License for small-scale payment institutions

Are you entering the dynamic financial technology market and considering providing payment services? The key to your business is obtaining the right license. This article will guide you through the entire process of obtaining a license for small-scale payment service providers (PPSMR) from the Czech National Bank. You will find specific answers to questions such as what conditions you must meet, what documents you need to prepare, and what risks to avoid.

Author of the article: ARROWS (JUDr. Jakub Dohnal, Ph.D., LL.M., office@arws.cz, +420 245 007 740)

Do you need a license? When are you required to register with the CNB

Before you embark on the complex application process, it is essential to clarify whether a small-scale payment service provider (PPSMR) license is the right choice for your business model. This section will help you navigate the basic definitions, limits, and permitted activities, which is the first step toward making a strategic decision.

What is a small-scale payment service provider (PPSMR)?

A small-scale payment service provider is a legal or natural person who, based on a license from the Czech National Bank (ČNB), is authorized to provide selected payment services in the Czech Republic. This is a specific, simplified regulatory regime intended primarily for start-up fintech companies, start-ups, or firms whose payment transaction volume does not reach the level requiring a full payment institution license.

The entire framework for PPSMR activities is defined in Act No. 370/2017 Coll., on Payment Services (ZPS), specifically in Chapter IV (§ 58-65a). This Act is a key document that sets out all the rights and obligations that will apply to you. Understanding these rules is essential for successfully obtaining a license and for subsequent smooth operation.

Key limit: The magic threshold of EUR 36 million

The most important and most restrictive factor for PPSMRs is the volume limit on payment transactions. The monthly average of the amounts of your payment transactions in the Czech Republic over the last 12 consecutive months must not exceed the equivalent of EUR 3,000,000. This brings us to the often-mentioned limit of EUR 36 million in the annual total.

This limit is the key difference between a "small" and "large" payment institution license. If your company is just starting out and does not have a twelve-month history, the CNB will base its assessment on the projections in your business plan.

It is therefore essential that your business plan is realistic and economically sound, as it will be used by the regulator to assess whether you meet the conditions for the small-scale regime. ARROWS' lawyers have extensive experience in preparing business plans that stand up to detailed review by the CNB.

What services can you provide with a PPSMR license?

A PPSMR license does not open the door to all types of payment services. The Payment Services Act precisely defines what is and is not permitted. With this license, you can typically provide the following services:

• Services enabling cash to be deposited into a payment account.
• Services enabling cash to be withdrawn from a payment account.
• Transfers of funds from a payment account (e.g., payments, standing orders).
• Issuing and managing payment instruments (e.g., payment cards).
• Money remittance, where neither the payer nor the payee uses a payment account with the provider.

Conversely, it is important to note that a small-scale payment service provider may not provide indirect payment order services (PIS) or account information services (AIS). These services, typical of modern open banking, are reserved for entities with a full payment institution license or a special payment account information manager license. The correct classification of your business is crucial, which is why at ARROWS we always start with a thorough analysis of your intentions to ensure that you are applying for the right type of authorization.

Contact our experts:

The foundations of success: Key conditions assessed by the CNB when granting a license

Obtaining a license from the CNB is not a mere formality. It is an in-depth process in which the regulator examines every aspect of your future business in detail. The aim is to ensure that you are a trustworthy, stable, and secure partner for the financial market and its users.

The entire assessment process can be divided into several key pillars that must be firmly anchored in your application and internal processes.

Solid foundations: Your business plan and client asset protection

Your business plan is a fundamental document for the CNB, revealing whether your business idea is viable and prudent. It must be supported by realistic economic calculations and contain detailed financial projections for the first three years of operation. The regulator will carefully examine whether your planned transaction volumes comply with the limits for PPSMRs and whether you have a clear idea of how you will generate profit.

Equally important is the protection of the funds entrusted to you by your clients. The Payment Services Act (Sections 21-24) requires you to keep these funds separate from your own company finances.

This is typically done by depositing them in a separate bank account with a credit institution. You must describe in detail to the CNB how you will fulfill this obligation. At ARROWS, we will help you prepare not only a precise business plan, but also design and describe mechanisms for protecting client funds so that they fully comply with regulatory requirements.

