Buying an EMI or PI licence: the change-of-control rules
There is no such thing as buying a payment licence. There is only buying the company that holds one — and the rules that govern who is allowed to own it. “Buy an EMI licence in Luxembourg” is one of the most persistent searches in European payments, and the answer always has the same shape: an authorisation is granted to a legal person, it cannot be assigned, and the way in is to acquire shares in the authorised entity. That acquisition is itself regulated. This piece sets out the two provisions that govern it, the thresholds that actually trigger a filing, what the supervisor can do if you get it wrong, and why the banking playbook does not apply.
1. The authorisation attaches to the entity
Authorisation is granted to an undertaking, on the basis of its programme of operations, governance, own funds, safeguarding arrangements and the suitability of its shareholders. None of that is transferable. A buyer acquires the shares, and the authorisation continues undisturbed — provided the conditions on which it was granted continue to be met.
Two conditions bear directly on a change of ownership. Under Article 11(6) of PSD2 (Directive (EU) 2015/2366), competent authorities shall refuse authorisation if, taking into account the need to ensure sound and prudent management, they are not satisfied as to the suitability of shareholders holding qualifying holdings. Under Article 11(7), where close links exist, authorisation is granted only if those links do not prevent effective supervision. Both are continuing conditions, not entry tests.
2. Two provisions, one for each licence type
The change-of-control regime sits in different places depending on what you are buying, and the two texts are close but not identical:
| Target | Provision | Trigger |
|---|---|---|
| Payment institution | PSD2 Article 6, “Control of the shareholding” | Acquiring or further increasing a qualifying holding so the proportion of capital or voting rights would reach or exceed 20%, 30% or 50%, or so the PI becomes a subsidiary |
| Electronic money institution | EMD2 (Directive 2009/110/EC) Article 3(3) | Acquiring or disposing of a qualifying holding, or increasing or reducing it, so the proportion would reach, exceed or fall below 20%, 30% or 50%, or so the EMI becomes or ceases to be a subsidiary |
Article 3(1) of EMD2 applies a specified list of PSD2 provisions to EMIs mutatis mutandis — Article 5, Articles 11 to 17, Article 19(5) and (6) and Articles 20 to 31. Article 6 is deliberately absent, because EMD2 carries its own equivalent in Article 3(3). Both provisions bite on direct or indirect holdings, and both run in reverse: a seller crossing down through 20%, 30% or 50%, or ceasing to be the parent, notifies on the same terms as a buyer.
3. The 10% that is not a trigger, and the 20% that is
“Qualifying holding” is defined by cross-reference to Article 4(1)(36) of Regulation (EU) No 575/2013: a direct or indirect holding representing 10% or more of the capital or of the voting rights, or which makes it possible to exercise a significant influence over the management of the undertaking.
That 10% is a definition, not a notification threshold: the obligation in PSD2 Article 6(1) and EMD2 Article 3(3) starts at 20%. The gap is where deals get untidy, because 10% still matters twice over. The significant-influence limb means a holding well under 10% of capital can be a qualifying holding if the shareholder agreement gives board control or veto rights. And Article 5(1)(m) of PSD2 requires the authorisation application to identify every qualifying holder, the size of the holding and evidence of suitability — so a sub-20% acquisition creating a new qualifying holder changes information the supervisor already holds, even though Article 6 is not engaged.
4. What the notification is, and what it is not
The obligation is to inform the competent authority in writing, in advance. Under PSD2 Article 6(2) the proposed acquirer supplies information indicating the size of the intended holding together with the relevant information referred to in Article 23(4) of Directive 2013/36/EU; EMD2 Article 3(3) makes the equivalent cross-reference. In practice the acquirer files whatever the home authority’s notification pack calls for — ownership chain up to the ultimate beneficial owners, financial soundness, source of the acquisition funding, integrity and repute, and the intended strategy for the target.
What the text does not contain matters as much. There is no harmonised assessment period in PSD2 or EMD2 — no sixty-working-day clock, no acknowledgement deadline, no interruption mechanism. Those belong to the banking, insurance and securities regimes. Timing is national practice and varies widely: ask the supervisor, do not read it off the directive.
5. Why the banking playbook does not transfer
Advisers who have done bank M&A reach for the Joint Guidelines on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector (JC/GL/2016/01), applicable since 1 October 2017. Those guidelines harmonise the assessment across the banking, insurance and securities sectors. Payment institutions and electronic money institutions are not among the target undertakings they cover.
That does not make the criteria irrelevant — reputation, financial soundness, governance and money-laundering risk are the same concerns everywhere, and national authorities frequently apply analogous tests. It means you cannot rely on a harmonised procedure: form, content and timetable come from the home member state, so a group deal across several states should expect several processes rather than one.
6. What happens if the notification is skipped
Under PSD2 Article 6(3), where the influence of a proposed acquirer is likely to operate to the detriment of prudent and sound management, competent authorities shall express their opposition or take other appropriate measures — the text names injunctions, penalties against directors or the persons responsible for management, and suspension of the voting rights attached to the shares. The same paragraph applies similar measures to persons who simply fail to give the prior information.
