AuthorPeter Oakes is an experienced anti-financial crime, fintech and board director professional. Archives
January 2025
Categories
All
|
Back to Blog
We appreciate when people and companies use the information we produce. Thank you. What we ask is that when doing so, you ensure that we are credited in a prominent part of your post or visual (not in a comment or at the end of the post). Yesterday we blogged about the release by Fintech Ireland of its Regulated Fintechs (EMoney, Payments & AISPs) in EEA Visual (repeated below). That Visual presented the top 10 EEA jurisdictions for regulated payment services as at 30 September 2025 and comprised of authorised emoney institutions, authorised payments institutions and registered account information services providers (but not CASPs/VASPs). In yesterday's post we promised to publish more information including data on the number of crypto-asset service providers authorised in the EU (& EEA) and also a combination of the two datasets to give a clear picture of the Top 10 EU Jurisdictions for the licensing of these innovative firms. Firstly, here is a reminder of yesterday's Visual to set the context: From the Visual above we see that the top 10 jurisdictions for Regulated Fintech (being authorised emoney, authorised payments and registered AISPs) are: Lithuania (106), France (102), Germany (94), The Netherlands (88), Spain (80), Sweden (78), Malta (58), Ireland (57), Poland (56) and Italy (55). You can find yesterday's blog here and the associated Linkedin Post here. Number of CASPs authorised in the EU (and EEA) The total number of authorised crypto-asset services providers in the EU (and the EEA) is 64 as at 29 September 2025 spread across 12 member states. The eagle-eyed amongst you may note that ESMA's register contains 65 entries. However on closer inspection, when one looks at the data recorded for German CASPs, one will note the name and LEI of one entity being repeated (i.e. Crypto Finance (Deutschland) GmbH). When stripped out that means that Germany (BaFIN) has authorised 19 entities as CASPs (not 20). In the next Visual immediately below one will see the EU (and EEA) jurisdictions where a CASP is authorised. Germany sets the pace with 19 CASP authorisations and is immediately followed by The Netherlands with 14. These two countries are the only ones where there are more than 10 CASPs authorised and they represent more than 50% of total authorised CASPs. Thereafter we have France with 7, Malta with 6 and 3 each in Spain, Cyprus Luxembourg and Finland. The final 4 countries making up list are Ireland and Austria with 2 CASPs each and Lithuania and Slovenia with 1 each. Since the last time we examined the number of authorised CASPs in the EU - back on 1 April - the number of authorisations reported to ESMA by NCAs increased 400% (albeit from a low base 😉 ). And Ireland authorised two CASPs in that period - both being entities within the Kraken crypto group (not a duplication!). A special blog is needed to examine the present position in Lithuania. Lithuania is home to literally hundreds of virtual asset services providers (VASPs). Is it not thus surprising that only one CASP has been authorised in Lithuania despite a massive VASP base? What happens to the Top 10 Jurisdictions when MiCAR authorisations and Payments authorisations are combined? If we combined the number of CASP authorisations with Payments authorisations (i.e. authorised emoney, authorised payments and AISP registrations) we land at the following table. From the table above, by combining both payments and CASPs into one dataset produces a new Top 10 of EU Jurisdictions. Germany comes out as the clear leader with a combined number of 113. Lithuania, which is in No. 1 for payments & emoney drops to 3rd place with a combined tally of 107. France comes in at No. 2 with 109. The larger number of authorised CASPs in Germany and France, 19 and 7 respectively, far exceeding the single CASP authorisation in Lithuania. The Netherlands has also accelerated its authorisation of CASPs, hitting 15 such authorisations bringing its combined total up to 103. Spain and Sweden come in at 5th and 6th place with 83 and 78 respectively. As we head down the chart, we find that Malta continues to cement its place as a leading fintech hub with a combined total of 64. Since the last time we examined in detail ESMA's CASP authorisation data back on 1 April 2025, Malta has only increased by (net) one authorisation. After Malta we find Ireland in 8th place at 59, then Poland with 56 in 9th place and closing the Top 10 with a respectable figure of 55 is Italy. You probably noted that Sweden, Poland and Italy make-up the Top 10 without a single CASP between them. Other interesting insights In the past 6 months (from 1 April to 30 September 2025) ESMA's records of authorised CASPs jumped 400% from 16 to 64. Back on 1 April the only countries that had notified ESMA of having authorised a CASP were Malta, the Netherlands, Cyprus, Luxembourg, Spain and Germany. In the past 6 months the following countries commenced authorising CASPs France, Lithuania, Ireland, Finland, Austria, Slovenia. As we head closer to the end of transitional periods in Europe through which VASPs seek to become authorised CASPs, we should expect to see dozens of new CASPs being authorised in Europe. If you found this information useful, you know what to do. Please go visit the Likedin Post and like the post, reshare the post and/or comment.
