Electronic Money Institutions (EMIs) and Payment Institutions (PI) are instrumental in making e-commerce and electronic payment possible across EEA and the Single European Payments Area (SEPA). The electronic payments market is growing at a rapid pace with businesses and consumers relying increasingly on electronic payments. The provision of such services are regulated by EU Directives and enforced by Member States’ regulators.
The services offered by Payment Institutions can vary from the provision of payment infrastructures to customers (e.g., for services industries) to services enabling payments between individuals. It also includes facilitation of secure credit and debit card transactions, both nationally and internationally. Other services include automatic currency conversion in sales outlets, the processing of electronic gift tokens or money-off vouchers, as well as recharging mobile phone pre-paid cards.
Electronic Money Institutions, are institutions issuing electronic money, or “e-money”, which is a monetary value representing a claim against an issuer, which is:
In addition to issuing electronic money, EMIs are also permitted to supply all services of Payment Institutions, to grant loans (under certain conditions) linked to payment services, to supply operational services and other services closely linked to the issuing of electronic money or to the supply of payment services. Entities with a banking license are automatically permitted to perform PI and EMI functions.
Payment institutions and electronic money institutions in Luxembourg are governed by the law of 10th November 2009 (“the PSL”) as amended, which is the result of the transposition of Directives (EU) 2007/64 of 13 November 2007 (PSD1) and 2015/2366 of 25 November 2015 (PSD2) on payments services in the internal market, and 2009/110/EC of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions.
PSD2 was adopted to catch up with technology developments in financial services and facilitate fintech businesses looking to provide payments services while ensuring cyber-security across the EU internal market. PSD2 has broadened the scope of payment services regulation in the EU and brought third party payment service providers (“TPPs”) within the scope of EU harmonised regulation for the first time. It has also introduced changes to conduct of business requirements aimed at improving consumer protection and competition and changes to security and transparency requirements. In respect to the regulation of TPPs, PSD2 introduced technical standards to govern their ability to access payment accounts and related data held with banks and other account providers (“ASPSPs”).
Finally, the PSL, as amended by PSD2, has introduced two new third-party payment service providers: Payment Initiation Services Providers (PISP) as well as Account Information Service Providers (AISP). These new payment institutions do not come into possession of client funds at any point, but do have access to client accounts information and, in the case of PISPs, transport the details of the payment instruction.
Before taking a formal decision to set up an EMI or PI in Luxembourg, prospective institutions often like to have an informational meeting with the supervisory authority, the Commission de Surveillance du Secteur Financier (CSSF). Such meetings allow the financial services supervisory authority to immediately clarify regulatory aspects to the prospective institutions. PIs and EMIs are subject to initial assessment, which takes place in form of a detailed application file to the CSSF, with a filing fee of EUR 30,000. Before reviewing the application, the CSSF invites the prospective institution to a meeting in order to have a formal introduction of the project and to meet the persons in charge. During the application review the CSSF may communicate and request further information to the applicants. After verification that all the legal requirements are fulfilled, the CSSF informs the Minister in charge of the CSSF of its recommendation to grant the applicant the license.
The institution’s head office and central administration must be in Luxembourg. The Company must provide its services to the Luxembourg market and have an office and employees in Luxembourg. Outsourcing of important operational functions is possible, but may not be undertaken in a way such as to materially impair the quality of the company’s internal control and the ability of the CSSF to control the company’s compliance with the obligations laid down in the Law. Financial service companies can make use of cloud services for data storage under the conditions of CSSF circular 17/654.
Following the delivery of the license, a letter is sent to the supervised entity explaining the various legal reporting to be submitted to the CSSF on a periodic basis.
An annual lump sum fee must also be paid to the regulator by PIs and EMIs based on the volume of payment transactions of the preceding year (EUR 30,000 until up to 1 billion transactions and EUR 40,000 for over 1 billion transactions).
Luxembourg authorised PIs and EMIs may provide their services in another EEA state, by using a “passport“ for cross-border services, or by setting-up an establishment or branch in an EEA country. This is done through a regulatory notification procedure.
Authorisation may only be granted to a legal person incorporated under Luxembourg law, which must be established in the form of a public limited company (société anonyme – SA).
The PSL Law requires a minimum capital of at least:
The Company must at all times respect the own funds as set out by the Law.