EU Passporting for Payment and E-Money Institutions

The principle is stated very clearly in Article 10(1) of Royal Decree 736/2019: “The authorization as a payment institution shall be valid in all Member States and shall allow the provision of payment services covered by the authorization throughout the European Union, under the free provision of services or the right of establishment.” That sentence contains the entire mechanism, and also its two limits.

The first limit concerns scope: the passport covers the services “covered by the authorization”. Not the ones you would like to provide, not the ones your competitors provide in that market: the ones listed in your Spanish license. If the service is not in your program of operations, it does not travel, and you will need to extend your license before notifying.

The second concerns procedure. The fact that the right exists does not mean you can exercise it on the day you decide to. You have to go through a notification process between your supervisor and the supervisor of the destination country, with fixed deadlines, and the right cannot be exercised until that process is complete.

What is worth establishing from the outset is the legal nature of the procedure: within the European Union you do not apply for authorization, you notify. The host authority does not decide on your application. It can pass on information and record what the rules literally call “reasonable grounds for concern”, but the decision lies with your home authority. Outside the EU the scheme is completely reversed: authorization is required, with a closed list of grounds for refusal, as we will see.

A point that surprises many e-money projects: Article 14 of Royal Decree 778/2012 provides that “Electronic money institutions may not issue electronic money through agents”. They may distribute and redeem electronic money through distributors, after notifying the Bank of Spain, and they may provide payment services through agents. But not issuance. It is a structural limitation that shapes the design of any European expansion based on a third-party network.

Another practical point: the documentation is submitted in English, because the Bank of Spain forwards it to the host supervisor. This is not a logistical detail. It means that the program of operations, the organizational description and the policies accompanying the notification must exist in an English version that says exactly the same as the Spanish one, and that holds up when read by a supervisor who does not know your original file.

On paper the distinction seems simple: a branch is a permanent establishment, and the free provision of services is carried out from Spain. In practice, the line blurs as soon as agents or distributors appear in the host country, because the question is no longer where your office is but whether you have a permanent presence there.

The European Banking Authority addressed exactly that problem in its Opinion EBA-Op-2019-03 of April 24, 2019, on the nature of passport notifications regarding agents and distributors. The Opinion sets criteria for determining when the use of agents amounts to establishment (and therefore requires a branch notification) and when it remains free provision of services:

• Nature of the mandate. Occasional activity points to free provision of services; regular or continuous activity points to establishment.
• Duration. The overall duration of the contractual relationship between the institution and its agents or distributors is assessed, together with the intention reflected in the business plans.
• Permanent presence. If the activities allow customers to benefit from the services through a permanent presence in the host Member State, that is a strong indication of establishment.

The Opinion adds a warning worth remembering when you build your argument: “a single criterion may not by itself be determinative”. It is not enough to point out that the contract is short or that there is no office; the overall picture is assessed. It also stresses that a stable permanent presence may exist even when operating through several agents under the free provision of services regime.

The practical consequence is uncomfortable but clear: an institution that deploys an agent network in another Member State and notifies it as free provision of services may find that the host supervisor treats it as an establishment. And that recharacterization is not theoretical: it changes the supervisory regime, the local obligations and, often, the tax burden.

There is a nuance in phase 2 that determines the real timeline: the Bank of Spain has one month to forward the documentation “that has been reviewed and assessed favorably”. In other words, the month does not start running on whatever is filed: it starts running on documentation the supervisor considers complete and correct. A weak file does not use up that month; it restarts it.

There is also a point of legal architecture worth understanding well, because it explains how the system behaves. Article 9 of Royal Decree 736/2019 governs the mirror case (a foreign institution entering Spain), and its wording is revealing. The host authority does not refuse: it informs the home authority “of any reasonable grounds for concern raised by the project”, in particular where it has reasonable grounds to suspect that money laundering or terrorist financing is taking place, or that engaging agents or establishing the branch could increase that risk. And the provision continues: “If, following the communications between both authorities, the competent authority of the home Member State decides favorably on the application, the branch shall be entered in the corresponding special register [...], from which moment the institution may start its activities.”

Two lessons follow from this. First: the decision is made by your supervisor, not by the host supervisor. Second, and more operational: the enabling milestone is registration, not the decision or the expiry of the deadlines. Until you are registered, you cannot operate.

One last warning, with an expiry date: if one year passes after the notification without the branch having started its activities, the supervisor records its removal from the special register and informs the other authority. A passport that is notified but not used lapses.

