What license do I need to operate a fintech in Portugal?

Service type determines the licensing requirement. Payment institutions offering payment services including transfers, card issuance and payment initiation must get authorization from the Banco de Portugal under the RJSPME regime. E-money institutions that issue electronic money require a distinct e-money license separately.

Fintechs that enable investment activities need authorization from the CMVM.

Portugal’s fintech regulatory environment is shaped by the interplay of EU-wide financial services directives and national implementing legislation. The Banco de Portugal serves as the primary regulator for payment services and electronic money, while the CMVM (Comissao do Mercado de Valores Mobiliarios) oversees investment-related fintech activities.

The regulatory framework has matured significantly in recent years, driven by the implementation of PSD2 (Payment Services Directive 2), the licensing of several domestic and international fintech operators, and the evolving regulation of crypto assets under both Portuguese law and the EU MiCA (Markets in Crypto-Assets) Regulation.

Fintech firms operating out of or within Portugal through 2026 will find here the full spectrum of licensing, regulation, EU passporting and compliance obligations covered in one resource.

For general banking information, see Opening a Business Bank Account in Portugal. For payment ecosystem details, see Portugal Payment Methods.

Regulatory Authorities

Authority Jurisdiction Key Fintech Areas
Banco de Portugal (BdP) Central bank, prudential and conduct supervision Payment institutions, e-money institutions, banks, VASPs (AML registration)
CMVM Securities market regulator Investment platforms, crowdfunding, crypto asset service providers (MiCA), robo-advisors
ASF (Autoridade de Supervisao de Seguros e Fundos de Pensoes) Insurance regulator Insurtech, insurance distribution
CNPD Data protection authority Data privacy compliance for all fintech activities

Payment Institution License

Overview

A payment institution license from the Banco de Portugal is required for companies providing one or more of the following payment services:

  1. Payment transaction execution covers credit transfers, direct debits and card payments.
  2. Issuance of payment instruments including cards and digital wallets.
  3. Merchant services encompass the acquisition of payment transactions.
  4. Money remittance
  5. Payment initiation services (PIS)
  6. Account information services (AIS) - lighter registration only

Application Requirements

Requirement Details
Initial capital EUR 20,000 (money remittance), EUR 50,000 (PIS), EUR 125,000 (other payment services)
Organizational structure Adequate governance, risk management, internal controls
Business plan 3-year projections, description of services, target market
IT systems Secure, resilient, compliant with EBA guidelines
AML/KYC program Comprehensive anti-money laundering framework
Professional indemnity insurance Required for PIS and AIS providers
Directors and shareholders Fit and proper assessment for all directors and qualifying shareholders (10%+)

Application Process

Phase Duration
Pre-application consultation with BdP 2-4 weeks
Application preparation 2-6 months
BdP review and assessment 3-6 months (statutory deadline: 3 months, often extended)
Conditional approval and remediation 1-3 months
License issuance After all conditions are met
Total 8-18 months

The Banco de Portugal takes a thorough yet collaborative approach to fintech licensing. Rather than maintaining the arms-length stance some European regulators adopt throughout the application period, the BdP’s fintech team engages in meaningful dialogue with applicants, provides feedback on draft submissions and identifies potential issues prior to formal submission.

This pre-application engagement reduces the risk of rejection and prolonged review cycles substantially. Firms pursuing a Portuguese payment institution license are strongly encouraged to schedule a pre-application meeting with the BdP’s payment services team before moving forward with the full application process.

E-Money Institution License

Overview

To issue electronic money - defined as electronically stored monetary value representing a claim on the issuer and accepted by third parties as a means of payment - companies need an e-money institution license.

Additional Requirements Beyond Payment Institution

Requirement Details
Initial capital EUR 350,000
Own funds Calculated based on outstanding e-money
Safeguarding Client funds must be safeguarded in dedicated accounts or insured
Redemption E-money must be redeemable at par value on demand

Payment services can be offered by e-money institutions under their e-money license without requiring a separate payment institution authorization.

PSD2 Compliance

Open Banking Framework

PSD2 (implemented in Portugal through Decree-Law 91⁄2018, known as the RJSPME) introduced two new categories of regulated services:

Payment Initiation Services (PIS). Third-party providers can initiate payments on behalf of users directly from their bank accounts. This enables payment methods that bypass traditional card networks.

Account Information Services (AIS). Third-party providers can access bank account information (with user consent) to provide aggregation, budgeting and financial management services.

Technical Standards

Compliant with the EBA’s Regulatory Technical Standards, Portuguese banks require dedicated APIs for Strong Customer Authentication and Common and Secure Communication. Many Portuguese banks use the SIBS API Gateway as a standardized access point, which simplifies PSD2 compliance for service providers.

