A Licence Alone Is Not Enough: Fintech Strategy in 2026

Until recently, a fintech company could build its international structure around a single licence in a jurisdiction with a predictable regulatory environment. In 2026, however, that model is increasingly creating more risks than advantages.

The market’s biggest challenge today is no longer that of obtaining a licence, but ensuring that the business has robust banking access. In practice, a significant proportion of enquiries come from businesses that already hold a licence or are duly registered but lack reliable banking relationships, safeguarding of client funds, correspondent banking arrangements, or partners for card issuing and SEPA payments.

The cost of choosing the wrong licensing strategy extends far beyond regulatory fees. The real price is often measured in months of delays, lost commercial opportunities, and the inability to meet the due diligence requirements of banks, payment partners, and correspondent banks.

MiCA Has Reshaped the Crypto-Asset Market

Following the application of Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), the European crypto-asset market has transitioned from a fragmented regulatory landscape to a system of harmonised regulatory oversight.

At the same time, the first months of full application of MiCA exposed a key weakness of the European regulatory model: a single regulation does not necessarily guarantee a uniform pace of implementation across all Member States.

Although MiCA introduced a harmonised regulatory framework for the entire EU market, authorisation as a crypto-asset service provider (CASP) continues to be granted by the national competent authorities (NCAs) of Member States. This has placed considerable pressure on national regulators, resulted in differing transitional periods, and led to inconsistent approaches to the assessment of authorisation applications. Although the Regulation established a transitional regime for existing crypto-asset service providers, Member States were permitted to determine the duration of that regime within the limits set by MiCA.

As a result, by mid-2026, some market participants had already obtained CASP authorisation, while many others remained in the authorisation process or were required to discontinue providing services within the EU following the expiry of the transitional regime. the practical lesson for the fintech sector has become clear: even the right licence is of little value without timely preparation, a genuine operational presence, a robust AML/CFT framework, and readiness to undergo regulatory scrutiny.

Business Model First, Licence Second

In practice, businesses often seek CASP authorisation even though their actual operating model is more appropriately classified as that of a Payment Institution (PI) or an Electronic Money Institution (EMI). The opposite is equally common: a fintech business may present itself as a traditional payment services provider, while its core business is, in fact, built around crypto-asset activities.

Making the wrong decision at this stage can be costly, and the consequences extend far beyond licensing fees. If the regulatory nature of a product is incorrectly assessed, a company may obtain authorisation that does not cover its actual business activities or establish a corporate structure that banks are unwilling to support.

For that reason, choosing between EMI, PI and CASP authorisation in 2026 is no longer merely a regulatory exercise; it is a strategic architectural decision. It will shape the group’s banking profile for the next three to five years.

European Regulators Assess Substance, Not Form

Today, European regulators focus less on the formal existence of a licence and more on whether a business is capable of maintaining a robust compliance framework over the long term. Their assessment extends to the ownership structure, corporate governance, sources of funding, internal controls, risk management, AML/CFT arrangements, sanctions screening, cyber resilience, and the ability to demonstrate the legitimate flow of funds.

This shift is particularly evident in jurisdictions that were, until recently, regarded as relatively fintech- and crypto-friendly.

Lithuania is a good example. Once widely viewed as one of the fastest routes into the EU market, it is now characterised by far more rigorous regulatory scrutiny. The Bank of Lithuania examines ownership structures, corporate governance, key control functions, internal control systems, AML/CFT arrangements, sources of funding, and the applicant’s genuine operational presence in considerably greater detail. Local management, compliance functions, and effective decision-making are no longer treated as formal licensing requirements but as essential components of a sustainable licensing strategy.

This is not an isolated development. Following the application of MiCA and the strengthening of EU anti-money laundering and counter-terrorist financing framework, regulators across Europe have increasingly shifted their focus from verifying whether a licence has been obtained to assessing whether the underlying business model is sustainable, well governed, and capable of meeting ongoing regulatory expectations. This is particularly relevant for cross-border operations, embedded finance, and businesses involving crypto-assets.

Substance Over Formal Presence

A separate but closely related issue is that of substance; namely the existence of a genuine corporate and operational presence within the relevant jurisdiction. By 2026, the mere incorporation of a company is no longer regarded as a sufficient business model in its own right.

Regulators increasingly expect businesses to demonstrate genuine local substance through resident directors, locally-based compliance officers, operational decision-making, and effective management exercised from within the jurisdiction. These requirements are applied particularly rigorously to fintech businesses involved in cross-border payment flows.

