Summary
Europe’s payments sector is not one market operating below potential. It is two populations that barely touch, and a company’s side is largely fixed by the jurisdiction it licensed in.
- The passport is binary, not partial. Of 1,444 authorised payment and e-money institutions, 565 (39.1%) have never notified into another EEA state, while 474 (32.8%) have notified into 29 or 30 of them. Only 28% of the licensed base sits anywhere in between.
- Where you authorise decides your market. In Ireland, Luxembourg, Cyprus, Lithuania, Latvia and Malta the median licence holder reaches 29 countries. In Germany the median is 1, in Spain 1, in Portugal 0, and in Italy 0 — with 84.0% of Italian institutions never having notified anywhere.
- The passport runs one way. Italy is the second most notified-into market in Europe, with 696 foreign institutions entering. Its own firms almost never leave.
- Licensing has slowed sharply. New authorisations peaked at 272 in 2019 and fell to 68 in 2025, a decline of 75%.
- Notified access far exceeds real presence. Among the 217 institutions with both passports and agent or branch networks, the median has notified into 29 countries and has an operational presence in 1. Thirty-one per cent have no presence in any country they passported into.
The last point is bounded in both directions and neither bound is comfortable. Section 3’s figure of 29 countries is a ceiling, because notification is not trade. Section 5’s figure of 1 is a floor, because agents only reveal business models with a physical footprint. For the median European payments institution, the number of markets it genuinely serves lies somewhere between 1 and 29, and no public source narrows it further.
PSD3 and the Payment Services Regulation were agreed by the Parliament and the Council in 2026, on the assumption that the passport works. That assumption has not been tested publicly since 2012.
Every input is published: the register snapshot with its checksum, the extraction script, and the derived tables.
1. The number everyone quotes
In the first half of 2026, fintech funding in the Americas reached $86.9 billion across 1,120 deals. In Europe, the Middle East and Africa it reached $11.3 billion across 626 deals.
Roughly eight times the capital for less than twice the deal count. The gap is in cheque size, not deal volume, which points at scaling rather than starting. Europe is not failing to produce fintech companies. It is failing to produce large ones.
The usual explanations are about money: risk-averse pension capital, a thin growth-stage market, weak exit routes, fragmented public markets. Each is true and each has been written about at length.
This report looks upstream of all of them, at something that can be measured rather than surveyed. Before a European fintech can raise a large round it has to be able to sell into a large market. The European Union’s central claim to founders is that one authorisation delivers exactly that: thirty countries, one licence.
We tested the claim against the register that records it.
2. How we did this
The European Banking Authority maintains the central PSD2 register of payment and e-money institutions, compiled from national competent authorities and updated at least daily. It is public and downloadable in full.
We took the golden copy on 22 September 2026 at 08:00 UTC: 330,535 records, SHA-256 d7b276b24a1e10e020eb961312d6f04b24d0c974bb67f1662a080aed78579478.
From it we kept the licensed base — 1,015 payment institutions and 429 e-money institutions, 1,444 in total — and excluded agents, branches, exempt entities and account-information providers from that count. For each institution the register lists the host countries it has notified into, which we counted excluding the home state, so full EEA coverage appears as 29.
We then used the 323,860 agent records and 248 branch records, each carrying its own country and a pointer to a parent institution, as evidence of operational presence. 316,593 matched a parent in our set.
Our passporting share came out at 60.9%, against 61% published from a July snapshot by the Helms Advisory tracker, which is how we know the field mapping is right. Full method, limitations and field definitions are in the appendix.
3. Two Europes, and they do not overlap
The European Union’s offer to a fintech founder is one sentence long, and every licensing advisor repeats it: get authorised once, sell into thirty countries. It is the largest structural advantage the EU claims over the United States, where a payments company assembles money transmitter licences state by state. It is why a founder tolerates a six-to-twelve-month authorisation and a quarter of a million euros in first-year cost.
We wanted to know whether the promise is kept, so we downloaded the register and counted.
The answer is not the one we expected, and not the one the existing commentary suggests. The passport is not a watered-down promise that delivers a little less than advertised. It is an almost perfectly binary one. Europe’s licensed payments sector has split into two populations that barely touch, and which of the two a company lands in is decided before it has a single customer.
What we pulled
The EBA’s central PSD2 register, golden copy, downloaded 22 September 2026 at 08:00 UTC. 330,535 records. SHA-256 d7b276b24a1e10e020eb961312d6f04b24d0c974bb67f1662a080aed78579478, published alongside this report.
We kept authorised payment institutions and e-money institutions: 1,015 PIs and 429 EMIs, 1,444 in total. We excluded the roughly 324,000 agents and branches, which are a distribution layer rather than licence holders, along with exempt entities and account-information providers.
For each institution the register lists the host countries it has notified into. We counted them, excluding the home state. A firm operating across the entire EEA therefore shows 29 hosts, not 30.
The check that told us the mapping was right: our passporting share came out at 60.9%, against the 61% that a third-party tracker reported from a July snapshot. Our totals run slightly higher — 1,444 against 1,425 — which is what eleven weeks of new authorisations look like.
It is not a distribution. It is a cliff.
879 institutions (60.9%) passport into at least one other EEA state. 565 (39.1%) never leave home.
That much matches the published figure. Here is what the published figure conceals.
Among the 879 that do passport, the median firm reaches 29 of the 30 EEA markets — the entire bloc. The mean is 21.9. The interquartile range runs from 13 to 29.
And the shape is startling. 565 institutions sit at zero. 474 sit at 29 or 30. Only 28% of the licensed base is anywhere in between. Seventy-two per cent of European payments institutions are at one pole or the other.
There is a second, smaller cluster worth explaining rather than dismissing: 57 firms stop at 26 and 47 at 28. These are not half-hearted expanders. The countries they omit are Liechtenstein (95 omissions), Iceland (84) and Norway (59) — the three EEA states outside the European Union. Twenty-six hosts is “the EU-27 minus my own.” Twenty-nine is “the EEA, everything.” Even the apparent middle of the distribution turns out to be two deliberate strategies rather than a gradient.
European fintechs are not choosing how much of Europe to address. They are choosing whether to address Europe at all.
Where you license decides which Europe you are in
The split is not random across the continent. It maps almost perfectly onto jurisdiction.
Six jurisdictions behave as export hubs, where the median licence holder reaches twenty or more countries: Cyprus, Ireland, Lithuania, Luxembourg, Latvia and Malta. Together they hold 420 licences, 29.1% of the EEA total. In Ireland the median firm passports into 29 countries and only 16.1% stay domestic. Luxembourg: median 29, 15.4% domestic. Cyprus: median 29, 17.6% domestic. Lithuania, the largest single jurisdiction with 151 licences: median 29, 21.2% domestic.
Eleven jurisdictions behave as domestic markets, where the median licence holder reaches three countries or fewer: Bulgaria, Czechia, Germany, Denmark, Estonia, Spain, Hungary, Italy, Norway, Romania and Sweden. Together they hold 555 licences, 38.4% of the total — and that group contains three of the four largest economies in the European Union.
Germany: 95 licences, median 1 host country, 45.3% domestic-only. Spain: 92 licences, median 1, 50.0% domestic-only. France: 121 licences, median 4, 43.0% domestic-only. Italy is the extreme case — 75 licences, median 0, and 84.0% of Italian payment institutions have never notified into a single other member state.
Portugal sits firmly in the second group: 16 licences, median 0, 56.2% domestic-only.
The full picture, for every jurisdiction with at least twenty licences:
| Jurisdiction | Licences | Never left home | Median host countries |
|---|---|---|---|
| Lithuania | 151 | 21.2% | 29 |
| France | 121 | 43.0% | 4 |
| Netherlands | 121 | 42.1% | 10 |
| Germany | 95 | 45.3% | 1 |
| Malta | 93 | 28.0% | 29 |
| Spain | 92 | 50.0% | 1 |
| Sweden | 85 | 42.4% | 2 |
| Italy | 75 | 84.0% | 0 |
| Ireland | 62 | 16.1% | 29 |
| Poland | 60 | 38.3% | 10 |
| Cyprus | 51 | 17.6% | 29 |
| Belgium | 45 | 8.9% | 18 |
| Norway | 41 | 51.2% | 0 |
| Luxembourg | 39 | 15.4% | 29 |
| Denmark | 39 | 43.6% | 2 |
| Czechia | 38 | 36.8% | 1 |
| Finland | 32 | 34.4% | 11 |
| Bulgaria | 26 | 61.5% | 0 |
| Latvia | 24 | 41.7% | 26 |
| Estonia | 23 | 30.4% | 2 |
| Romania | 21 | 71.4% | 0 |
| Hungary | 20 | 70.0% | 0 |
Smaller jurisdictions are in the published dataset. Portugal, with 16 licences, sits at 56.2% and a median of 0.
The Italian paradox
Now turn the data around and count notifications inbound rather than outbound.
The most-targeted markets in Europe are Germany with 700 institutions notified in, Italy with 696, Austria with 695, Portugal with 681 and Spain with 677. The least-targeted are Malta at 578, Lithuania at 558, Iceland at 538 and Liechtenstein at 522.
So the single market works in Italy. Six hundred and ninety-six foreign institutions have notified their way in. It simply does not work for Italians — 84% of Italy’s own licence holders have never used the same right in reverse.
The same inversion holds across the big domestic markets. Germany, Italy, Spain and Portugal are among the most attractive destinations on the continent and among the least likely origins. The hub jurisdictions are the opposite: Malta and Lithuania are where you go to get a licence, not where you go to sell.
This is the finding that should worry a policymaker. The passport is functioning as a one-way valve. Capital, competition and customer acquisition flow from six small jurisdictions into the large national markets, and the firms licensed in those large markets overwhelmingly do not flow back.
What this means if you are choosing a regulator
For an operator the practical reading is blunt, and it is the reason this section exists.
The decision about where to authorise is not an administrative one about cost and timeline. On this evidence it is the single largest determinant of a company’s addressable market, and it is made at the point of least information — before product-market fit, often before the first hire.
A licence obtained in Vilnius, Dublin, Valletta, Luxembourg, Riga or Nicosia lands you among peers who address the whole EEA as a matter of course. A licence obtained in Rome, Madrid or Frankfurt lands you among peers who, in the majority of cases, never leave. We cannot tell from the register whether the jurisdiction causes the behaviour or merely attracts firms that already intended it. Both readings have the same consequence for a founder choosing today.
The caveat that governs everything above
A passport notification is a legal permission, not evidence of trade. An institution notified into 29 countries may be actively serving two. Every number in this section measures potential market access and is an upper bound on real market access.
This matters more here than in most reports, because there is direct evidence that the gap is large. The European Commission’s 2013 impact study on the original Payment Services Directive found that passports were frequently sought for the entire EEA — and that an analysis of what those firms actually advertised on their own websites showed they typically served no more than four EEA member states outside their home country.
Four. Against a notified median that is now 29.
We cannot close that gap with this dataset, and we will not pretend otherwise. What we can say is that nobody has measured it since 2012, that the notified figures have grown dramatically in the intervening fourteen years, and that European payments policy is currently being rewritten on the assumption that notification and operation are the same thing. Our dataset is published so that somebody can do the harder study.
Two further limits. The register carries no revenue, customer or volume data, so a firm in two countries may be far larger than one in twenty-eight; we count permissions, not businesses. And 17 records list a host value of “EU” rather than a country code, which we excluded as a data-entry artefact.
Why this shows up in a funding chart
A United States fintech launches into roughly 340 million people on day one.
A European fintech launches into one of two very different futures. If it is in the 32.8% at the top of the distribution, it has notified access to the whole bloc and its growth story is legible to an investor. If it is in the 39.1% at the bottom — and that includes the median German, Spanish, Italian and Portuguese licence holder — its addressable market is one country, and the Series A it can raise is priced accordingly.
Europe does not have a fintech sector that scales slightly worse than America’s. It has one sector that is built to scale and another, larger one that structurally is not, and the second is concentrated in the economies that can least afford it.
Aggregate that across a continent and it looks like the funding gap in Section 1.
4. Licensing has a geography, and it is moving
If the passport were doing its job, it would not matter where in the EEA you got authorised. A licence is a licence; the rights are identical on paper.
In practice founders agonise over the choice, advisors sell entire practices around it, and there is a functioning secondary market in which Lithuanian e-money institutions passported into twenty-seven and twenty-nine EEA countries are advertised for sale as premium assets — priced, explicitly, on the breadth of their passporting.
That market should not exist. If one licence really bought thirty countries, passport count would not be a differentiator worth paying for. The fact that it is priced tells you the market has already concluded what Section 3 measured.
This section maps where European fintech is actually getting licensed, how long it takes, and what has changed.
