How to Be a Payment Institution in Finland (2026): FIN-FSA Authorisation Steps, Capital & Safeguarding

Understanding how to be a payment institution in Finland is essential for any fintech founder, compliance officer or legal team planning to offer payment services in the Finnish market or passport into the wider EEA from Helsinki. The Finnish Financial Supervisory Authority (FIN-FSA) is the sole competent authority for granting payment institution (PI) and electronic money institution (EMI) authorisations, and its requirements are shaped by both national legislation and the evolving EU regulatory framework. With PSD3 and the new EU Payment Services Regulation (PSR) advancing through the legislative process in 2026, applicants now face tighter governance, capital and safeguarding expectations than at any point in the last decade.

This guide maps the complete authorisation process, from threshold assessment through post-licence reporting, and highlights every practical step a prospective payment institution must take to secure and maintain its FIN-FSA licence.

Quick Answer: Can I Be a Payment Institution in Finland?

Yes. Any legal entity incorporated in Finland, or with a branch established in the country, may apply to FIN-FSA for authorisation as a payment institution, provided it meets the regulatory requirements set out in Finland’s Payment Institutions Act and the relevant EU directives. The process is rigorous but well-defined. At a glance, the core steps are:

1. Assess scope. Determine whether your planned services trigger full authorisation or whether a lighter registration regime applies.
2. Prepare documentation. Compile the application dossier, including a business plan, programme of operations, governance structure and AML/KYC policies.
3. Meet capital requirements. Demonstrate that the entity holds the required minimum initial capital (EUR 125,000 for a PI; EUR 350,000 for an EMI).
4. Establish safeguarding arrangements. Choose and document a compliant model for protecting client funds, either segregated accounts or an insurance/guarantee arrangement.
5. Implement governance and IT security. Appoint fit-and-proper management, establish internal controls, and meet operational resilience and strong customer authentication (SCA) standards.
6. Submit to FIN-FSA and respond to review queries. File the application, engage with the regulator’s question-and-answer phase, and await the formal authorisation decision.

Each of these steps is explained in detail in the sections that follow. Readers seeking a condensed checklist can also consult the FIN-FSA’s own guidance page for payment service providers.

Do I Need Payment Institution Authorisation in Finland?

Not every entity providing payment-related services requires full FIN-FSA authorisation. Finnish law distinguishes between registration (a lighter regime for smaller operators) and authorisation (required once activity exceeds defined thresholds). The critical dividing line centres on average monthly transaction volumes.

According to FIN-FSA guidance, a provider whose average monthly payment transaction volume does not exceed EUR 3 million may operate under a simpler registration regime. Once that threshold is exceeded, or if the entity intends to passport services into other EEA states, full authorisation as a payment institution is mandatory. For electronic money institutions, the threshold analysis applies to e-money outstanding rather than payment volumes alone.

Applicants should note that even below the EUR 3 million threshold, certain services, such as account information services (AIS) or payment initiation services (PIS), carry their own registration obligations under the revised payment services framework. Industry observers expect that PSD3 and the new PSR will tighten these thresholds and supervision of registered entities, making early engagement with FIN-FSA advisable regardless of current volumes.

PI vs EMI vs Bank: Which Route and Why

Choosing the right licensing pathway is among the most consequential decisions a prospective payment institution in Finland will make. The three principal entity types, bank, authorised payment institution and electronic money institution, differ significantly in their permitted activities, capital burdens, supervisory intensity and time to market.

For most fintechs entering the Finnish market, the PI route offers the fastest path and the lowest capital burden. The EMI licence is necessary only where the business model involves issuing stored-value products that qualify as electronic money. A full banking licence is disproportionate for companies whose core activity is payment processing, remittance or initiation. Understanding these distinctions early prevents costly pivots mid-application.

How to Be a Payment Institution in Finland: FIN-FSA Authorisation Process Step by Step

The FIN-FSA authorisation process for payment service providers follows a structured sequence. Applicants who prepare thoroughly and engage in pre-application dialogue tend to move through the process more efficiently. Below is the end-to-end workflow, broken into four phases.

Phase 1, Pre-application

Before submitting a formal application, prospective applicants should request a pre-application meeting with FIN-FSA. This meeting is not mandatory, but it allows the regulator to signal any preliminary concerns about the business model, governance or safeguarding approach. During this phase the applicant should:

• Incorporate the legal entity. A Finnish limited liability company (Oy) is the most common structure.
• Draft the programme of operations. This document, required by FIN-FSA, must describe the payment services to be provided, the target market, the organisational structure, the IT architecture, outsourcing arrangements and projected financial statements for the first three years.
• Identify fit-and-proper persons. Senior management, board members and qualifying shareholders must pass FIN-FSA’s suitability assessment.

