Payment service providers

Authorisation is required when:

• the total value of completed transactions exceeds an average of EUR 3 million per month (authorisation of a payment institution)
• the total value of issued electronic money exceeds EUR 5 million (authorisation of an electronic money institution)
• providing a payment initiation service (PIS)
• the payment institution or electronic money institution intends to operate in another EEA member state.

The clarifications to be appended to the application for authorisation are provided for by a Decree of the Ministry of Finance (1040/2017, in Finnish). The FIN-FSA requires that all the information listed in the Decree of the Ministry of Finance is appended to the application for authorisation. The FIN-FSA also recommends that entities applying for authorisation comply with the European Banking Authority EBA's Guidelines on Authorisation of Payment Institutions EBA/GL/2017/09 (in Finnish).

Key requirements regarding the content of the application for authorisation

• a list of intended payment services and adequate information on the applicant
• information on minimum capital:
  • payment institutions, no less than EUR 125 000
  • payment initiation service provider, no less than EUR 50 000
  • provider of transmission of money (exclusively), no less than EUR 20 000
  • electronic money institutions, no less than EUR 350 000
• information on most important shareholders and
• information that verifies the fitness and propriety of the company’s management and board of directors (see below Fit & proper)
• information on the company’s financial qualifications and possible accounts data for previous years
• information on the acceptance of deposits, payment transfers, and protection of customer assets
• a description of internal control, risk management, and information management systems
• information on customer identification and customer due diligence procedures and the prevention of money laundering and terrorism financing
• information on management of operational and security risks and reporting of incidents and fraud
• information on the payment initiation service provider's indemnity insurance or other comparable guarantee against liability.

The processing of authorisation is subject to a processing fee under the schedule of processing fees. Processing fees will be charged for both positive and negative resolutions. If the processing of an application is interrupted due to the applicant’s withdrawal of the application, a fee is collected for the costs that have arisen up to the point of withdrawal.

These services may be provided without authorisation when:

• the monthly average of the preceding 12 months’ total value of payment transactions executed by a natural person does not exceed EUR 50 000; or
• the monthly average of the preceding 12 months’ total value of payment transactions executed by a legal person does not exceed EUR 3 million; and
• the payment service is not offered in another member state of the EEA
• the total value of the electronic money issued by the issuer of electronic money does not exceed EUR 5 million
• providing only account information service.

Submission and content of registration notification:

Provisions on appendices to the registration notification are laid down in section 8 of the Act on Payment Institutions (in Finnish) and in paragraph 6 in FIN-FSA Regulations and guidelines 8/2016 (in Finnish). FIN-FSA requires that all the information as required by regulation listed above is appended to the registration notification.

Key requirements regarding the content of the registration notification

• a list of intended payment services and adequate information on the applicant
• information that verifies the fitness and propriety of the company’s management (see below Fit & proper)
• a business plan, including but not limited to the following information: description of procedures, processes and information systems related to the provision of services
• information on the protection of customer assets
• information on customer identification and customer due diligence procedures and the prevention of money laundering and terrorism financing
• information on management of operational and security risks and reporting of incidents and fraud
• information on the account information service provider's indemnity insurance or other comparable guarantee against liability.

The processing of registration is subject to a processing fee under the schedule of processing fees. Processing fees will be charged for both positive and negative resolutions. If the processing of an application is interrupted due to the applicant’s withdrawal of the application, a fee is collected for the costs that have arisen up to the point of withdrawal.

Payment service legislation excludes certain payment services from the scope the law. Payment service legislation does not apply to services based on specific payment instruments that can be used only in a limited way, when

1. the payment instrument allows the holder to acquire goods, services or other commodities only in the premises of the issuer or within a limited network of commodity providers under direct agreement with the issuer 
2. instruments which can be used only to acquire a very limited range of goods, services or commodities or
3. instruments provided at the request of an undertaking or a public sector entity that are valid only in a single member state of the European Economic Area and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods services or commodities from suppliers having a commercial agreement with the issuer.