In other words, it is no longer sufficient for a company simply to be incorporated in the chosen jurisdiction. It must also demonstrate that management, risk oversight, and the business’s key functions are genuinely carried out there.

Banking Considerations Now Outweigh Licensing

As a result, international fintech businesses are increasingly moving away from single-entity structures. Instead, the market is shifting towards multi-entity models, with one entity dedicated to fiat payment services, another to crypto-asset activities and, in many cases, an additional holding company responsible for intellectual property, liquidity management, and investment structuring.

The reason is straightforward: banks assess far more than a company’s regulatory authorisation. They are increasingly focusing on the predictability of its compliance framework, the robustness of its transaction monitoring systems, and the overall risk profile of the group.

In practice, banking considerations now often have a greater influence on corporate structuring than the licensing process itself. A company may obtain CASP authorisation, yet this does not guarantee reliable access to payment infrastructure or successful onboarding with European financial institutions. Moreover, many banks continue to regard crypto-only business models as presenting an elevated risk, even where the business is fully compliant with applicable regulatory requirements.

When CASP Authorisation Does Not Replace an EMI Licence

For businesses whose core operations are conducted in fiat currencies, a Payment Institution (PI) or Electronic Money Institution (EMI) licence remains the primary regulatory framework. It provides the legal basis for offering fiat payment services, maintaining payment accounts, operating card programmes, and accessing the SEPA and SWIFT payment infrastructure. However, it does not in itself guarantee access to banking services.

CASP authorisation is required for business models built around regulated crypto-asset services, including the custody and administration of crypto-assets, the exchange of crypto-assets for funds or other crypto-assets, the transfer of crypto-assets, the operation of a trading platform, the placement of crypto-assets, investment advice relating to crypto-assets, and crypto-asset portfolio management.

Particular attention should also be paid to business models involving stablecoins and electronic money tokens (EMTs). Following the application of MiCA, such products can no longer always be regarded as purely crypto-asset products. Where token-based activities effectively perform a payment function, the business may simultaneously fall within the scope of both MiCA and the EU payment services regime, in particular Directive (EU) 2015/2366 on payment services in the internal market (PSD2) and Directive 2009/110/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions.

For that reason, CASP authorisation does not necessarily replace an EMI or PI licence. In certain business models, it represents only the first layer of the overall regulatory structure.

Compliance as Part of Group Structuring

At the same time, businesses are also changing the way in which they select jurisdictions. Whereas speed of authorisation was once the primary consideration, today’s decisions are increasingly driven by the regulator’s reputation, the stability of the banking sector, the quality of the international tax framework, and the predictability of the compliance environment.

In many cases, these considerations have a greater influence on group structuring than the tax burden itself.

For businesses developing digital ecosystems, implementing tokenisation strategies, or preparing to attract strategic investment, a multi-entity structure is increasingly proving to be the most effective solution. It enables fiat-based operations to be separated from crypto-related risks, regulatory obligations to be allocated across different entities, and the risk profile of the core business to be contained without unnecessary expansion.

AML/CFT, Sanctions, and Tax Transparency

At the same time, the interaction between AML/CFT requirements, sanctions compliance, and tax transparency is becoming increasingly significant.

This means for international businesses that a structure which appears effective from a licensing perspective may, nevertheless, create significant risks in relation to the automatic exchange of tax information, source-of-funds verification, or demonstrating the commercial rationale for transactions.

This is where a multi-entity structure can provide a distinct advantage. It enables tax, sanctions, and AML/CFT risks to be contained within the relevant part of the group, rather than automatically affecting the group’s core fiat business.

A New Standard: Banking First, Licensing Second

It is 2026 and the question of whether to choose an EMI licence or CASP authorisation no longer has a universal answer.

For some groups, a Payment Institution (PI) or Electronic Money Institution (EMI) licence remains the foundation for international expansion and access to fiat payment infrastructure. For others, CASP authorisation is indispensable for scaling crypto-asset services across the EU. Increasingly, however, the most effective solution is a multi-entity structure in which the licensing strategy is designed around regulatory resilience, banking viability, and tax efficiency from the outset.

The practical recommendation is straightforward: begin not with the choice of licence, but with an assessment of whether the business model is bankable.

* * *

Will banks understand the transaction flows? Is the customer risk profile acceptable? Can the business clearly demonstrate the source of funds, explain its sanctions risk management and transaction monitoring framework, and justify the role of each entity within the group?

If these questions are addressed only after authorisation has been obtained, the business may find it is holding a licence that cannot be effectively used within the existing banking and payments infrastructure.

That is why the new standard for international fintech is clear: first, banking readiness; second, jurisdiction; and only then, licensing.