?
CASP authorisation under MiCA is separate from PI authorisation under PSD2. Some firms hold both. See our CASP authorisation in Spain piece.
Can the PI use a sponsor bank for settlement?
Yes. Indirect participation in payment systems through a sponsor bank is the common model for new PIs. Direct participation requires settlement-account access at the national central bank.
11. What to do, today
- Choose your PSD2 services 1–8 carefully — this drives capital, safeguarding and AML scope.
- Engage BdE in a pre-application meeting; surface structural issues early.
- If you are AIS-only, plan against the lighter registration regime, not the full authorisation file.
- Build the post-grant reporting infrastructure (FTF, DMO, DTE, EDITRAN onboarding) in parallel with the application.
- Watch the PSD3 / PSR file — it reshapes this regime materially.
Related: EMI licence in Spain · Where to base your EMI · PSD3 and the PSR tracker
