Payment institution licence in the form of an Anonymity Company or a European Company (SE)

d3784bf6-2e82-4b2e-aa8a-7b435bf9ceb3 995374 Άδεια λειτουργίας ιδρύματος πληρωμών με τη μορφή Ανώνυμης Εταιρείας ή Ευρωπαϊκής Εταιρείας (SE)

• At a Glance
• Basic information
• Application
• What you will need
• Requirements
• Fees
• Related
• Output
• Steps
• Digital steps
• Other information
• Feedback
• Legislation
• Categories
• Show Procedure
  • Steps
  • Digital Steps

At a glance

Points of service

MINISTRY OF ECONOMY AND FINANCE

Digital provision points

• The service is not provided digitally

Number of required documents

19

Fees

Variable

Deadline of completion

3 months

Description

This procedure concerns the granting of an authorisation to operate a payment institution in the form of a public limited company or a European company (SE) under Regulation (EC) No 2157/2001 (EU). It is addressed to legal persons.

Basic information

Competent body

MINISTRY OF ECONOMY AND FINANCE

Authority/Public body’s Unit responsible for the institutional framework of the procedure

Provided to

Legal Entities

Related links

Validity duration

Indefinite

Notes

The procedure is conducted by the Bank of Greece, which determines by decision the content of the application for authorisation, the required supporting documents and information submitted to that effect, the specific conditions and procedure for granting the authorisation as well as any other relevant matters, under Article 5(6) of Law 4537/2018.

Last update

25/09/2026

Application

Application Type

Application

Submission by:

Submitted by the applicant (in person or by post)

Submitted by:

Legal entities

Title

Application for granting an authorisation for a payment institution in the form of a public limited company or a European company (SE) under Regulation (EC) No 2157/2001 (EU L 1294).

Notes:

• The application must be duly filled out and signed by two natural persons authorised to that effect, with signatures certified by the competent authority. The applicant must also include the relevant authorising documents among the supporting documents appended to the declaration.

• The empty space following each question in the application is NOT indicative of the extent of the intended response.

• Applicants must comply with and observe all the provisions applicable to them. The level of detail in the application must be commensurate with the size and internal organisation of the applicant, as well as with the nature, scale, complexity and level of risk of the service or services the applicant intends to provide.

• The questions must be duly answered; otherwise, the applicant must provide any necessary clarifications.

• When submitting the application and the required details and information to the Bank of Greece, the applicant shall not refer to internal procedures or other documents held by it, but must set out the extracts to which it wishes to refer verbatim, indicating their source.

• A reference to the corresponding paragraph must be added to the submitted information or documents, which must be appended as numbered attachments, as per the predefined serial numbering set out herein. The numbering of the attachments must remain unchanged, even when there is no information / documentation to be submitted.

• Where there are no competent authorities to issue the required certificates, equivalent documents issued by a reliable independent source will be submitted.

• Certificates submitted for the purposes of this procedure must have been issued by duly authorised persons and must have been duly certified and translated into Greek or English.

• False or misleading information or the deliberate withholding of important information may lead – beyond any criminal liability – to the immediate rejection of the application without further evaluation.

• Applications and any accompanying information or documents submitted in printed form must be accompanied by an electronic storage medium of the applicant’s choice (CD or USB), on which all said information or documents, as applicable, must be stored in scanned form (as PDF files).

• The above is submitted in a sealed dossier to the following address:

BANK OF GREECE, Directorate for the Inspection of Supervised Companies; 21, Eleftheriou Venizelou Street, 102 50 Athens, Contact number: +30 210 3205006-7, Fax: +30 210 3205405 Email: Dep.supinspection@bankofgreece.gr WEBSITE: www.bankofgreece.gr

• The information or documents submitted with the application is covered by the obligation of official - professional secrecy pursuant to Article 25 of Law 4537/2018 and Article 54 of Law 4261/2014.

What you will need

Print

Requirements

Fees

Related

Means of redress or appeal:

Administrative appeal

Under Article 24 of the Code of Administrative Procedure, an informal appeal may be lodged against a negative decision. Furthermore, in accordance with Article 26 of Law 4537/2018, decisions of the Bank of Greece issued pursuant to said law and regulatory acts concerning payment services issued by the Bank by delegation are subject to an application for annulment before the Council of State.

