Executive Summary
- Ireland and EU. Begin through an authorised payment institution that contracts directly with each business and operates its payment account. Keep the startup's role to contracted technology and support. A named balance does not itself require e-money issuance. (Directive (EU) 2015/2366, articles 3(j), 18–20; ABC Projektai, C-661/22, EU:C:2024:148, operative part.)
- Ireland and EU. Seek own PI authorisation when the group intends to become the account provider and execute transfers as principal. Seek own EMI authorisation when it intends to issue a separate monetary asset meeting every e-money element. Neither an app label nor a card determines that classification. (Directive 2009/110/EC, articles 2(2), 6 and 10; Directive (EU) 2015/2366, Annex I.)
- Ireland. The provider must own the regulated customer relationship, safeguarding and payment complaints. The startup must not receive customer funds into its own operating account or promise its own redeemable balance. Agency, distribution and outsourcing require separate functional assessments. (European Union (Payment Services) Regulations 2018, S.I. No. 6/2018, regulations 17 and 30; Directive 2009/110/EC, article 3(4)–(5).)
- EU. Authorisation precedes passporting, and passporting covers specified services. Each destination also needs a supported operational route. The provider's permission does not become the startup's permission. (Directive (EU) 2015/2366, articles 28–31; Central Bank of Ireland, Payment Institutions, “Passporting”.)
- Ireland and India. Indian development and support can remain outsourced, but the regulated principal must retain control. Access by a separate Indian affiliate to EU personal data requires a transfer assessment even when servers remain in Europe. (Regulation (EU) 2022/2554, articles 28–30; EDPB Guidelines 05/2021, version 2.0, paragraphs 9 and 15–17.)
- India. Before funding an Irish regulated subsidiary, assess the Indian investor's financial-services status and overseas-investment eligibility. A non-financial Indian entity investing in foreign financial services faces a preceding-three-financial-years profitability condition. (RBI, Master Direction No. 15/2024-25, updated 1 April 2026, paragraph 21(7)(b), (d).)
The first product and its funds flow
The recommended first release serves Irish-established businesses through an Irish-authorised full payment institution, called the Provider. Customers receive euro payment accounts, identifiable incoming bank payments and outbound euro credit transfers. Initial customer acquisition remains confined to Ireland; launch routes must appear in the Provider's agreed service schedule. There is no cash service, credit, interest, foreign exchange, cryptoasset product or India remittance. Cards remain outside the first release.
Each business accepts the Provider's payment-account agreement before activation. The Indian company supplies the interface under a separate technology arrangement. Any software subscription terms identify that separate service and do not make the startup liable for the account balance.
Incoming funds reach accounts controlled by the Provider through its banking arrangements. The Provider records the customer's entitlement in its authoritative ledger and safeguards relevant payment funds. The startup displays that ledger; it cannot create spendable balances independently. A named reference or virtual IBAN must be described according to its actual account structure, without promising a separate bank deposit account.
The customer submits an authenticated payment instruction directly to the Provider through its contracted technical channel. The Provider accepts or refuses the order, debits the payment account and executes the transfer through its settlement arrangements. The recipient receives ordinary bank funds. No recipient agrees to accept a separate monetary asset issued by the startup or the Provider.
These proposed boundaries support payment-account classification without separate e-money issuance. The incoming and outgoing credit transfers fall within Annex I, point 3(c), of PSD2. The permissions schedule must cover the account operations actually supplied. (Directive (EU) 2015/2366, article 18(2)–(3) and Annex I; ABC Projektai, C-661/22, operative part.)
Provider-led entry is recommended because this defined product can leave the regulated account business with an existing principal. The commercial trade-off is dependence on that principal's acceptance rules, supported features, pricing and suspension rights. Own PI authorisation becomes the stronger initial choice if principal control is non-negotiable and the group can resource the Irish institution.
The balance determines the authorisation category
The EMI vs payment institution decision requires examination of the customer's rights and the recipient's asset. E-money requires electronically stored monetary value representing a claim on its issuer, issued against received funds for payments and accepted by someone other than that issuer. The elements are cumulative. Ireland implements that definition through the European Communities (Electronic Money) Regulations 2011. (Directive 2009/110/EC, article 2(2); S.I. No. 183/2011, regulation 3.)
