Small payment institutions — the Article 32 exemption, and why it cannot be passported

The Article 32 small payment institution regime is cheaper to enter and, by design, cannot be passported — PSD2 switches off the passporting articles for registered firms in a single line. Directive (EU) 2015/2366 lets member states exempt small providers from most of the authorisation regime below a monthly average of EUR 3 million in payment transactions. What the exemption buys, what it costs, and the 30-day clock that starts when you outgrow it are all in Article 32 — and the account information service regime in Article 33 works on a deliberately different basis. This walks through both.

1. What Article 32 actually exempts

Article 32(1) lets member states exempt, or allow their competent authorities to exempt, natural or legal persons providing the payment services in points (1) to (6) of Annex I from the application of all or part of the procedure and conditions in Sections 1, 2 and 3 of Title II — with the exception of Articles 14, 15, 22, 24, 25 and 26. Those carve-outs are the register, the notification of the register to the EBA, and the supervisory machinery: designation of competent authorities, supervision, professional secrecy and the right of appeal. A registered firm is a supervised firm.

Note the scope limit at the front. Points (1) to (6) of Annex I are the classic payment services. Payment initiation services (point 7) and account information services (point 8) are outside Article 32 entirely — a firm providing those cannot use this route, and the second of them has its own regime in Article 33.

Two conditions apply. Under Article 32(1)(a), the monthly average of the preceding 12 months’ total value of payment transactions executed by the person — including any agent for which it assumes full responsibility — must not exceed a limit set by the member state which “in any event, amounts to no more than EUR 3 million“. For a new entrant the test is applied to the projected total in the business plan, unless the competent authority requires that plan to be adjusted. Under Article 32(1)(b), none of the natural persons responsible for the management or operation of the business may have been convicted of offences relating to money laundering, terrorist financing or other financial crimes.

2. Why it does not passport

Article 32(3) is the provision that decides whether this regime fits a business, and it is one sentence: the persons registered under Article 32(1) “shall be treated as payment institutions, save that Article 11(9) and Articles 28, 29 and 30 shall not apply to them“.

Articles 28, 29 and 30 are the passporting chain — the exercise of the right of establishment and freedom to provide services, the home and host authority notification procedure, and the supervisory arrangements that go with it. Disapplying them means a registered small payment institution has no mechanism to notify into another member state. It is not that passporting is difficult; there is no procedure available to it.

Article 32(2) reinforces the domestic character: a registered person must have its head office or place of residence in the member state in which it actually carries out its business. And Article 32(4) lets member states go further, providing that a registered person may engage only in certain of the activities listed in Article 18.

Facts: a firm registered as a small payment institution in one member state has customers arriving from two neighbouring states through its website, and its board asks how to formalise cross-border activity under the existing registration.

What the rule says: it cannot. Articles 28 to 30 do not apply, so there is no notification route to a host authority, and Article 32(2) requires the head office to be in the member state where the business is actually carried out. Cross-border provision requires full authorisation as a payment institution under Article 11.

What the practitioner does: treats the question as an authorisation project with a lead time, not a notification. In the meantime, the honest position is to stop actively marketing into the other member states rather than to rely on the reverse-solicitation instincts that come from other regimes.

3. Outgrowing the exemption: the 30-day clock

Article 32(5) has two limbs. The registered person must notify the competent authorities of any change in its situation relevant to the Article 32(1) conditions. And where the conditions in paragraphs 1, 2 or 4 are no longer met, member states must ensure that the person concerned seeks authorisation within 30 calendar days in accordance with Article 11.

Thirty days is short for a full authorisation dossier, which is why the trigger has to be monitored rather than discovered. The metric is a rolling one — the monthly average of the preceding 12 months — so it is knowable in advance from the trend, and a firm that only computes it annually will find out late.

Facts: a registered firm’s transaction volumes grow through the year. In month nine the trailing 12-month monthly average crosses the national limit, but nobody recalculates until the annual return in month fourteen.

