How to be a Payment Institution in Finland

The concept of a payment institution (PI), or a payment service provider (PSP), first came into existence through the EU’s first Payment Services Directive (PSD1) in 2009. The directive was incorporated into Finnish legislation through the Act on Payment Institutions (297/2010) and the Act on Payment Services (290/2010), which consequently led to a spark in the Fintech industry in Finland. Thanks to the directive, companies could start providing different kinds of payment services that only banks, central banks and government agencies were able to provide in the past. The second Payment Services Directive (PSD2) from 2018 further developed the payment services markets by consolidating and revising the PSD1 and introducing new payment services that were not included in the first directive.

In this second part of our Fintech in Practice series, we will dive into the world of PIs by describing, in light of the aforementioned directives, how to function as a PI in Finland and what one should consider when applying for a PI authorisation. You can find the first part of our Fintech in Practice series here, in which we presented the practicalities of being a virtual asset service provider (VASP) in Finland.

Payment Institution Authorisation in Finland

According to Finnish legislation, a PI is a company that has been granted authorisation to provide payment services such as the execution of payment transactions, issuance of payment instruments, or transmission of money. This could, for instance, include mobile apps that enable users to transfer money from one device to another without using direct bank transfers.

In Finland, the provision of payment services usually requires authorisation by the Finnish Financial Supervisory Authorisation (FIN-FSA). Authorisation is required if the total value of completed transactions of the PI exceeds an average of EUR 3 000 000 per month, if the PI intends to operate in another EEA state or if the PI intends to provide payment initiation services. If none of these criteria apply, the company can provide payment services simply by registering with the FIN-FSA.

A company applying for a PI authorisation must, in connection with the application, provide the FIN-FSA with information on, for instance, intended payment services, major shareholders, financial qualifications, protection of customer assets, KYC procedures, risk assessment of operational and security risks as well as information on minimum share capital. In other words, PIs are subject to relatively strict license requirements.

The minimum share capital requirement of a PI in Finland is EUR 125 000, and the authorisation process costs EUR 6 200 in regard to the handling fees payable to the FIN-FSA, and takes approximately 9-12 months. Once the authorisation has been granted, the PI can provide payment services inside the entire EEA. The provision of payment services outside of Finland still requires the PI to notify through the FIN-FSA to all other member states in which the PI wants to operate.

Payment Service Provider Registration in Finland

Some companies that only facilitate payment services on a small scale do not need to apply for authorisation. However, these payment service providers, i.e., PSPs, must register with the FIN-FSA and provide them with similar information as required in the PI authorisation process. The handling fee of the FIN-FSA is EUR 1 750 and the registration process takes approximately 3-6 months.

The registration process is lighter than the authorisation process, and the application must thus not be as comprehensive. For instance, registered PSPs do not have any initial capital requirements, and they do not, unlike PIs, have to report on the PSP’s shareholders and close links. On the other hand, the downside is that PSPs can only offer payment services in Finland, and the number of completed transactions cannot exceed an average of EUR 3 000 000.

The processing times and final costs of the registration and authorisation process depend largely on how well the applications have been prepared. Thus, we recommend every PI and PSP applicant to take advantage of external legal assistance when preparing the application to the FIN-FSA.

Functioning as a Payment Institution

Once a company has obtained its authorisation, it is important that it complies with all applicable laws and regulatory requirements set out by the FIN-FSA. This includes having adequate capital reserves, maintaining proper accounting records and reporting any suspicious transactions to the authorities. In addition to ongoing reporting of suspicious transactions, the reporting obligation includes biannual or annual reporting on information regarding financial statements, customer risks, lending, overdue claims, solvency, risk assessments and potential fraud. Additionally, PIs must, from time to time, report on other matters connected to the company's daily activities, such as operational risks, ownership changes and offering services in other EEA countries.

In addition to the internal costs arising from the reporting, the FIN-FSA charges both a basic and a proportional fee for the supervision of the PI. The bigger the company is, the higher the fee is. For example, a PI with an annual turnover of EUR 15 000 000 would have to pay an annual supervision fee of around EUR 38 200. The high costs and reporting as well as compliance obligations indicate PI authorisation should only be applied for when the benefit of the authorisation outweighs the company's potential financial and administrative burden. However, functioning as a PI comes with several upsides from a business standpoint. For example, within the scope of its authorisation, a PI can also provide foreign exchange services, account switch services, and to some degree, grant credit to its customers.

The internal resources used for the application process and the ongoing compliance can nevertheless be decreased with the use of experienced legal assistance. Therefore, we recommend all PIs either have a dedicated in-house compliance and/or legal team or outsource these tasks to an external law firm.

Lastly

Currently, there are 15 companies registered as domestic PIs in Finland. The Finnish PI industry is still quite young and the number of domestic PIs is expected to grow. The previous directive on PIs came into force back in 2018, and the upcoming third Payment Services Directive (PSD3) is awaited to provide greater regulatory oversight and consumer protection for payment services in the EU.

The planned PSD3 is going to include new provisions for areas such as strong customer authentication, open banking, and access to account information. However, the PSD3 will at the earliest be in effect in 2026, if not closer to the turn of the decade. Additionally, it remains to be seen how the Markets in Crypto-Assets Regulation (MiCA) (which passed the European Parliaments vote in April 2023) is going to affect the operations of PIs who offer crypto related services besides their traditional payment services. You can read more of MiCA in our previous article.

Functioning as a PI is not a straightforward task. Thus, it is of utmost importance for every aspiring PI to organise the company structure and all internal practices by considering all relevant regulations. External legal expertise will make the application process and ongoing compliance smoother and cheaper.

As a law firm with extensive experience in advising PIs on the Finnish market, we are happy to help you with any questions you may have regarding your project. Together we can make sure that your PI project is off to a good regulatory start, whereby you can focus on the business side of the PI operations.