0 Comments
Read More
Back to Blog
We appreciate when people and companies use the information we produce. Thank you. What we ask is that when doing so, you ensure that we are credited in a prominent part of your post or visual (not in a comment or at the end of the post). Introduction Fintech Ireland is delighted to present the top ten EEA for regulated payment services (“Regulated Fintech”) as at 30 September 2025. To be more specific, this definition captures authorised emoney institutions, authorised payments institutions and registered account information services providers (but not CASPs/VASPs). Over the coming days we will be releasing more data on fintech authorisations/licences in the EEA, but for today we concentrate on the traditional payment services market. We like to thank CompliReg a leading provider of advice to firms seeking emoney, payments and MiCAR authorisations for helping pull this information together. Its extensive experience working across Europe and the UK is a big help in finding people to discuss our reports before they are released. Read the full blog at https://complireg.com/blogs--insights.html The last occasion we looked at the top 10 Regulated Fintechs was back on the 1 April this year. It was very interesting to look at developments in the EEA market over the past six months. What we have seen is static growth - just a 1% increase from 1,169 in April to 1,181 in September. The net difference of 12 Regulated Fintechs comprises of a net increase of 3 x emoney, 12 x payments and decrease of 3 x AISPs. This leaves us with 337 authorised emoney firms, 747 authorised payments firms and 97 registered AISPs. Who makes up the top 10? The top 10 jurisdictions based on the number of Regulated Fintech in order are: Lithuania (106), France (102), Germany (94), The Netherlands (88), Spain (80), Sweden (78), Malta (58), Ireland (57), Poland (56) and Italy (55). These countries comprise circa 65.5% of the total number of Regulated Fintechs in the EEA. While the countries comprising the top 10 remains the same, the rankings within the 10 has changed. Lithuania, France and Germany stay at #1, #2 and #3 respectively. The Netherlands has leapfrogged Spain taking the #4 position. The biggest mover within the top 10 is Malta, which rose from #10 position to #7. If you are reading this post and saying to yourself that you know you read of certain countries announcing new authorisations/registrations in the past 6 months, don’t forget that some firms also have their authorisations revoked or voluntarily withdrawn. Without analysing too much detail, one reason why Poland slipped from 7th to 9th is because of the large number of AISPs which were de-registered there in the past half year. Is there any threat to the current status quo of the Top 10? Sitting outside the top 10 and not quite within striking distance are Finland #11 (44), Cyprus #12 (41), Norway #13 (38), Belgium #14 (37) and in equal 15th both Czech Republic and Denmark with 33 each. We like to thank CompliReg a leading provider of advice to firms seeking emoney, payments and MiCAR authorisations for helping pull this information together and our friends at our Family of Fintech Nations for supporting this initiative (FintechLithuania.com, FrenchFintech.com, NetherlandsFintech.com, FintechEspana.com, FintechMalta.com, FintechIreland.com, FintechCyprus.com, FintechLatvia.com. No doubt over the coming days each of these will promote their own jurisdictions based on this report and again when we release some new MiCAR Authorisation facts and figures. If you found this useful, you know what to do. Please go https://www.linkedin.com/posts/peteroakes_fintech-micar-activity-7379541156264566784-mdPy