Payment institution and EMI authorisation in France
Providing payment services or issuing electronic money in France requires authorisation from the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority), granted after an opinion of the Banque de France on the security of means of payment. ORWL Avocats prepares and runs the application for two types of applicant: the fintech setting up its own payment institution or electronic money institution (EMI), and the crypto-asset service provider (CASP) that, since 2 March 2026, must also be a payment institution to transfer or hold e-money tokens (EMTs) for its clients. The statutory time limit is three months from a complete application; we observe around nine months between filing and decision.
Which authorisation should you apply for?
The status follows from the activity, never the other way round. Three questions guide the choice: do you issue electronic money, are your payment services limited to the EMTs of your CASP business, and which volumes and markets are you targeting?
Which ACPR authorisation do you need?
Indicative diagram, to be confirmed by analysing each flow. An issuer of electronic money whose average outstanding amount stays below EUR 5 million may apply for a simplified EMI authorisation.
A prior question comes before these three: does the activity require authorisation at all? The limited network exclusion, or agent or distributor status for an authorised institution, may apply. ORWL Avocats also carries out this preliminary qualification, in particular for activities that combine crypto-assets and payments (in French).
Payment institution with full authorisation
It may provide all the payment services listed in the French Monetary and Financial Code (CMF, Article L. 314-1, II), use agents and serve other Member States under the EU passport. Its initial capital depends on the services: EUR 20,000 for money remittance only, EUR 50,000 for payment initiation and EUR 125,000 for other services (CMF, Article L. 522-7; ministerial order (arrêté) of 29 October 2009, Article 4). Under Article L. 522-6, the ACPR expects at least two effective managers (dirigeants effectifs).
Payment institution under a simplified authorisation
The ACPR may grant a simplified authorisation (agrément simplifié), the French implementation of the option in Article 32 of PSD2, where the average amount of payment transactions over the preceding twelve months, including through agents, does not exceed EUR 3 million a month (CMF, Articles L. 522-11-1 and D. 522-1-1). The minimum capital is EUR 40,000 (Article D. 522-1-2), and the institution is not subject to an ongoing own funds requirement. In return:
- money remittance, payment initiation and account information services are closed to it;
- it does not benefit from the EU passport;
- it files a periodic declaration of compliance with the ACPR and, each year, an audit report on its segregated account or guarantee.
This status suits a launch with controlled volumes. It requires close monitoring of volumes and early preparation of the move to full authorisation.
Electronic money institution
An EMI issues and manages electronic money, a stored monetary value that can be redeemed, and may provide payment services. Its initial capital is EUR 350,000 (Directive 2009/110/EC, Article 4; ministerial order of 2 May 2013). A simplified authorisation is available where average outstanding electronic money stays below EUR 5 million, with a ceiling of EUR 250 per instrument (CMF, Article L. 526-19).
MiCA reserves the issuance of an EMT to credit institutions and EMIs (Regulation (EU) 2023/1114, Article 48(1)). The firm supports the issuer all the way: EMI authorisation, then the white paper, the reserve of assets and the right of redemption (issuing a stablecoin under MiCA (in French)).
A CASP whose payment services are limited to EMTs follows a dedicated procedure, described further down this page.
What does the application file contain?
The application is filed on the ACPR portal using the authority’s standard form. It covers seven parts; the last one underpins the Banque de France opinion on the security of means of payment. For a CASP providing EMT services, the third column shows what the streamlined procedure changes.
| Part of the file | What the ACPR and the Banque de France check | For a CASP providing EMT services | Expected deliverables |
|---|---|---|---|
| Programme of operations | The exact payment services envisaged, the flows, the operating model, partners and any agents | To be produced, limited to the EMT services provided as a CASP. Read also: the ACPR sets out the conditions of the streamlined authorisation for CASPs offering EMT services (in French) | Programme of operations, flow charts |
| Business plan | Viability over three years, volume assumptions, own funds calculation | To be produced | Three-year business plan, budget forecast |
| Governance, managers and shareholders (in French) | At least two effective managers, their good repute and competence, qualifying shareholders and the chain of control | Taken from the file submitted to the AMF; identity of the members of the supervisory body, which must be separate from management | File on managers and shareholders, articles of association, group chart |
| Capital and own funds | Paying up of the initial capital, method for calculating own funds | Evidence of capital and own funds; method based on fixed overheads accepted | Certificate of paid-up capital, own funds calculation |
| Safeguarding of funds | Segregation or guarantee, reconciliations, separation of assets | Separation of client assets from the provider’s own assets, a point stressed by the ACPR | Description of safeguarding arrangements, segregated account agreement or guarantee contract |
| Internal control and AML/CFT | Permanent and periodic control, compliance, money laundering risk classification | Description of internal control to be produced | Description of the internal control framework, AML/CFT procedures, risk classification |
| Security of means of payment (in French) | Security policy, risk analysis, incidents, sensitive payment data, encryption, strong customer authentication | Relies on the security documents submitted to the AMF; additional items requested by the Banque de France | Security policy, incident management procedure, map of sensitive payment data, encryption policy, description of strong customer authentication |
The firm drafts the legal documents and reviews the technical and financial documents prepared by the institution and its providers. Above all, it checks their consistency: the same flow must be described in the same way in the programme of operations, the business plan, the security policy and the AML/CFT procedures. Such discrepancies between documents account for a large share of the authority’s questions.
