Payment institution lawyers in France

Payment institutions and electronic money institutions (EMIs) are authorised and supervised in France by the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority), after an opinion of the Banque de France on the security of means of payment. ORWL Avocats advises payment fintechs, crypto-asset service providers (CASPs) and stablecoin projects at every stage: qualifying the activity, choosing the status, obtaining authorisation, securing payments, staying compliant and growing the institution. Since 2 March 2026, a CASP that transfers or holds e-money tokens (EMTs) for its clients must also be a payment institution.

The life cycle of a payment or e-money institution

This page is the entry point to our payments practice. It presents the available statuses, the procedure before the ACPR, the dual status of crypto-asset businesses and the obligations that follow authorisation, then points to four detailed pages.

Is ACPR authorisation required?

The question arises as soon as a business handles its clients’ funds. The French Monetary and Financial Code (CMF) reserves eight services to authorised payment service providers, mirroring Annex I of the second Payment Services Directive (Directive (EU) 2015/2366, PSD2): cash deposits and withdrawals on a payment account, the execution of payment transactions (direct debits, credit transfers, card payments), with or without credit, the issuing of payment instruments and the acquiring of payment transactions, money remittance, payment initiation and account information services (CMF, Article L. 314-1, II). The issuance of electronic money is reserved to credit institutions and electronic money institutions (CMF, Article L. 315-1).

Three situations account for most of the requests we receive:

• the marketplace or intermediary that collects the price on behalf of the seller, which is in principle acquiring or money remittance;
• the fintech that offers an account, a card or an e-wallet to its users;
• the CASP that receives funds from its clients or provides services on EMTs.

Exclusions exist: the limited network of acceptors or limited range of goods (CMF, Article L. 521-3, with a notification to the ACPR above EUR 1 million of transactions over twelve months), the commercial agent acting for only one of the parties, and the electronic communications provider within certain amount limits. They are interpreted strictly, and the ongoing revision of EU payments law narrows them. Our page on crypto-assets and payments (in French) details this qualification and the specific case of funds in transit.

Which status for which activity?

The choice of status follows from the qualification. It depends on the services envisaged, the volumes, the need for an EU passport, the capital available and the timetable. The table summarises the six possible routes. The simplified authorisations (agrément simplifié) correspond to the exemptions provided for in Article 32 of PSD2 and Article 9 of the second Electronic Money Directive (Directive 2009/110/EC, EMD2); the detailed pages and the firm help to decide.

The thresholds come from the French Monetary and Financial Code (Articles L. 522-11-1, D. 522-1-1 and D. 522-1-2 for the simplified payment institution; Articles L. 526-19, D. 526-2, D. 526-3 and D. 526-5 for the simplified EMI), from the ministerial order (arrêté) of 29 October 2009 (Article 4) for the capital of payment institutions and from EMD2 (Article 4) for that of EMIs. Simplified authorisations suit a launch; they lapse one month after the ACPR records that the ceilings have been exceeded, so the move to a full authorisation must be planned ahead.

For the procedure and the documents of the application, see Obtaining payment institution or electronic money institution authorisation (in French).

Crypto-assets and payments: the dual status

The MiCA Regulation (Regulation (EU) 2023/1114) and PSD2 overlap on two points.

The first concerns funds. A CASP that holds clients’ funds must place them with a credit institution or a central bank, and a CASP that provides payment services related to its crypto-asset services must be authorised as a payment service provider (MiCA, Article 70). Many platforms therefore hold a dual status, CASP with the AMF (Autorité des marchés financiers, the French financial markets regulator) and payment institution with the ACPR, examined in a coordinated way by the two authorities.

The second concerns e-money tokens. MiCA deems EMTs to be electronic money (Article 48(2)), and electronic money is funds within the meaning of PSD2 (Article 4(25)). The European Commission confirmed this in a letter to the European Banking Authority (EBA) of 6 December 2024. On 10 June 2025, the EBA specified that two crypto-asset services are payment services where the provider acts on behalf of its clients: transferring EMTs and holding EMTs in wallets open to third parties. It recommended not requiring dual authorisation before 2 March 2026; beyond that date, the payment activity of a provider without authorisation must be restricted, with a deferral to 1 July 2026 at the latest for former PSANs (digital asset service providers) under the French transitional regime (EBA opinion of 12 February 2026).

The ACPR drew the consequences of this position in a communication of 19 February 2026 (in French). A CASP that undertakes to limit its payment services to EMTs may file a streamlined payment institution application (agrément allégé): documents already filed with the AMF are not requested again, the Banque de France relies on the information security documents of the CASP file, own funds requirements are calculated under a method close to that of MiCA, and the usual prudential reporting is only required after eighteen months. In return, this authorisation does not allow any service on traditional funds; any extension requires a complete application.

The dual status also works the other way round: the issuer of an EMT must itself be a credit institution or an electronic money institution (MiCA, Article 48(1)). A euro-backed stablecoin project therefore begins with an EMI authorisation before the ACPR, ahead of the MiCA white paper. See Issuing a stablecoin under MiCA (in French).

Obtaining authorisation: how does the procedure work?