Strong Customer Authentication (SCA)

SCA requirements apply to electronic payment transactions in Portugal:

  • Two-factor authentication required for online payments, account access, and transaction initiation
  • Exemptions available for low-value transactions (under EUR 30), recurring transactions and trusted beneficiaries
  • Dynamic linking required for payment initiation (authentication linked to specific amount and payee)

EU Passporting

Passport Into Portugal

Fintech companies licensed in other EU/EEA member states can provide services in Portugal through:

Cross-Border Services (Freedom of Provision of Services):

  • No physical presence in Portugal required
  • Home state regulator notifies BdP
  • Compliance with Portuguese consumer protection and AML rules required
  • Notification processing: Typically 1-3 months

Branch Establishment (Freedom of Establishment):

  • Physical branch in Portugal
  • More extensive notification requirements
  • Subject to both home state and BdP supervision on certain matters
  • Notification processing: Typically 2-4 months

Passport From Portugal

Portuguese-licensed payment institutions and e-money institutions can passport their services to all other EU/EEA member states through the same mechanisms. The BdP coordinates the notification process with the host state regulator.

Passport Direction Notification Period Key Requirements
Into Portugal (cross-border) 1-3 months Home state notification, Portuguese AML compliance
Into Portugal (branch) 2-4 months Home state notification, branch registration
From Portugal (cross-border) 1-2 months BdP notification, host state AML compliance
From Portugal (branch) 2-3 months BdP notification, host state registration

EU passporting is one of the most powerful features of a Portuguese fintech license. A company licensed by the Banco de Portugal can provide services across the entire EU/EEA without obtaining licenses in each individual member state.

This is particularly valuable for companies targeting the Lusophone market (Portugal, and by cultural connection, Brazil through partnership models), the broader Iberian market (Spain), or the wider European market.

Portugal’s position as a smaller regulatory jurisdiction can actually be an advantage in the licensing process, as the BdP handles fewer applications than regulators in larger markets (such as the FCA in the UK or BaFin in Germany), potentially resulting in more personalized engagement and faster processing.

Crypto Asset Regulation

Current Framework

Portugal regulates crypto assets through a layered approach:

AML Registration (Banco de Portugal): Virtual Asset Service Providers (VASPs) providing any of the following services must register with the Banco de Portugal:

  • Exchange between virtual assets and fiat currencies
  • Exchange between virtual assets
  • Transfer of virtual assets
  • Custody and administration of virtual assets
  • Participation in and provision of financial services related to virtual asset offerings

The registration process involves AML/KYC compliance assessment, fit and proper evaluation of directors and ongoing reporting obligations.

MiCA Implementation (CMVM/Banco de Portugal): Covering a wide range of aspects, the EU Markets in Crypto-Assets Regulation establishes a comprehensive framework for:

MiCA Category Regulatory Authority Key Requirements
Asset-Referenced Tokens (ARTs) Banco de Portugal Authorization, reserve requirements, governance
E-Money Tokens (EMTs) Banco de Portugal E-money institution license required
Other crypto assets (utility tokens) CMVM White paper requirements, marketing rules
Crypto Asset Service Providers (CASPs) CMVM Authorization, prudential requirements, conduct rules

Tax Treatment of Crypto

The Portuguese tax treatment of crypto assets has evolved significantly:

  • Capital gains from crypto disposals held less than 365 days: Taxed at 28% (individuals) or standard IRC rates (companies)
  • Capital gains from crypto held 365+ days: Exempt (individuals), standard IRC rates (companies)
  • Crypto-to-crypto exchanges: Taxable events
  • Mining income: Taxed as professional/business income
  • Staking rewards: Taxed as income upon receipt

Portugal’s standing as a “crypto tax haven” has weakened markedly following the 2023 State Budget’s introduction of capital gains tax on crypto disposals. Cryptocurrency profits remained largely untaxed for individuals previously, drawing numerous crypto-focused businesses and investors.

Aligning more closely with other European jurisdictions, the new rules retain the 365-day holding period exemption for individuals, which favors Portugal over many countries. Firms evaluating Portugal for crypto activities should prioritize regulatory clarity and EU passporting benefits instead of tax advantages.

Crowdfunding Regulation

The EU Crowdfunding Regulation (ECSP) has been implemented in Portugal, with the CMVM as the national competent authority:

  • Investment-based and lending-based crowdfunding platforms need ECSP authorization
  • Maximum offering: EUR 5 million per project per 12 months
  • Investor protection requirements including key investment information sheets
  • Cross-border passporting available within the EU

Sandbox and Innovation Programs

BdP Innovation Hub

The Banco de Portugal operates an innovation hub that provides:

  • Guidance to fintech companies on regulatory requirements
  • Clarification of licensing obligations
  • Dialogue on innovative business models and their regulatory treatment
  • No formal regulatory sandbox (unlike the UK FCA model), but a collaborative approach

Portugal Fintech

Portugal Fintech is an industry association that represents the fintech ecosystem and acts as an intermediary between startups, regulators and established financial institutions. It organizes events, provides networking opportunities and advocates for regulatory modernization.