The selected product creates a payment-account entitlement against the Provider. The Provider receives and transfers payment funds, without agreeing to issue a separate monetary asset. In ABC Projektai, the Court of Justice held that receipt without an immediate payment order, with funds remaining in a payment account, constitutes a payment service rather than e-money issuance. Holding a balance for future payments therefore does not automatically require an EMI. The Provider may use the account only for payment transactions and cannot conduct deposit-taking under its PI authorisation. (ABC Projektai, C-661/22, judgment of 22 February 2024, EU:C:2024:148, paragraphs 43–49 and operative part.)
For an alternative e-money product, assume customers agree to exchange received euros for the issuer's electronic value. Participating business payees contract with that issuer and voluntarily accept the value, becoming holders able to spend or redeem it. Those additional facts satisfy the separate-asset and third-party-acceptance elements. A general-purpose payment product of that kind requires a permitted e-money issuer; ordinary PI permission is insufficient. (Directive 2009/110/EC, articles 2(2) and 10.)
Irish official materials require attention to the acceptance question. The Department of Finance describes the Commission's interpretation that third parties must accept the e-money, rather than merely receive funds after redemption. It also identifies the contractual relationship with the accepting payee. The Central Bank's July 2026 newsletter calls for firms to assess EBA Q&A 6336. These administrative materials inform supervisory assessment; they do not amend the statutory definition. (Department of Finance, National Risk Assessment Ireland 2026, p. 173; Central Bank of Ireland, Payments and E-Money Newsletter, July 2026, pp. 1–2.)
The argument for obtaining an EMI immediately is that it can accommodate future issuance alongside payment services. That wider category does not justify describing today's ordinary payment-account balance as e-money. The product's actual rights, acceptance arrangements and authorised services must support the chosen description. (Directive 2009/110/EC, articles 2(2) and 6(1)(a).)
The principal under each route
Under the provider-led route, the Provider is the contracting payment-service principal, account operator, funds controller and regulated complaints owner. Its banking counterparty holds the safeguarded cash under the agreed safeguarding arrangement. The startup supplies software and support without becoming a debtor for customer payment funds. It handles complaints about its separate software service. Marketing must identify the Provider and describe the startup's separate role. The commercial contract cannot transfer the Provider's regulatory responsibility to the startup. (Directive (EU) 2015/2366, articles 19–20 and 52; S.I. No. 6/2018, regulation 17.)
Under own Irish PI authorisation, the group's Irish company takes those customer contracts and payment obligations itself. It controls payment funds, maintains safeguarding arrangements and handles regulated complaints. The Indian company becomes its technology supplier, including where the companies share ownership. Marketing identifies the authorised Irish PI as account and transfer provider. The PI may issue payment instruments where its permitted services cover that activity, but it cannot issue its own e-money. (Directive (EU) 2015/2366, articles 18–20 and Annex I, points 3 and 5; Directive 2009/110/EC, article 10.)
Under own Irish EMI authorisation, the Irish company becomes the issuer and debtor for the e-money claim. It contracts with holders, safeguards backing funds and owns issuance, redemption and regulated complaints. It can also provide payment services within its authorised scope. The bank holding backing funds does not replace the EMI as issuer. Marketing must identify that Irish entity and the nature of the value. (Directive 2009/110/EC, articles 6–7 and 11.)
The EMI's terms must address issuance at par and the holder's right to request redemption at par. Redemption charges must respect the statutory conditions. The specific contractual derogation for non-consumer acceptors is not a blanket waiver for every business holder. Interest or benefits linked to the holding period are prohibited. (Directive 2009/110/EC, articles 11–12.)
For later cards, the programme must name the legal card issuer and allocate account, card and complaints duties. A separate issuer needs its own customer-facing terms and permitted functions. Where the account Provider also issues the card, its authorisation must cover issuing payment instruments. A card programme's brand or scheme connection cannot establish either permission or e-money classification. (Directive (EU) 2015/2366, Annex I, point 5; Directive 2009/110/EC, article 2(2).)
The startup's permitted delegated functions
For the selected release, the startup builds screens, collects documents through Provider-approved workflows and supplies technical support. The Provider sets acceptance criteria and retains customer approval, payment execution and account restriction decisions. The startup has no authority to contract as payment-service principal or move customer funds for its own account.
The technical-services exclusion requires the supplier never to possess the funds to be transferred. It expressly excludes payment initiation and account information services from that exclusion. An independent service initiating payments from accounts held elsewhere cannot rely merely on the absence of funds possession. The selected interface therefore operates as the Provider's contracted channel, without a separate startup payment-initiation or account-aggregation service. (Directive (EU) 2015/2366, article 3(j).)