and like the post, reshare the post and/or comment. The spread of emoney versus payments institutions Of Lithuania’s total of 106 Regulated Fintechs 70% (71) comprises emoney firms, with 32 payments firms and just 3 AISPs. In the past 6 months Lithuania’s population of emoney firms and payments firms has decreased by (net) 3 and 1 respectively. Meanwhile France’s bevy of Regulated Fintechs is skewered towards payments institutions. These make up 67% (68) of its total of 102. While Lithuania has the largest number of emoney firms authorised, Germany has the largest number of payments firms at 83, representing 88% of its total of 94. It is difficult to see the logic of why there is a somewhat less evenness of the emoney and payments firm split across all member states. There appears to be a lack of consistency across the EEA on defining when a company should be an emoney firm versus a payments firms. Malta Malta certainly stands out as a jurisdiction growing its Regulated Fintech base. It now sits at position #7. Yet while jumping three places from number 10 in the past 6 months it did so by merely increasing the number of net emoney firms from 34 to 37 – that’s right, by authorising 3 firms. When one throws in the number of MiCAR authorised firms into the definition of ‘Regulated Fintech’ expect to see Malta reach far loftier heights. Fintech Malta is working on a new Map for issue shortly. See www.FintechMalta.com and check out the event planned for 23 October 2025! Cyprus Cyprus saw a net increase of one firm. Fintech Cyprus is working on a new Map for issue shortly. www.FintechCyprus.com The Netherlands The Netherlands increase the number of Regulated Fintech by a net increase of 4 x emoney firms and 5 payments firms. Its website will be updated shortly with its first Fintech Map. Keep an eye on it. www.NetherlandsFintech.com Luxembourg Luxembourg’s overall net number of Regulated Fintech stayed steady 25. However it has commenced to authorise crypto-asset service providers. It is updating it Fintech Luxembourg Map, so keep an eye on www.FintechLuxembourg.com Ireland Ireland has arguably been viewed as one of the toughest jurisdictions within the EEA to obtain a fintech licence. Its regulator makes no apology for that and is arguably concerned about regulatory arbitrage across the EEA and in the past a race to the bottom by certain Member States in their approach to authorisations. Fintech Ireland recently released its Map of 88 fintechs which have a licence in Ireland. That Map includes emoney, payments, crowdfunding, VASPs and CASPs. Find that Map at https://fintechireland.com/news-insights/irelands-central-bank-has-issued-88-fintechs-licences-new-map-released-thanks-to-compliregcom. And don’t forget Fintech Ireland is hosting its 2nd Annual Fintech Ireland Summit on Thursday 27th November 2025. It is a great opportunity for the indigenous and international fintechs to gather under one roof. Get your tickets at www.fintechirelandsummit.com Fintech Region Family Our Fintech Region Family also comprises of - Lithuania (www.fintechlithuania.com), Croatia (www.fintechcroatia.com), Latvia (www.FintechLatvia.com), France (www.FrenchFintech.com), and Spain (www.FintechMalaga.com and www.FintechEspana.com)
Back to Blog
Friday 20th January 2023: Central Bank of Ireland (CBI) issued a Dear CEO letter to the fintech industries of electronic money institutions and payments institutions. The purpose is to reaffirm the CBI's supervisory expectations built on its supervisory experiences, both firm specific and sector wide, and enhance transparency around its approach to, and judgements around, regulation and supervision.
