Spain Payment Institution License 2026: Complete Guide to Banco de España Authorisation

A Spanish Payment Institution licence is a strong route for fintechs that want to provide payment services from Spain and expand across the European Union without becoming an Electronic Money Institution. It can support money remittance, transfers, payment execution, merchant acquiring, payment initiation and other regulated payment services, depending on the permissions granted by the Banco de España.

For a founder, the key decision is whether a Payment Institution is actually the right regulatory category. A PI can move money and provide payment services, but it cannot issue electronic money. If customers need to hold a stored monetary balance issued by your company, the Spanish EMI regime may be more appropriate. If the business is very small, Spain also has a lower-volume registration route for qualifying payment providers with average monthly payment transactions not exceeding EUR 3 million, but that is not the same as a full authorised PI.

A full Spanish PI should be treated as a regulated operating company. The Banco de España will assess the payment flow, services, management, shareholders, capital, safeguarding, AML controls, security, outsourcing, financial model and the ability of the institution to operate safely after authorisation.

What is a Spanish Payment Institution?

A Payment Institution, or Entidad de Pago, is an entity authorised under Spain's payment services framework to provide one or more regulated payment services. The current core legislation is Royal Decree-Law 19/2018 on payment services, supported by Royal Decree 736/2019 and the wider EU PSD2 framework.

The authorisation is granted by the Banco de España, with SEPBLAC input on anti-money laundering matters within its competence. Spanish law requires the institution's central administration, registered office and part of its payment services activity to be located in Spain.

What can a Spanish PI do?

The permission can cover the payment services relevant to the business, including services that enable cash to be placed on or withdrawn from a payment account, execution of payment transactions, direct debits, card payments and credit transfers, issuing payment instruments, merchant acquiring, money remittance, payment initiation services and account information services.

The exact scope should be selected carefully. A remittance company may need a narrower permission than a merchant acquirer or an account-based payments platform. Applying for services that the business has no credible plan to provide creates extra complexity, while applying too narrowly can prevent the firm from launching the intended product.

What can a Spanish PI not do?

A Payment Institution cannot accept deposits from the public and cannot issue electronic money. Funds received from users for the purpose of providing payment services are not treated as bank deposits, but the institution must protect relevant customer funds under the safeguarding rules.

This is the key distinction for many fintech founders. If the customer simply instructs the company to execute a transfer, PI authorisation may be sufficient. If the customer pays money into a wallet and receives stored value that remains available for future payments, the model should be tested against the electronic money regime.

Why choose Spain for a Payment Institution?

Spain gives an authorised PI access to a large domestic market and the EU passporting framework. Once authorised, the institution can notify the Banco de España that it intends to provide its authorised payment services in other EU Member States, including through freedom to provide services, branches or agents where appropriate.

Spain can therefore serve as the home state for a wider European payments strategy. The reason to choose it should be operational and commercial substance, not simply the headline capital level. The applicant should be able to explain why the management, business, banking and target market fit Spain.

How much capital does a Spanish PI need?

The initial capital requirement depends on the payment services provided:

EUR 20,000: where the institution provides only money remittance.

EUR 50,000: where the institution provides payment initiation services.

EUR 125,000: where the institution provides one or more of the broader payment services covering payment accounts, execution of payment transactions, issuing payment instruments or merchant acquiring.

In addition to initial capital, PIs providing the relevant payment services must maintain sufficient own funds on an ongoing basis. The Banco de España can also require a higher own-funds amount, within the statutory framework, where the risk profile and internal control environment justify it.

The practical lesson is that the headline capital number is not the project budget. The company also needs cash for management, compliance, AML, technology, banking, safeguarding, insurance where relevant, audits and the period before the business is generating sustainable revenue.

Does Spain have a small payment institution route?

Yes. Spain provides an exemption from the full PI authorisation regime for qualifying providers whose average monthly value of payment transactions over the preceding 12 months does not exceed EUR 3 million, subject to the statutory conditions and registration with the Banco de España.

For a founder, the lower-volume route can be useful where the business is deliberately small and focused on Spain. It should not automatically be chosen simply because it appears easier. A company expecting rapid growth or EU-wide expansion may be better served by full PI authorisation from the outset, particularly because the commercial value of the full licence includes the EU cross-border framework.

What local substance does the Banco de España expect?

Spanish law requires the PI's central administration, registered office and part of its payment services activity to be in Spain. That is a stronger test than simply incorporating a Spanish company. The applicant should be able to demonstrate real management and the ability of the Banco de España to supervise the institution effectively.

The management team should cover the material risks of the business. Depending on the model, that normally means credible senior responsibility for payments operations, compliance and AML, finance and safeguarding, technology and security, and risk. Group or outsourced functions can be used, but the Spanish PI must remain capable of directing and controlling the regulated activity.