The security part calls for dedicated work with the technical teams. ORWL Avocats also prepares institutions for the Banque de France review of the security of means of payment (in French).
Initial capital and own funds: how much is needed?
Two requirements apply cumulatively. Initial capital must be paid up at the time of authorisation. Own funds must then be held at all times; they grow with the business and may never fall below the initial capital. For a payment institution, their amount is calculated under one of the three methods of the ministerial order (arrêté) of 29 October 2009 (Articles 29 to 31), which transposes Article 9 of PSD2 (Directive (EU) 2015/2366).
| Method | Basis | Calculation | Scaling factor k |
|---|---|---|---|
| A · Fixed overheads | Fixed overheads of the preceding year; in the first year, those projected in the business plan | 10% of the basis | No |
| B · Payment volume | One twelfth of the total amount of payment transactions executed in the preceding year | Decreasing rates by slice: 4% up to EUR 5 million 2.5% from EUR 5 to 10 million 1% from EUR 10 to 100 million 0.5% from EUR 100 to 250 million 0.25% above | Yes |
| C · Relevant indicator | Interest income and expenses, commissions and fees received, other operating income | Decreasing rates by slice: 10% up to EUR 2.5 million 8% from EUR 2.5 to 5 million 6% from EUR 5 to 25 million 3% from EUR 25 to 50 million 1.5% above | Yes |
The scaling factor k is 0.5 for an institution that provides money remittance only and 1 for other payment services. Method A suits institutions whose structural costs outweigh their volumes, which is often the case at launch.
The directive leaves it to the national authority to determine the applicable method. The choice is prepared in the business plan and discussed with the ACPR during the examination; we model it with the institution’s accountant.
Two regimes depart from this pattern:
- an electronic money institution calculates the requirement for issuance under a method of its own, 2% of average outstanding electronic money (ministerial order of 2 May 2013), and applies method A, B or C to its payment services unrelated to issuance;
- a CASP using the streamlined application may apply method A, the closest to MiCA; according to the ACPR, the requirement should in principle be covered by the one MiCA already imposes on the CASP, a quarter of its fixed overheads (Regulation (EU) 2023/1114, Article 67), without falling below the initial capital for the payment service concerned.
How are client funds safeguarded?
The funds an institution receives from its clients do not belong to it: it may not use them for its own account (CMF, Article L. 522-1). It must safeguard them under one of the two methods provided for by PSD2 (Article 10) and the French Monetary and Financial Code (Article L. 522-17 for payment institutions, Article L. 526-32 for EMIs).
Segregation, the default method
Client funds are never commingled with the institution’s own funds. Where they are still held at the end of the business day following their receipt, they are deposited in a separate account with a credit institution or invested in secure, liquid, low-risk assets. They are then insulated from the institution’s other creditors, including in insolvency.
In practice, segregation requires:
- a bank willing to open the account, after its own review of the project;
- a segregated account agreement suited to the institution’s flows;
- daily reconciliations between the funds owed to clients and the segregated funds.
The firm negotiates the agreement with the bank and drafts the reconciliation procedures that the ACPR will review.
A guarantee, the alternative
An institution may instead cover the funds with an insurance policy or a comparable guarantee from an insurance undertaking or a credit institution outside its group. The amount must match the funds that would otherwise have been segregated, and the cover is called upon if the institution defaults. This route requires finding a guarantor; the contract must cover exactly the volumes in the business plan.
For a CASP, the ACPR stresses one further point: the arrangements must prevent any confusion between clients’ rights over their crypto-assets and the provider’s own assets.
CASPs: obtaining payment institution authorisation through a streamlined application
EMTs are deemed to be electronic money (MiCA, Article 48(2)), and electronic money is funds within the meaning of PSD2. On 10 June 2025, the European Banking Authority (EBA) drew the consequence: transferring EMTs on behalf of clients and holding them in wallets open to third parties are payment services. It recommended not requiring dual authorisation before 2 March 2026. For former PSANs (digital asset service providers) under the French transitional regime, that date was deferred to 1 July 2026, or to the date of their CASP authorisation if earlier (EBA opinion of 12 February 2026).
The firm first checks, service by service, whether your EMT activities are payment services: this qualification of crypto services under payments law (in French) comes before any filing.
