Payment institution licence or EMI licence in Spain

The case, in five lines

What is brought

Application to the Banco de España (Spain's central bank) for authorisation as a payment institution (articles 11 and 12 of Royal Decree-Law 19/2018, RDL 19/2018) or as an electronic money institution (article 4 of Law 21/2011), or for registration if you provide only account information services or qualify for the small payment institution exemption (articles 14 and 15 of RDL 19/2018). If refused, expressly or by silence, a recurso de alzada (administrative appeal) to the Minister for the Economy and, against the Minister's decision, a judicial review claim.

Before which court

The decision is taken by the Comisión Ejecutiva (Executive Committee) of the Banco de España (article 23.1.b of Law 13/1994 on the Autonomy of the Banco de España), after a report from Sepblac (Spain's financial intelligence unit and AML supervisor). Its supervisory decisions do not exhaust administrative remedies: they are appealed to the Minister for the Economy (article 2.2 of Law 13/1994), and the Minister's decision is challenged, in sole instance, before the Sala de lo Contencioso-administrativo (Contentious-Administrative Chamber) of the Audiencia Nacional (the National High Court) (article 2.3), without the prior attempt at negotiation that article 5 of Organic Law 1/2025 requires only in civil proceedings.

Deadline

The Banco de España decides within three months of receipt or of the date the documentation is complete; if no decision is notified, the application is deemed refused (article 11.2 of RDL 19/2018 and article 4.1 of Law 21/2011). The recurso de alzada must be filed within one month of notification of the refusal, or at any time against a deemed refusal (article 122.1 of Law 39/2015, the Administrative Procedure Act, LPAC); judicial review must be sought within two months from the day after notification of the Minister's decision (article 46.1 of the LJCA, the Contentious-Administrative Jurisdiction Act), a strict time limit that cannot be extended.

Who can bring it

The applicant is the Spanish company that will carry on the business, whether already incorporated or still in formation, since authorisation is granted before incorporation and entry in the Registro Mercantil (the Companies Registry) (article 13.1 of RDL 19/2018); it must have its head office, registered office and part of its business in Spain (article 11.3). Anyone intending to provide payment services on a professional basis or to issue e-money must apply, except providers already authorised by law, such as banks. Any appeal is brought by the applicant.

Financial risk

If authorisation is refused, the time and money invested are lost, although you may reapply. Providing payment services repeatedly and on a professional basis without authorisation is a very serious infringement (article 92 of Law 10/2014, as amended by RDL 19/2018), punishable with the fines in its article 97, and issuing e-money without authorisation is prohibited (article 2 of Law 21/2011). Once authorised, the cost is ongoing: initial capital of 20,000 to 125,000 euros, or 350,000 if you issue e-money, own funds, safeguarding, professional indemnity insurance if you provide payment initiation, a statutory audit and DORA compliance. Losing the judicial review usually means paying the costs.

First, what your product does with the client's money

Article 1.2 of Royal Decree-Law 19/2018 lists eight payment services: cash deposits into and withdrawals from a payment account; direct debits, card payments and credit transfers, whether or not covered by a credit line; issuing of payment instruments and acquiring; money remittance; payment initiation; and account information. Providing them on a professional basis requires being a payment institution or a provider already authorised by law, such as a bank.

The first question decides the licence. If the client holds a prepaid balance that they later spend with third parties, that is usually e-money: stored monetary value representing a claim on the issuer, issued on receipt of funds and accepted by third parties (article 1.2 of Law 21/2011). Issuing it is reserved to banks and electronic money institutions (EMIs) (article 2), which need 350,000 euros of capital. Many wallet providers only find this out at the first request for information.

A firm providing only account information services is registered rather than authorised, with a reduced application and professional indemnity insurance (articles 15 and 16.2). Payment initiation does require authorisation, 50,000 euros and that insurance (articles 16.1 and 19.1.b). The exclusions in article 4 are read narrowly: firms relying on the limited network exclusion appear in the Banco de España register (article 13.2), and the commercial agent exclusion applies only where the agent acts for just one party, unlike a marketplace that collects from the buyer and pays out to the seller.