Trustworthiness and competence: Vetting key persons

The CNB places great emphasis on the people behind the company. All senior managers (typically executives and members of statutory bodies) and persons with a qualifying holding (owners of a significant share in the company) are subject to thorough vetting. The regulator assesses their "trustworthiness," which is a summary of their professional integrity and experience.

According to Decree No. 1/2022 Coll., you must provide information about their activities over the past 10 years. Any negative record, such as administrative penalties in connection with business activities, bankruptcy decisions, revocation of other licenses, or even dismissal from a managerial position due to misconduct, may be a red flag for the CNB and lead to the rejection of the application.

ARROWS provides a key service in the form of preliminary screening of key persons and preparation of all documentation proving their trustworthiness and professional competence, thereby preventing major complications in the proceedings.

The three pillars of your compliance: ŘKS, AML, and SCA

To operate successfully in a regulated environment, you must build your business on three solid pillars of compliance. This is not bureaucracy, but a functional system that protects you, your clients, and the entire financial system.

• Control and monitoring system (CMS): Think of CMS as your company's nervous system. It is a set of internal rules, processes, and control mechanisms that ensure your company operates properly and prudently. You must identify all risks associated with your activities – operational, security, legal, and reputational – and put in place measures to manage and mitigate them. This system must be described in internal guidelines required by Decree No. 7/2018 Coll.
• AML/CFT (Anti-Money Laundering/Countering the Financing of Terrorism): This pillar is your line of defense against financial crime. You are required to implement a robust system to combat money laundering and terrorist financing.
• This primarily includes identifying and verifying clients (a process known as Know Your Customer – KYC), continuously monitoring their transactions, and reporting any suspicious transactions to the Financial Analytical Office.
• ARROWS will prepare a complete set of internal AML/CFT guidelines tailored to your business model.
• Strong Customer Authentication (SCA): The third pillar is the security of the payments themselves. The EU Payment Services Directive (PSD2) introduced the requirement for strong customer authentication. This is a two-factor authentication that must be used whenever a customer accesses their online account or makes an electronic payment. The authentication must combine at least two of the following three elements:

1. Knowledge: Something only the user knows (password, PIN).
2. Possession: Something only the user has in their possession (mobile phone with an app, hardware token).
3. Inherence (biometrics): Something the user is (fingerprint, face scan).

These three systems – ŘKS, AML, and SCA – are not separate. They form a single interconnected whole that must be perfectly implemented and described in your application. Their correct setup is not only a prerequisite for obtaining a license, but also the basis for the sustainable and secure growth of your business.

The most common obstacles in the licensing process and how to avoid them

The CNB licensing process is demanding and full of potential pitfalls that can lead to delays or even rejection of your application. Knowing these risks and proactively addressing them is the key to success. The following table summarizes the most common problems and shows how an experienced legal partner can help you with them.

 

Risk to be addressed and potential problems	How ARROWS can help
Incomplete or formally incorrect application: Missing attachments, incorrectly completed forms leading to immediate rejection and delays in the proceedings by months.	We ensure the complete preparation of the application and all its attachments in accordance with the current requirements of the CNB and related regulations, thereby minimizing the risk of formal errors.
Unrealistic or inconclusive business plan: Financial projections do not correspond to market reality or are not sufficiently substantiated, which the CNB will assess as insufficiently prudent.	We will help you put together a precise business plan with realistic economic calculations that will stand up to detailed scrutiny by the regulator. Our experience with more than 400 corporate clients gives us unique insight into the market.
Inadequate management and control system (MCS): Missing or only general internal guidelines for risk management, security, and business continuity.	We will prepare a complete set of internal guidelines tailored to your business model, including rules for managing operational and security risks, ensuring compliance with regulatory requirements.
Problems with the credibility of senior management: A negative record in registers or insufficiently documented experience of key managers may lead to the rejection of the entire application.	We will conduct a preliminary check of key persons and prepare all documentation proving their trustworthiness and professional competence, thereby preventing possible complications in the process. If necessary, we can help you find suitable candidates from our network.
Weak AML/CFT measures: Generally formulated anti-money laundering policies that do not reflect the specific risks of your business.	We will prepare a robust system of internal policies for AML/CFT, including risk assessment and procedures for reporting suspicious transactions, which will protect you from sanctions.