Output & Results

Methods of receipt

Email, In person or by post

Output

Decision

Steps

Digital steps

Other information

Official title

Granting of an authorisation to operate a payment institution in the form of a public limited company or a European company (SE) under Regulation (EC) No 2157/2001 (EU)

Languages supported

Greek, English

Legislation

Categories

Τype of procedure

Operating Licenses

Trigger

Applied for

Trigger (submission method)

Application (handwritten), Application (letter)

Life events

Licences and compliance

Type

Outgoing

End of Process

Ιndefinite

J1

   ΔΔ
   
   5
   0
   0

0 2

   0
   
   

   83842
   
   No
   
   
   
   
   Indefinite
   
   
   255180
   
   
   
   
   8210
   
   
   Supporting document

This procedure concerns the granting of an authorisation to operate a payment institution in the form of a public limited company or a European company (SE) under Regulation (EC) No 2157/2001 (EU). It is addressed to legal persons. 5000.00 5000.00 19 0 0

   3 months

1 Financial Where the application is submitted by an undertaking in the process of being incorporated, it is clarified that the authorisation to operate a Payment Institution is only granted by the Bank of Greece provided that the undertaking has been incorporated as per the legislative provisions in force and that, at the time the licence is granted, the balance of the share capital deposit account, as well as the amount of own funds, are not below the statutory threshold.

No No

1 The supervisory fees relating to authorisation are set out in Executive Committee Act 238/2/10.01.2025. More specifically, Chapter IV of the act states that applicants must pay the amount of EUR 5 000 to the Bank of Greece when submitting their application. 5000 €

Cost Calculation One-off, Quantitative

Method of Payment Bank of Greece

Type of Cost Impost

No

1 General information on notification of the applicant’s identity Form

General information on notification of the applicant’s identity

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The following information is required to verify the applicant’s identity: a. the applicant’s name and trade name, if these are not identical; b. a statement by the applicant as to whether it is an already incorporated legal person or is in the process of being incorporated. Applicant legal persons must be incorporated at the time of granting by the Bank of Greece of authorisation to operate a Payment Institution; c. the General Commercial Registry (hereinafter ‘GEMI’) number and the tax identification number (hereinafter ‘Tax ID No’) of the applicant subject to authorisation; d. the legal form and certified copy of or draft articles of association, evidencing said legal form; e. the postal address of the head office and the registered office; f. the email address and website, if available; g. the name or names of the persons responsible for the contents of the application and the authorisation procedure, including relevant contact details; h. any business associations relating to the provision of payment services which the applicant intends to join; i. a certificate of registration with the GEMI, if the undertaking has already been incorporated, otherwise a certificate from a chamber of commerce, register or other equivalent body, certifying that the name used is available.

Document submitted under requirements: No

No 3062

2 Supervision by other supervisory authorities Document

Supervision by other supervisory authorities

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: Information on whether the applicant is or has been supervised by a competent financial sector authority.

Document submitted under requirements: No

No 4084

3 Activity programme Schedule/Program

Activity programme

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The activity programme submitted by the applicant must include the following information: a. a detailed description of the payment services the applicant intends to provide, including an explanation of how the applicant itself identifies said services as activities falling within the requested services of Article 4(3) of Law 4537/2018; b. a sworn statement by the applicant as to whether it will, at any time, come into possession of any amounts of money; c. a description of the performance of payment services detailing all parties involved, including the following information for each provided payment service: i. a cash-flow chart, unless the applicant intends to provide exclusively payment initiation services; ii. settlement agreements, unless the applicant intends to provide exclusively payment initiation services; iii. draft contracts between all parties involved in the provision of payment services, including contracts with card payment schemes, where applicable; iv. completion time frames; d. a copy of the draft framework contract, as defined in Article 4(21) of Law 4537/2018; e. the projected number of facilities from which the applicant intends to provide payment services and/or perform activities related to the provision of payment services, where applicable; f. a description of any services ancillary to payment services as provided for in Article 18(1)(a) of Law 4537/2018, where applicable; g. a declaration by the applicant as to whether it intends to grant credit pursuant to Article 18(4) of Law 4537/2018, and, if so, within what limits; h. a declaration by the applicant regarding whether it plans to provide payment services to other EEA Member States or third countries after the granting of authorisation by the Bank of Greece; i. a declaration as to whether or not the applicant intends, within the first three years of commencing operations, to carry out, or is already carrying out, other types of business activities pursuant to Article 18 of Law 4537/2018, including a description of the nature and projected scale of such activities. Said activities must be carried out in accordance with EU and national legislation and without prejudice to Article 11(5) of Law 4537/2018; j. information regarding professional liability or other comparable insurance as specified in Chapter V, in case the applicant intends to provide the services referred to in Article 4(3)(f) and (g) of Law 4537/2018 (payment initiation and account information services).