What the ACPR streamlines
In its communication of 19 February 2026 (in French), updated on 24 September 2026, the ACPR opens a streamlined application (agrément allégé) to any CASP, authorised or applying for authorisation, that undertakes to limit its payment services to the EMT services it provides as a CASP. Documents already submitted to the AMF (Autorité des marchés financiers, the French financial markets regulator) are not requested again. The Banque de France relies on the CASP file, in particular for information system security.
What still has to be produced
For the ACPR:
- the identity of the members of the supervisory body and of the statutory auditors;
- a programme of operations and a three-year business plan;
- evidence of initial capital and own funds;
- a description of internal control;
- the security policy, the procedure for handling security incidents and security-related complaints, and the control of access to sensitive payment data.
For the Banque de France (the firm also prepares institutions for its review of the security of means of payment (in French)):
- the procedure for reporting information system and fraud matters to management and to the authorities;
- the map and flow diagram of sensitive payment data;
- the list of encryption algorithms, with attention to quantum risk, and the key management policy;
- the strong customer authentication mechanism, its enrolment and its application to sensitive operations.
The services to tick on the form follow from the chosen model. For the custody of EMTs, treated as keeping payment accounts, and the related transfers, the ACPR indicates cash deposits and withdrawals on a payment account, the execution of credit transfers and the acquiring of payment transactions. For transferring EMTs without keeping an account, it indicates money remittance alone. This choice also determines the applicable initial capital.
The ACPR’s points of attention
- Governance: a supervisory body separate from management; effective managers may neither chair it nor hold a majority of its voting rights.
- Safeguarding of assets: no confusion between clients’ rights and the provider’s own assets.
- Own funds: a method based on fixed overheads, aligned with the MiCA requirement.
The limits of the authorisation obtained
The authorisation covers only payment services on EMTs, in France and under the EU passport. It allows no services on traditional scriptural money. The usual prudential reporting of payment institutions is only required after eighteen months, with a first submission for the reporting date of 31 December 2027. AML/CFT reporting follows the usual arrangements, with a first submission on 31 March 2027.
Our method starts from the file already submitted to the AMF: we identify the documents that can be reused, draft those that are missing and align governance with the ACPR’s expectations. The firm also handles CASP authorisation from the AMF (in French), so both applications can be run in parallel.
How does the authorisation procedure work, and how long does it take?
Six stages separate the first meeting from the launch of the business.
PSD2 requires the authority to decide within three months of receiving a complete application (Article 12). This period only runs once the file is deemed complete, and the questions of the ACPR and the Banque de France suspend it in practice: we observe around nine months between filing and decision.
Three habits reduce the number of exchanges:
- filing a complete and consistent application from day one;
- appointing the institution’s contact person (référent) on the portal early, as all exchanges go through it;
- answering each round of questions with updated documents, not just explanations.
How can the authorisation evolve?
From simplified to full authorisation
A simplified authorisation lapses one month after the ACPR records that its conditions are no longer met (CMF, Article L. 522-11-1 for payment institutions, Article L. 526-19 for EMIs). One month is not enough to obtain full authorisation. The application should therefore be filed as soon as projections show that the ceiling will be exceeded, with the capital, own funds and framework of a fully authorised institution. The move then opens the EU passport and the services that were previously closed.
From the CASP streamlined authorisation to traditional funds
A CASP that wants to provide payment services other than the custody and transfer of EMTs, for example euro credit transfers, must apply for an extension of its programme of operations. The ACPR examines it as a complete application, under the usual procedure. It is best anticipated from the first application: a well-built programme of operations makes the extension easier.
Capital transactions and changes of managers follow their own procedures; the firm also advises on the entry of a shareholder or the appointment of a manager in a payment institution (in French).
Why work with ORWL Avocats?
ORWL Avocats has advised digital finance projects before the ACPR and the AMF since 2018. On authorisations, the firm advises fintechs setting up a payment or electronic money institution, marketplaces collecting funds on behalf of their sellers, CASPs subject to the dual status for their EMT services, stablecoin issuers applying for EMI status and simplified institutions moving to full authorisation. The practice is ranked in Chambers FinTech and recognised by Leaders League in blockchain law.
An authorisation file rests first on legal qualification: which flows are payment services, which status covers them, how MiCA and PSD2 fit together. A consultant can assemble the documents; a lawyer is liable for the analysis, communications with the client are covered by legal professional privilege, and the lawyer negotiates the contracts with banks, guarantors and providers. The lawyer also defends the institution in the event of disagreement with the authority.
A partner leads each matter, from scoping to the College’s decision and throughout the life of the institution. The firm coordinates the other advisers involved: accountants and statutory auditors, information security providers, safeguarding banks, insurers.
ORWL Avocats’ Regulatory expertise
ORWL Avocats has recognised expertise in obtaining payment institution and electronic money institution authorisations, including for CASPs providing EMT services and for stablecoin issuers.
Payment and e-money institution lawyers in France