Phase 2, Application submission

The formal application is submitted to FIN-FSA together with a comprehensive dossier. Based on FIN-FSA’s published guidance for FIN-FSA payment service providers, the core documents include:

• Completed application form (FIN-FSA template)
• Programme of operations and three-year business plan
• Description of internal governance, including compliance function and risk management
• AML/KYC policies and procedures
• Safeguarding arrangements (method chosen and evidence of implementation)
• Proof of initial capital
• IT security and operational resilience documentation (including SCA implementation)
• Outsourcing policy and register of outsourced functions
• Fit-and-proper documentation for all senior managers, board members and qualifying shareholders
• Auditor’s confirmation of initial capital (where applicable)

Phase 3, FIN-FSA review and Q&A

Once the application is filed, FIN-FSA conducts a substantive review. The regulator will typically issue one or more rounds of supplementary questions. Response times from the applicant directly influence the overall timeline. Applicants should assign a dedicated regulatory liaison to manage the Q&A process and maintain a log of all correspondence.

Phase 4, Decision and registration

FIN-FSA issues a formal decision either granting or refusing authorisation. Upon approval, the entity is entered into the FIN-FSA national register and notified to the European Banking Authority (EBA) for inclusion in the EU-wide register of payment and electronic money institutions. The authorised payment institution in Finland may then begin providing payment services and, if desired, initiate the passporting notification process to operate in other EEA states.

Overall, a well-prepared PI application can achieve authorisation in approximately three to nine months. EMI applications generally take longer owing to the additional complexity of e-money safeguarding and higher capital requirements. The actual processing time depends on the completeness of the submission and FIN-FSA’s caseload at the time of filing.

Capital, Own Funds and Safeguarding: Payment Institution Requirements in Finland

Capital and safeguarding sit at the heart of any payment institution application. FIN-FSA scrutinises both the initial capital at the point of authorisation and the ongoing own funds the entity must maintain throughout the life of the licence.

Minimum initial capital

The minimum initial capital thresholds for payment institutions and electronic money institutions in Finland are drawn from EU directives and transposed into Finnish law. The applicable minimums are:

Capital must be fully paid up and evidenced at the time of application. FIN-FSA may require an auditor’s confirmation. The capital must remain available and unencumbered, it cannot consist of funds borrowed from related parties.

Ongoing own funds

After authorisation, the PI or EMI must maintain own funds calculated using one of three methods prescribed by the EU framework (Methods A, B or C), based on transaction volumes, overheads or a combination. FIN-FSA may specify which method applies. Own funds must at all times meet or exceed the higher of the initial capital minimum and the calculated ongoing requirement.

Safeguarding of client funds

Safeguarding is the mechanism by which a payment institution protects the funds it holds on behalf of clients. Under Finnish law and the EU framework, a PI or EMI must ensure that customer funds are ring-fenced from the institution’s own assets. FIN-FSA accepts two principal safeguarding models:

Applicants must describe their chosen safeguarding model in detail in the application dossier, including the identity of the custodian bank or insurer, the contractual terms and the procedures for reconciling client balances daily. FIN-FSA expects evidence that the safeguarding mechanism is operational, not merely planned, before authorisation is granted. Industry observers expect PSD3 and the new PSR to further tighten safeguarding requirements, potentially mandating more frequent reconciliation and stricter insolvency-remoteness tests.

Governance, AML, IT Security and Operational Requirements

Meeting the payment institution requirements in Finland goes well beyond capital and safeguarding. FIN-FSA expects applicants to demonstrate robust governance, anti-money-laundering controls, IT security and operational resilience from day one.

AML/KYC obligations

Finland’s Anti-Money Laundering Act transposes the EU’s anti-money-laundering directives. Every payment institution must:

• Conduct customer due diligence (CDD) at onboarding and on an ongoing basis
• Implement risk-based KYC procedures, including enhanced due diligence for higher-risk customers and transactions
• Appoint a compliance officer responsible for AML policy
• File suspicious activity reports (SARs) with Finland’s Financial Intelligence Unit (FIU, known as Rahanpesun selvittelykeskus)
• Maintain transaction records for at least five years

Outsourcing and third-party risk

PIs and EMIs frequently outsource critical functions, core banking systems, cloud infrastructure, customer support. FIN-FSA requires an outsourcing policy that identifies all material outsourced functions, assesses the risks and ensures that supervision is not compromised. The EU Digital Operational Resilience Act (DORA), which applies from January 2025, adds further obligations around ICT third-party risk management, incident reporting and resilience testing that apply to payment institutions.