What the rule says: the obligation to seek authorisation within 30 calendar days ran from the point the condition ceased to be met, not from the point the firm noticed. The intervening period is activity conducted while the basis for the exemption no longer held.

What the practitioner does: computes the trailing 12-month monthly average every month, sets an internal trigger at a margin below the national limit — far enough back to assemble an Article 11 application — and treats crossing it as a board matter with a dated decision to either file or manage volume.

4. What the exemption does not touch

Article 32(6) is unambiguous: paragraphs 1 to 5 “shall not apply in respect of Directive (EU) 2015/849 or of national anti-money-laundering law”. The prudential relief has no AML dimension whatsoever. A registered small payment institution is an obliged entity on the same terms as an authorised one — customer due diligence, transaction monitoring, suspicious transaction reporting and the whole AML/CFT framework apply in full.

This is the most consistently underestimated feature of the regime. The costs the exemption removes are prudential and procedural: initial capital, own-funds calculation, and the fuller authorisation dossier. The costs it leaves are the ones that dominate an operating payments business — the AML function, monitoring, screening, and the reporting that follows a filing.

Article 34 adds a transparency layer at member-state level: a state applying an exemption under Article 32 had to notify the Commission by 13 January 2018 and notify any subsequent change forthwith, and must inform the Commission of the number of persons concerned and, annually, of the total value of payment transactions executed as of 31 December each year.

5. Article 33 works the other way round

Account information service providers are handled separately, and the contrast is instructive. Under Article 33(1), natural or legal persons providing only the service in point (8) of Annex I are exempt from Sections 1 and 2 with the exception of specified points of Article 5(1), Article 5(3) and Articles 14 and 15 — and Section 3 applies, with the exception of Article 23(3).

Article 33(2) then provides that these persons are treated as payment institutions save that Titles III and IV do not apply, with the exception of Articles 41, 45 and 52 where applicable, and Articles 67, 69 and 95 to 98.

The critical difference is what Article 33 does not say. It does not disapply Articles 28, 29 and 30. A registered AISP therefore keeps the passporting route that a registered small payment institution loses — which is why “registered rather than authorised” means two quite different things depending on which service you provide. Article 33 also retains Articles 95 to 98, so the operational and security risk, incident reporting, authentication and SCA obligations continue to apply, including the RTS discussed in our note on SCA exemptions.

6. When the regime actually fits

Reading Articles 32 and 33 together, the small payment institution regime suits a business that is domestic by design and expects to stay under the national limit: a single-market operator with a defined customer base and no cross-border ambition inside the planning horizon. It suits a firm testing a proposition before committing to authorisation less well than it first appears, because the 30-day escalation gives no room to build the dossier once growth arrives.

Where a firm knows it will passport, the registered route adds a migration rather than saving a step: the authorisation has to be obtained eventually, and obtaining it under time pressure with a live customer book is materially harder than obtaining it before launch. Our comparison of where to base an EMI covers the same trade-off from the licensing side, and note that the e-money regime under Directive 2009/110/EC has its own separate exemption in Article 9 of that directive — the two should not be conflated.

7. FAQ

8. What to do, today

• Check the national limit, not the EUR 3 million ceiling. Member states may set it lower, and the plan should be built against the number that applies to you.
• Compute the trailing 12-month monthly average every month, including agent volumes, and set an internal trigger far enough below the limit to assemble an Article 11 dossier inside 30 days.
• If cross-border is on the roadmap at all, price full authorisation now — the registered route cannot be upgraded by notification, and doing it under a live book is the expensive version.
• Do not scope the AML function down. Article 32(6) leaves it untouched, and it is the larger part of the running cost.
• If you provide account information services, read Article 33 rather than Article 32 — different scope, no volume condition, and the passporting articles are not switched off.

Related: Where to base your EMI · Branch versus freedom of services · AISP and PISP registration in France · Own funds and initial capital for PIs and EMIs