Compliance Obligations

Ongoing Requirements for Licensed Entities

Obligation Frequency Authority
Prudential reporting (own funds, capital adequacy) Quarterly Banco de Portugal
AML suspicious transaction reporting As needed UIF (Banco de Portugal)
Complaint handling and reporting Annual Banco de Portugal
Conduct of business reporting Annual Banco de Portugal
Data protection compliance Ongoing CNPD
Security incident reporting (major incidents) Within 4 hours Banco de Portugal
Annual accounts and audit Annual Banco de Portugal + commercial registry
Client fund safeguarding reporting Monthly Banco de Portugal

Consumer Protection

Fintech companies operating in Portugal must comply with:

  • Price transparency requirements (all fees and charges clearly disclosed)
  • Right of withdrawal for distance contracts (14 days)
  • Complaint handling procedures (response within 15 business days)
  • Portuguese language requirements for consumer-facing documentation
  • Accessibility requirements for digital financial services

For general business compliance in Portugal, see Portugal Business Laws and Compliance. For data protection specifically, see Portugal Data Protection (RGPD/GDPR).

Licensing Cost and Staffing Benchmarks

Scoping realistic first-year budgets is essential for fintech founders pursuing Portuguese authorisations. Lisbon talent costs are materially lower than Dublin or Amsterdam but substance requirements still demand a meaningful team.

Cost Item Payment Institution (Full PSP) E-Money Institution Crypto CASP (MiCA) Crowdfunding Platform
Initial regulatory capital (EUR) 125,000 350,000 50,000-150,000 25,000
Application fee (EUR) ~5,000 ~5,000 ~4,000 ~3,000
Legal and compliance drafting (EUR) 30,000-70,000 50,000-100,000 25,000-60,000 15,000-30,000
Lisbon office (annual, EUR) 15,000-40,000 20,000-50,000 15,000-40,000 10,000-25,000
Two qualified directors (annual, EUR) 120,000-200,000 160,000-250,000 120,000-200,000 90,000-150,000
AML officer (annual, EUR) 50,000-85,000 60,000-100,000 55,000-90,000 40,000-70,000
External audit (EUR) 12,000-25,000 18,000-35,000 15,000-30,000 10,000-20,000
First-year total excluding capital (EUR) 232,000-425,000 313,000-540,000 234,000-424,000 168,000-298,000

MiCA Transition Timetable

Staged MiCA application requirements materially shape Portuguese fintech strategy. Founders need to account for these milestones in their planning:

  • 30 June 2024. MiCA’s Title III covering asset-referenced tokens and Title IV covering e-money tokens become applicable.
  • 30 December 2024. Full MiCA application including CASP authorisation regime.
  • 30 December 2024 - 1 July 2026. represents a transitional window in Portugal. Existing national VASP registrations continue to be valid throughout this period, yet new market entrants require MiCA authorization.
  • 1 July 2026. for all crypto asset service providers operating in Portugal, with MiCA CASP authorisation becoming mandatory for service offering.

National competent authorities, including the Banco de Portugal, are responsible for ensuring that MiCA’s transitional arrangements do not create supervisory arbitrage; CASPs operating during the transition remain subject to national AML requirements and must transition to the harmonised MiCA authorisation standard before the transitional period ends.

Sanctions for Supervisory Breaches

Banco de Portugal sanctions are consequential. The following table summarises the headline penalties under the Legal Framework for Payment Services and Electronic Money (Decree-Law 91⁄2018):

Violation Individual Sanction (EUR) Corporate Sanction (EUR)
Operating without authorisation 75,000-1,500,000 150,000-5,000,000
Safeguarding failures 10,000-500,000 25,000-2,500,000
AML breaches (grave) Up to 5,000,000 Up to 10,000,000 or 10% turnover
Incident reporting failure 5,000-250,000 25,000-1,000,000
Misleading advertising 1,000-50,000 5,000-200,000
PSD2 SCA failure (recurrent) 5,000-500,000 25,000-2,500,000

Passporting to Spain and the Iberian Market

For Portuguese-authorised payment institutions and e-money institutions, the immediate cross-border opportunity is Spain. The Bank of Spain (Banco de Espana) receives thousands of passporting notifications per year and processes Portuguese notifications under standard EBA timelines.

Step Responsible Authority Deadline
Notification submitted by Portuguese EMI/PI to Banco de Portugal Home state Within 1 month of intent to passport
BdP forwards complete notification to Banco de Espana Home state 1 month from receipt
Spanish authority acknowledges and may require additional marketing rules Host state 1 month from BdP forwarding
Activity may commence - Upon Spanish acknowledgement or after 3 months total

Although passporting removes the need for a second authorisation, companies still must comply with Spanish conduct-of-business rules, Spanish language documentation requirements for consumers, and Spanish AML supervision when serving Spanish customers.

Fit and Proper Assessment Criteria

Every director candidate should be assessed against the Banco de Portugal’s fit-and-proper framework before submitting the authorisation application. Common rejection triggers include:

  • Prior bankruptcy proceedings within the last 10 years without full discharge and rehabilitation.
  • Pending criminal investigations or convictions for economic, financial, or tax offences.
  • Insufficient professional experience: at least 5 years in financial services is the practical minimum for executive directors.
  • Simultaneous directorships in competing regulated entities without explicit BdP approval.
  • Incomplete or misleading disclosure in the questionnaire, concealment is treated as independent misconduct.