Payment institution, small payment institution or EMI: the choice sets the capital

Initial capital depends on the services: 20,000 euros for money remittance only, 50,000 for payment initiation and 125,000 for any of the services in letters a) to e), such as accounts, cards or acquiring (article 19.1 of RDL 19/2018). It must be available when authorisation is granted (article 2.1.c of Royal Decree 736/2019) and may never fall below that figure. On top of this come own funds requirements, which the Banco de España may raise or lower by up to 20% (article 19.2.b).

An EMI needs 350,000 euros and own funds in line with its business (articles 6 and 7 of Law 21/2011). If it also carries on other activities, the Banco de España may require it to move e-money issuance into a separate company, whose authorisation must be sought within three months (article 22 of Royal Decree 778/2012), and it may require a hybrid payment institution to hold more capital if the rest of the business threatens its soundness (article 19.2.d of RDL 19/2018).

The exemption regime is the fast track. A firm providing only services a) to f), with average payment transactions not exceeding 3,000,000 euros a month and no managers convicted of money laundering or financial crimes, is registered instead of authorised (article 14), and registration is deemed to have taken place twenty days after the documentation is filed (article 4.1 of Royal Decree 736/2019). The trade-off: no EU passport and, once the threshold is exceeded, 30 calendar days to apply for authorisation if it wants to keep operating (article 14.2.d and article 4.3 of Royal Decree 736/2019).

What the Banco de España actually looks at: shareholders, managers and substance

Article 12 of the Royal Decree-Law lists the grounds for refusal, and the last one sums them all up: that the information and evidence provided are not assessed favourably (letter g). The burden is on the applicant. Authorisation is refused for inadequate governance or internal control, unsuitable shareholders or managers, close links that hinder supervision, third-country law that obstructs it, or insufficient capital; Law 21/2011 repeats the list (article 4.2).

A qualifying shareholder is anyone holding 10% or more of the capital or voting rights, or able to exercise significant influence (article 17.1), and the power to appoint or remove a director counts as significant influence (article 2.1.m of Royal Decree 736/2019): your 8% investor falls within the assessment. Corporate shareholders must provide three years of accounts, the transparency of the group is reviewed up to the ultimate beneficial owner (article 12.b) and, where the controller is outside the Union, a guarantee covering the entire payments business may be required (article 17.3).

Directors and general managers need good repute, knowledge and experience (article 12.c) and are entered in the Registro de Altos Cargos (the register of senior officers) before taking office: the appointment is notified within fifteen working days and the Banco de España has three months to assess it, with deemed approval if it does not decide (article 5.7 of Royal Decree 736/2019). Substance is not negotiable: head office, registered office and part of the business in Spain (article 11.3 of RDL 19/2018). A board that takes its decisions in London is a refusal waiting to happen.

Safeguarding, security and DORA: where applications stall

Client money does not belong to the institution. A payment institution must not commingle it with its own funds and, if it has not paid it out by the end of the business day following receipt, must deposit it in a segregated account with a credit institution or in secure, liquid, low-risk assets, or cover it with insurance or a guarantee from outside its group (article 21 of RDL 19/2018); in insolvency, users have an absolute right of separation. An EMI safeguards the funds received in exchange for e-money (article 9 of Law 21/2011).

In practice, the bottleneck is finding a bank willing to hold the safeguarding account. The Court of Justice of the European Union has accepted that a bank may apply its own customer due diligence measures to a payment institution that banks with it, provided they are proportionate to the risk: it pays to apply with that banking relationship well under way and with an AML manual able to withstand Sepblac's report (article 2.1.k of Royal Decree 736/2019).

