Payment service providers

Authorisation and registration of payment institutions and electronic money institutions

Authorisation of a payment institution and registration of an entity providing a payment service without authorisation

Provision of payment services or issuance of electronic money refers to activity mentioned in the Act on Payment Institutions the Act on Payment Institutions (297/2010, in Finnish), which, as a rule, requires authorisation. The term payment service refers to, for example, execution of a payment transaction, issuance of payment instruments, and transmission of money.

This page contains information about seeking authorisation or registration of:

  • payment institutions
  • natural and legal persons providing payment services without authorisation (incl. account information service)
  • electronic money institutions
  • persons providing issuance of electronic money without authorisation
  • payment service providers within a limited network.

Application forms

The Financial Supervisory Authority (FIN-FSA) has prepared forms to facilitate the submission and processing of applications for entities applying for authorisation and registration.

The form with attachments should be submitted to the FIN-FSA’s Registry kirjaamo(at)finanssivalvonta.fi (secure email connection kirjaamo(at)finanssivalvonta.fi.s) or by post to the address Financial Supervisory Authority, Registry, PO Box 103, 00101 Helsinki.

 

Authorisation of a payment institution or electronic money institution

Authorisation is required when:

  • the total value of completed transactions exceeds an average of EUR 3 million per month (authorisation of a payment institution)
  • the total value of issued electronic money exceeds EUR 5 million (authorisation of an electronic money institution)
  • providing a payment initiation service (PIS)
  • the payment institution or electronic money institution intends to operate in another EEA member state.

The clarifications to be appended to the application for authorisation are provided for by a Decree of the Ministry of Finance (1040/2017, in Finnish). The FIN-FSA requires that all the information listed in the Decree of the Ministry of Finance is appended to the application for authorisation. The FIN-FSA also recommends that entities applying for authorisation comply with the European Banking Authority EBA's Guidelines on Authorisation of Payment Institutions EBA/GL/2017/09 (in Finnish).

Key requirements regarding the content of the application for authorisation

  • a list of intended payment services and adequate information on the applicant
  • information on minimum capital:
    • payment institutions, no less than EUR 125 000
    • payment initiation service provider, no less than EUR 50 000
    • provider of transmission of money (exclusively), no less than EUR 20 000
    • electronic money institutions, no less than EUR 350 000
  • information on most important shareholders and
  • information that verifies the fitness and propriety of the company’s management and board of directors (see below Fit & proper)
  • information on the company’s financial qualifications and possible accounts data for previous years
  • information on the acceptance of deposits, payment transfers, and protection of customer assets
  • a description of internal control, risk management, and information management systems
  • information on customer identification and customer due diligence procedures and the prevention of money laundering and terrorism financing
  • information on management of operational and security risks and reporting of incidents and fraud
  • information on the payment initiation service provider's indemnity insurance or other comparable guarantee against liability.

The processing of authorisation is subject to a processing fee under the schedule of processing fees. Processing fees will be charged for both positive and negative resolutions. If the processing of an application is interrupted due to the applicant’s withdrawal of the application, a fee is collected for the costs that have arisen up to the point of withdrawal.

Provision of payment services or issuance of electronic money without authorisation (registration) incl. account information service

These services may be provided without authorisation when:

  • the monthly average of the preceding 12 months’ total value of payment transactions executed by a natural person does not exceed EUR 50 000; or
  • the monthly average of the preceding 12 months’ total value of payment transactions executed by a legal person does not exceed EUR 3 million; and
  • the payment service is not offered in another member state of the EEA
  • the total value of the electronic money issued by the issuer of electronic money does not exceed EUR 5 million
  • providing only account information service.

Submission and content of registration notification:

Provisions on appendices to the registration notification are laid down in section 8 of the Act on Payment Institutions (in Finnish) and in paragraph 6 in FIN-FSA Regulations and guidelines 8/2016 (in Finnish). FIN-FSA requires that all the information as required by regulation listed above is appended to the registration notification.

Key requirements regarding the content of the registration notification

  • a list of intended payment services and adequate information on the applicant
  • information that verifies the fitness and propriety of the company’s management (see below Fit & proper)
  • a business plan, including but not limited to the following information: description of procedures, processes and information systems related to the provision of services
  • information on the protection of customer assets
  • information on customer identification and customer due diligence procedures and the prevention of money laundering and terrorism financing
  • information on management of operational and security risks and reporting of incidents and fraud
  • information on the account information service provider's indemnity insurance or other comparable guarantee against liability.

