We analyze whether your payment gateway is an exempt technical service provider or provides a payment service subject to authorization under PSD2 and Royal Decree-law 19/2018: holding of funds, fit as a payment institution or PISP, operating as an agent of an authorized institution, strong customer authentication (SCA) and anti-money laundering.
Free consultation
We reply within 24 h
Six building blocks to determine whether your gateway needs a license and, if so, which one: from the regulatory perimeter analysis to authorization, security and compliance.
We analyze whether your gateway falls within the technical service provider exclusion (technology support without ever holding the funds) or whether it provides a payment service subject to authorization under PSD2 and Royal Decree-law 19/2018.
If there is a payment service, we define the route: applying for a payment institution license, registering as a payment initiation service provider (PISP) or operating as an agent of an already authorized institution while your own license is being processed.
The key point: if the gateway ever holds the payer’s funds or aggregates them before settling them to the merchant, it crosses the regulatory perimeter and needs authorization and safeguarding.
We review the strong customer authentication required by PSD2, the applicable exemptions and the card data security standard (PCI DSS), as well as the operational resilience framework (DORA) where it applies.
If the gateway provides a payment service, it is an obliged entity: we implement the risk assessment, KYC, monitoring, the SEPBLAC representative and reporting.
We structure the contracts with the acquirer, the card schemes and the technical suppliers, and the allocation of responsibilities, so that the model works in practice.
Not all gateways are equal in the eyes of the law: providing technical support is one thing; touching the funds or initiating payments is another. The regulatory fit depends on exactly what your platform does.
"A purely technical gateway transmits data and connects the merchant with the acquirer without ever holding the funds. It is excluded from authorization, but the boundary must be documented."
"An aggregator or payment facilitator that receives the funds and then settles them to the merchant provides a payment service: it needs authorization and safeguarding of client funds."
"If the gateway initiates payments from the customer’s account (open banking), it is a payment initiation service: it is regulated even if it never holds the funds."
"When the model requires managing funds and providing several payment services, the route is your own payment institution license, with the capital, governance and compliance that come with it."
Assuming that a gateway never needs a license is a common mistake: as soon as it touches funds or initiates payments, it enters the PSD2 perimeter, and operating without authorization blocks the business and exposes it to penalties.
The most common mistake: taking for granted that a gateway is "just technology". The line is whether the funds are held at any point; if it is crossed without authorization, the problem surfaces when the business is already up and running.
Payment initiation is regulated even if you do not touch funds: confusing a technical gateway with a PISP leads to operating without the required registration with the Bank of Spain.
Safeguarding and AML are not optional: if the gateway provides a payment service, it must safeguard client funds and comply with anti-money laundering rules from day one.
Providing payment services without prior authorization from the Bank of Spain may result in the business being halted.
The penalty regime of Royal Decree-law 19/2018 reaches anyone who provides payment services without authorization, with liability for directors.
Acquirers, banks and card schemes require a clear regulatory fit before integrating a gateway: without it, integrations are blocked.
Before launching or scaling, it is worth validating the regulatory perimeter: whether your model touches funds, initiates payments or aggregates, and which authorization or agent route suits you.
A payment gateway is the technology that connects a merchant with the payment ecosystem (acquirer, card schemes, banks) to authorize and process transactions. In its most basic form, it transmits and protects data without ever holding the funds.
The key question is not technological but regulatory: if at any point it holds the funds or initiates the payment, it is no longer mere technical support.
It depends. If it is a technical service provider that provides support without ever holding the funds, it is excluded from authorization under PSD2 and Royal Decree-law 19/2018.
If it touches the funds, aggregates them or initiates payments, it provides a payment service and needs authorization (payment institution) or registration (PISP), or must operate as an agent of an authorized institution.
When its role is limited to technology support (data processing and storage, authentication, networks, terminals) and it does not come into possession of the funds to be transferred. This exclusion is provided for in PSD2 and in Royal Decree-law 19/2018.
Important: the exclusion does not cover payment initiation or account information, which are regulated even if the provider does not hold the funds.
They differ in whether they touch the funds and in their authorization:
A PISP (payment initiation service provider) initiates a payment order from the customer’s bank account within the open banking framework. Unlike a technical gateway, it is regulated (it requires registration with the Bank of Spain) even if it never holds the funds.
Many modern gateways include payment initiation, which places them within the regulated perimeter.
Strong customer authentication (SCA) is the PSD2 requirement to verify the user with at least two independent factors (something they know, have or are) in electronic payments. It is developed in Delegated Regulation (EU) 2018/389 and allows certain exemptions.