The Royal Decree also requires procedures for incidents and complaints, control of sensitive payment data, business continuity and a security policy that extends to outsourced functions, with a data protection impact assessment and a data protection officer (article 2.1.f to j of Royal Decree 736/2019). Since January 2025, DORA (the Digital Operational Resilience Act) has made the management body accountable for ICT risk and, except in microenterprises, requires someone to be designated to monitor arrangements with ICT third-party providers (article 5 of Regulation 2022/2554): your US cloud needs a contract, an exit strategy and oversight.

The clock: three months that start only with a complete file

The three-month period runs from receipt or from the date the necessary documentation is complete; if no decision is notified, the application is deemed refused, although the Banco de España remains obliged to decide (article 11.2 of RDL 19/2018). In practice, each request for information pushes back the start of the clock: your April application may not yet be refused if the supervisor regards it as incomplete. That is why the application should be filed complete, using the Banco de España's own guide as the index (article 2.6 of Royal Decree 736/2019).

The same provision also requires speed, avoidance of undue formality and procedural economy, and aims to foster the greatest possible competition (article 11.2; article 4.1 of Law 21/2011). This is not rhetoric: a refusal must be reasoned on one of the grounds in article 12, and refusing on the basis of remediable defects without first asking for them to be remedied is open to challenge.

What almost nobody exploits is the asymmetry of administrative silence. The initial licence carries deemed refusal, but extensions of services and amendments to the articles of association are decided within three months and may be deemed granted if no decision is issued (article 6 of Royal Decree 736/2019). A narrower, robust programme is authorised sooner, and extending it later is usually faster than defending a project the supervisor does not yet see as mature. Deemed approval, however, does not make up for missing essential requirements.

Operating too early, EU passporting and euro stablecoins

Providing payment services repeatedly and on a professional basis without authorisation or registration is a very serious infringement (article 92 of Law 10/2014, as amended by Royal Decree-Law 19/2018), and issuing e-money without authorisation is prohibited (article 2 of Law 21/2011). Operating while the application is pending also taints the fit and proper assessment and Sepblac's report. In the meantime, the way out is to act as an agent of an authorised institution, entered in the Banco de España register (articles 3.3 and 13.1).

A payment institution authorised in Spain may operate throughout the Union (article 3.15 of RDL 19/2018), under the freedom to provide services, through a branch or through agents, after notifying the Banco de España, which enters them in its register (article 5.2.a of Royal Decree 736/2019). A small payment institution has no passport (article 14.2.b). And the Spanish branch of a non-EU firm needs its own authorisation (article 1.1 of Royal Decree 736/2019) and cannot operate in other Member States: that requires an authorised Spanish subsidiary.

To launch a euro stablecoin, MiCA alone is not enough: an e-money token may only be offered to the public by its issuer, authorised as a bank or an EMI, or by another person with the issuer's written consent, with a notified and published crypto-asset white paper and 40 working days' notice to the competent authority (articles 48.1 and 48.6 of MiCA). The token is e-money (article 48.2): this licence is the gateway. And since March 2026, holding or transferring these tokens for clients requires, subject to exceptions, a payment services licence, whether your own or a partner's, which is where this guide connects with our guide to the MiCA licence.

If the Banco de España refuses or stays silent: administrative appeal and the Audiencia Nacional

This is the point people most often get wrong. The decision is taken by the Comisión Ejecutiva of the Banco de España (article 23.1.b of Law 13/1994), and its acts outside its monetary functions do not exhaust administrative remedies: they are appealed by recurso de alzada to the Minister for the Economy (article 2.2), within one month of notification or, against a deemed refusal, at any time (article 122.1 LPAC). A recurso de reposición (a request for reconsideration) is not available, and going straight to the Audiencia Nacional risks inadmissibility while the one-month deadline for the administrative appeal runs out.

The Minister has three months; after that, as a rule, the appeal may be treated as dismissed (article 122.2 LPAC). Against the Minister's decision, judicial review must be sought within two months from the day after notification (article 46.1 LJCA) before the Sala de lo Contencioso-administrativo of the Audiencia Nacional, in sole instance (article 2.3 of Law 13/1994), where we act together with a procurador (court agent). Against a deemed dismissal, the Tribunal Constitucional (the Constitutional Court) and the Tribunal Supremo (the Supreme Court) have held that the six-month time limit cannot be invoked against the claimant. No prior negotiation is required: article 5 of Organic Law 1/2025 applies only in civil cases.