Operational resilience and IT security

FIN-FSA expects applicants to demonstrate strong customer authentication (SCA) capabilities and secure communication channels in line with the PSD2 Regulatory Technical Standards. IT systems must be subject to regular penetration testing, business continuity planning and incident management procedures. Under the new PSR, these expectations are likely to be reinforced and, in certain areas, made directly applicable via regulation rather than directive.

PSD3 and PSR Changes in 2026: What Finnish Applicants Must Do Differently

The EU’s legislative overhaul of the payments framework, comprising the third Payment Services Directive (PSD3) and the directly applicable Payment Services Regulation (PSR), represents the most significant change to the regulatory landscape since PSD2 entered force. While the precise timelines for final adoption and national transposition continue to evolve, the direction of travel is clear and the practical implications for anyone seeking to become a payment institution in Finland are already shaping applications.

The key changes that early indications suggest will affect PI and EMI applicants include:

• Stronger authorisation and supervision powers for FIN-FSA. The new framework is expected to grant national competent authorities enhanced tools for ongoing supervision, including the ability to withdraw authorisation more readily and impose larger administrative penalties.
• Tighter safeguarding standards. The PSR is likely to require more granular safeguarding arrangements, including clearer insolvency-remoteness provisions and more frequent reconciliation of client funds.
• Enhanced governance requirements. Applicants should expect FIN-FSA to scrutinise board composition, compliance function independence and outsourcing governance more intensely under the new regime.
• Broader scope of regulated services. Certain currently unregulated or lightly regulated payment services may fall within the full authorisation perimeter.
• Direct applicability of the PSR. Unlike PSD2 (a directive requiring national transposition), the PSR will apply directly across all EU member states, eliminating divergences in national implementation and creating a single rulebook for payment service providers.

Applicants filing now should build their governance and safeguarding frameworks to the higher PSD3/PSR standard rather than relying on current minimum requirements. This approach avoids costly retrofitting and signals regulatory maturity to FIN-FSA during the review process.

After Authorisation: Reporting, Register Entry, Passporting and Fees

Securing authorisation is the beginning, not the end, of the regulatory relationship. An authorised payment institution in Finland must meet ongoing obligations that include supervisory reporting, fee payments and, for those seeking cross-border activity, the passporting notification process.

• Register entry. Upon authorisation, FIN-FSA enters the entity into its national register of payment service providers. The institution also appears in the EBA’s EU-wide register of payment and electronic money institutions, which is publicly searchable. Applicants can verify their own registration status, or that of any counterparty, through the EBA register.
• Passporting across the EEA. An authorised Finnish PI or EMI may provide services in other EEA states through the freedom to provide services or by establishing a branch. The process requires notification to FIN-FSA, which then informs the host-state regulator. Passporting does not require a separate licence in each country, making Finland a strategically attractive home-state jurisdiction.
• Ongoing supervisory reporting. FIN-FSA requires periodic reports on financial position, transaction volumes, complaints data, fraud statistics and material outsourcing arrangements. The frequency and format of reporting are specified at the time of authorisation and may evolve under PSD3/PSR.
• Supervisory fees. FIN-FSA charges annual supervisory fees, calculated on a proportionate basis. These fees cover the cost of ongoing supervision and must be budgeted into the institution’s operating plan.

A practical first-year compliance checklist should include: confirming register entry with both FIN-FSA and EBA, filing initial supervisory returns, conducting the first internal audit of AML controls, performing ICT resilience testing under DORA obligations, and initiating any planned passporting notifications.

Sources

1. Finnish Financial Supervisory Authority (FIN-FSA), Payment service providers authorisations
2. FIN-FSA, Payment service providers
3. European Banking Authority (EBA), Register of payment and electronic money institutions
4. Finanssiala (Finance Finland), Payment services in Finland
5. Bank of Finland (Suomen Pankki), Payments overview
6. Nordic Law, How to be a payment institution
7. Enfuce, Approved as an authorised payment institution (press release)