What do you need before applying?

• A Spanish legal entity and transparent ownership structure.

• The correct capital for the services being requested.

• A clear flow of funds and payment service classification.

• A programme of operations and detailed regulatory business plan.

• Three-year financial forecasts and ongoing own-funds calculations.

• Suitable directors, senior management and significant shareholders.

• Safeguarding arrangements for relevant customer funds.

• AML, KYC, sanctions and transaction monitoring controls.

• Complaints and customer support procedures.

• Security, fraud, incident management and business continuity.

• DORA and ICT third-party risk management.

• Outsourcing arrangements and oversight controls.

• Banking and settlement infrastructure.

• A plan for agents and EU passporting if the model requires them.

How to obtain a Spanish PI licence

1. Map the payment flow. Identify who pays, who receives the funds, where the money is held, how settlement occurs and which entity performs each regulated step.

2. Confirm the Payment Institution perimeter. Make sure the model is payment services rather than e-money issuance, banking or another regulated activity.

3. Select the permissions. Map the product to the specific payment services the Banco de España should authorise.

4. Establish the Spanish entity and governance. Put controllers, directors and senior responsibility in place and demonstrate Spanish operating substance.

5. Build the financial model and capital plan. Demonstrate initial capital, own funds, costs, revenue assumptions and sufficient runway.

6. Design safeguarding and banking. Explain how relevant customer funds are protected, reconciled and separated from the firm's own money.

7. Build AML and compliance controls. Tailor KYC, KYB, sanctions, monitoring and escalation to the actual customers and countries.

8. Prepare security and DORA documentation. The operational framework should cover incidents, sensitive payment data, continuity, ICT risk and outsourced technology.

9. Submit the Banco de España application. Use the current prescribed forms and required supporting documentation.

10. Manage questions and keep the application current. Inform the Banco de España of material changes and make sure regulator responses remain consistent across the whole file.

11. Prepare for authorisation and EU expansion. Finalise staff, systems, banking, customer documentation and cross-border notifications so the licence can be used commercially.

What documents does the application include?

The Banco de España's current authorisation process requires the prescribed application forms plus a substantial supporting pack. The published requirements include a business plan and financial projections, information on security incidents, sensitive payment data, continuity arrangements, statistical payment and fraud data, security policies, significant shareholders and the suitability of directors and people responsible for management.

A high-quality application also needs the broader evidence behind those forms, including the programme of operations, governance, AML framework, safeguarding, outsourcing, complaints, capital and financial model. The application should read as one business. Different documents should not use different customer numbers, payment flows or providers.

Safeguarding customer money

A PI that receives funds from users for payment services must safeguard the relevant funds in accordance with the applicable Spanish and EU framework. Safeguarding is designed to protect customers if the institution fails and should be integrated with the actual bank account and payment architecture.

The firm should be able to identify how much money is relevant customer money, where it is held, how the amount is reconciled and how discrepancies are escalated. If the business uses multiple banks, processors or settlement accounts, the safeguarding design needs to track the real flow rather than rely on a high-level policy statement.

AML, sanctions and SEPBLAC

Payment Institutions are obliged entities under Spain's AML legislation. The Banco de España authorisation process also includes SEPBLAC input within its competence. A weak financial crime framework can therefore undermine an otherwise strong prudential application.

The controls should fit the business. A merchant acquirer serving Spanish retailers has a different risk profile from a remittance firm sending money to multiple higher-risk countries. Customer due diligence, beneficial ownership, enhanced due diligence, sanctions, transaction monitoring and suspicious activity escalation should reflect those differences.

Technology, security and DORA

Modern payment institutions are technology businesses as well as regulated financial firms. The Banco de España application materials specifically address security incidents, sensitive payment data, business continuity, payment and fraud statistics and security policy. Since DORA became applicable, ICT risk and third-party technology oversight also form part of the operating standard for regulated payment firms.

Founders should therefore map critical providers early. If the core ledger, payment gateway, KYC, cloud environment and fraud tooling are all outsourced, the PI needs contracts, due diligence, monitoring, incident escalation and exit planning capable of supporting those dependencies.

How long does a Spanish PI licence take?

Spanish law requires the Banco de España to decide a PI authorisation application within three months from receipt of the application or from the point at which the documentation needed for the decision is complete. If no express decision has been notified within the maximum period, the application is treated as refused by administrative silence.

As with an EMI, the practical project is longer than the statutory decision period. The company needs to be ready before the regulator can regard the application as complete. Management, capital, business plan, AML, safeguarding, technology and providers should therefore be developed before or alongside the filing rather than left until the final stages.

Can a Spanish PI operate across the EU?