Pursuant to section 8 a of the Payment Institutions Act, service providers excluded from the scope of the law are obligated to submit a notification to the FIN-FSA on the provision of payment services within a limited network or for a very limited range of commodities (as referred to in section 2, subsection 4, paragraphs 1 and 2 of the Payment Institutions Act). A notification is required only when the total value of payment transactions executed over the preceding 12 months exceeds the amount of EUR 1 million.

The notification shall contain a description of the services offered and specify under which exclusion provided in paragraphs 1 or 2 the service is excluded from the scope of the Payment Institutions Act. The notification shall be sent to the Financial Supervision Authority's registry office (kirjaamo(at)fiva.fi) in electronic form, making it possible to copy and publish the description on the FIN-FSA’s website. The notification shall be filed with the FIN-FSA form titled Ilmoitus rajoitetusti käytettävään maksuvälineeseen perustuvan palvelun tarjoamisesta (in Finnish). 

The FIN-FSA will either grant approval of registration or refuse registration based on a decision that the service does not meet the requirements for a limited network. The processing of registration is subject to a processing fee (hourly fee) under the schedule of processing fees.

Service providers within a limited network that exceed the above-mentioned limits are entered into a public register of payment institutions, as well a description of the service and the legal basis for the exclusion of the service outside the scope of the law. These details will also be forwarded to the public register of payment institutions maintained by the European Banking Authority EBA.

Regulations and guidelines 4/2022

Upon receiving the application or notification of registration, the FIN-FSA will assess whether the payment service provider meets the legal requirements and put forward a decision. If the application is incomplete, the FIN-FSA will ask the applicant to submit further documentation before resolving the matter. Applications for authorisation shall be processed within no more than 3 months and notifications of registration within no more than 1 month. The processing time does not start until the FIN-FSA has received all required documentation. The total processing time is highly dependent on the quality and detail of the submitted application.

1. How do I know whether my service requires authorisation or registration?

In principle, authorisation is always required when a payment service pursuant to section 1, subsection 2 of the Act on Payment Institutions is provided. If you are not sure about the need for authorisation, please familiarise yourself, for example, with the information to be found on the website of the Financial Supervisory Authority (FIN-FSA). If the need for authorisation remains unclear even after familiarising yourself with the FIN-FSA’s website or the legislation, you can send a description of the service to the address kirjaamo(at)finanssivalvonta.fi and request the FIN-FSA’s assessment of the matter. The description should make clear, among other things, the movement of cash flows and the roles of the different parties in the service. Please also attach your own reasoned assessment of the need for authorisation.

2. Can I submit a listing of the payment services provided in accordance with PSD2?

The business plan must list and describe specifically the payment services, as referred to in section 1 of the Act on Payment Institutions, that the operator intends to provide. The entity may, if it wishes, attach a clarification of payment services under the Directive, but this is not necessary.

3. We have not yet reached a final agreement with a bank on the opening of a client funds account. We have also not yet concluded final agreements with regard to the activities we outsource. What materials do we submit to the FIN-FSA at the authorisation application stage?

In such a situation, please submit the drafts of the agreements. If, for example, a client funds account provider has not yet been selected, a free-form and as accurate as possible explanation of how the matter will be organised is sufficient. The final agreements will be submitted later, sometimes only after the authorisation is received, for example.

4. How precisely should the company’s business model be described?

The business model should be described in as much detail as possible. The description should make clear, among other things, the following aspects:

• how the transfer of funds takes place and how cash flows move in practice and where
• which parties are involved in the transfer of funds (what relationship do they have with the applicant)
• which other parties (e.g. technical service providers) may be involved in the transfer of funds and the provision of the service package
• it is recommended that the transfer of funds be illustrated with a process diagram.

5. Of whom should fit & proper assessments be made?

Regulations require that a fit & proper notification must be made not only for the members of the Board and the CEO, but also for other senior management personnel. In principle, the company is allowed to determine for itself the roles included in “other senior management”, but the FIN-FSA has consistently considered that, for example, the heads of individual business areas, as a rule, belong to this category. The FIN-FSA has also recommended that, for example, a fit & proper notification be made for the compliance officer/head of compliance function.