If you are looking to get authorised as an electronic money or payments institution in Ireland, contact us. We are working with a number of such applicants and we advise those already authorised on their on-going regulatory obligations, business models and strategy. See our Authorisation Page with links to useful Authorisation Guides. Busy start to the year with enquiries from UK, Asia and the US continuing to roll in about the benefits, opportunities and challenges of establishing a EEA regulated presence in Ireland, particularly for #emoney and #payments. While Ireland is in the top three of the final round, there remains stiff competition (so to speak) from two other leading jurisdictions. Thus it was good to see, , as I am sure others will agree, the Central Bank of Ireland most recent Dear CEO letter issued to emoney and payments institutions on Friday 20 January 2023 by Mary-Elizabeth McMunn, Director of Credit Institutions Supervision. It will help provide greater clarity not only to currently authorised emoney and payments firms, but also those in the authorisation pipeline and those thinking of filing in Ireland. It is a meaty document at 5,168 words across eleven (11) pages. Download a copy of the letter and additional relevant reading material here - https://complireg.com/blogs--insights/2023-dear-ceo-letter-re-supervisory-findings-and-expectations-for-payment-and-electronic-money-e-money-firms If you wish to get a quick understanding of the letter in terms of your regulatory obligations search the words 'we expect'. You will see those appear eleven (11) times too! Right now, best to mark in your calendar and work backwards, that an audit opinion on safeguarding, along with a Board response on the outcome of the audit, is to be submitted to the CBI by 31 July 2023. And it is not just a case of ringing your current external auditors and appointing them.
The purpose of the letter is to reaffirm the CBI's supervisory expectations built on its supervisory experiences, both firm specific and sector wide, and enhance transparency around our approach to, and judgements around, regulation and supervision. The breakdown of the letter is as follows: (1) Supervisory Approach for the Payment and E-Money Sector (provides wider and specific context to our supervisory approach). (2) Supervisory Findings (key findings from supervisory engagements over the last 12 months and actions the CBI expects firms to undertake) ➡ Safeguarding; ➡ Governance, Risk Management, Conduct and Culture; ➡ Business Model, Strategy and Financial Resilience; ➡ Operational Resilience and Outsourcing; ➡ Anti-Money Laundering and Countering the Financing of Terrorism;
(3) Conclusion and Actions Required (CBI's expectation that this letter is provided to and discussed with your Board, and any areas requiring improvement that directly relate to your firm are actioned). Next Steps: Get in contact with Peter Oakes / CompliReg. Founded by the CBI's inaugural Director of Enforcement and AML/CFT Supervision & board director of payments, emoney and MiFID companies. Peter is also a former: FSA (now FCA) enforcement lawyer; senior officer (legal) at ASIC; and adviser to the deputy director of banking at SAMA. Further Reading: 10 December 2021: Authorisation Guidance and Supervisory Expectations for Payment and Electronic Money Firms (Central Bank of Ireland) 09 December 2021: Central Bank of Ireland Dear CEO Letter on Supervisory Expectations for Payment and Electronic Money (E-Money) Firms
Back to Blog
Report on the Peer Review on Authorisation under PSD 2 Released European Banking Authority11/1/2023 Are you looking for the Report on the Peer review on Authorisation under PSD2 released today by the European Banking Authority? Click here or the image above to download it in PDF format. If you are struggling with an application for an electronic money or payments institution authorisation in Europe, contact us here and/or complete the Authorisation/Licence Enquiry Form here. If you are looking at becoming authorised in Ireland as an emoney institution or payments institution check out Fintech Ireland's and CompliReg's authorisation guides here. What does the EBA peer review say?The report sets out the findings of the EBA’s peer review on the authorisation of #Payment Institutions (PIs) and #ElectronicMoney Institutions (EMIs). In executive summary format, the report says:
Some good supervisory practices observed by the EBASome good supervisory practices observed during the analysis that might be of benefit for other CAs to adopt.