Europe has a licensing capital, and it is not where you would guess
Lithuania holds 151 of the 1,444 PI and EMI licences in the EEA — 10.5%, the largest single jurisdiction. France and the Netherlands follow at 121 each (8.4%), then Germany at 95 (6.6%), Malta at 93 (6.4%), Spain at 92 (6.4%), Sweden at 85 (5.9%) and Italy at 75 (5.2%).
The top eight jurisdictions account for 833 licences, 57.7% of the EEA total. But counting licences hides the split, because the chart below shows these are not the same product at all.
But the raw count understates what is happening, because Section 3 showed that these licences are not the same product. Lithuania and Malta together hold 244 licences whose median holder reaches 29 countries. Germany and Italy together hold 170 whose median holder reaches one country and zero respectively. On a passport-weighted basis — licences multiplied by the markets they actually open — the gap between the hub jurisdictions and the large economies is not 1.4x. It is an order of magnitude.
Lithuania did not simply build a faster authorisation track. It built the track that the firms intending to sell across Europe select into, and the large member states have been left issuing licences to firms that stay home.
A founder reading this should notice what it implies: the choice of regulator is not administrative. It determines your timeline, your capital expectations, your supervisory relationship, and — critically — how correspondent banks read your licence when you try to open accounts.
Is Europe licensing more fintechs, or fewer?
This is the question the register answers that nobody has asked of it, and the answer is the second-best headline in this report.
The register carries an authorisation date for every institution in the licensed base, so the trend is directly computable.
The register carries an authorisation date for all 1,444 institutions, so this is directly computable. New authorisations peaked at 272 in 2019 and fell to 68 in 2025 — a decline of 75%.
The 2018–19 spike (192 then 272) is PSD2 implementation: a one-off wave as the directive’s regime came into force and firms regularised. The interesting number is what followed. Authorisations ran at 115 in 2020, 109 in 2021, then settled into the 70s and 80s. Europe is now licensing roughly a quarter as many payment institutions per year as it did at the peak.
One honest complication: 2026 is running at 92 through 22 September, which annualises well above 2025 and may be the front end of a pre-PSD3 rush, with firms authorising now to grandfather into the new regime. Do not present 2026 as a partial-year collapse. It is the opposite, and the reason is probably regulatory timing rather than market health.
Read this alongside Section 3 and the two findings sharpen each other. Europe is issuing markedly fewer new payment licences than it did at the PSD2 peak, and 39.1% of the ones it has issued open exactly one market. The shortage is not of fintechs. It is of fintechs positioned to become large — which is a different problem, with a different fix, from the one the funding-gap commentary usually proposes.
One methodological warning: the register reflects current authorisation status, so firms that surrendered or lost a licence may be absent, biasing older years downward. State this in the methodology appendix and, if you can, reconstruct historical snapshots from archived register dumps to correct for it. If you cannot correct for it, do not publish the year-over-year trend as a headline.
How long it takes, by regulator
Advisory market guidance holds that Lithuania is the fastest realistic route at three to six months for a well-prepared file and will accept an application before the company is even incorporated, that most EU jurisdictions run six to twelve months for an EMI and six to ten for a payment institution, and that the UK’s FCA typically takes twelve months or more — with the quality of the filing mattering more than the choice of country.
That is advisory guidance, not data. It comes from firms who sell licensing services, which does not make it wrong but does make it worth checking.
We could not build that table, and the reason is worth stating rather than hiding. The EBA’s central copy records the date an authorisation was granted but not the date it was applied for. Recovering application dates means going to thirty national registers one at a time, and several do not publish them at all.
So we report what we can stand behind and leave the rest. A regulator that does not publish application dates cannot be held to a service standard by anyone, and founders choosing a jurisdiction deserve to know which those are. That is a separate piece of work and we intend to do it.
What PSD3 does and does not fix
The timing of this report is not accidental. PSD3 and the accompanying Payment Services Regulation were agreed by the co-legislators in 2026, and member states have eighteen months from entry into force to transpose the directive. The reform preserves the single-licence passport while refining the mechanics around notification requirements and home/host supervisory cooperation. The PSR, being a regulation rather than a directive, applies directly across all member states without national transposition — which is precisely aimed at the conduct-rule fragmentation that dogged PSD2.
That is a real improvement and we should say so.
But note the shape of it. The PSR harmonises conduct. The Commission’s own 2013 diagnosis located the passporting bottleneck somewhere else — in AML, consumer protection and data protection, bodies of law that PSD3 does not touch.
