Providing payment services needs a licence in every main market. The EU's PSD2 has applied since 2018 and a replacement PSD3 and Payment Services Regulation were provisionally agreed in November 2025. Singapore licenses providers in three classes under the Payment Services Act, and the UAE in four categories with capital from AED 100,000 to AED 3 million, local incorporation and local data storage. India requires payment data to be stored in India, and Saudi Arabia requires SAMA approval before a payment company can be incorporated.
European Union
PSD2 became applicable in January 2018 and its strong customer authentication rules in September 2019. Firms are authorised by the competent authority of their Member State, for example the Central Bank of Ireland. The Commission proposed PSD3 and a directly applicable Payment Services Regulation in June 2023, and Parliament and Council reached provisional agreement on 27 November 2025. Until the new texts are adopted and apply, PSD2 remains the law.123
Singapore and the UAE
Singapore's Payment Services Act requires a licence to carry on a payment service business unless exempt, in one of three classes: money-changing, standard payment institution or major payment institution. Since 26 August 2024 applicants must also submit a legal opinion and an independent external auditor assessment.
In the UAE no one may provide or promote retail payment services without a Central Bank licence. Category I covers all services including payment tokens; Category II excludes payment tokens; Category III excludes cross-border transfers; Category IV is for payment initiation and account information. Initial capital ranges from AED 100,000 to AED 3 million depending on category and volume. The applicant must be incorporated in the UAE and must store personal and payment data in the UAE.45678910
India and Saudi Arabia
India requires payment system operators to store the entire payment data in India; data processed abroad must be deleted there and brought back within one business day or 24 hours. In Saudi Arabia a licence or preliminary approval from SAMA is needed before a company carrying on payment services can be incorporated.1112
| Market | Regime | Key figure or condition | Source |
|---|---|---|---|
| EU (DE, FR) | PSD2; PSD3 and PSR agreed | PSD2 since January 2018; provisional deal 27 November 2025 | European Commission |
| Singapore | Payment Services Act 2019 | Three licence classes | MAS; SSO |
| UAE | Retail Payment Services and Card Schemes Regulation | Four categories; AED 100,000 to 3 million capital; UAE data storage | CBUAE Rulebook |
| India | RBI payment data storage | All payment data stored in India | RBI |
| Saudi Arabia | SAMA approval before incorporation | Licence or preliminary approval | Ministry of Commerce |
Decisions to make
- Which payment services will the business actually provide in each market?85UAE categories and Singapore licence classes depend on the services and volumes.
- Will the business need cross-border transfers or payment tokens in the UAE?89Only Categories I and II cover cross-border fund transfer, and only Category I covers payment tokens.
- Can payment data be stored in-country?1110India and the UAE require local storage, which affects technology architecture.
- Will an EU licence be obtained now under PSD2 or after PSD3 applies?2The new texts were agreed in November 2025 but their application dates must be checked.
Documents usually needed
- Business plan with services, volumes and safeguarding arrangements
- Evidence of initial capital and own funds calculation
- Legal opinion and external auditor assessment (Singapore)
- AML/CFT policies and fit-and-proper information on controllers and directors
- Data storage and outsourcing arrangements
Common mistakes
- Applying for a UAE category that does not include cross-border transfers when the model needs them
- Hosting payment data abroad for Indian or UAE operations
- Assuming PSD3 already applies
- Seeking Saudi incorporation before SAMA approval for a payment business
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- SAMA's Law of Payments and Payment Services and its licensing rules could not yet be checked.
- UK payment institution authorisation, US state money transmitter licensing and FinCEN money services business registration could not be confirmed.
- Singapore thresholds between standard and major payment institutions, and base capital, were not shown on the pages read.
- India's payment aggregator and cross-border payment aggregator rules were not researched.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The EU's second Payment Services Directive (PSD2), Directive (EU) 2015/2366, became applicable in January 2018, and its strong customer authentication requirement came into force on 13 September 2019. EU Member States, including Germany and France.