The authorisation procedure for a payment institution or an EMI follows a stable path, which we run in the same way as a CASP authorisation:

• Scoping. We understand the project, qualify each flow and each service, and settle the status and the strategy of the application. This phase sometimes takes activities out of the scope of authorisation and saves months.
• Application file. Programme of operations, three-year business plan, governance and internal control, safeguarding of funds, AML/CFT framework, security policy, file on managers and qualifying shareholders. The firm drafts the legal documents and reviews the technical and financial documents prepared by the institution and its providers.
• Filing and completeness review. The application is filed on the ACPR’s portal. The authority first checks that it is complete, then examines it; all exchanges go through the portal.
• Examination. The ACPR sends rounds of questions; in parallel, the Banque de France prepares its opinion on the security of means of payment. We prepare each answer with the institution and take part in the exchanges with the regulator’s staff.
• Decision. The ACPR’s Supervisory College decides after the Banque de France opinion. The authorisation is entered in REGAFI, the French register of financial agents.
• Go-live. Between the decision and the launch, the institution puts in place what the application described: segregated account or guarantee, procedures, reporting, contracts with providers. We remain involved during this phase and beyond.

PSD2 requires the authority to decide within three months of receiving a complete application (Article 12); the French Monetary and Financial Code sets the same period for simplified authorisations (Article R. 522-1). This period only runs from completeness, and in practice the regulator’s questions suspend it. We observe around nine months between filing and decision for a complete application. The points that most often slow an application down are the safeguarding of funds, the outsourcing of critical functions, the separation between effective managers (dirigeants effectifs) and the supervisory body, the chain of control of shareholders located outside the European Union, and the robustness of the business plan.

The security requirements reviewed by the Banque de France have a page of their own: Security of means of payment: preparing for the Banque de France review (in French).

After authorisation: staying compliant

Authorisation opens a lasting relationship with the ACPR. None of our detailed pages covers this aspect on its own; here are its main lines.

What the institution files and declares

• periodic prudential and accounting returns, whose frequency and content depend on the status; institutions under a simplified authorisation file a periodic declaration of compliance with the ceilings and an annual audit report on the safeguarding of funds;
• an annual internal control report, provided for by the ministerial order of 3 November 2014, covering compliance, risks and anti-money laundering;
• annual declarations on anti-money laundering and counter-terrorist financing;
• the notification of major operational incidents, now organised by the DORA Regulation (Regulation (EU) 2022/2554, applicable since 17 January 2025);
• fraud statistics on payment transactions.

What the institution must have approved or must notify

• the appointment of a new effective manager or member of the supervisory body, assessed for good repute, knowledge and experience;
• the acquisition, increase or disposal of a qualifying holding, subject to prior authorisation by the ACPR;
• a change to the programme of operations, the addition of a service or the move from a simplified to a full authorisation;
• the use of an agent or a distributor, registered by the principal institution;
• the provision of services or the establishment of a branch in another Member State, by notification to the ACPR;
• the outsourcing of an important operational function.

What the institution applies day to day

• the safeguarding of funds received from clients, by segregation in a dedicated account or by a guarantee;
• the AML/CFT framework: risk classification, customer due diligence, transaction monitoring, reports to Tracfin (the French financial intelligence unit);
• payment security: strong customer authentication, incident management, protection of sensitive payment data;
• digital operational resilience: ICT risk management, contracts with ICT service providers, testing;
• transparency and users’ rights: pre-contractual information, framework contracts, complaints handling, mediation.

The ACPR checks compliance with these obligations off-site and on-site. Its Sanctions Committee may impose reprimands, prohibitions and financial penalties, and the College may restrict or withdraw the authorisation. The firm supports authorised institutions over time: annual review of the framework, drafting of notifications and applications for changes, preparation and follow-up of inspections, defence before the Sanctions Committee. The topics shared with CASPs are developed on our pages AML/CFT compliance for crypto-asset service providers in France and Digital operational resilience (DORA) for CASPs in France, each of which includes a box on payment and e-money institutions. Capital transactions and changes of managers have their own page: Shareholders and managers of a payment institution (in French).

PSD3 and the PSR: what changes

On 28 June 2023, the European Commission proposed a third Payment Services Directive (PSD3) and a Payment Services Regulation (PSR). The Council and the European Parliament reached a political agreement in November 2025; the Council published the final compromise texts on 23 April 2026. At the time of writing, formal adoption and publication in the Official Journal of the European Union are still pending; transposition and application periods will run from that publication.

For institutions, the main changes are known:

• authorisation and supervision remain in the directive; conduct, transparency, security, anti-fraud and account access rules move to a directly applicable regulation, which reduces divergences between Member States;
• the electronic money institution status merges into the payment institution status, and the Electronic Money Directive (2009/110/EC) is repealed;
• the limited network and commercial agent exclusions are clarified and narrowed;
• institutions already authorised will go through a confirmation or renewal procedure within the periods set by the directive.

We monitor these texts for our clients and already build into authorisation files and compliance overhauls the requirements whose content is settled.

Why work with ORWL Avocats?

ORWL Avocats has advised digital finance projects before the AMF and the ACPR since 2018. In payments, the firm advises payment fintechs, CASPs that hold funds in transit or provide EMT services, stablecoin issuers applying for EMI status, and authorised institutions that extend their activity or change their shareholding. This practice at the crossroads of crypto-assets and payments, before both authorities at once, is the core of our experience. The practice is ranked in Chambers FinTech and recognised by Leaders League in blockchain law.

An authorisation file begins with a legal qualification on which everything else depends: which flows are payment services, which exclusions apply, which status covers the activity, how MiCA and PSD2 fit together. A consultant can assemble the documents; a lawyer is liable for the analysis, deals with the regulator under legal professional privilege, negotiates the contracts with banks and providers, and defends the institution in the event of disagreement, inspection or sanction. A lawyer also coordinates the other aspects of the project: company law, personal data, contracts, tax.

A partner leads each matter, from scoping to decision and then throughout the life of the institution. We work with a network of partners that we coordinate: accountants and statutory auditors, information security providers, insurance brokers, safeguarding banks.