If staff instead perform payment services for the Provider as its agent, the Provider must complete the applicable registration process before that activity starts. The contract must identify the principal and the functions performed on its behalf. Outsourcing operational functions requires notification, including functions assessed as non-critical or non-important. Important operational functions attract additional control requirements. A technology label cannot replace that assessment. (Directive (EU) 2015/2366, articles 19–20; S.I. No. 6/2018, regulation 30; Central Bank of Ireland, “Amendments Processing for Payment Institutions”, “Application to Change Critical Outsourcing Arrangements”.)
An e-money version needs a further distinction. An EMI may use persons acting for it to distribute and redeem its e-money. It cannot issue e-money through agents, although payment-service agency is permitted under the applicable conditions. Software can perform issuer-controlled technical processing; a permitted e-money issuer, rather than the selected PI, must remain the originator accountable for issuance. The startup cannot originate its own value under a distribution agreement. (Directive 2009/110/EC, articles 3(4)–(5) and 10; European Commission, E-money Directive Questions and Answers, 22 December 2016, pp. 8–9.)
Safeguarding and financial resources
For this release, choose statutory segregation with a credit institution rather than treating the startup's bank account as safeguarding. The Provider must identify the relevant funds, reconcile customer entitlements against backing funds and protect them against its other creditors. Safeguarding is distinct from capital available to absorb the Provider's operating losses. Customer funds must not finance product development. (S.I. No. 6/2018, regulation 17; Central Bank of Ireland, Guidance Note on Completing an Application, May 2025, p. 23.)
The partner agreement should identify collection accounts, safeguarding accounts, reconciliation frequency, shortfall correction and return-of-funds procedures. It should require evidence of the bank arrangement and prohibit using protected funds for startup fees or commercial reserves. Allocate those reserves to the startup's own money. Explain safeguarding accurately in customer terms, without presenting the wallet as a bank deposit or promising a bank deposit guarantee.
An own PI offering the selected account-based transfers falls within the €125,000 initial-capital category. The €20,000 money-remittance category is not an alternative for operating these payment accounts. Own funds must remain at least the higher of initial capital and the applicable Method A, B or C requirement. The initial sum is not the full operating budget. (Directive (EU) 2015/2366, articles 7–9; Central Bank of Ireland, Guidance Note on Completing an Application, May 2025, pp. 19–20.)
An own EMI requires at least €350,000 initial capital. Its e-money own-funds calculation ordinarily uses 2% of average outstanding e-money, with applicable floors and supervisory adjustments. Payment services unrelated to issuance require their additional calculation. Customer backing funds remain separate from those own resources. (Directive 2009/110/EC, articles 4–5 and 7.)
Irish management and Indian operations
An own Irish application requires an Irish corporate applicant with its head office and registered office in Ireland. The Central Bank expects real management, decision-making capacity and resources there. For a PI, part of its payment-services business must operate in Ireland. Incorporation alongside an India-only decision centre does not satisfy those requirements. (S.I. No. 6/2018, regulation 21; Central Bank of Ireland, Guidance Note on Completing an Application, May 2025, pp. 13–14.)
The applicant must appoint suitable directors and senior managers, establish risk and compliance responsibilities, and demonstrate oversight of outsourced work. The Central Bank does not permit outsourcing the risk-management and compliance functions themselves. It assesses proposed outsourcing of support activities within those functions case by case. Shareholders and funding sources also require assessment. The team should budget for Irish personnel able to challenge Indian development and support, control changes and maintain service during supplier failure. (Central Bank of Ireland, Expectations for Authorisation of Payment and Electronic Money Institutions and Registration of Account Information Service Providers, April 2024, pp. 13–14 and 18–23.)
For the selected provider-led product, the Provider bears these institutional responsibilities. India can supply development and support under an agreement that preserves access for the Provider, auditors and supervisors. DORA requires financial entities to manage ICT third-party risk and document contractual protections. Critical or important functions attract further requirements. (Regulation (EU) 2022/2554, articles 28–30.)
Specify service and data locations, permitted subcontractors, incident cooperation, recovery arrangements, audit access and exit assistance. The Provider must retain sufficient staff to supervise performance and replace the service. The Central Bank's outsourcing guidance informs those expectations; it is supervisory guidance rather than a separate statutory licence for offshore work. (Central Bank of Ireland, Cross-Industry Guidance on Outsourcing, December 2021, pp. 29–40.)