Document submitted under requirements: No

No 1716

4 Business plan Action / implementation plan

Business plan

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The business plan submitted by the applicant must include the following: a. a plan for the development and promotion of the services (marketing),which must include: i. an analysis of the company’s competitive position in the relevant segment of the payments market, ii. a description of the users of the payment services, the resources allocated to the development and promotion of services (marketing), and distribution channels; b. in case of undertakings already operating, audited financial statements accompanied by a certificate of a certified auditor or auditing company, as defined in Law 4449/2017 (Government Gazette, Series I, No 7), for the previous three financial years, if available. If these are not yet available, a summary of the financial position shall be submitted instead; c. a budget for the first three financial years following commencement of operations, demonstrating the applicant’s ability to use the appropriate and proportionate systems, resources and procedures to ensure proper operation. The budget will include: i. a forecast profit and loss account and balance sheet statement, including target achievement scenarios and stress scenarios and their key assumptions, such as transaction volume and value, number of customers, pricing, average amount per transaction, projected increase in profit margin; ii. a breakdown of main income and expenses, financial liabilities and fixed assets; iii. a chart and in-depth analysis of the estimated cash flows for the first three years of operation; d. information on the equity of Article 8 of Law 4537/2018, including the amount and in-depth analysis of the make-up of the initial capital, as defined in Article 7 of Law 4537/2018; e. information on the minimum capital requirements and their calculation in accordance with method B of Article 9 of Law 4537/2018, unless the applicant intends to provide exclusively payment initiation services. This information must include: i. an annual forecast of the composition of equity for the first three years of operation according to Method B; and ii. an annual forecast of equity for the first three years of operation in accordance with the other methods referred to in Article 9 of Law 4537/2018.