Yes. A fully authorised Spanish Payment Institution can use the EU passporting framework for its authorised payment services. The Banco de España handles notifications for freedom to provide services, branches and agents in other Member States and communicates with the relevant host authority.

The licence is therefore capable of supporting a wider European payments business. Passporting does not remove every host-country requirement, so the rollout should still consider local consumer rules, marketing, AML implementation, tax and operational matters.

Can a Spanish PI offer stablecoin payments?

Potentially, but the regulatory analysis has become more important in 2026. A payment service involving e-money tokens can create an overlap between MiCA and PSD2. The Banco de España has specifically highlighted that CASPs providing payment services with EMTs may need the appropriate PSD2 authorisation.

For a founder building stablecoin settlement, the correct stack can therefore involve MiCA CASP authorisation, a Payment Institution or EMI permission, or a partnership with a regulated payment provider, depending on who performs each part of the transaction. The model should be mapped before the licensing route is selected.

Common Spain PI application mistakes

• Applying as a PI when the product actually issues electronic money.

• Choosing the EUR 20,000 capital route even though the business needs broader payment services.

• Using a Spanish company without enough management or payment activity in Spain.

• Submitting forecasts that do not reconcile with the operational and compliance headcount.

• Treating safeguarding as a generic policy instead of mapping the actual customer funds.

• Using outsourced technology without credible oversight and DORA controls.

• Underestimating SEPBLAC and AML requirements.

• Applying for every payment service even though the product does not need them.

• Choosing the small-volume regime despite a commercial plan that will quickly exceed EUR 3 million per month.

• Planning immediate EU-wide expansion without the resources to support the cross-border operating model.

Frequently asked questions

What is the minimum capital for a Spanish Payment Institution?

The minimum depends on the services. It is EUR 20,000 for money remittance only, EUR 50,000 for payment initiation services and EUR 125,000 for the broader payment services covering payment accounts, execution, issuing and acquiring. Ongoing own-funds requirements also apply to relevant authorised PIs.

Can a Spanish PI hold customer money?

A PI can receive funds from users for the purpose of providing payment services, but those funds are not bank deposits and the institution must safeguard relevant customer funds. The exact safeguarding treatment depends on the service and transaction flow.

Can a Spanish PI issue a wallet balance?

A PI can provide payment accounts and payment functionality, but it cannot issue electronic money. If the wallet creates electronically stored monetary value issued on receipt of funds and accepted by third parties, the EMI perimeter needs to be assessed. The user interface alone does not determine the legal classification.

Can a foreign company own a Spanish PI?

Yes. Foreign ownership is possible, subject to the suitability assessment of significant shareholders and the wider group structure. The licensed institution still needs central administration, registered office and part of its payment services activity in Spain and must be capable of effective local supervision.

Does a Spanish PI licence passport across Europe?

A full authorised PI can use the EU cross-border notification framework to provide its authorised payment services in other Member States. The institution should complete the required notifications through the Banco de España before beginning the relevant cross-border activity.

What is the difference between the full PI and Spain's small payment institution route?

The lower-volume regime is an exemption from full authorisation for qualifying providers whose average monthly payment transaction value does not exceed EUR 3 million and who meet the relevant conditions. A full PI is designed for a broader or larger operation and is the more appropriate route where EU passporting and material scale are part of the strategy.

Does a Spanish PI need a local office?

The statutory requirement goes beyond a mailing address. The institution's central administration and registered office, together with part of its payment services activity, must be in Spain. The practical governance and staffing model should demonstrate that the Banco de España can supervise a genuine Spanish operation.

How long does Banco de España have to approve a PI?

The formal decision period is three months from receipt of the application or the point at which the documentation required to decide it is complete. The total project is longer because preparation, company setup, management, compliance, technology, safeguarding and banking need to be built before a complete application can be assessed.

Can I buy a Spanish PI instead of applying from scratch?

Yes, an authorised PI can be acquired, but it is a regulated company acquisition rather than a simple licence transfer. Changes in significant ownership can require regulatory assessment. Due diligence should cover permissions, capital, safeguarding, AML, regulatory reporting, complaints, agents, technology, Banco de España correspondence and whether the target's licence supports the buyer's intended model.

How Buckingham Capital Consulting can help

Buckingham Capital Consulting has specialised in payment services, e-money and regulated fintech since 2013. We advise founders and financial groups on Spanish PI and EMI strategy, regulatory perimeter analysis, permission mapping, business plans, financial projections, governance, safeguarding, AML, DORA, outsourcing and full application preparation.

For a Spanish PI project, we start with the payment flow and growth plan so the business chooses the correct permission and capital level before committing to the build. We then prepare the application around the real Spanish operating model and planned EU expansion. Contact Buckingham Capital Consulting to discuss a Spanish Payment Institution authorisation or European payments market-entry project.