Payment Gateway Licensing 2026: When You Need One

The line between "using a payment processor" and "being a payment processor" is thinner than most founders think. Cross it accidentally and you face fines, frozen funds, or forced shutdown. This guide explains where that line sits in the jurisdictions that matter most for SaaS and e-commerce businesses.

When you need a license (and when you don't)

The core question is simple: are you touching customer money, or is someone else handling it on your behalf?

If you sell your own product and a payment processor (Stripe, Adyen, PayPal) collects money from your customer and deposits it in your account, you generally don't need a payment license. The PSP holds the license. You're a merchant.

But the moment you start doing any of the following, regulators get interested:

Collecting payments on behalf of other merchants (marketplace model)
Holding customer funds, even briefly, before forwarding them
Splitting payments between multiple parties
Issuing stored value, credits, or wallet balances that can be redeemed
Facilitating money transfers between users

Marketplace founders hit this wall constantly. The moment your platform collects a payment from a buyer and later pays out a seller (minus your commission), you may be performing a regulated payment service. The "may" depends on jurisdiction, structure, and how funds flow.

The EU framework: PSD2 now, PSD3 ahead

The EU's Payment Services Directive defines who needs authorization. Under PSD2 (still in force as of early 2026, with PSD3 expected to take effect in 2027), you need authorization if you provide "payment services" as defined in Annex I. This includes executing payment transactions, issuing payment instruments, and acquiring payment transactions.

The marketplace exemption (and its limits)

PSD2 contains a "commercial agent" exemption. If your platform acts as a commercial agent for either the payer or the payee (not both), you may be exempt. This exemption has been the lifeline for many marketplaces, but regulators have been narrowing it aggressively.

Germany's BaFin has taken the strictest interpretation. If your platform exercises any discretion over payment routing, timing, or handling, the exemption likely doesn't apply. France's ACPR takes a slightly softer approach but has still cracked down on platforms claiming the exemption too broadly. The practical test: if either the buyer or seller would say "the platform handles my money," you probably need a license.

What licensing costs in the EU

A Payment Institution (PI) license in the EU typically requires:

Initial capital of EUR 125,000 (for payment execution services)
Application preparation: EUR 50,000 to EUR 150,000 in legal and compliance consulting
Timeline: 6 to 18 months depending on the member state
Ongoing compliance: AML program, reporting, capital maintenance, annual audit

Lithuania and Luxembourg have become popular for PI licensing due to relatively faster processing times (6-9 months typical). The Netherlands and Germany take longer (12-18 months) but carry stronger reputational weight. A Lithuanian PI license passports across the EU just as effectively as a German one, but some banking partners and enterprise clients prefer licenses from larger member states.

The PSD3 shift

PSD3 tightens rules further. The commercial agent exemption narrows. New requirements around strong customer authentication apply to more transaction types. If you're currently operating under an exemption, assume PSD3 will require you to reassess. Start the licensing conversation now rather than scrambling when PSD3 enforcement begins.

The UK: post-Brexit divergence

The UK's FCA regulates payment services under the Payment Services Regulations 2017, derived from PSD2 but now diverging. The UK has not committed to adopting PSD3-equivalent rules, creating a growing gap between UK and EU requirements.

Key differences for cross-border businesses:

Separate license required. A EU PI license no longer passports to the UK. If you serve UK customers and touch their funds, you need FCA authorization separately. The FCA application process runs 6-12 months with similar capital requirements to the EU.

The UK's agent model. Many businesses use a licensed UK PSP as their "agent" rather than obtaining their own license. This works but limits control. Your PSP can change terms, impose restrictions, or terminate the relationship. For early-stage businesses processing under GBP 3 million annually, the agent model often makes sense. Beyond that, the economics favor your own license.

E-money vs. payment institution. If your platform holds funds for users (wallet functionality), you likely need an e-money license rather than a PI license. E-money authorization requires higher capital (GBP 350,000 minimum) and stricter safeguarding requirements. Many SaaS platforms accidentally create e-money obligations by letting users maintain balances.

