Where to base your EMI: a comparison of six EU jurisdictions
The choice of home regulator drives the next eighteen months of your project — and the eighteen years that follow. Six EU member states are common candidates for an Electronic Money Institution authorisation that you intend to passport across the bloc: Spain, the Netherlands, France, Italy, Germany and Luxembourg. The legal framework is the same — Directive 2009/110/EC, the Second Electronic Money Directive (EMD2). The differences are operational, not statutory: how each supervisor reads the file, how long they take to read it, and what they expect to see on year two.
1. The legal common ground
Every member state implements EMD2 with the same core requirements:
- Initial capital: €350,000 minimum own funds for an EMI.
- Programme of operations describing the products, channels and customer journeys.
- Governance map with named key-function holders, fitness-and-properness evidence.
- ICT framework aligned with DORA from January 2025.
- Safeguarding model for customer funds — segregated account or insurance.
- AML / CTF framework with risk model, policies, named representative.
- Outsourcing register and contracts.
What differs is the supervisor’s local expectation — and the practical experience of getting the file read.
2. Six jurisdictions, side by side
🇪🇸 Spain — Banco de España (BdE)
- Statutory review: three months from a complete file. Realistic end-to-end with feedback rounds: four to six months.
- Application language: Spanish.
- Strengths: deep examiner expertise on payment-services topics; predictable feedback-round structure; well-documented AML expectations through SEPBLAC.
- Watch-outs: the supplementary national-reporting set (CIRBE, DTE, the SEPBLAC FTF and DMO) starts day-one of operations. See our SEPBLAC pillar.
- Best for: firms targeting Iberian and LATAM-corridor customers, or wanting a structured supervisory dialogue.
🇳🇱 Netherlands — De Nederlandsche Bank (DNB)
- Statutory review: three months. Realistic end-to-end: six to nine months for first-time applicants.
- Application language: Dutch or English (DNB accepts English files).
- Strengths: prudential and conduct supervision under one roof; mature fintech-engagement function; well-documented Wwft expectations.
- Watch-outs: the Banking Information Reference Portal connection is the single biggest source of slip — see our Reference Portal piece.
- Best for: firms wanting an English-language supervisory dialogue and a deep European fintech ecosystem.
🇫🇷 France — Autorité de contrôle prudentiel et de résolution (ACPR)
- Statutory review: three months. Realistic end-to-end: six to nine months.
- Application language: French. Some supplementary annexes accepted in English.
- Strengths: strong consumer-protection orientation; clear expectations on conduct and SCA; well-defined AML reporting through TRACFIN.
- Watch-outs: French-language requirement is real — supervisor expects core documents in French and direct dialogue with the team in French.
- Best for: firms with a French market focus or with French-speaking founding teams.
🇮🇹 Italy — Banca d’Italia
- Statutory review: three to four months under TUB and the implementing measures. Realistic end-to-end: eight to twelve months.
- Application language: Italian.
- Strengths: meticulous review style; strong on operational resilience and outsourcing; CONSOB-Banca d’Italia split is well-defined.
- Watch-outs: the Archivio Unico Antiriciclaggio (daily AML archive obligation) is unusually granular; OAM agent registration is a separate process.
- Best for: firms with a domestic Italian focus; weaker fit for a pure passporting hub.
🇩🇪 Germany — BaFin / Bundesbank
- Statutory review: three months under ZAG. Realistic end-to-end: six to ten months.
- Application language: German for core file; supplementary materials in English are tolerated case by case.
- Strengths: deep expertise on BaaS / fintech-bank topology; clear MaRisk and BAIT framework; mature DORA alignment.
- Watch-outs: BaFin’s expectation that the AML representative sits inside the regulated entity is the strictest of the six; outsourcing is harder to get accepted.
- Best for: firms operating bank-fintech stacks or with a strong German market focus.
🇱🇺 Luxembourg — CSSF
- Statutory review: three months. Realistic end-to-end: six to nine months.
- Application language: French, German or English (CSSF accepts all three; English is common for fintechs).
- Strengths: European-language flexibility; deep funds-industry infrastructure; well-defined CSSF circulars on outsourcing, IT, governance.
- Watch-outs: capital and substance expectations are pragmatic but real — an empty letterbox in Luxembourg will not be authorised.
- Best for: cross-border product distribution; firms valuing English-language supervisory dialogue.
3. Capital and own-funds reality
The €350,000 EMD2 floor is the same in every member state. What differs is the supervisor’s view on ongoing own funds — the EMI must hold capital proportional to outstanding e-money under the formula in Article 5 of EMD2 (Method A, B or D). In practice:
- BdE, DNB, ACPR and CSSF apply the EMD2 formula with limited national overlay.
- BaFin applies a more conservative Method-A-like view by default unless the firm demonstrates a justification.
- Banca d’Italia is granular on the segregation calculation and the safeguarding mechanism.
4. Passporting once authorised
For the choice between Freedom of Services and a branch, see our companion piece on branch vs Freedom of Services.
EMD2 passporting is straightforward in principle: the home supervisor notifies the host supervisor and the EMI is authorised to provide services there under the EU passport. In practice:
- Notifications are processed within one to three months at the host side.
- Some host states ask additional questions before de facto activity is permitted, especially around the AML representative for the host market — see our cross-border AML rep piece.
- National-reporting obligations (statistical, AML, payments) often kick in once host activity exceeds modest thresholds.
5. A practical decision framework
Three useful filters:
- Language and operating reality — pick the supervisor whose application language matches the language your governance and operations actually run in. A French file produced by translation alone is visible to ACPR.
- Customer market — if 60%+ of your activity is in one member state, base there. Passporting works, but the home supervisor cares about consumer outcomes in the home market most.
- ICT and outsourcing posture — if you run a bank-fintech stack with significant outsourced ICT, BaFin and CSSF will probe deepest; budget extra time.
6. FAQ
Is one jurisdiction objectively faster than another?
The statutory three-month period is a common starting point. End-to-end times converge between six and ten months once feedback rounds are counted. The biggest variable is the quality of the file, not the supervisor.
Does the EMD2 review change after DORA applies?
Yes — every supervisor since January 2025 expects the application to be DORA-aligned: ICT third-party register, incident-classification process, threat-led testing readiness. This applies uniformly across the six jurisdictions.
Can I move my licence from one member state to another later?
Practically no. The licence is granted by the home supervisor; moving means re-applying in the new state. Plan as if the choice is permanent.
What about smaller member states outside this comparison?
Other EU member states authorise EMIs and can be valid choices for specific business models. The six above are common because of market depth, supervisory capacity and the size of the local fintech ecosystem.
Is “passporting” the same as “freedom of services” and “freedom of establishment”?
“Passporting” is the colloquial term covering both. Freedom of services means you operate cross-border without a local establishment; freedom of establishment means you set up a local branch or subsidiary. Both flow from the home authorisation.
7. What to do, today
- Map your business model against the six supervisors’ known emphases — language, ICT, outsourcing, AML.
- Talk to two or three of the supervisors before submitting; pre-application meetings are encouraged everywhere and surface red flags early.
- Build the file in the supervisor’s working language from the start — translation post-hoc is visible.
- Plan the post-grant reporting catalogue (national returns, AML files, statistical returns) before submission, not after.
Related: How to launch Dutch IBANs · What is SEPBLAC? · What is the Reference Portal?