On our figures that bottleneck is still there. The reform preserves and refines a passport that 39.1% of institutions have never used once, and that the firms we can observe are using at roughly a tenth of its notified extent. Tidying the notification mechanics is worth doing. It is not the same as fixing what stops firms from crossing borders.
One further wrinkle worth a paragraph for operators: EMIs will eventually need to hold a PSD3 payment institution authorisation, with the e-money product surviving but the licence structure changing, and a licence obtained now grandfathering into the new regime. Whatever the passporting data says, the near-term incentive for a founder is to get authorised before the transition rather than after it.
5. Twenty-nine on paper, one in practice
Section 3 ended on an admission: a passport notification is a permission, not evidence of trade, so our median of 29 host countries is a ceiling. We said we could not close that gap with this dataset.
We were wrong. The register can close part of it, and the answer is the most consequential number in this report.
Agents and branches are operational presence
The register does not only list licence holders. It lists 323,860 registered agents and 248 EEA branches, each carrying its own country of establishment and a pointer to the institution it belongs to. We matched 316,593 of those child records to a parent payment or e-money institution.
An agent or a branch is not a notification. It is a commercial arrangement or a physical establishment in a specific country — somebody signed something, somebody is being supervised there. Where a firm has agents, it is doing business. So for the institutions that have them, we can compare the countries a firm has notified into against the countries it has put something in.
This is the same question the European Commission asked in 2013, when it checked what passported firms actually advertised on their websites and found they typically served no more than four EEA states outside their home country. Nobody appears to have asked it since. We can now ask it of the register itself.
The result
217 institutions have both at least one notified host country and at least one agent or branch. Among them:
- The median firm has notified into 29 countries.
- The median firm has an agent or branch in 1 of them.
- The median share of notified countries with any operational presence is 3.4%.
- 68 firms (31.3%) have agents or branches, but not one of them is in any country they have passported into.
The distribution is not a tail phenomenon. 164 of the 217 cover two or fewer of their notified markets. Nine cover eleven or more.
The firms at the top of that distribution are exactly who you would expect, and their identification matters because it shows the measure is working rather than producing noise. MoneyGram International, licensed in Belgium, covers 28 of its 29 notified countries and carries 26,642 agents. RIA Payment Institution, licensed in Spain, covers all 17 of its notified markets with roughly 56,000 agents. American Express Payments Europe covers 22 of 29. Ebury Partners Belgium 21, Lemonway 20, Trustly 12.
Cash remittance networks and established institutions genuinely operate across Europe. Almost nobody else in this sample does.
The caveat, and it is large
This measure has a serious limitation and the report is worthless if we bury it.
Agents are a business-model artefact. A money remittance network needs thousands of high-street agents. A digital e-money institution serving German customers from Vilnius through an app needs none at all, and will show zero operational presence on this measure while having real customers and real revenue in Germany. Of the 1,444 institutions in the register, 1,119 have no agents or branches whatsoever — they are simply invisible to this method.
So the 217 are not a representative sample of European fintech. They are the subset whose business model leaves a physical footprint. Our figure of one country is therefore a floor, in exactly the way that Section 3’s twenty-nine is a ceiling.
We considered dropping this analysis for that reason and decided the opposite, because the bracket itself is the finding.
What the bracket means
For the median European payments institution, the number of countries it genuinely operates in lies somewhere between 1 and 29.
That is not a narrow uncertainty. It is the difference between a single-market continent and a collection of national markets wearing a shared legal costume, and it is the number on which the entire European case for passporting rests.
Nobody knows where in that range the truth sits. The EBA does not publish it. National competent authorities do not publish it. The Commission measured a version of it fourteen years ago, found four, and appears not to have measured it again. PSD3 and the Payment Services Regulation are no longer being debated: the co-legislators reached provisional agreement in November 2025 and the agreed texts were published in April 2026. Europe has settled its payments law for the next decade on the assumption that the passport works — an assumption for which, as far as we can establish, no current evidence exists in public.
When the Commission last looked, notification exceeded operation by roughly seven to one. Our floor and ceiling are consistent with a ratio far worse than that today.
Why this is the whole argument
Put the three sections together.
Europe’s payments sector is split into firms that notify for everything and firms that notify for nothing, with almost nobody in between, and which side a company falls on is largely determined by the jurisdiction it licensed in. New authorisations have fallen roughly 75% from their 2019 peak. And for the firms we can actually observe operating, notified access exceeds real presence by an order of magnitude.