The US: state-by-state complexity

The US has no federal payment license equivalent to the EU's PI framework. Instead, you face a patchwork of state money transmitter licenses (MTLs), each with its own requirements, fees, and timelines.

What triggers licensing. If you receive money from one party and transmit it to another, most states consider you a money transmitter. Marketplaces, payment facilitators, and platforms holding user funds typically qualify. The definition varies by state, which is the core problem.

The cost reality. Getting licensed in all 50 states plus DC, Puerto Rico, and US Virgin Islands requires:

Individual applications in each state (fees range from $500 to $10,000+ per state)
Surety bonds: typically $25,000 to $500,000 per state depending on volume
Net worth requirements: some states require $100,000+ in net worth
Background checks on all control persons
Total timeline: 12 to 24 months for full nationwide coverage
Total cost: $500,000 to $2 million for initial licensing across all states

This is why most startups don't pursue their own MTLs. Instead, they partner with a licensed money transmitter and operate under that entity's licenses. Companies like Stripe Connect, Adyen for Platforms, and specialized banking-as-a-service providers offer this shelter.

The PayFac model. Payment facilitators (PayFacs) sit between the card networks and sub-merchants. Becoming a registered PayFac with Visa or Mastercard requires sponsorship from an acquiring bank, a registration process with the card networks, and PCI DSS Level 1 compliance. This doesn't eliminate state licensing requirements but provides a structured path for marketplaces. Annual revenue above $10 million from payment processing often makes the PayFac registration worthwhile.

Singapore: a cleaner framework

Singapore's Payment Services Act created a unified licensing framework. Three license types cover different payment activities:

Money-changing license (simplest)
Standard payment institution (SPI): for businesses below certain thresholds
Major payment institution (MPI): for businesses above SPI thresholds

SPI thresholds include: monthly average payment transactions not exceeding SGD 3 million and daily e-money float not exceeding SGD 5 million. Stay below these and the compliance burden is lighter. Cross them and you need MPI authorization, which brings capital requirements and more extensive compliance obligations.

For SaaS and e-commerce businesses using Singapore as an Asia-Pacific hub, the SPI license provides a workable entry point. Application timeline: 3-6 months typical. Cost: SGD 50,000 to SGD 150,000 in preparation and legal fees.

Three mistakes that get founders in trouble

Mistake 1: assuming your PSP's license covers you. Stripe's license covers Stripe. If you're using Stripe Connect and routing payments between buyers and sellers on your marketplace, Stripe covers the payment processing. But if you're holding funds outside Stripe (in your own bank account, even temporarily), Stripe's license doesn't protect you. The moment funds touch your account before reaching the intended recipient, you may be performing a regulated activity.

Mistake 2: ignoring the jurisdiction where your customers are. Your company is in Delaware and your servers are in AWS. You think US rules apply. But if you have EU customers, EU rules apply to the services you provide to them. A German customer paying through your platform means German/EU payment regulations are relevant, regardless of where your company sits.

Mistake 3: building the product first and asking about licensing later. Retrofitting compliance into an existing payment flow is expensive and disruptive. One fintech founder I worked with spent 18 months building a marketplace payment system, then learned the architecture couldn't support the fund segregation required for licensing. They rebuilt 60% of the payment stack. Ask the licensing question before writing the first line of payment code.

The decision framework

For most SaaS and e-commerce businesses processing under $5 million annually:

Use a licensed PSP. Stripe, Adyen, PayPal, or a regional equivalent. Let them handle licensing, compliance, and fund safeguarding. Your cost is their processing fee (typically 1.5% to 3.5% per transaction). This is almost always the right answer at early stages.

Consider your own license when:

Processing fees exceed the cost of licensing and compliance (usually above $10-20 million annual volume)
You need payment flow control that PSP partnerships can't provide
Your business model inherently involves fund holding or complex payment splitting
You want to offer payment services as a product (not just use them internally)

The licensing path is expensive, slow, and ongoing. But for businesses where payments are the product (not just the checkout), owning the license means owning the value chain.