Fintech
Fintech & Licensing (EMI, MSB, VASP)
Compliance frameworks regulators and partners can trust.
Overview
Operating a payment company, crypto exchange, remittance business, e-money issuer, or virtual asset service provider without the correct regulatory authorisation is not a sustainable business strategy. Banks will not maintain accounts for unlicensed payment businesses. Institutional investors will not deploy capital into unlicensed crypto funds. Regulators in the EU, UK, UAE and increasingly in Asia-Pacific are actively pursuing unlicensed payment and crypto businesses with significant civil and criminal enforcement consequences. The question is not whether to license — it is which regulatory framework, in which jurisdiction, for which business model, and in which sequence. HPT Group advises on the full regulatory licensing process for payment institutions, electronic money institutions, virtual asset service providers, money services businesses, and investment services firms across EU, UK, Middle East, Caribbean and Asia-Pacific jurisdictions. Our approach begins with a regulatory mapping exercise — analysing your specific business model, payment flows, customer types and geographic scope against the applicable regulatory frameworks — before recommending a jurisdiction. A Lithuanian EMI licence passportable across all 27 EU member states is the right answer for a pan-European payments business. A UAE VARA licence is the right answer for a MENA-facing crypto exchange. A Cayman CIMA registration may be appropriate for a fund-facing crypto vehicle with no retail customers. We identify the framework that fits the activity, not the easiest approval. Our clients include payment platform founders seeking EU market access, crypto exchange operators requiring credible regulatory standing for banking and institutional partnerships, remittance businesses building compliance-first infrastructure, and fintech companies that have been operating informally and now require regulatory authorisation to scale or raise capital. We manage the complete process from regulatory mapping through licence application, compliance framework design, MLRO appointment, banking partner introduction and post-licence ongoing compliance management.
What's Included
- EMI licence applications
- MSB and payment licence advisory
- VASP and crypto licensing
- AML/KYC framework design
- Banking partner introductions
Typical Engagement Timeline
From first contact to
fully implemented structure.
Timelines vary by engagement complexity and jurisdiction. The steps below reflect a typical instruction from initial application through to active implementation.
Day 1
Application
Submit your application and structured intake form. We review your situation, confirm fit, and agree scope and fees in writing before any work begins.
Days 3–5
Diagnosis Call
A 90-minute senior strategy call to cover your current structure, residency, revenue flows, risk exposure and goals. All relevant documents reviewed in advance.
Days 10–21
Blueprint Delivery
Written memorandum delivered covering current position analysis, proposed structure with diagrams, jurisdiction rationale, and implementation sequencing.
Weeks 3–18
Implementation
Entity formation, banking introductions, registered agent setup, compliance calendar and substance design — all coordinated and managed by the HPT senior team.
Day 1
Application
Submit your application and structured intake form. We review your situation, confirm fit, and agree scope and fees in writing before any work begins.
Days 3–5
Diagnosis Call
A 90-minute senior strategy call to cover your current structure, residency, revenue flows, risk exposure and goals. All relevant documents reviewed in advance.
Days 10–21
Blueprint Delivery
Written memorandum delivered covering current position analysis, proposed structure with diagrams, jurisdiction rationale, and implementation sequencing.
Weeks 3–18
Implementation
Entity formation, banking introductions, registered agent setup, compliance calendar and substance design — all coordinated and managed by the HPT senior team.
Capabilities
What this service covers.
EMI & Payment Institution Licences
Electronic Money Institution (EMI) and Payment Institution (PI) licences under the EU's Payment Services Directive 2 (PSD2, Directive 2015/2366/EU) and the Electronic Money Directive (EMD2, Directive 2009/110/EC) provide a passportable regulatory framework for e-money issuance, payment account provision, payment initiation, account information and money remittance across all 27 EU/EEA member states. Lithuania (Bank of Lithuania), Malta (MFSA), Ireland (Central Bank of Ireland) and the Netherlands (DNB) are the primary EMI licensing hubs. We advise on jurisdiction selection, manage the full application preparation and submission, and design the AML/KYC compliance framework required for approval.
VASP & Crypto Asset Licensing
Virtual Asset Service Providers require registration or licensing under an increasing number of frameworks: EU MiCA (Markets in Crypto-Assets Regulation, Regulation 2023/1114) full authorisation from December 2024; UAE VARA (Virtual Assets Regulatory Authority) full market product approval; Cayman Islands CIMA Virtual Asset Service Providers Act (VASPA) registration; Gibraltar Financial Services Commission DLT Provider framework; Bahamas Securities Commission DARE Act 2020 licensing; and Bermuda Digital Asset Business Act (DABA) Class F licence. We assess which regime matches your custody, exchange, brokerage or advisory activities and manage the applicable authorisation process.