6. When does the FIN-FSA arrange an authorisation meeting?

The FIN-FSA will contact you when it is time to arrange an authorisation meeting. Usually, a meeting is arranged no later than the stage when the company has submitted sufficient clarifications of its activities to such an extent that it is advantageous to consider the application at the meeting.
Authorisation meetings are arranged for those applying for a payment institution’s authorisation but not, as a rule, for those applying for registration.

7. How does the application process proceed?

After receiving an application or notification, the FIN-FSA assesses whether the entity fulfils the statutory requirements, and issues a decision on the matter. If the application is incomplete, the FIN-FSA will ask for further clarification before deciding on the matter. In addition, an authorisation application always involves at least one authorisation meeting, which is, as a rule, arranged on the applicant’s premises.

8. How long does the entire application process take?

The duration of the application process depends on, among other things, the quality and comprehensiveness of the application. An incomplete application will result in the FIN-FSA submitting several requests to the company for additional clarifications. It is therefore worth paying attention to the quality of the application already at the first stage. An authorisation process takes, on average, 6-12 months and a registration process, on average, 3-6 months.

9. How much does an authorisation or a registration decision cost and what other payment obligations does the supervised entity have?

The FIN-FSA’s schedule of processing fees is available here. An invoice for chargeable procedures will be sent when the decision is made. Supervised entities must also pay an annual supervision fee.

10. In what format do I submit the company’s financial figures, e.g. income statement, balance sheet, own funds, and solvency statements and forecasts?

Form templates are available on the FIN-FSA’s website. These indicate what information regarding the income statement, balance sheet, own funds and solvency should be included in the statements and forecasts insofar as the company has data to be reported on these items. In addition to the statements themselves, the background assumptions and estimates used in them must be clearly stated and displayed separately. Form templates can be found here (item "MA-taulukko" – in Finnish).

11. What clarifications are required with regard to customer due diligence?

A statement on internal policies, procedures and controls, as referred to in chapter 2, section 3 of the Anti-Money Laundering Act 444/2017 (AML Act), as well as the operating guidelines, as referred to in chapter 9, section 1 subsection 3 of the AML Act, applicable to the company’s own activities in order to comply with the AML Act. The purpose of the operating guidelines is to describe the procedures by which the company ensures compliance with the obligations of the AML Act.

At least the following aspects should be evident from this statement:

• Customer identification and identity verification when establishing a customer relationship in practice (see chapter 3, section 2 of the AML Act)
  • Who are the company’s customers under the AML Act?
  • Are customers/customer representatives met in person or is remote identification used?
    • If the customer/customer’s representative is met in person, the documents from which identity is verified
    • If remote identification is used, is a strong electronic identification method or other electronic identification technology used that is data secure and verifiable?
• Customer due diligence: acquisition and documentation of customer due diligence information (see chapter 3, sections 3 and 4 of the AML Act)
  • What information is requested on the customer information form/websites?
  • Is information obtained from elsewhere?
  • Is some information verified?
  • How is the origin of funds ascertained?
• Processes related to beneficial owners and politically exposed persons in practice (see chapter 3, sections 6 and 13 of the AML Act)
• Enhanced customer due diligence obligation related to a high-risk non-EEA state (see chapter 3, sections 10 and 13a of the AML Act)
  • How is this taken into account in practice?
• Procedures for ongoing monitoring of customers’ risk category in practice
  • Simplified and enhanced customer due diligence
  • Updating of information
  • Monitoring
  • Link to company’s risk assessment
  • Detection of suspicious transactions/events/information and reporting of them to the Financial Intelligence Unit (see chapter 4 of the AML Act)
• Compliance with international financial sanctions and national freezing decisions in practice
• Outsourcing/third party
  • If activities related to customer due diligence and identification are carried out by actors other than the applicant itself, a statement on the roles and tasks of these actors
• Resourcing, internal controls and division of responsibilities of AML functions (see chapter 9, section 1 of the AML Act)
  • The company must nominate a person who is responsible for monitoring compliance with the AML Act and regulations issued pursuant to it. The company must also appoint a person who is responsible for internal controls, if this is justified taking into account the size and nature of the reporting entity
  • Procedures for reporting suspected violations within the reporting entity (chapter 7, section 8 of the AML Act)
• Personnel training
  • Content, scope, documentation
  • Who is responsible for training

The FIN-FSA has prepared regulations and guidelines, the aim of which is to give regulations, interpretations and recommendations to supervised entities of the FIN-FSA for the application of regulations on the prevention of money laundering and terrorist financing. 