The Commission proposed a Payment Services and Electronic Money Services Directive (PSD3) and a Payment Services Regulation (PSR) on 28 June 2023, and the European Parliament and Council reached a provisional political agreement on 27 November 2025. EU. Formal adoption, publication and application dates were not stated on the page; until then PSD2 and the E-Money Directive continue to apply.
The Commission timeline gives 27 November 2025; the linked European Parliament press release is dated 21 November 2025. Check the Official Journal for adoption and application dates.
Payment institutions and electronic money institutions need Central Bank of Ireland authorisation.
Reused from market guide claim ie-banking-003.
The Payment Services Act 2019 provides for the licensing and regulation of payment service providers and the oversight of payment systems, and section 5(1) requires a person to hold a licence to carry on a business of providing a payment service unless exempt. Licences are granted under section 6 as standard payment institution or major payment institution licences, and MAS also refers to a money-changing licence. Defined services include account issuance, domestic and cross-border money transfer, merchant acquisition, e-money issuance, digital payment token services and money-changing. Most provisions commenced on 28 January 2020.
The section 5(1) requirement is seen through the statutory definition of exempt payment service provider; section 5 itself was not visible. The three licence classes are named on the MAS Payment Services Act page. Reused from market guide claim sg-regulatory-g01.
MAS licenses payment service providers in three classes: a money-changing licence, a standard payment institution licence and a major payment institution licence. Singapore. Thresholds between standard and major payment institutions were not shown on the page read.
From 26 August 2024 MAS requires payment service licence applicants to submit a legal opinion and an independent external auditor assessment, and may place cases on hold. Singapore. Not applied to applications submitted before 26 August 2024, although MAS may still request them case by case.
In the UAE no person may provide or promote retail payment services without a Central Bank licence under the Retail Payment Services and Card Schemes Regulation, in force since 6 June 2021. Federal; Article 2(1). Exempted persons are listed in the regulation.
Issued under the former Central Bank law; Federal Decree-Law No. 6 of 2025 replaced that law from 16 September 2025. The rulebook lists the regulation as in force; confirm any transitional changes under the 2025 law.
The UAE regulation has four licence categories: Category I covers payment account and instrument issuance, merchant acquiring, payment aggregation, domestic and cross-border fund transfer and payment token services; Category II the same without payment tokens; Category III the same without cross-border transfers; Category IV payment initiation and account information. Federal. Article 3(2) to 3(5).
Issued under the former Central Bank law; Federal Decree-Law No. 6 of 2025 replaced that law from 16 September 2025. The rulebook lists the regulation as in force; confirm any transitional changes under the 2025 law.
Minimum initial capital for a UAE retail payment service provider is AED 3 million (Category I), AED 2 million (II) or AED 1 million (III) where average monthly payment transactions are AED 10 million or more, half those amounts below that, and AED 100,000 for Category IV. Federal. Article 6(1).
Issued under the former Central Bank law; Federal Decree-Law No. 6 of 2025 replaced that law from 16 September 2025. The rulebook lists the regulation as in force; confirm any transitional changes under the 2025 law.
An applicant for a UAE retail payment services licence must be a legal person incorporated in the UAE, and licensees must store personal and payment data in the UAE. Federal. Article 1(7) (applicant) and Article 14(22) (data storage); backups must also be kept in a separate location.
Issued under the former Central Bank law; Federal Decree-Law No. 6 of 2025 replaced that law from 16 September 2025. The rulebook lists the regulation as in force; confirm any transitional changes under the 2025 law.
The Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored in systems located only in India; processing abroad is permitted if the data is deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. RBI circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 and FAQs; applies to payment system operators, banks as operators or participants, and their third-party service providers.
FAQ page dated 26 June 2019. Reused from market guide claim in-data-013.
Where a company's activity requires it, a licence or preliminary approval from the Saudi Central Bank (SAMA) is needed to incorporate the company. Financial activities supervised by SAMA, for example banking, finance and payment services.
Reused from market guide claim sa-regulatory-004.
Questions on this topic
12 statements on payment institution licensing