MSB & Money Transmission Licences
For US-facing operations, Money Services Business (MSB) registration with FinCEN under the Bank Secrecy Act is the baseline federal requirement, supplemented by state Money Transmitter Licences (MTLs) required in each state where you operate — from New York's BitLicence and MTL (the most burdensome, requiring USD 500,000 minimum net worth) to more accessible state regimes. For UK operations, FCA authorisation as an Authorised Payment Institution or registered Small Payment Institution under the Payment Services Regulations 2017 (SI 2017/752). We work with specialist regulatory counsel in each jurisdiction and manage the overall multi-jurisdictional process.
AML/KYC Framework Design
Every regulated payment, e-money or VASP licence requires a documented, operational and independently auditable AML/KYC compliance framework. This means: MLRO appointment (qualified, fit-and-proper approved by the regulator), written AML risk assessment covering customer, product, geographic and delivery channel risks, Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures, transaction monitoring system configuration with alert thresholds, Suspicious Activity Report (SAR) filing procedures, staff training programme, and ongoing compliance monitoring. We design these frameworks for regulatory submission and operational use — working with your internal compliance team or providing interim MLRO services where required.
Jurisdictions Covered
8+ jurisdictions.
Directly advised and operationally active.
Jurisdictions Covered
Where we operate and advise.
Lithuania
The leading EU EMI hub, supervised by the Bank of Lithuania under a pragmatic and fintech-friendly regulatory approach. Over 130 EMI and PI licences issued. Processing timeline 3–6 months — the fastest in the EU. Initial capital EUR 350,000 (EMI) or EUR 125,000 (PI). Minimum substance requirements: local director, MLRO, registered office. Full EU/EEA passport. Annual supervisory fee approximately EUR 3,000–8,000. Established fintech ecosystem with available compliance talent and cost-effective operations.
Malta
Malta Financial Services Authority (MFSA) licensing for EMIs, Payment Institutions, VASPs under the Virtual Financial Assets Act (VFAA) 2018 and Investment Services Act Cap 370. VFA Agent requirement for VASP applications. MiCA-compliant CASP licence pathway from 2024. EU passport for payment and e-money licences. Processing timeline 6–12 months. Higher costs than Lithuania but strong international credibility and established legal and compliance market. MFSA known for detailed substantive review.
UAE (VARA & ADGM)
Dubai Virtual Assets Regulatory Authority (VARA) established under Dubai Law No. 4 of 2022 provides the regulatory framework for virtual asset activities in Dubai. VARA Full Market Product authorisation required for custody, exchange, brokerage, lending and advisory. ADGM Financial Services Regulatory Authority (FSRA) provides a broader financial services framework under English common law. Processing timeline 6–12 months. Strong banking access for VARA-licensed entities. UAE CBUAE oversight for payment service providers operating onshore.
Cayman Islands
CIMA Virtual Asset Service Providers Act (VASPA) 2020 registration for VASPs offering exchanges, custody, transfers and issuance. Light-touch regime relative to EU MiCA — registration rather than full authorisation for many activities. Popular for fund-facing crypto vehicles, token issuance structures and sophisticated institutional crypto businesses that do not require EU-passportable licences. Annual registration fee USD 3,000–10,000 depending on activity category. Processing timeline 3–5 months.
Gibraltar
Gibraltar Financial Services Commission (GFSC) Distributed Ledger Technology (DLT) Provider framework — the world's first specifically designed blockchain business licence, operational since January 2018. Nine core DLT principles for licence conditions. Well-regarded internationally but limited banking options restrict commercial utility. Processing timeline 6–12 months. Initial capital EUR 100,000. Strong for token issuance structures, crypto custodians and DLT-native businesses with European market focus.
Bahamas
Securities Commission of the Bahamas (SCB) DARE Act 2020 (Digital Assets and Registered Exchanges) provides a comprehensive crypto regulatory framework. DARE licence required for exchanges, custodians and brokers. SCB has demonstrated a pragmatic approach to licensing crypto businesses. Processing timeline 4–8 months. Minimum capital requirements vary by activity. Strong for North American and Caribbean-facing crypto businesses. Beneficial geographic and time-zone position for Americas-focused operations.