Some recommendations identified by the EBAThe report expands on the recommendations included in the EBA’s response to the European Commission on the review of the PSD2 (EBA/Op/2022/06) and recommends that, as part of its ongoing PSD2 review process, the European Commission:
What are the objectives of the EBA report?The objectives of this report are to:
This report is also a partial fulfilment of the mandate conferred by the PSD2 on the EBA to review the Guidelines “on a regular basis and in any event at least every 3 years” (Article 5(5) PSD2). Which competent authorities are in scope?The peer review was performed by a Peer Review Committee of EBA and CA staff (see Annex 1 for the composition) and covered the CAs from all EU Member States and from two EEA States, as detailed in Annex 2. One EEA CA (IS) was not reviewed because it has only recently implemented the PSD2 and did not receive any application for the authorisation of PIs and EMIs in the period analysed (2019-2021). [CompliReg - not sure if IS is a typo, and should be 'SI' for Slovenia?] The Self-Assessment model adopted by the EBAThe analysis has been conducted based on the CAs’ responses to a self-assessment questionnaire (SAQ), which covered a three-year period from 1 January 2019 to 31 December 2021. Where necessary, the PRC followed up with the CAs in writing seeking further clarifications and explanations. The PRC also conducted interviews with a subset of 10 CAs (BG, DK, ES, PL, PT, MT, NL, IT, LT and SE) to gain a better understanding of their supervisory practices. EBA Conclusion on timeliness of the authorisation processPage 51, para 171 "5. Conclusions and recommendations" sates: "With regard to the timeliness of the authorisation process, the review found that, while all CAs comply with the requirement in Article 12 PSD2 to take a decision on an application within 3 months from receiving a complete application, the average duration of the authorisation process varies significantly across MS, ranging from 4-6 months to +20 months. The main reason for this is the quality of applications and applicants’ timeliness in addressing the issues identified with the application. The PRC also identified a number of other reasons for these variations in duration across CAs, which include different timelines set out in national law and different procedural approaches adopted by CAs in the acceptance and assessment of applications." [CompliReg - no doubt, and there is merit here, many firms will struggle with the EBA's finding that "all CAs comply with the requirement in Article 12 PSD2 to take a decision on an application within 3 months from receiving a complete application".] The constitution of the 'peer review committee'?The Peer reviews were carried out by ad hoc peer review committees composed of staff from the EBA and members of competent authorities, and chaired by the EBA staff. This peer review was carried out by:
List of Competent Authorities subject to the peer review
Back to Blog
This post is a follow up post to last week's one (8 December 2021) where we released data on the Top 5 European Union member states for electronic money institution (EMI) authorisations. You can find those posts here - CompliReg blog here and Linkedin post here. Which are the Top 5 European Union member states for #paymentinstitutions (#API) authorisations? Read on, you may be surprised. #fintechfunfacts #fintechfriday
This post is a follow up to last week's one (8 December 2021) when CompliReg released data on the Top 5 European Union member states for electronic money institution (EMI) authorisations. You can find those posts at CompliReg https://lnkd.in/eimmnhup & Linkedin https://lnkd.in/e_JwinjJ. There are 774 APIs authorised in the European Economic Area.* Following the United Kingdom's exit from the European Union, the crown for the home of the largest number of APIs lands on the head of Germany (9.7%) followed by The Netherlands (9.3%), France (9.2%), Spain (7.8%) with Sweden (7.2%) rounding out the Top 5. Lithuania, the undisputed leader of EMI authorisations, came in at 8th place at 6.2%. Given that EMIs can provide payment services too, I don’t think Lithuania will be viewing today’s release as anything but positive for its overall ecosystem. We will publish data combining both #EMIs and #APIs very shortly in order to give a more holistic picture of where the majority of these #fintech firms are authorised in the #EEA. That post will arguably provide the final word on Europe’s top spot for the highest number of such authorisations. Had the UK not left the European Union, it would be the undisputed king of #payment firms, just as it would have been for #emoney institutions. Let us know if this information is interesting and your thoughts. Are you surprised by the split? Did you expect Sweden to make the Top 5? Are you surprised that when it comes to authorised #paymentservices firms, the EMI leader board is not replicated? And of course, if you need assistance with your fintech authorisation, please get in contact (that's the advertisement piece!). CompliReg supports: * https://lnkd.in/eqiNpFdZ * https://FintechMalta.com, * https://FintechIreland.com, * https://FintechCyprus.com, * https://FintechUK.com and soon a new Fintech France website! * Data based on European Banking Authority records published 8th December 2021. Linkedin Post here - https://www.linkedin.com/posts/peteroakes_paymentinstitutions-api-fintechfunfacts-activity-6877591088606007296-N9xp
Back to Blog
Proposed 5 year strategy issued by Payment Systems Regulator.