The gateway must support SCA and handle exemptions correctly so as not to increase friction or take on liability for fraud.
If the gateway provides a payment service, it is an obliged entity under Law 10/2014: it must implement a risk assessment, due diligence (KYC) and monitoring, appoint a SEPBLAC representative and report suspicious transactions.
A purely technical provider that does not provide payment services is not, by virtue of that activity, an obliged entity.
Yes. An alternative to obtaining your own license is to operate as an agent of an already authorized payment institution, entered in the relevant register and under that institution’s responsibility.
It is a common route to launch sooner or validate the model, but it requires a solid contract and controls that the principal institution will supervise.
PCI DSS (Payment Card Industry Data Security Standard) is the card industry’s data security standard that anyone who stores, processes or transmits card data must meet. It is not a license but a contractual requirement of the card schemes, yet it is essential to operate a gateway securely.
It is Royal Decree-law 19/2018 of November 23 on payment services and other urgent financial measures, which transposes PSD2 (Directive (EU) 2015/2366) into Spanish law. It governs who may provide payment services, payment institutions, payment initiation, account information and the exclusions from its scope.
It is a PSD2 exclusion for instruments that can only be used to acquire goods or services within a limited network of providers or for a very specific range of products (for example, a retail chain’s gift cards). Above certain thresholds, it must be notified to the Bank of Spain. It is different from the commercial agent exemption.
PSD3 and the Payment Services Regulation (PSR) are in the final stage of the legislative process (political agreement at the end of 2025 and a compromise text in 2026, with practical application expected around 2027). They will replace PSD2, merge payment institutions and electronic money institutions into a single category, strengthen SCA and fraud liability, and expand open banking. It is advisable to design your project with this horizon in mind.
This is the question that defines everything. If the money passes through the gateway’s accounts before reaching the merchant, or the gateway aggregates and settles it, then it holds the funds and provides a payment service. If the flow goes directly from the payer to the acquirer/merchant and the gateway only transmits data, it does not hold them.
The supervisor of payment services in Spain is the Bank of Spain, which authorizes and keeps the register of payment institutions, agents, and payment initiation and account information service providers. A purely technical provider does not register for that activity, but it is advisable to document why it falls outside the perimeter.
Whether authorization is needed, and how much capital is required, depends on whether the gateway touches the funds and which payment service it provides. We help you place your model before you start.
Two questions frame the regulatory fit: whether the gateway holds the funds at any point and exactly which payment service it provides.
Before you commit to any fees, we pin down the regulatory perimeter and the right route. That way you avoid applying for a license you do not need or, worse, operating without one you do need.
| Model | Technical gateway | Aggregator / facilitator | PISP | Payment institution |
|---|---|---|---|---|
| License required? | No (excluded) | Yes | Specific registration | Yes |
| Touches the funds? | No | Yes | No | Yes, with safeguarding |
| Authorization | None (document the exclusion) | Payment institution | PISP registration with the Bank of Spain | Payment institution authorization |
| Initial capital (indicative) | Not applicable | €125,000 | €50,000 | €20,000 to €125,000 depending on services |
| Supervisor | Bank of Spain (perimeter) | Bank of Spain | Bank of Spain | Bank of Spain |
Indicative figures for comparison purposes. The exact capital and the regulatory fit depend on the specific payment services the gateway provides and on whether it holds the funds; they must be validated case by case under Royal Decree-law 19/2018 and PSD2.
A gateway’s regulatory fit is not a label: it is the result of analyzing the flow of funds, the services provided and security. The key is to choose the right route before building the product.
First of all, you need to map whether the money passes through the gateway and which service it provides. That decision determines whether it needs a license or registration, or is excluded.
Strong customer authentication, exemptions and PCI DSS compliance must be resolved early: they affect friction, fraud and the relationship with acquirers and card schemes.
If there is a payment service, anti-money laundering and the contracts with the acquirer and suppliers must be designed from the outset, not as an afterthought.
If you want to validate your gateway’s regulatory fit or prepare the authorization application, see our services for fintech regulation and the payment institution license.
Fitting a gateway into the rules is not about giving it a label: it is a set of consistent decisions (flow of funds, payment services, security and compliance) that determine whether it needs a license. Here is a panel to show how this works in practice.
1) FlowThe goal is not to label the gateway as soon as possible, but to see whether the money passes through it. That determines the whole regulatory fit.
2) ServiceAcquiring, execution, initiation or account information. Each service has its own authorization or registration and its own capital.
