Actor

EP

Payment Institution (Établissement de Paiement)

A status created by DSP1 for players specialising in payment services (transfers, direct debits, acquiring, AIS, PIS) without deposits or credit. Typical cases: Lydia, Qonto, Fintecture, Bridge.

Definition

An EP (Établissement de Paiement, payment institution) is a licensed payment service provider, but neither a bank (EC) nor an electronic money issuer (EME).

Created by DSP1 (2007, transposed in France in 2009), the status opened the payments market to specialised non-banking players. The ACPR grants the licence in France, and an EP can passport its licence across the entire EEA.

The 8 authorised payment services

The licence covers all or part of a limitative list (Annex I of DSP2):

  1. Cash deposit into a payment account.
  2. Cash withdrawal from a payment account.
  3. Execution of operations (transfers, direct debits, card payments) on an account held with the PSP.
  4. Operations backed by short-term credit tied to the payment.
  5. Issuing and acquiring payment instruments (e.g. card acquirer).
  6. Money remittance (Western Union, Wise in part).
  7. PIS — payment initiation (created by DSP2).
  8. AIS — account information (created by DSP2).

The licence is applied for service by service: Bridge was long licensed for AIS + PIS only, Qonto for services 3 and 5.

EP vs EC vs EME

  • EP — payments and tied credit only, without deposits or e-money. Min. capital €20K to €125K.
  • EC — payments + deposits + credit. Min. capital €5M.
  • EME — payments + e-money issuance. Min. capital €350K.

Many fintechs start as an EP, switch to EME to issue cards in-house, then apply for the EC licence for credit.

Ring-fencing of funds: the great rule

An EP cannot keep its customers' money on its balance sheet. PSU funds must be ring-fenced:

  • in a segregated account at a third-party EC (the dominant method);
  • or invested in safe and liquid assets;
  • or covered by a guarantee at least equal to the funds held.

This is what protects the customer in case of bankruptcy: their money is recoverable, since the FGDR does not cover EP accounts.

What an EP cannot do

  • Take deposits: it only holds payment accounts, not savings.
  • Grant credit beyond short-term credit tied to the payment (< 12 months in practice).
  • Issue electronic money (a top-up wallet): the EME licence is required.
  • Join TARGET2 / TIPS directly, except since 2023 when the ECB is gradually opening access to non-banks.

In the PSD2 ecosystem

The EP is the historical status of DSP2 fintechs: most AISPs, PISPs and business neobanks started there. Lighter than an EC, it remains heavily regulated (AML-CFT, SCA, ACPR reporting, governance, own funds calculated by volume).

Concrete examples

  • French EPs: Qonto (business account), Lydia (P2P, became Sumeria under EME), Bridge (AIS + PIS), Fintecture (PIS), Shine (business account), Lemonway and Mangopay (marketplaces).
  • EP → EME transition: Lydia became an EP and then created Sumeria under EME to issue cards in-house and offer a remunerated wallet.
  • Capital by service: €20K for pure money remittance, €50K for AIS + PIS, €125K for acquiring/issuing — the ACPR also requires a 3-year business plan and a full governance file.
  • Licensing lead time: 6 to 12 months, more for multi-service. Many go through a PSP agent or a BaaS during the process to get started.
  • Passporting: a French EP can passport its licence to 29 other EEA countries — which allows Qonto to serve Germany, Italy and Spain from France.
  • Ongoing supervision: quarterly reporting to the ACPR (own funds, volumes, fraud, DORA incidents), possible inspections, sanctions ranging from a warning to licence withdrawal.

Sources

Go deeper

From the blog

Longer reads to go beyond the definition.

August 24, 2026
security

QWAC vs QSealC: who does what, and why you've got the wrong layer — Read more

The QWAC is read by the TLS layer, once, at the handshake. The QSealC is read by the application layer, on every request. Where each private key lives, what STET requires, and how to read a 'certificate error'.

April 7, 2026
technical

Technical architecture of a PSD2 API: what to know before writing the first line of code — Read more

A technical overview of PSD2 for CTOs, developers and technical PMs: API standards, security (mTLS, eIDAS certificates), OAuth2, SCA flows, consent management, implementation pitfalls.

April 6, 2026
regulation

Understanding PSD2: what it changes for your customers and your business — Read more

Everything an executive, a product manager or a business team needs to understand about PSD2. Players, consent, opportunities, without technical jargon.