Article 6(4) covers the worst case: where a holding is acquired despite opposition, member states must provide — regardless of any other penalty — for the corresponding voting rights to be suspended, the nullity of votes cast, or the possibility of annulling them. EMD2 Article 3(3) mirrors both. A completed acquisition can leave the buyer holding shares it cannot vote.
7. Three worked examples
Example 1 — 12% with a veto
Facts: an investor takes 12% of an authorised payment institution, with a shareholders’ agreement giving it a veto over the business plan and one of three board seats.
Rule: 12% is a qualifying holding under Article 4(1)(36) of the CRR, and the veto independently satisfies the significant-influence limb. But it does not reach 20%, so the Article 6(1) trigger is not met.
What the team does: no Article 6 filing, but the Article 5(1)(m) picture the authority holds is now wrong — a new qualifying holder whose suitability has never been assessed. Update the shareholder information and be ready to evidence the investor’s repute; silence is what turns a routine minority round into a supervisory finding.
Example 2 — the indirect acquisition
Facts: a fund acquires 100% of a holding company whose only asset is 60% of an authorised EMI. No EMI shares change hands.
Rule: EMD2 Article 3(3) applies “directly or indirectly”. The fund indirectly acquires 60% and the EMI becomes its subsidiary — two independent triggers.
What the team does: notify the EMI’s competent authority in advance, mapping the chain from the fund’s controllers down to the EMI, and check whether the fund’s other holdings create close links engaging Article 11(7). An upstream transaction that never touches the share register is still a change-of-control filing.
Example 3 — signing before notifying
Facts: a buyer signs and completes a 55% purchase of a payment institution, intending to notify the authority once the deal is public.
Rule: the obligation under Article 6(1) is to inform in advance. Failure to provide the prior information attracts the same measures as an adverse influence finding under Article 6(3) — injunctions, penalties against management, suspension of voting rights.
What the team does: the fix is sequencing, and it is free — notification is a condition precedent to completion in a well-drafted share purchase agreement. The cost of waiting is weeks; the cost of not waiting is a suspended voting block and a supervisory relationship opened on a breach.
8. What the buyer inherits on day one
The authorisation survives the change of ownership, and so does everything attached to it. On completion the entity still has to satisfy its initial-capital and own-funds requirements — for an EMI, initial capital of not less than EUR 350,000 under Article 4 of EMD2 — still has to safeguard relevant funds, maintain its agent and distributor registrations, and keep its passport notifications accurate.
The diligence list is therefore the licence conditions themselves: the programme of operations against what the business actually does today, the safeguarding arrangement and its attestation history, own-funds headroom, the agent register, open supervisory correspondence and any undertakings given, and the AML framework. A licence bought without that review comes with someone else’s remediation plan.
9. FAQ
Can a payment or e-money licence be transferred to another company?
No. Authorisation is granted to a specific legal person and is not assignable. Acquiring the entity’s shares is the route, and that acquisition is itself subject to prior notification once the thresholds are crossed.
Where is the notification threshold set?
At 20%, 30% and 50% of capital or voting rights, plus the point at which the institution becomes (or ceases to be) a subsidiary. PSD2 Article 6(1) for payment institutions, EMD2 Article 3(3) for EMIs.
Does a 10% stake have to be notified?
Not under Article 6 or Article 3(3) — 10% is the definition of a qualifying holding in Article 4(1)(36) of Regulation (EU) No 575/2013, not the notification trigger. It still matters: the supervisor holds shareholder information under Article 5(1)(m) of PSD2 that must remain accurate.
Do sellers have to notify as well as buyers?
Yes. Both provisions apply to a decision to dispose of a qualifying holding, or to reduce it below 20%, 30% or 50%, or so that the institution ceases to be a subsidiary.
How long does the assessment take, and is there a deadline?
Neither PSD2 nor EMD2 sets a harmonised assessment period. The sixty-working-day mechanics familiar from bank acquisitions come from the banking regime and do not apply here. Timing is national practice — ask the home authority early.
What can the supervisor do if we complete without notifying?
Article 6(3) permits injunctions, penalties against directors or persons responsible for management, and suspension of voting rights — expressly including for failure to give prior information. Where a holding is acquired despite opposition, Article 6(4) requires suspension, nullity of votes cast, or annulment.
10. What to do, today
- Screen the cap table for influence, not only percentages — veto and board-appointment rights can create a qualifying holding below 10% — and identify the correct text before drafting: PSD2 Article 6 for a payment institution, EMD2 Article 3(3) for an EMI.
- Map the ownership chain to the ultimate controllers, including indirect and upstream acquisitions, and check for close links that engage Article 11(7).
- Ask the home authority for its notification pack and expected timetable at the outset — there is no directive period to plan against — and make notification a condition precedent to completion.
- Diligence the licence conditions themselves — safeguarding, own funds, agent register, passport notifications, open supervisory correspondence — because all of them survive the sale.
Related: Where to base your EMI · Own funds and initial capital · PSD2 passporting notifications · Reporting obligations at market entry