3) SecurityStrong customer authentication, exemptions and PCI DSS. When they are neglected, fraud, friction and risk with the card schemes increase.
4) ComplianceAML/CFT, safeguarding of funds where applicable, and contracts with the acquirer and suppliers. This is what turns the regulatory fit into an operational and defensible model.
Quick decisionYou neither hold funds nor initiate payments: technical service provider, excluded from authorization.
You initiate payments from the customer’s account: registration as a PISP with the Bank of Spain.
You receive and settle funds: payment institution license, or agent of an authorized institution.
A clear analysis of whether the gateway holds the funds at any point in the payment chain.
Flow-of-funds diagram, account structure and description of the settlement process.
Identification of the services provided (acquiring, execution, initiation, information).
Functional description of the service and mapping to the payment services listed in Royal Decree-law 19/2018.
Where relevant, justification of the technical provider, limited network or commercial agent exclusion.
Regulatory fit report and, where applicable, notification to the Bank of Spain.
Strong customer authentication, exemption management and card data security.
SCA policy, exemptions matrix and PCI DSS certification or questionnaire.
A proportionate anti-money laundering framework when a payment service is provided.
AML/CFT manual, risk assessment, KYC files and appointment of the SEPBLAC representative.
Clear allocation of responsibilities with the acquirer, card schemes and technical suppliers.
Acquirer contracts, supplier agreements, SLAs and business continuity framework.
Spot them before launch to avoid operating outside the perimeter or applying for an unnecessary license.
If you are defining the regulatory fit of a payment gateway, these terms come up in the regulatory analysis, in contracts and in dealings with the Bank of Spain and the card schemes.
Technology that connects the merchant with the acquirer and the card schemes to authorize and process payments. Its regulatory fit depends on whether it holds the funds or initiates payments.
A provider of technology support for payment services that never holds the funds. It is excluded from authorization, except for payment initiation and account information.
An institution authorized by the Bank of Spain to provide payment services and manage client funds with safeguarding. Initial capital of €20,000 to €125,000 depending on services.
A service that initiates a payment order from the customer’s bank account. It is regulated (registration is required) even if it never holds the funds. Initial capital of €50,000.
A facilitator that receives the funds from transactions and then settles them to the merchant. Because it holds the funds, it provides a payment service and needs authorization.
Verification of the user with at least two independent factors in electronic payments, required by PSD2 and developed in Delegated Regulation (EU) 2018/389, with a closed list of exemptions.
The card industry standard for anyone who stores, processes or transmits card data. It is not a license but a contractual requirement of the card schemes.
The law that transposes PSD2 in Spain. It governs payment services, payment institutions, payment initiation and account information, and the exclusions from its scope.
The obligation to keep client funds received for the execution of payment transactions segregated and protected. It applies when the gateway holds the funds.
Download our guide with the full framework: when a gateway is excluded, when it needs a license, which category to choose and what security and compliance it requires.
Tell us how your gateway works and we will explain whether it needs a license and which route is the most efficient for your project.
The regulatory fit of a payment gateway is determined by Directive (EU) 2015/2366 (PSD2) and its transposition in Spain, Royal Decree-law 19/2018 of November 23 on payment services. Supervision and authorization fall to the Bank of Spain, which assesses whether the activity constitutes a payment service and which category applies.
Royal Decree-law 19/2018 excludes from its scope technical service providers that support payment services (data processing and storage, authentication, networks, terminals) without at any time coming into possession of the funds to be transferred. A gateway limited to that role falls outside the perimeter, but the exclusion does not extend to payment initiation or account information.
If the gateway holds or aggregates the funds, it provides a payment service and needs authorization as a payment institution (initial capital of €20,000 to €125,000 depending on the services). If it initiates payments from the customer’s account, it is a PISP (specific registration), and if it aggregates account information, an AISP. It is also possible to operate as an agent of an already authorized payment institution.
When there is a payment service, the strong customer authentication rules of Delegated Regulation (EU) 2018/389, the safeguarding of client funds and the anti-money laundering obligations of Law 10/2014 apply. On the contractual side, there is also the card data security standard (PCI DSS) required by the card schemes.
PSD3 and the Payment Services Regulation (PSR), now in the final stage of the legislative process, will replace PSD2, merge payment institutions and electronic money institutions into a single category, and strengthen authentication, fraud liability and open banking, with practical application expected around 2027. It is advisable to design the gateway with this horizon in mind.
Key legislation, linked to the official text:
Legislation and links reviewed in .