AML responsibility and business customer terms
The Provider owns customer due diligence and ongoing monitoring for its regulated service. Indian staff may collect identification and beneficial-ownership evidence under instructions, but their work does not displace that responsibility. Outsourced collection is different from statutory reliance on an eligible third party. The Provider must retain responsibility for its own risk-acceptance and suspicious-transaction-reporting obligations. The contract must preserve any reporting obligation that applies independently by law to another person. (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, sections 33, 35, 40 and 42; Central Bank of Ireland, AML/CFT Guidelines for the Financial Sector, June 2021, pp. 37–38 and 66–69.)
For the proposed product, require evidence of each business's ownership, authorised users and expected transaction activity. The operating schedule should allocate sanctions controls, alert review, payment blocking and escalation. Add a transfer-data schedule for payer and payee information and the handling of incomplete messages. Give the Provider access to source records and audit trails. Contractual indemnities between the companies cannot substitute for performance of the Provider's statutory duties. (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, sections 33 and 42; Central Bank of Ireland, “Fund Transfer Regulations Notification Requirement for Payment Service Providers”.)
Business-only distribution does not remove every customer protection. Ireland's 2025 Consumer Protection Regulations have applied since 24 March 2026. Their definition includes incorporated businesses unless turnover exceeds €5 million in the previous financial year, with a group-turnover test. Regulation 9 limits which provisions apply to payment services and e-money, so neither wholesale exclusion nor wholesale application is correct. (S.I. No. 81/2025, regulations 1–3 and 9.)
The Provider must address strong customer authentication for account access and electronic payments. Business status alone does not establish an exemption. The Central Bank requires a separate assessment of the secure corporate processes or protocols proposed for the corporate exemption. (Directive (EU) 2015/2366, article 97; Central Bank of Ireland, PSD2 Frequently Asked Questions, corporate exemption under article 17 of the authentication RTS.)
Payee verification also belongs in the launch specification. The euro-area deadline was 9 October 2025, including for ordinary credit transfers. The Provider must offer verification before payment authorisation and without charging the customer. A business user may opt out only when submitting multiple payment orders as a package. Irish PIs and EMIs offering euro credit transfers have a separate deadline of 9 April 2027 to offer sending and receiving instant euro credit transfers. The partner agreement must address that later obligation without deferring payee verification. (Regulation (EU) No 260/2012, articles 5a(8), 5b(2) and 5c(1), (6), (9), as inserted by Regulation (EU) 2024/886, article 1.)
The account terms should identify the Provider, fees, authorisation method, execution rules, refusal grounds, liability and termination process. Any non-consumer waiver must fall within the permitted payment-services derogations. Do not equate the Code's business threshold with every other statutory consumer definition. The Provider owns payment complaints; startup support records and escalates them without obscuring statutory complaint or eligible external-redress routes. (Directive (EU) 2015/2366, articles 38, 52, 61 and 101–102.)
Expansion beyond Ireland
The Provider must complete the appropriate passport process before supplying covered services into another member state. Own authorisation would place that obligation on the Irish PI or EMI. An Irish application, pending application or software agreement supplies no passport entitlement. Branches, agents, distributors and cross-border services require the route appropriate to their actual functions. (Directive (EU) 2015/2366, articles 28–31; Directive 2009/110/EC, article 3(1), (4)–(5).)
Before adding a country, distinguish transfers for existing Irish customers from offering accounts to businesses established there. Record the regulated principal, authorised service, passport notification and proposed establishment or service route where applicable. Separately secure the Provider's contractual support for that destination, customer class, payment rails and any card programme. Scheme connectivity does not establish permission to acquire customers there. Nor does a passport require a banking or card partner to support the commercial programme. (Central Bank of Ireland, Payment Institutions, “Passporting”; Electronic Money Institutions, “Passporting”.)
Destination review must address applicable conduct, complaints and AML arrangements. The Indian supplier receives no independent EU financial-services passport by supporting the Provider. Each new launch remains conditional on the principal's permissions and the agreed service actually covering it. (Directive (EU) 2015/2366, articles 28–31.)