 

Step-by-step application process: From preparing the documentation to the CNB's decision

The process of obtaining a PPSMR license is a marathon, not a sprint. It consists of several phases, each with its own specifics and time requirements. Understanding this schedule will help you better plan and allocate resources.

Preparation (1-2 months)

This is the most important and most intensive phase of the entire process. The quality of the preparation directly affects the speed and success of the subsequent administrative proceedings. During this time, it is necessary to collect and prepare all the necessary documentation.

This phase includes:

• Preparation of a detailed business plan with financial projections.
• Creating a complete set of internal regulations (management and control system, AML/CFT rules, security policies, procedures for protecting client funds).
• Collecting all documents proving the trustworthiness and competence of senior management and persons with qualified participation.
• Completing the official application form for a license to operate as a small-scale payment service provider.

We emphasize that ARROWS Law Firm is able to prepare this entire complex package of documentation for the client on a turnkey basis. Our experience from dozens of similar projects allows us to significantly streamline the process and ensure that the application is complete and of the highest quality.

Submission of the application and administrative proceedings (3-6 months)

Once all the documentation has been prepared, it is submitted electronically to the Czech National Bank, typically via a data box (ID: 8tgaiej) or by e-mail with a recognized electronic signature. At this point, the administrative proceedings are initiated.

The statutory deadline for the CNB to issue a decision is 3 months. However, it is necessary to be realistic – in practice, this period is often extended. The CNB may request additional information, explanations, or modifications to certain documents. Each such request interrupts the deadline.

The total time from the submission of the application to the final decision is therefore typically between 4 and 6 months.

At this stage, ARROWS takes over all communication with the CNB, handles additional queries, and represents the client throughout the proceedings, saving you valuable time and allowing you to focus on preparing your business.

License granting and commencement of activities

After successfully completing the administrative procedure, you will receive a positive decision from the CNB granting you a license to operate. Your company will then be entered in the publicly available register of payment service providers maintained by the CNB. Only from the moment of entry in this register are you legally entitled to start providing your services to clients.

International ambitions vs. Czech reality: PPSMR license restrictions and the role of ARROWS International

Many fintech startups and companies have global ambitions from the outset. However, in the context of the PPSMR license, it is absolutely crucial to understand its territorial restrictions. Ignoring this fact can lead to strategic mistakes and unnecessary costs.

Key restriction: The PPSMR license does not allow "passporting"

It is important to note that the small-scale payment service provider regime is a national exemption under the European Payment Services Directive (PSD2). In practice, this means that the PPSMR license is valid only and exclusively in the Czech Republic.

This license does not grant you a so-called European passport (passporting), which is a right that allows full-fledged payment institutions to automatically offer their services in other EU/EEA member states based on a single license from their home country.

With a PPSMR license, you cannot legally open a branch in Germany or actively target clients in Poland. This is essential strategic information for anyone planning rapid international expansion.

Our experts on financial licensing

Your gateway to the world: ARROWS International

Just when your ambitions outgrow the borders of the Czech Republic, our unique advantage comes into play. Instead of looking for new legal partners in each country, we offer you a comprehensive solution through the ARROWS International network. Built over more than ten years, this network brings together proven law firms and advisors across Europe and around the world.

If you decide to expand, ARROWS will prepare a strategy for transitioning from a PPSMR license to a full payment institution license that already allows passporting. Subsequently, in cooperation with our international partners, we will take all the necessary steps to notify your activities in the target countries. This ensures a uniform standard of quality and a coordinated approach, wherever you go.

EU regulations that still apply to you (e.g., CESOP)

Although the PPSMR license is national, this does not mean that you are completely isolated from European regulation. If your services enable cross-border payments (e.g., your Czech client pays a Slovak e-shop), you may be subject to certain pan-European obligations.

A great example is the CESOP (Central Electronic System of Payment Information) system. This is a central European database to which payment service providers, including PPSMRs, must report cross-border payment data on a quarterly basis. The aim is to combat VAT fraud. This obligation shows how interconnected the national and European levels are.

Navigating these nuances is complex, and this is where the value of an experienced legal partner comes in, who monitors not only Czech but also European legislation and alerts you to new obligations in a timely manner.