The processing of registration is subject to a processing fee under the schedule of processing fees. Processing fees will be charged for both positive and negative resolutions. If the processing of an application is interrupted due to the applicant’s withdrawal of the application, a fee is collected for the costs that have arisen up to the point of withdrawal.

Payment services offered within a limited network or for a very limited range of goods and services – Obligation to notify FIN-FSA

Payment service legislation excludes certain payment services from the scope the law. Payment service legislation does not apply to services based on specific payment instruments that can be used only in a limited way, when

  1. the payment instrument allows the holder to acquire goods, services or other commodities only in the premises of the issuer or within a limited network of commodity providers under direct agreement with the issuer 
  2. instruments which can be used only to acquire a very limited range of goods, services or commodities or
  3. instruments provided at the request of an undertaking or a public sector entity that are valid only in a single member state of the European Economic Area and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods services or commodities from suppliers having a commercial agreement with the issuer.

Pursuant to section 8 a of the Payment Institutions Act, service providers excluded from the scope of the law are obligated to submit a notification to the FIN-FSA on the provision of payment services within a limited network or for a very limited range of commodities (as referred to in section 2, subsection 4, paragraphs 1 and 2 of the Payment Institutions Act). A notification is required only when the total value of payment transactions executed over the preceding 12 months exceeds the amount of EUR 1 million.

The notification shall contain a description of the services offered and specify under which exclusion provided in paragraphs 1 or 2 the service is excluded from the scope of the Payment Institutions Act. The notification shall be sent to the Financial Supervision Authority's registry office (kirjaamo(at)fiva.fi) in electronic form, making it possible to copy and publish the description on the FIN-FSA’s website. The notification shall be filed with the FIN-FSA form titled Ilmoitus rajoitetusti käytettävään maksuvälineeseen perustuvan palvelun tarjoamisesta (in Finnish). 

The FIN-FSA will either grant approval of registration or refuse registration based on a decision that the service does not meet the requirements for a limited network. The processing of registration is subject to a processing fee (hourly fee) under the schedule of processing fees.

Service providers within a limited network that exceed the above-mentioned limits are entered into a public register of payment institutions, as well a description of the service and the legal basis for the exclusion of the service outside the scope of the law. These details will also be forwarded to the public register of payment institutions maintained by the European Banking Authority EBA.

Regulations and guidelines 4/2022

Authorisation or registration process of a payment service provider

Upon receiving the application or notification of registration, the FIN-FSA will assess whether the payment service provider meets the legal requirements and put forward a decision. If the application is incomplete, the FIN-FSA will ask the applicant to submit further documentation before resolving the matter. Applications for authorisation shall be processed within no more than 3 months and notifications of registration within no more than 1 month. The processing time does not start until the FIN-FSA has received all required documentation. The total processing time is highly dependent on the quality and detail of the submitted application.

Common questions and answers related to authorisation applications and registration (Q&A)

1. How do I know whether my service requires authorisation or registration?

In principle, authorisation is always required when a payment service pursuant to section 1, subsection 2 of the Act on Payment Institutions is provided. If you are not sure about the need for authorisation, please familiarise yourself, for example, with the information to be found on the website of the Financial Supervisory Authority (FIN-FSA). If the need for authorisation remains unclear even after familiarising yourself with the FIN-FSA’s website or the legislation, you can send a description of the service to the address kirjaamo(at)finanssivalvonta.fi and request the FIN-FSA’s assessment of the matter. The description should make clear, among other things, the movement of cash flows and the roles of the different parties in the service. Please also attach your own reasoned assessment of the need for authorisation.

2. Can I submit a listing of the payment services provided in accordance with PSD2?

The business plan must list and describe specifically the payment services, as referred to in section 1 of the Act on Payment Institutions, that the operator intends to provide. The entity may, if it wishes, attach a clarification of payment services under the Directive, but this is not necessary.

3. We have not yet reached a final agreement with a bank on the opening of a client funds account. We have also not yet concluded final agreements with regard to the activities we outsource. What materials do we submit to the FIN-FSA at the authorisation application stage?

In such a situation, please submit the drafts of the agreements. If, for example, a client funds account provider has not yet been selected, a free-form and as accurate as possible explanation of how the matter will be organised is sufficient. The final agreements will be submitted later, sometimes only after the authorisation is received, for example.

4. How precisely should the company’s business model be described?

The business model should be described in as much detail as possible. The description should make clear, among other things, the following aspects:

  • how the transfer of funds takes place and how cash flows move in practice and where
  • which parties are involved in the transfer of funds (what relationship do they have with the applicant)
  • which other parties (e.g. technical service providers) may be involved in the transfer of funds and the provision of the service package
  • it is recommended that the transfer of funds be illustrated with a process diagram.

5. Of whom should fit & proper assessments be made?

Regulations require that a fit & proper notification must be made not only for the members of the Board and the CEO, but also for other senior management personnel. In principle, the company is allowed to determine for itself the roles included in “other senior management”, but the FIN-FSA has consistently considered that, for example, the heads of individual business areas, as a rule, belong to this category. The FIN-FSA has also recommended that, for example, a fit & proper notification be made for the compliance officer/head of compliance function.

6. When does the FIN-FSA arrange an authorisation meeting?

The FIN-FSA will contact you when it is time to arrange an authorisation meeting. Usually, a meeting is arranged no later than the stage when the company has submitted sufficient clarifications of its activities to such an extent that it is advantageous to consider the application at the meeting.
Authorisation meetings are arranged for those applying for a payment institution’s authorisation but not, as a rule, for those applying for registration.

7. How does the application process proceed?

After receiving an application or notification, the FIN-FSA assesses whether the entity fulfils the statutory requirements, and issues a decision on the matter. If the application is incomplete, the FIN-FSA will ask for further clarification before deciding on the matter. In addition, an authorisation application always involves at least one authorisation meeting, which is, as a rule, arranged on the applicant’s premises.

8. How long does the entire application process take?

The duration of the application process depends on, among other things, the quality and comprehensiveness of the application. An incomplete application will result in the FIN-FSA submitting several requests to the company for additional clarifications. It is therefore worth paying attention to the quality of the application already at the first stage. An authorisation process takes, on average, 6-12 months and a registration process, on average, 3-6 months.

9. How much does an authorisation or a registration decision cost and what other payment obligations does the supervised entity have?

The FIN-FSA’s schedule of processing fees is available here. An invoice for chargeable procedures will be sent when the decision is made. Supervised entities must also pay an annual supervision fee.

10. In what format do I submit the company’s financial figures, e.g. income statement, balance sheet, own funds, and solvency statements and forecasts?

Form templates are available on the FIN-FSA’s website. These indicate what information regarding the income statement, balance sheet, own funds and solvency should be included in the statements and forecasts insofar as the company has data to be reported on these items. In addition to the statements themselves, the background assumptions and estimates used in them must be clearly stated and displayed separately. Form templates can be found here (item "MA-taulukko" – in Finnish).

11. What clarifications are required with regard to customer due diligence?

A statement on internal policies, procedures and controls, as referred to in chapter 2, section 3 of the Anti-Money Laundering Act 444/2017 (AML Act), as well as the operating guidelines, as referred to in chapter 9, section 1 subsection 3 of the AML Act, applicable to the company’s own activities in order to comply with the AML Act. The purpose of the operating guidelines is to describe the procedures by which the company ensures compliance with the obligations of the AML Act.

At least the following aspects should be evident from this statement:

  • Customer identification and identity verification when establishing a customer relationship in practice (see chapter 3, section 2 of the AML Act)
    • Who are the company’s customers under the AML Act?
    • Are customers/customer representatives met in person or is remote identification used?
      • If the customer/customer’s representative is met in person, the documents from which identity is verified
      • If remote identification is used, is a strong electronic identification method or other electronic identification technology used that is data secure and verifiable?
  • Customer due diligence: acquisition and documentation of customer due diligence information (see chapter 3, sections 3 and 4 of the AML Act)
    • What information is requested on the customer information form/websites?
    • Is information obtained from elsewhere?
    • Is some information verified?
    • How is the origin of funds ascertained?
  • Processes related to beneficial owners and politically exposed persons in practice (see chapter 3, sections 6 and 13 of the AML Act)
  • Enhanced customer due diligence obligation related to a high-risk non-EEA state (see chapter 3, sections 10 and 13a of the AML Act)
    • How is this taken into account in practice?
  • Procedures for ongoing monitoring of customers’ risk category in practice
    • Simplified and enhanced customer due diligence
    • Updating of information
    • Monitoring
    • Link to company’s risk assessment
    • Detection of suspicious transactions/events/information and reporting of them to the Financial Intelligence Unit (see chapter 4 of the AML Act)
  • Compliance with international financial sanctions and national freezing decisions in practice
  • Outsourcing/third party
    • If activities related to customer due diligence and identification are carried out by actors other than the applicant itself, a statement on the roles and tasks of these actors
  • Resourcing, internal controls and division of responsibilities of AML functions (see chapter 9, section 1 of the AML Act)
    • The company must nominate a person who is responsible for monitoring compliance with the AML Act and regulations issued pursuant to it. The company must also appoint a person who is responsible for internal controls, if this is justified taking into account the size and nature of the reporting entity
    • Procedures for reporting suspected violations within the reporting entity (chapter 7, section 8 of the AML Act)
  • Personnel training
    • Content, scope, documentation
    • Who is responsible for training

The FIN-FSA has prepared regulations and guidelines, the aim of which is to give interpretations and recommendations to supervised entities of the FIN-FSA for the application of regulations on the prevention of money laundering and terrorist financing. The new regulations and guidelines have been circulated for comment and await consideration of the partial reform of the ALM Act in Parliament. The draft regulations and guidelines may be used, even though there may still be minor changes to them.

  • Regulations and guidelines 1/2022; Prevention of money laundering and terrorist financing (draft – in Finnish): Request for comment - Lausuntopalvelu (Luonnos_Määräykset_ja_ohjeet_1_2022.pdf).

12. What form should the risk assessment of money laundering and terrorist financing take?

  • When preparing a risk assessment, you may use:

13. How do I calculate the minimum amount of an electronic money institution’s own funds?

The calculation formula for the minimum amount of an electronic money institution’s own funds is determined according to the services provided.

If the institution only provides issuance of electronic money or payment services related to issuance of electronic money, the minimum amount of the institution’s own funds is calculated only using method D, as referred to in Article 5, paragraph 3 of the Electronic Money Directive (2009/110/EC, hereinafter EMD), i.e. 2% of the amount of electronic money issued. According to the FIN-FSA’s interpretation, payment services related to issuance of electronic money are, in principle, payment transactions related to a payment account (electronic money wallet), provision of a payment account in which only electronic money is stored, and issuance of a payment instrument if only the electronic money in question is used with the payment instrument.

If, in addition to issuing electronic money, the institution provides payment services that are not related to electronic money, such as credit, money transfer or payment transactions not related to a payment account, the minimum amount of the institution’s own funds is calculated according to EMD Article 5, paragraph 2, using the own funds calculation method selected for the company, plus the 2% electronic money requirement (i.e. A/B/C+D). If the calculation method selected for the institution is the payment-transaction-based method (B), only those payment transactions that are not related to the electronic money are taken into account in the amount calculated by the method.

An electronic money institution must, however, always have own funds of at least EUR 350,000, as required by EMD Article 4, so if the amount calculated using method D or the calculation formula A/B/C+D falls below EUR 350,000, the minimum amount of own funds is EUR 350,000.

Withdrawal of authorisation and registration

A payment institution may apply for withdrawal of authorisation, in which case said institution shall submit to the FIN-FSA the documentation listed in section 5.14 of FIN-FSA Regulations and guidelines 8/2016 (in Finnish).

A registration may be withdrawn by informally notifying FIN-FSA of the reason for ceasing the activity.

Use the following form to report fit & proper assessment to FIN-FSA

Fit & proper form (rtf, in Finnish)

The application shall be appended with the FIN-FSA fit & proper form and additional documentation regarding reliability and suitability as provided in the Decree of the Ministry of Finance on the Information to be Appended to the Authorisation Application of a Payment Institution. In addition, see FIN-FSA Regulations and guidelines 8/2016 (in Finnish) for information on reporting of the fitness and propriety of persons providing services without authorisation.

Payment institution or electronic money institutions with authorisation from the FIN-FSA are allowed to provide payment services in other EEA Member States on a cross-border basis. Detailed instructions are included in FIN-FSA Regulations and guidelines 8/2016, chapter 7 (in Finnish).

Foreign service providers operating in other EEA Member States are correspondingly allowed to provide payment services in Finland. This requires the service provider to contact the competent authority of its home Member State.

The application forms:

Contact information

Senior Financial Supervisor Juha Eerikäinen, juha.eerikainen(at)fiva.fi, phone +358 9 183 5322

Senior Financial Supervisor Senni Haajanen, senni.haajanen(at)fiva.fi, phone +358 9 183 5538

Senior Financial Supervisor Mirja Kaspianranta, mirja.kaspianranta(at)fiva.fi, phone +358 9 183 5569