Ireland
Central Bank of Ireland EMI and PI authorisation under the European Union (Payment Services) Regulations 2018. Preferred EU entry point for US-headquartered companies seeking EU market access, given Ireland's common law legal system and English language. Strong legal, compliance and fintech talent market. Processing timeline 12–18 months — the longest in the EU. Minimum capital EUR 350,000 (EMI). Strong regulatory relationships and a sophisticated, well-staffed Central Bank review team. Full EU/EEA passport.
Labuan (Malaysia)
Labuan Financial Services Authority (Labuan FSA) licensing for Money Broking and E-Money businesses under the Labuan Financial Services and Securities Act 2010. Low cost, processing timeline 3–6 months, and strong Southeast Asian banking relationships. Labuan FSA has actively encouraged digital financial services licensing. Useful for APAC-focused payment and fintech businesses seeking a cost-effective regulated hub with Malaysian banking access. Annual licensing fee approximately USD 5,000–15,000.
How It Works
From instruction to implementation.
Regulatory Mapping
We conduct a detailed mapping of your business model — specific payment activities, customer types (retail vs institutional), geographic scope, fiat and crypto flows, custody vs non-custody, B2B vs B2C — against applicable regulatory frameworks across relevant jurisdictions. The output is a written regulatory analysis identifying which licences are legally required for your activities, which are commercially advisable for banking and partnership purposes, and which two or three jurisdictions provide the best fit for your business model, timeline and budget. We identify hidden licensing triggers that applicants frequently overlook, such as acquiring transaction routing, FX conversion and stored value thresholds.
Application Preparation
We prepare the full licence application pack: detailed business plan covering business model, revenue projections, compliance strategy and market analysis; corporate structure diagram and legal documentation; fit-and-proper documentation for all directors, shareholders and key function holders (CV, criminal record certificate, financial history); AML/KYC policies and procedures; technology and IT security assessment; safeguarding and client asset protection arrangements; capital adequacy calculations; and compliance monitoring programme. Each regulator has specific requirements for format, depth and supporting evidence — we tailor the pack accordingly.
Submission & Regulator Liaison
We manage submission of the complete application pack, maintain a formal correspondence log with the regulatory authority, respond to all queries and requests for additional information, prepare management for regulator interviews (which are standard for FCA, Central Bank of Ireland and MFSA applications), and track the application through each stage of the review process. We escalate delays where appropriate and advise on pre-application meetings with the regulator — which are available in Lithuania, Malta and Labuan and can reduce processing time significantly. Processing timelines: Lithuania 3–6 months; VARA/ADGM 6–12 months; MFSA 6–12 months; FCA 12–18 months.
Banking & Launch Support
A licence without a banking relationship is commercially inoperative. We manage banking partner introductions for the licensed entity immediately following authorisation — introducing to institutions with demonstrated track records of banking licensed payment and VASP businesses in the relevant jurisdiction. We also advise on compliance framework implementation for go-live: transaction monitoring system configuration, KYC provider integration, SAR reporting workflow, MLRO operational procedures, and the ongoing regulatory reporting obligations applicable to your licence type. We remain available for ongoing regulatory queries and compliance reviews.
Comparable Client Outcomes
What clients have achieved with this service.
Anonymised and generalised for confidentiality. All outcomes reflect real engagements. Results vary by individual circumstances, jurisdiction and timing.
- Hong Kong fintech founder
EU EMI licence secured in Lithuania within 7 months — enabled client to onboard three European institutional payment partners that previously required a regulated entity.
- UK crypto startup
VASP registration strategy designed across two jurisdictions — compliant operating model established ahead of MiCA implementation, ahead of competitors by approximately 14 months.
- African remittance business
MSB licence and correspondent banking relationships established in a compliant jurisdiction — processing volume scaled from USD 400K to USD 4.2M per month within 18 months of licensing.
Key Questions
What clients ask us.
Straight answers to the questions that come up in every engagement. If your question is not here, ask us directly.
Ask a Question →Lithuania: 3–6 months. Malta: 6–12 months. Ireland: 12–18 months. Netherlands: 9–15 months. Minimum initial capital: EUR 350,000 (full EMI) or EUR 125,000 (PI). Total advisory, legal and regulatory fees for a Lithuanian EMI application typically range from EUR 40,000–80,000 depending on complexity and whether AML framework and MLRO services are included. For FCA or CBI applications, total costs are typically GBP 80,000–150,000+ given the longer process and more demanding requirements. We provide a detailed cost and timeline estimate at the outset.