The court defers to the supervisor's technical discretion and reviews the facts, the reasoning and any manifest error: the case is won in the administrative file. If the refusal rests on a real deficiency, it is usually faster to fix it and reapply while the appeal runs; if it rests on a legal error, such as treating a payment account as e-money, the appeal has real prospects. The institution's civil disputes with clients, agents or its bank do require the prior attempt at negotiation; in consumer claims, the consumer's prior complaint to the institution without a satisfactory answer is enough (seventh additional provision of Organic Law 1/2025).

How we run the case, step by step

1. 1

   We classify your product and the flow of funds

   We map each feature onto the services in article 1.2, check whether any of it is e-money and choose between authorisation, the exemption regime or registration as an account information service provider.

2. 2

   We design the structure and the substance in Spain

   Head office and team here, a fit and proper board, transparent ownership up to the ultimate beneficial owner, capital with a buffer and, where a non-EU party has control, the guarantee that may be required.

3. 3

   We prepare a complete application

   Programme of operations, three-year business plan, safeguarding arrangements with your bank, governance and internal control, AML manual, security, business continuity and DORA.

4. 4

   We handle all dealings with the supervisor

   We answer every request for information with evidence and on time and log the date of every filing so we know when the three months start to run; if the Banco de España stays silent, we decide whether to wait or appeal.

5. 5

   We finalise the authorisation and open for business

   Incorporation and entry in the Registro Mercantil, the special register and the Registro de Altos Cargos, a working safeguarding account and, where relevant, passport and agent notifications.

6. 6

   If authorisation is refused, we appeal within the deadlines

   A recurso de alzada to the Minister for the Economy within one month, judicial review before the Audiencia Nacional within two months of the Minister's decision and, if faster, a fresh application correcting the deficiency.

The law that applies

• Arts. 1.2, 11 y 12 RDL 19/2018. Eight payment services; authorisation by the Banco de España, after a report from Sepblac, within three months of receipt or of complete documentation; silence counts as refusal and any refusal must be reasoned. BOE-A-2018-16036
• Arts. 14, 15 y 17 RDL 19/2018. Exemption regime up to 3,000,000 euros a month, with no passport; registration for account information services; qualifying holdings from 10% or with significant influence. BOE-A-2018-16036
• Arts. 19 y 21 RDL 19/2018. Capital of 20,000, 50,000 or 125,000 euros depending on the services, plus own funds; safeguarding in a segregated account, secure assets or insurance, with an absolute right of separation in insolvency. BOE-A-2018-16036
• Arts. 2, 4 y 5 RD 736/2019. Contents of the application; registration of a small payment institution after twenty days; senior officers notified within fifteen working days and assessed within three months, with deemed approval. BOE-A-2019-18425
• Arts. 1, 2, 4, 6 y 9 Ley 21/2011. Define and reserve e-money; authorisation by the Banco de España within three months, with deemed refusal; initial capital of 350,000 euros and safeguarding of funds received. BOE-A-2011-12909
• Art. 2 Ley 13/1994, de Autonomía del Banco de España. Acts of the Banco de España outside its monetary functions are appealed to the Minister for the Economy (now by recurso de alzada), and the Audiencia Nacional hears, in sole instance, challenges to the Minister's decision. BOE-A-1994-12553
• Art. 46 Ley 29/1998 (LJCA). Two months for judicial review from the day after notification of the act that exhausts administrative remedies; if the act is not express, the statute sets six months from the deemed act. BOE-A-1998-16718
• Art. 48 Reglamento (UE) 2023/1114 (MiCA). Only an issuer authorised as a credit institution or EMI, with a notified and published white paper, or another person with its written consent, may offer e-money tokens, which are e-money, giving 40 working days' notice. 32023R1114

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions