Licensing & Market Entry

GCC Licensing Jurisdictions

Each GCC central bank runs its own licensing regime for payment service providers, with its own capital requirements, governance standards, AML/CFT expectations and supervisory process. A licence in one GCC state gives no right to operate in another, so a firm building a GCC-wide business usually needs a separate authorisation, and a licensed entity or branch, in each market.

We keep up to date with each regulator's application process, current timelines, documentation requirements and supervisory priorities. Applicants who meet their target regulator before filing, to clarify scope, confirm that the capital structure is acceptable and walk through the AML programme, get better results and shorter timelines than those who file without that contact.

Discuss GCC licensing →

European Licensing

Since Brexit, a payments business serving both UK and EU customers needs two authorisations: one from the FCA in the UK and one from a national regulator in the EU (often Ireland, Luxembourg, Lithuania or the Netherlands for English-language businesses). The regimes are drifting apart. In the EU, PSD2 still applies; the final texts of PSD3 and the Payment Services Regulation have been agreed and are expected to apply from 2028. In the UK, the Payment Services Regulations 2017 remain in force, new safeguarding rules took effect in May 2026, and legislation before Parliament would move the Payment Systems Regulator's functions into the FCA.

UK: Financial Conduct Authority (FCA)

UK payment services need FCA authorisation as a payment institution or an electronic money institution. The application needs a detailed business plan, three years of financial projections, governance documents including fitness and propriety assessments for directors and the people responsible for managing payment services, AML/CFT documentation, evidence of IT security and operational resilience, and safeguarding arrangements for customer funds.

• Authorised Payment Institution (API): full payment services permission
• Small Payment Institution (SPI): for firms with average monthly payment volumes below €3 million; registration rather than full authorisation
• Electronic Money Institution (EMI): needed where the business issues e-money
• Fitness and propriety: directors and managers responsible for payment services are assessed individually by the FCA

EU: Central Bank of Ireland and Other National Regulators

Ireland is a common choice for English-speaking payment firms because of the Central Bank of Ireland's established process for payment institution applications, the depth of Dublin's fintech sector and access to EU passporting. Lithuania has authorised many fintechs and suits some smaller firms, though its supervisor has become stricter in recent years. The right jurisdiction depends on target markets, operating model and how much regulatory engagement the firm can support.

• Payment institution and e-money institution authorisation under PSD2, and later PSD3
• Passporting notifications for branches or cross-border services in other EEA states
• AML/CFT programme design aligned with EBA guidelines, national law and the new EU AML framework overseen by AMLA
• Governance: board composition, independent directors and compliance function requirements

Discuss European licensing →

The Authorisation Process: What to Expect

Getting authorised depends as much on managing the relationship with the regulator as on legal drafting. The quality of the business plan, the credibility of the management team and the preparation before filing weigh as heavily as the formal documents. Regulators in the GCC and Europe favour applicants who have thought their business model through and can show they understand the risks it creates and how they will control them.

Discuss your application →

Regulatory Sandbox Support

Most GCC central banks, the FCA and several EU regulators run sandbox or innovation programmes that let firms test new payment services under supervision before applying for a full licence. A sandbox is most useful for new models such as embedded payments, BNPL, open banking aggregation or crypto-asset payments, where the right licence category is unclear or the regulator has not yet set out its position.

• SAMA Regulatory Sandbox: for fintechs testing new services in Saudi Arabia under temporary permission
• QCB Regulatory Sandbox: for new payment services in Qatar. MENA Advisory is headquartered in Doha and knows the QCB sandbox process first-hand
• UAE: the CBUAE sandbox, alongside ADGM's RegLab and the DIFC Innovation Testing Licence in the financial free zones
• CBB FinTech Regulatory Sandbox: one of the first in the GCC, with a simple route to testing before full authorisation
• FCA Innovation Services: regulatory sandbox, direct support and digital sandbox options for UK firms

A sandbox does not guarantee a full licence. Firms that use the testing period to build their relationship with the regulator, show they can operate and refine their AML programme go into the full application in a much stronger position.

Discuss sandbox strategy →

Correspondent Banking Access

For cross-border payment businesses, a licence is necessary but not enough. They also need correspondent banking, the accounts and settlement relationships through which cross-border payments are made, and it is getting harder to obtain. Over the past decade global banks have cut correspondent relationships with money service businesses to reduce risk, and new entrants have far fewer banks to choose from.

To open a correspondent account, an applicant must convince the bank that it has a credible AML programme, understands the risk in its customer base, has a viable business that can pay for proper compliance, and is run by people the bank's compliance team can trust. The bank's decision is a credit and compliance risk judgement, not an administrative step.

• Identifying and prioritising correspondent banks by corridor and currency
• Preparing for the bank's due diligence: AML programme summary, beneficial ownership documents, management profiles and evidence of compliance infrastructure
• Commercial negotiation: account terms, pricing and operational connectivity
• Fallback options where traditional correspondent access is not available: partner bank models, payment aggregators and regional bank relationships

Discuss correspondent access →