Yes — all EU EMI and PI licences require genuine local establishment, not a letterbox entity. The Bank of Lithuania requires at minimum a local director, a qualified MLRO, a registered office address and evidence of actual operational presence. MFSA and CBI requirements are more demanding: local management team, compliance function, IT systems and substance commensurate with the scale of the business. VARA requires physical UAE presence. The regulator will assess the genuineness of your local establishment during the review process and as an ongoing licence condition. We assist in identifying qualified local directors, MLROs and compliance personnel.
Only for activities that do not require authorisation in the relevant jurisdiction. You cannot issue electronic money, accept customer funds into payment accounts, execute payment transactions, or operate a crypto exchange without the relevant licence. Operating without authorisation — even during a beta or soft-launch phase — constitutes a criminal offence in most jurisdictions and can result in formal regulatory proceedings that compromise the pending licence application. We advise on what is legally permissible in the pre-licence development and testing phase, including sandbox regimes available in the UK (FCA Regulatory Sandbox), UAE (ADGM RegLab) and Lithuania.
EU EMI: EUR 350,000 initial capital, maintained on an ongoing basis. EU PI (payment initiation, account information): EUR 50,000–125,000 depending on services. VASP requirements vary: UAE VARA categories from AED 200,000; Cayman VASPA registration no minimum capital requirement; Gibraltar DLT licence EUR 100,000. US state MTL requirements vary from USD 10,000 (Vermont) to USD 2,000,000+ (New York). New York BitLicence has no specified minimum capital but requires a surety bond. We provide a jurisdiction-specific capital requirement analysis as part of the regulatory mapping.
MiCA (Markets in Crypto-Assets Regulation, EU Regulation 2023/1114) is the EU's comprehensive regulatory framework for crypto-asset service providers and issuers, fully applicable from December 2024. MiCA creates three asset classes (asset-referenced tokens, e-money tokens, and other crypto-assets) and requires all Crypto-Asset Service Providers (CASPs) operating in the EU to obtain a MiCA authorisation from a national competent authority — passportable across all 27 member states. MiCA replaces fragmented national VASP registration regimes (including the existing French, German and Spanish regimes). Businesses currently operating under transitional provisions must apply for MiCA authorisation by December 2024. We advise on MiCA readiness and manage authorisation applications.
Licensed EMIs, PIs and VASPs face a continuous compliance burden: annual regulatory reporting (financial statements, safeguarding audit, AML effectiveness review), ongoing transaction monitoring, SAR filing with the national financial intelligence unit, periodic regulatory returns (liquidity, capital adequacy, large transaction reports), staff AML training, quarterly MLRO compliance reports to the board, and notification of material changes to the business model, ownership or key personnel. Breach of ongoing licence conditions can result in licence suspension or revocation. We provide a post-licence compliance calendar and ongoing MLRO advisory support for clients requiring it.
Important Notes
- —A licence obtained without a credible, operational compliance framework will not survive the regulator's post-approval supervisory review. The compliance framework must be designed for actual operation, not just regulatory submission.
- —Banking relationships for licensed fintechs and VASPs have become significantly more difficult to establish since 2020 due to correspondent bank de-risking. We assess banking viability before selecting a licensing jurisdiction — a licence in a jurisdiction with no viable banking options provides no commercial benefit.
- —Regulatory requirements change frequently and unpredictably. MiCA, DORA (Digital Operational Resilience Act), updated FATF guidance on VASPs and national implementation of AML Directive 6 all create ongoing compliance obligations. Your framework must be designed to adapt and must be reviewed annually.
- —The EU passporting benefit of an EMI licence only applies to EMI activities — not to VASP activities under MiCA, which requires a separate MiCA CASP authorisation. Do not assume an existing EMI licence covers your crypto activities under MiCA.
- —Fit-and-proper requirements apply to all directors and key function holders. Regulatory history, criminal records, prior licence refusals or revocations, financial insolvency history and conflicts of interest are all reviewed. We conduct an internal fit-and-proper pre-screening before any application is submitted.
- —Advisory and application management fees from £8,500 depending on jurisdiction, licence type, complexity and whether ongoing compliance support is required.
Get HPT intelligence in your inbox
Offshore structuring analysis, jurisdiction updates, and tax planning insights. No marketing. Unsubscribe any time.
Get Started
Ready to discuss your situation?
Apply to become a client and tell us about your business, assets and goals. We will assess fit and outline terms before any charges are incurred.
Related Services
Services that are frequently combined with or complement this practice area.