• Regulations and guidelines 2/2023 Prevention of money laundering and terrorist financing.

12. What form should the risk assessment of money laundering and terrorist financing take?

• When preparing a risk assessment, you may use:
  • Risk assessment - Prevention of money laundering and terrorist financing - www.finanssivalvonta.fi (Risk assessment of obliged entity)
  • EBA (ML/TF) risk factors Guidelines (pdf, in Finnish)
  • EBA (ML/TF) risk factors Guidelines (pdf)

The FIN-FSA has prepared regulations and guidelines, the aim of which is to give regulations, interpretations and recommendations to supervised entities of the FIN-FSA for the application of regulations on the prevention of money laundering and terrorist financing. The regulations and instructions specify in more detail the requirements of the ALM Act, including the risk assessment of the obliged entity.

• Regulations and guidelines 2/2023 Prevention of money laundering and terrorist financing

13. How do I calculate the minimum amount of an electronic money institution’s own funds?

The calculation formula for the minimum amount of an electronic money institution’s own funds is determined according to the services provided.

If the institution only provides issuance of electronic money or payment services related to issuance of electronic money, the minimum amount of the institution’s own funds is calculated only using method D, as referred to in Article 5, paragraph 3 of the Electronic Money Directive (2009/110/EC, hereinafter EMD), i.e. 2% of the amount of electronic money issued. According to the FIN-FSA’s interpretation, payment services related to issuance of electronic money are, in principle, payment transactions related to a payment account (electronic money wallet), provision of a payment account in which only electronic money is stored, and issuance of a payment instrument if only the electronic money in question is used with the payment instrument.

If, in addition to issuing electronic money, the institution provides payment services that are not related to electronic money, such as credit, money transfer or payment transactions not related to a payment account, the minimum amount of the institution’s own funds is calculated according to EMD Article 5, paragraph 2, using the own funds calculation method selected for the company, plus the 2% electronic money requirement (i.e. A/B/C+D). If the calculation method selected for the institution is the payment-transaction-based method (B), only those payment transactions that are not related to the electronic money are taken into account in the amount calculated by the method.

An electronic money institution must, however, always have own funds of at least EUR 350,000, as required by EMD Article 4, so if the amount calculated using method D or the calculation formula A/B/C+D falls below EUR 350,000, the minimum amount of own funds is EUR 350,000.

14. Is my home address acceptable as the address of the payment service provider? 

It is not acceptable. The address of the payment service provider must be a business premises. The FIN-FSA must have the right of inspection under the Act on the Financial Supervisory Authority, and the subject of an inspection cannot therefore be within the scope of domestic peace.

The Financial Supervisory Authority (FIN-FSA) reminds payment institutions granting credit of their obligation to report to the Positive Credit Register, maintained by the Finnish Tax Administration’s Incomes Register Unit.

Further information on the obligation to report can be found on the Tax Administration's website.

Compliance with the obligation to report of payment institutions granting credit is monitored by the FIN-FSA.

A payment institution may apply for withdrawal of authorisation, in which case said institution shall submit to the FIN-FSA the documentation listed in section 5.14 of FIN-FSA Regulations and guidelines 8/2016 (in Finnish).

A registration may be withdrawn by informally notifying FIN-FSA of the reason for ceasing the activity.

Fit & proper form (rtf, in Finnish)

The application shall be appended with the FIN-FSA fit & proper form and additional documentation regarding reliability and suitability as provided in the Decree of the Ministry of Finance on the Information to be Appended to the Authorisation Application of a Payment Institution. In addition, see FIN-FSA Regulations and guidelines 8/2016 (in Finnish) for information on reporting of the fitness and propriety of persons providing services without authorisation.