An investor pricing a European fintech’s second and third year of growth has to underwrite market access that cannot be verified from any public source. Faced with unverifiable expansion, the rational response is a smaller cheque. Repeat that across a continent for a decade and it produces the funding chart in Section 1 — not because European investors are timid, but because European market access is, on the only evidence available, unmeasurable.
The fix that follows is unglamorous and cheap. Member states already collect activity data from institutions under existing supervisory reporting. Publishing volumes or customer counts by host country, even banded and lagged, would let anyone establish in an afternoon what this report can only bracket. Until that happens, Europe’s central claim to fintech founders remains an assertion.
What we would do next, and what we are handing over
The honest close is a list of what we could not do.
We could not measure activity for the 1,119 institutions with no physical footprint, which is most of the digital sector. We could not separate firms that notified broadly and then retreated from those that never intended to use the notification. We could not obtain application dates from most national registers, which is why Section 4’s authorisation-timeline table is incomplete. And we could not test the obvious follow-up — whether firms in hub jurisdictions are foreign-owned shells or genuine local businesses — because the register carries a registered address but no beneficial ownership.
Every input is published alongside this report: the register snapshot with its SHA-256, the extraction script, and the derived tables. If you can answer one of the questions above, the data is there and we would rather you published it than nobody did.
6. A founder’s reading
This section is the practical consequence of everything above. It is opinionated, and it is drawn from the data rather than from advisory marketing.
The choice of regulator is a strategic choice, not an administrative one
The licensing decision is usually framed as cost and timeline: how much capital, how many months, which advisor. On this evidence it is the single largest determinant of the market a company ends up addressing, and it gets made at the point of least information — before product-market fit, often before the first hire.
Authorise in Ireland, Luxembourg, Cyprus, Lithuania, Latvia or Malta and your median peer addresses 29 countries. Authorise in Italy, Romania, Hungary, Bulgaria or Norway and your median peer addresses none.
We cannot tell from the register whether the jurisdiction causes the outcome or simply attracts firms that already intended it. Both readings point the same way for anyone choosing today.
What to actually weigh
Your realistic market in three years, decided honestly and up front. If the answer is one country, a domestic licence is the correct and cheaper choice, and the rest of this section does not apply. The failure mode is not choosing a domestic regulator. It is choosing one by default and discovering the constraint at Series A.
Banking access, which the register cannot show you but which decides whether you operate. Correspondent banks read the name of your regulator. This is the most common reason a technically valid licence turns out to be commercially useless, and it is the question to ask other founders in a jurisdiction before you ask an advisor.
Substance requirements against where your team actually is. Hub jurisdictions expect local management, a compliance officer and real premises. Some founders treat this as a formality. Supervisors increasingly do not.
PSD3 timing. E-money institutions will need to hold a payment institution authorisation under the new regime, with the e-money product surviving and the licence structure changing. A licence obtained now grandfathers in. The 2026 authorisation figures suggest others have already worked this out.
Whether you will ever need agents. If your model needs physical distribution, Section 5 says plainly that almost nobody achieves it at scale across Europe. Budget accordingly, and treat any plan that assumes notification equals distribution as unfunded.
Do not read the passport as market entry
The most important operational point in this report is the one an investor will eventually test you on.
Notifying into a country is administrative. Operating there means local AML interpretation, consumer protection rules, data protection, bank onboarding, local payment habits and usually local staff. The Commission identified exactly this in 2013 as the reason passports were not working, and PSD3 does not touch most of those bodies of law.
A roadmap that treats twenty-nine notified countries as twenty-nine addressable markets is not a roadmap. Pick three, resource them properly, and say so in the deck. On this data it will be more than most of your competitors have actually done.
If you are in a domestic jurisdiction already
This is the position of the median German, Spanish, Italian and Portuguese licence holder, and the data does not offer a comfortable answer.
Your licence carries the same legal rights as a Lithuanian one. The peer group around you is not using them. The practical question is whether the barrier is your regulator’s posture, your banking relationships, or a market entry cost nobody in your market has yet paid — and that is answerable by talking to the handful of firms in your country that did passport out. In Italy, that is sixteen per cent of the licensed base. They exist, and they are worth finding.