Article 12 of Royal Decree 736/2019 defines the concept unambiguously: an agent is “a natural or legal person who provides payment services on behalf of a payment institution”. And it expressly excludes two cases that are often confused with it: “Representatives with powers for a specific transaction, and persons linked to the payment institution or its group by an employment relationship, shall not be considered agents.”

Under Article 13(1), the notification to the supervisor requires three blocks of information: the information listed in Article 23(1) of Royal Decree-law 19/2018; information on the internal control and reporting procedures and bodies to be used in relations with the agents, both to prevent money laundering and to ensure compliance with sector rules; and information on the procedures adopted to select and train the agents. That third block is the one that gets most files sent back, because almost no one has it in writing before being asked for it.

When the destination is another Member State, an extra layer is added. Article 13(3) requires following the passport procedure and, if the institution intends to use a permanent network of agents in that State, also notifying the identity of the persons responsible for managing the network in the host Member State and an address there. In practice, it is a mandatory local point of contact.

On liability, there is no room for interpretation. Article 14(1) provides that payment institutions “shall be liable for compliance with the obligations [...] in respect of the acts carried out by their agents, whether by the agents themselves or by third parties to whom the latter may, where applicable, delegate”, and that they must establish appropriate control policies and procedures, as well as “carry out controls of the acts performed by their agents at least once a year”. Sub-delegation does not break the chain of liability, and the annual control is an express obligation, not merely good practice.

The grounds for refusal outside the EU form a closed list and are worth reading, because they describe exactly what the supervisor looks at. Article 10(3) allows refusal where the Bank of Spain considers that “the administrative structures or the financial situation of the payment institution are not adequate”; where “the program of operations provides for the provision of payment services for which the institution is not authorized”; where it considers that the branch's activity “will not be subject to effective control by the supervisory authority of the host country”; or where there are “legal or other obstacles that prevent or hinder the control and inspection of the branch by the Bank of Spain”.

The second ground is the one that links this page to the scope of your license: applying for a branch outside the EU with a program that goes beyond what is authorized means certain refusal. And the last two explain why the destination matters so much: it is not only your institution that is assessed, but also the capacity of the local supervisor and whether the Bank of Spain can realistically carry out inspections there.

To change the notified information afterwards, Article 10(5) requires notice at least one month in advance, and adds that a material change to the branch's program of operations may not be made if, within that month, the Bank of Spain objects by a reasoned decision based on any of those same grounds.

In the banking regime, the distinction between the two modes is marked by the verbs the law uses. Article 11 of Law 10/2014 states that, to open a branch abroad, the institution must first “apply” to the Bank of Spain, and that, to operate for the first time under the free provision of services, it must first “notify” it. Applying and notifying are not the same thing, and the difference carries over into the procedure.

Article 14 of Royal Decree 84/2015 develops this. For a branch in another Member State, the Bank of Spain “may only refuse the opening [...] where it has reason to doubt, in view of the project concerned, the adequacy of the administrative structures or the financial situation of the credit institution, or where the program of operations submitted provides for activities for which the institution is not authorized”, and it decides by reasoned decision within a maximum of two months. The application must include three items: the State in whose territory the branch is to be established and the address for requests for information; a program of operations setting out the planned activities and the organizational structure of the branch; and the names and track record of the managers in charge.

For the free provision of services, a notification is enough, stating the activities the institution intends to carry out “from among those it is authorized to perform”, and the Bank of Spain forwards the notification to the host supervisor within a maximum of one month.

Two more particularities. Any change to the notified information requires notice at least one month in advance, and within that month the Bank of Spain may object by reasoned decision. And where the institution is a significant supervised entity for the purposes of the Single Supervisory Mechanism, the decision on opening the branch lies with the European Central Bank, as do the other powers under that article, except receiving the application.

Outside the EU the deadline rises to three months and silence becomes negative: the application “may be deemed rejected”.

The Bank of Spain maintains a specific procedure for the free provision of services by credit institutions and financial credit establishments in another State, and its own stated purpose defines its scope: prior notification to operate under the free provision of services “in non-EU States (or Member States, in the case of financial credit establishments)”. In other words, an EFC follows the national notification route for Member States too, which in practice means it does not enjoy the automatic EU passport available to payment institutions, electronic money institutions and credit institutions.

The consequence is a design issue, and it has to be addressed before applying for anything. If the group's plan involves operating in several Member States with a single license, an EFC is not the right vehicle. That decision should be weighed against the alternatives (payment institution, electronic money institution or credit institution), depending on which activity you really want to passport.