The PSR's strategy sets out an approach that aims to make sure payments and payment systems work well for everybody and that there is fair competition and access to payments for all. The approach is to protect and embrace what’s working well, change what’s not, and lay the foundations for new products, ways to pay and new payment systems so that they develop with the needs of real people and businesses in mind. Key elements of the PSR Strategy The strategy sets out the PSR’s perspective on payment systems and the markets they support. It considers what is going well, where there is scope for improvement, and the risks and issues that need to be tackled.
What this looks like in practice In the strategy the PSR also sets out a number of actions it will take to deliver these priorities. Some of the key actions it is proposing include:
What happens next This document is a proposed strategy . The PSR is now seeking feedback from everyone with an interest in payment systems and how they work. The deadline for responding is 10 September 2021. This will help the PSR finalise its approach and ensure it is focused on the right outcomes, and - ultimately - have a strategy that is balanced and credible in the eyes of those its regulates and protects. As well as gathering written feedback the PSR is arranging a series of engagement events to listen and understand the views of its stakeholders. More information about these events can be found on its website. If you have any questions, please get in touch via [email protected] Links:
Back to Blog
Some choice headlines in the papers about Brexit in the past week as we - according to Brexit Ireland's countdown to Brexit clock - just little more than 33 days before 11p.m. (UK time) on Thursday 31st December 2020 when the Brexit transition period ends with no deal on financial services in sight. This week sees the EU negotiating team returning to London after face-to-face talks came to end more than a week ago after Mr Bariner's team was hit by a case of Covid. They will be greeted by headiness such as: UK dismisses ‘derisory’ EU fishing offer ahead of last-ditch trade talks; Europe’s finance sector hits ‘peak uncertainty’ over Brexit; and The City braces for Brexit. There is no equivalence regime provided for within either EMD2 (electronic money institutions) or PSD2 (payments services institutions)! One thing we are still very surprised by is the many in #fintech, #techfin and indeed #finserv (and scarily their advisers) who think that recent news on 'equivalence' deals are applicable to all UK #finserv which passport across the European Union / EEA. The announcement on Monday 23rd November by the European Commission was simply and specifically about European regulators finalising a late change seeking to avoid chaos in £15tn of derivatives contracts held between UK and EU counterparties. Then on Wednesday 25th, they insisted outposts of EU banks in London would have to trade certain derivatives in the EU. Back in August 2020 the European Parliament reminded that "Equivalence decisions are a unilateral decision by the Commission. The Commission ultimately exercises its discretion as conferred upon it by the “empowerment” given in EU sectoral legislation.'' BUT MORE IMPORTANTLY "The Commission also enjoys discretion to withdraw equivalence decision. The equivalence frameworks in force do not provide as such specific procedures for monitoring, reviewing or amending equivalence decisions." There are no equivalence provisions in EU bank, payments nor electronic money directives, and the equivalence provision in MiFiD doesn't apply to retail investment services. See the below table on the 'Role of equivalence in key EU banking and financial services legislation' for confirmation. The upshot is that if you are a UK authorised payments institution or electronic money intuition, come Thursday 31st December 2020 when your ability to passport across the whole of European Economic Area comes to an end, so too does your business model unless you have obtained an authorisation in an EU/EEA state. There are are other options available but we'll leave that for another article. If you are a regulated fintech looking for a home post #brexit contact https://complireg.com/authorisations.html. Read our Fintech Authorisation Guides published jointly by CompliReg and Fintech Ireland on the authorisation process. And check out the 'Why Ireland for Fintech' brochure. Why Ireland for your regulated fintech?
“From January 1st, EU rules will apply to UK firms wishing to operate in the EU. UK firms will lose their financial passport: it’ll be anything but business as usual for them. This means they will have to adhere to individual home-state rules in each and every member state,” the official said. Further reading:
26 November 2020 - Move to EU or face disruption, City of London is warned
27 August 2019 - "Third country equivalence in EU banking and financial regulation"
29 July 2019 - Financial services: Commission sets out its equivalence policy with non-EU countries 12 July 2017 - "Third-country equivalence in EU banking legislation"
|