Operational and regulatory threats after obtaining a license

Obtaining a license is only the beginning. The real challenge is to keep it and operate your business in accordance with constantly changing rules. Long-term cooperation with a legal partner who understands your industry is an investment in the stability and security of your business.

 

Risks to be addressed and potential problems and sanctions	How ARROWS can help
Exceeding the turnover limit: Failure to monitor transaction volumes may result in exceeding the €36 million annual limit, which constitutes a breach of the license and may lead to its revocation.	We offer ongoing legal advice and monitoring of regulatory obligations to alert you to approaching limits in good time and help you plan your transition to a full payment institution license.
Problems with banks: Traditional banks may refuse to hold an account for PPSMRs due to high AML risk, which can paralyze your business.	Thanks to our experience and extensive network of contacts (we have over 150 a.s. and 250 s.r.o. companies in our portfolio), we can help you navigate the banking sector and prepare documents that prove your credibility.
Insufficient security and fraud: Failure to implement Strong Customer Authentication (SCA) or other security incidents can lead to financial losses and damage to your reputation.	We provide professional training for employees and management in the areas of cybersecurity and regulatory requirements (SCA, PSD2). We will prepare documentation that will protect you from fines.
Regulatory changes: Financial regulations are constantly evolving (e.g., new CNB decrees, EU regulations). Failure to comply with new obligations can result in heavy penalties.	We provide continuous regulatory oversight for our clients. We will inform you of any changes in a timely manner and prepare a review of your internal regulations and contracts to ensure that your business is always in compliance with the law.
Inspections by the CNB: The CNB carries out regular supervision. Inadequate documentation or procedural errors can lead to administrative proceedings.	Zastupujeme klienty při jednání se správními orgány, včetně ČNB. Zajistíme, aby vaše dokumentace byla vždy připravena na kontrolu a ochránila vás před sankcemi.

Frequently asked questions (FAQ)

Here you will find answers to the most common practical questions that clients ask in connection with the PPSMR license.

How long does the entire process of obtaining a PPSMR license take?

Answer: Preparing the documentation usually takes 1 to 2 months. The licensing procedure at the CNB has a statutory deadline of 3 months, but in practice it can take 4 to 6 months. With our help, we will ensure that the application is complete and that the process is as quick as possible.

What happens if I approach or exceed the EUR 36 million limit?

Answer: As soon as you realize that you are approaching the limit, you must immediately apply to the CNB for a full payment institution license. This is a more complex process. We recommend addressing this situation in advance. ARROWS will help you prepare a transition strategy and take care of all legal steps.

How much does it cost to obtain a PPSMR license?

Answer: The price depends on the complexity of your business model and the scope of services required. The CNB administrative fee is in the thousands of Czech crowns. The main investment is the preparation of comprehensive documentation.

At ARROWS, we will prepare a specific, tailor-made price offer for you after an initial free consultation.

Do I need to have a registered office in the Czech Republic to obtain a license?

Answer: Yes, the law requires that the applicant have its registered office and actual place of business in the Czech Republic. If you are a foreign company, you must establish a branch or subsidiary here.

ARROWS can help you with the entire process of establishing a company and securing a registered office.

Your journey to fintech innovation begins with a partner you can trust

Obtaining a license for small-scale payment service providers is a demanding but manageable process with professional guidance. It is a strategic step that will allow you to legally enter the market and implement your innovative ideas. The key to success is thorough preparation, flawless documentation, and in-depth knowledge of the regulatory environment.

At ARROWS, we are ready to guide you through this process from start to finish. From initial legal consultation, through the drafting of internal guidelines and preparation of complete documentation that will protect you from sanctions, to representation in courts and administrative bodies. Our services also include obtaining the necessary permits, preparing and reviewing contracts, and providing professional training for your employees and management.

Our experience from long-term care for more than 150 joint-stock companies, 250 limited liability companies, and 51 municipalities and regions is a guarantee of quality and speed. We are not just external suppliers; we become part of your team. We connect our clients with potential and are happy to hear your business ideas. And if your plans extend beyond borders, thanks to the ARROWS International network, we are also your partner for international expansion.

Contact us today for an initial consultation and build your success on a solid foundation of legal certainty.

Don't want to deal with this problem yourself? More than 2,000 clients trust us, and we have been named Law Firm of the Year 2024. Take a look HERE at our references.