EU personal data accessed in India
Corporate customers still supply personal data about directors, beneficial owners and authorised users. The Provider will ordinarily control processing needed for its payment and AML purposes. The startup acts as processor only where it follows documented instructions. Independent marketing or product-analytics purposes need their own role and lawful-basis assessment. (Regulation (EU) 2016/679, articles 4–6, 13–14 and 28.)
A separate Indian affiliate's remote access can constitute an international transfer even where EU servers retain the records. India has no Commission adequacy decision. The parties therefore need an applicable Chapter V mechanism and a documented assessment of the transfer. The EDPB's guidance distinguishes a separate recipient from employees acting within the same legal entity. (GDPR, articles 44–46; EDPB Guidelines 05/2021, version 2.0, paragraphs 9 and 15–17; European Commission, “Adequacy decisions”.)
Where the 2021 standard contractual clauses apply, select the correct controller-to-processor or processor-to-processor module. Those clauses do not cover transfers where the Indian recipient's relevant processing is already directly subject to the GDPR; an applicable alternative Chapter V mechanism is required. Assess Indian law and practice under clause 14, apply necessary supplementary safeguards and suspend transfers that cannot meet the required protection. Signing clauses alone does not complete that assessment. (Commission Implementing Decision (EU) 2021/914, article 1 and Annex, clauses 14–16; European Commission, SCC Questions and Answers, questions 23–24 and 40.)
Use synthetic development data, restrict production access by role, log support activity and test deletion and incident procedures. An India support team that needs readable identity documents cannot rely on storage encryption as the sole answer to access risk. Assess whether the proposed onboarding or monitoring requires a data-protection impact assessment. Execute the processing and transfer arrangements before production access starts. (GDPR, articles 28, 32 and 35; Decision (EU) 2021/914, Annex, clause 14.)
Funding the Irish structure from India
Indian nationality alone does not determine overseas-investment treatment; the investor and its residence matter. Before subscribing for Irish shares or providing guarantees, the group should take the structure to its designated authorised-dealer bank. Assess the foreign activity under India's functional financial-services test. (RBI, Master Direction No. 15/2024-25, updated 1 April 2026, paragraphs 1, 21 and 26.)
A non-financial Indian entity investing in foreign financial services, other than banking or insurance, must satisfy the preceding-three-financial-years profitability condition. The stated IFSC exception does not extend to an Irish subsidiary. An Indian financial-services investor follows a different eligibility route. A resident individual cannot use the ordinary ODI route to establish an Irish financial-services company by direct subscription. The parent should establish eligibility before treating its proposed Irish capital contribution as available funding. (RBI, Master Direction No. 15/2024-25, paragraphs 21(7)(a)–(d), 22 and 24(2).)
The contracts and decisions required before launch
Start with a signed product specification and funds-flow schedule. Then obtain the Provider's written acceptance of the model, verify its authorisation and service scope, and classify every delegated function. Require completion of applicable notifications or registrations before activation. If the programme materially changes the Provider's business model, the Provider must obtain prior Central Bank approval before launch. The partner contract should make safeguarding arrangements, customer terms, complaints procedures and operational testing conditions of launch. (Directive (EU) 2015/2366, articles 14 and 19–20; S.I. No. 6/2018, regulation 17; Central Bank of Ireland, “Amendments Processing for Payment Institutions”, “Application for Material Change of a Business Model”.)
Negotiate pricing, service failures, suspension rights, liability allocation and termination assistance before building around one Provider. Preserve customer access to account information and a workable funds-return process on exit. Migration to another principal needs the required customer-contract and funds-transfer steps; ownership of the interface does not transfer customer balances.
A payment institution license Europe strategy becomes appropriate when the group chooses to own the regulated payment-account relationship and can resource an Irish institution. Begin the Central Bank's exploratory process with the product model and Key Facts Document before preparing the full application. The application must substantiate the proposed services, capital, management, safeguarding, controls and outsourcing. (Central Bank of Ireland, “Payment Authorisation”; Directive (EU) 2015/2366, article 5.)
The provider-led model becomes inadequate before the startup acts independently as payment-service principal or originates its own e-money. For payment accounts alone, obtain own PI permission or retain another capable principal. For the defined separate-value product accepted by third parties, obtain own EMI permission or keep a permitted provider as issuer. If the Provider refuses a feature or destination, remove it or change the arrangement before launch. (Directive (EU) 2015/2366, articles 19–20 and 37; Directive 2009/110/EC, articles 3 and 10.)