Definition
An NCA (National Competent Authority) is the national financial authority responsible for applying PSD2 within its territory: authorising PSPs, supervision, oversight and enforcement.
It is the generic term used in European texts, behind which sit very concrete entities: the ACPR in France, BaFin in Germany, Banco de España in Spain, the FCA in the UK.
NCA vs EBA: how the roles split
- EBA — European level: writes the technical standards (RTS) and guidelines to be applied in a harmonised way.
- NCA — national level: applies those rules, grants or refuses authorisation, supervises and sanctions.
A fintech never applies to the EBA for authorisation: it applies to its home NCA, which then notifies the EBA to activate the European passport.
The main NCAs
- ACPR (France) — backed by the Banque de France.
- BaFin (Germany).
- Banco de España (Spain, with the CNMV on certain scopes).
- Banca d'Italia (Italy).
- DNB (Netherlands, with the AFM).
- NBB (Belgium, with the FSMA).
- FCA (United Kingdom) — outside the EEA since Brexit, but with a demanding Open Banking framework.
- CBI (Central Bank of Ireland) — often chosen by fintechs seeking a European authorisation.
What an NCA does
- Issues authorisations: PI, EMI, AISP, PISP, CBPII.
- Notifies the EBA to activate the European passport: an authorisation in a single State allows operations throughout the EEA.
- Supervises on an ongoing basis: capital, governance, AML/CFT, IT security, ASPSP API quality.
- Sanctions (fines, withdrawal of authorisation).
- Cooperates with other NCAs and the EBA through supervisory colleges.
What an NCA does not do
- Writes neither the RTS (EBA) nor the directive (Commission).
- Does not issue eIDAS certificates (the TSPs' role).
- Does not supervise a foreign TPP on its soil: a German AISP operating in France via the passport remains supervised by BaFin (its home NCA), in cooperation with the ACPR.
In the PSD2 ecosystem
The NCA is a TPP's single entry point into PSD2. Once authorised by its home NCA, a fintech can reach across the entire EEA via the European passport — a major asset for scaling.
Concrete examples
- France (ACPR): Bridge, Lydia, Pennylane, Qonto and Fintecture obtained their authorisation and operate across the whole EEA via the passport.
- Germany (BaFin): N26, Klarna (in part), Tink's German subsidiary — a reputation for demanding standards on governance and AML/CFT.
- Ireland (CBI): Stripe, Square (Block), Wise and Revolut chose it as their home NCA, for the processing times and the English-speaking ecosystem.
- Choosing your NCA: processing time (3 to 18 months), fintech expertise, working language, cost of a local structure, proximity to target markets — a structuring strategic choice.
- Checking a partner: first consult the national register (REGAFI for the ACPR), then the EBA Register for the European scope.