An authorised payment institution (API) is a company that holds full authorisation from a financial regulator to provide payment services without being a bank. The category was created by European payment services legislation and exists in the member states of the European Economic Area and, in nearly identical form, in the United Kingdom. Money remitters, merchant acquirers, payment gateways that handle funds, bill payment firms and open banking providers commonly operate as authorised payment institutions.
The term is used mostly in the United Kingdom, where the Financial Conduct Authority distinguishes an authorised payment institution from a small payment institution, which is merely registered and subject to lighter rules. The abbreviation API in this sense is unrelated to an application programming interface.
Legal basis
The status was introduced by the first Payment Services Directive of 2007 and is currently governed in the European Union by the Second Payment Services Directive, as transposed into each member state's law. In the United Kingdom the equivalent rules are in the Payment Services Regulations 2017, which remained in force after the country left the European Union. The European Banking Authority has issued guidelines on what an application must contain.
The European Union reached political agreement in November 2025 on a replacement framework, still awaiting formal adoption in late 2026, a third Payment Services Directive for licensing together with a directly applicable Payment Services Regulation, which among other things would bring electronic money firms into the payment institution regime.
Services a payment institution may provide
Authorisation is granted for specific services from a list set in the legislation. They include operating a payment account and placing or withdrawing cash on it, executing credit transfers and direct debits, issuing payment instruments, acquiring payment transactions, money remittance, payment initiation services and account information services. A firm may carry out only the services named in its permission and must apply to add others.
A payment institution may hold customer funds only for the purpose of executing payments. It cannot take deposits, pay interest on balances or issue electronic money; a firm that wants to offer stored balances that customers keep and spend over time needs to be an electronic money institution. It may grant credit linked to a payment only under narrow conditions.
Authorisation requirements
An applicant submits a detailed file to the regulator of its home country. The main elements are as follows.
- Programme of operations and business plan. The firm describes the services, the flow of funds, forecast budgets for the first years and its outsourcing arrangements.
- Initial capital. The minimum depends on the services: 20,000 euros for money remittance alone, 50,000 euros for payment initiation, and 125,000 euros for most other services. This is a form of minimum capital requirement.
- Governance and controls. The file covers risk management, internal controls, security policy, incident reporting, business continuity and anti-money laundering procedures.
- People and owners. Directors and managers must pass a fit and proper assessment, and those holding a qualifying shareholding must be shown to be suitable.
- Safeguarding. The firm explains how it will protect customer funds.
The firm's head office must be in the country of authorisation, and it must carry on at least part of its business there.
Ongoing obligations
Once authorised, the institution must at all times hold own funds at least equal to the higher of its initial capital and an amount calculated by one of three methods set in the legislation, based on fixed overheads or on payment volume. It reports to the regulator periodically and must notify changes in control, management and outsourcing.
Customer money must be protected through safeguarding: funds received are kept separate from the firm's own money, in a designated account at a credit institution or in secure liquid assets, or are covered by an insurance policy or guarantee. In the United Kingdom the regulator tightened these rules for payment and e-money firms with a revised regime taking effect in 2026, following concerns about shortfalls found when firms failed. Conduct rules also apply, covering information given to customers, execution times, liability for unauthorised transactions and strong customer authentication.
Agents, branches and passporting
A payment institution may provide services through a registered payment services agent, for whose actions it remains fully responsible. A firm authorised in one European Economic Area state may serve customers in the others through passporting, by notifying its home regulator. United Kingdom firms lost this right when the country left the single market, and many set up a second authorised entity inside the European Union to continue serving customers there.