Appendix: method, limits and sources
Source
European Banking Authority central register of payment and electronic money institutions under PSD2, golden copy, downloaded from EUCLID on 22 September 2026 at 08:00 UTC. 330,535 records. SHA-256 d7b276b24a1e10e020eb961312d6f04b24d0c974bb67f1662a080aed78579478, verified against the checksum the EBA publishes alongside the file.
The register is compiled from national competent authorities, who are responsible for its accuracy, and updated at least daily. The EBA states it has no legal significance.
Definitions
Licensed base. Entity types PSD_PI (1,015) and PSD_EMI (429). We excluded agents, branches, exempt institutions, excluded service providers, account-information providers and entities entitled under national law.
Host countries. The register records payment services per country. We took the country keys, removed the home state, and counted the remainder. Full EEA coverage therefore appears as 29, not 30. Seventeen records carried a host value of EU rather than a country code; we excluded these as data-entry artefacts.
Operational presence. Countries of establishment of an institution’s registered agents (PSD_AG) and EEA branches (PSD_BR), matched to the parent institution. 316,593 of 324,108 child records matched a parent in our set.
Authorisation date. The ENT_AUT property, present for all 1,444 institutions.
Limits
Notification is not trade. Section 3 measures permissions. It is an upper bound on market access.
Agents are a business-model artefact. Section 5’s presence measure is invisible to firms without physical distribution. 1,119 of 1,444 institutions have no agents or branches at all. It is a lower bound.
Survivorship in the time series. The register reflects current status, so institutions that surrendered or lost authorisation are absent. This depresses earlier years and makes the post-2019 decline look somewhat steeper than it was. Do not read the 2019 peak as a precise figure.
2026 is partial, running to 22 September.
No activity data. The register carries no revenue, customer or volume figures. A firm in two countries may be far larger than one in twenty-eight. We count permissions and establishments, not businesses.
No ownership data. We could not test whether hub-jurisdiction institutions are locally owned or foreign-controlled, because the register carries a registered address but no beneficial ownership.
Causality. Where jurisdiction correlates with passporting behaviour, we report the correlation. We do not claim the regulator causes it.
Validation
Our passporting share of 60.9% reproduces the 61% published by the Helms Advisory EMI tracker from a July 2026 snapshot, which is how we established that our field mapping was correct. Our totals run slightly higher — 1,444 against their 1,425 — consistent with eleven weeks of new authorisations. That tracker is prior work on the same register and we credit it.
The measure in Section 5 identifies MoneyGram, RIA and American Express as the institutions with the broadest real presence. A method that places the cash remittance networks at the top of a physical-presence ranking is measuring something real.
Prior work
European Commission, impact study on Directive 2007/64/EC (2013), which found that as of August 2012 only 32% of authorised payment institutions had sought a passport, that passports were frequently sought for the whole EEA, and that firms typically served no more than four EEA states outside their home country. It also recorded institutions reporting that divergent national implementation of AML, consumer protection and data protection law had to be satisfied before a passport could be used.
We are not aware of a public update to that measurement in the fourteen years since.
Sources
The dataset
- EBA register of payment and electronic money institutions under PSD2 — the landing page, which also carries the table of all thirty national registers.
- Register download (EUCLID) — the golden copy. The disclaimer at euclid.eba.europa.eu/register/pir/disclaimer must be accepted in the same browser session first, or the download fails.
- Specification of the data properties of the JSON file — the field definitions used in the appendix.
- Identification numbers used in the EBA registers
- EBA press release on the register’s launch, 18 March 2019
Legal basis of the register
- Commission Implementing Regulation (EU) 2019/410
- Commission Delegated Regulation (EU) 2019/411
- EBA final report on the draft RTS and ITS for the register
Prior work
- Study on the impact of Directive 2007/64/EC and on the application of Regulation 924/2009 (2013) — the source of the 32% passporting figure and the finding that firms typically served no more than four EEA states outside their home country. Note that this copy is hosted by the European Payment Institutions Federation rather than the Commission.
- Helms Advisory EMI and PI tracker — the published 61% passporting figure we used to validate our field mapping.
The reform
- PSD3 proposal, COM(2023) 366
- PSR proposal, COM(2023) 367
- European Parliament Legislative Train: revision of EU rules on payment services — the current state of the file and the accompanying impact assessments.
Funding context
- KPMG Pulse of Fintech, H1 2026 — the $86.9bn and $11.3bn figures in Section 1