Payment Institution and Fintech Licensing in Portugal
A payment institution in Portugal needs PSD2 authorisation, typically through Banco de Portugal. Its proposed payment services determine whether PSD2 requires EUR 20,000, EUR 50,000 or EUR 125,000 in initial capital.
Diagram text version
Define the service. Apply at the home-state authority. Check the cross-border authorisation route.
Which fintech activities need authorization in Portugal?
Three regimes decide which authorization a fintech needs in Portugal. Payment services need authorization as a payment institution under PSD2, and the route typically runs through Banco de Portugal. Crypto-asset services need MiCA authorization or the MiCA notification route for eligible financial entities. Personalized investment advice follows the Comissão do Mercado de Valores Mobiliários (CMVM) route. The competent authority depends on the specific service, so the service boundary decides which regime applies.
ICT-risk, AML and data-protection duties apply on top of whichever authorization the activity needs.
What initial capital does a payment institution need?
PSD2 Article 7 sets the initial-capital category by payment service. Money remittance needs EUR 20,000, payment-initiation services need EUR 50,000 and the other covered payment services need EUR 125,000. The category follows the services the company proposes to provide.
How does payment-institution passporting work?
A payment-institution authorization is valid across Member States for the services it covers. Cross-border provision follows the home-state notification route in PSD2 Articles 28 and 29. The home-state authorization and the notification both come before the company offers the authorized services in another Member State.
When does a crypto-asset service need MiCA authorization?
A person may not provide crypto-asset services in the Union unless that person is authorized as a crypto-asset service provider or falls within the MiCA Article 60 financial-entity route. Under MiCA Articles 59 and 63, the authorization specifies the crypto-asset services it covers.
Eligible credit institutions and investment firms that use the MiCA notification route notify their home authority at least 40 working days before they first provide the service. Crypto-asset advice also requires suitably knowledgeable personnel. The Portugal crypto regulation guide covers the supervisors and the expired Portuguese transitional permission.
Which ICT and incident-reporting rules apply?
DORA Article 6(5) requires a documented ICT-risk framework. The framework is reviewed at least annually, or periodically for a microenterprise, and after a major ICT-related incident. Supervisory instructions also trigger a review. DORA also sets major-incident reporting duties, and the DORA articles listed in the sources below cover them.
Which AML and data-protection duties apply?
Lei n.º 83/2017 requires obliged entities to retain identification, client-file and transaction records for seven years. The same law requires risk-sensitive due diligence.
GDPR Article 33 requires a controller to notify the competent supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The notification is unnecessary if the breach is unlikely to risk individuals’ rights and freedoms. The GDPR and data protection guide covers notices, records, data protection officers and data rights.
When is investment advice a regulated activity?
Personalized investment advice is consultoria para investimento under CVM Article 294(1). The provider needs the CMVM authorization or registration route that matches the service and the instruments.
Common questions
What initial capital does a payment institution need?
Can a Portuguese payment institution passport its services?
When does a crypto-asset service need MiCA authorization?
What is the MiCA notification period for some financial entities?
How often must the DORA ICT-risk framework be reviewed?
How long must a fintech keep AML records?
What is the GDPR breach-notification deadline?
Does investment advice require CMVM registration?
The information on this page is checked against official sources and reviewed regularly. It is corrected when the law or official guidance changes, as the Editorial Standards describe.