Document submitted under requirements: No

No 7230

5 Organisational structure Organization chart

Organisational structure

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The applicant must provide a description of its organisational structure, including the following information: a. a detailed organisational chart depicting each directorate, department or related structural framework, including the name of the person or persons responsible, in particular those who will be responsible for the Internal Audit, Regulatory Compliance and Risk Management sectors. The organisational chart shall be accompanied by descriptions of the duties and responsibilities of each directorate, department or relevant structural framework in accordance with the general principles of governance set out in paragraph 4 of Chapter II of Presidential Decree/TE 2577/9.3.2006 (Government Gazette, Series I, No 59); b. a forecast of the total number of staff for the first three years of operation; c. documented policy on outsourcing of operational activities to third parties and a description of the relevant contracts, with regard to: i. the identity and geographic position of the provider of the outsourcing services; ii. the identity of the persons within the payment institution responsible for each of the outsourcing activities; iii. a clear description and key details of the activities that have been or will be outsourced; d. a copy of the draft outsourcing contracts, accompanied by the following: i. a document confirming that the Management Board is aware of the identification and assessment of risks arising from outsourcing, as well as the adoption of appropriate measures to mitigate them and any residual risks; ii. a document certifying that a plan is in place to terminate contracts with specific service providers, with the option of transferring the outsourced work to another service provider and/or to the applicant; iii. an explicit reference to the clause in the contract which ensures that both the applicant and the Bank of Greece have full rights of control and access to the service provider’s data, systems and premises in relation to the outsourced service; e. a description of the use of branches and agents, within the meaning of Article 4(38) of Law 4537/2018, where applicable, which shall include: i. a breakdown of the on-site and off-site inspections that the applicant intends to carry out, at least once annually, at its branches and agents, together with details of their frequency; ii. the IT systems, procedures and infrastructure to be used by the applicant’s agents to carry out activities on its behalf; iii. regarding agents, the policy on their selection, monitoring procedures, training procedures and a draft partnership agreement; iv. a reference to the national and/or international payment system to which the applicant will have access. If there is cooperation with agents within the meaning of Article 4(38) of Law 4537/2018 in Greece or other EEA Member States, the following information and details must be submitted, accompanied by a solemn declaration by the agent confirming their accuracy: a. if the above agent is a natural person: full name or business name and trade name, address, contact details, legal form, scope of main activities, GEMI number for entities obligated to register or those voluntarily included therein, and Tax ID No; b. if the above agent is a legal person or sole proprietor: the details and information referred to in point (a) above, the certificate confirming that the undertaking has not been declared bankrupt and the certificate confirming that no application for bankruptcy has been filed, both of which must have been issued within the six months prior to their submission, the certificate of commencement/change of business activities issued by the competent tax office, a description of the applicant’s activities and a reference to the most significant of these in terms of turnover; c. a description of the distributor’s organisational structure, including details of its points of sale, number of employees and any outsourced activities; d. a description of the internal audit mechanisms to be used by the agent to comply with the provisions on the prevention of money laundering and terrorist financing, as per Law 4557/2018 (Government Gazette, Series I, No 139) and Bank of Greece Banking and Credit Matters Committee Act 281/5/17.3.2009 (Government Gazette, Series II, No 650), insofar as these differ from those of the applicant; e. with regard to executives and persons responsible for managing the agent’s payment services: (I) a certified copy of a valid identity card or passport and (ii) section 4, entitled ‘Suitability of the natural person’ of the ‘Assessment questionnaire on proposed acquisitions of holdings by natural persons’ of Annex II to Executive Committee Act 142/11.6.2018 (Government Gazette, Series II, No 2674), filled out, signed and accompanied by the corresponding supporting documents. Non-EU residents must also submit a certified copy of a residence permit or proof of lawful residence in Greece. The certificates and attestations referred to in points (a), (b) and (e) of the above paragraph must be adapted in terms of form, type, procedure and issuing authority in accordance with the relevant provisions laid down by the legislation of the respective EEA Member State in which the agent in question operates.

Document submitted under requirements: No

No 7207

6 Initial capital Proof

Initial capital

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: In order to verify the existence of the initial capital pursuant to Article 5(1)(c) of Law 4537/2018, proof shall be submitted of full payment of the minimum required initial capital, where applicable, pursuant to Article 7 of Law 4537/2018, which must be deposited with a credit institution established in Greece or with a branch operating in Greece and which is not a related party of the applicant within the meaning of the Related Party of Annex A to Law 4308/2014 (Government Gazette, Series I, No 251). This amount must remain deposited or must have been deposited by the date on which the Bank of Greece grants the authorisation to operate a payment institution. In any case, the legal incorporation of the applicant must have been completed prior to the issuance of the authorisation, provided that the applicant was still undergoing incorporation at the time of submission of the application for authorisation. In the case of an incorporated legal person, a certificate from a certified auditor within the meaning of Law 4449/2017 must also be submitted, stating that the legal person’s net worth is not less than the minimum required initial capital, as depicted in its up-to-date balance sheet. In addition, the information provided concerning the initial capital shall include the necessary supporting documents, issued by a reliable, independent source, in relation to any natural or legal person intending to participate in the applicant’s initial capital, concerning the origin of the funds from which the initial capital will be or has already been covered.

Document submitted under requirements: No

No 3798

7 Measures to safeguard the funds of payment service users Other Document

Measures to safeguard the funds of payment service users

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: Payment institutions providing the payment services referred to in Article 4(3)(a) to (f) shall safeguard, regardless of the scope of the services they provide, the amounts of money they receive from payment service users or through other payment service providers for the execution of payment transactions. If the applicant safeguards the funds of payment service users pursuant to Article 10(1)(a) of Law 4537/2018, it will place those funds exclusively in deposit accounts with a credit institution established in Greece or with a branch operating in Greece and which is not a related party of the applicant within the meaning of the Related Party of Annex A to Law 4308/2014. In this case, the applicant will provide a description of the safeguarding measures that must include the following: a. the number of persons with access to the safeguarding account and their duties; b. a description of the management procedure and the compliance verification procedure, which ensure safeguarding of the funds of payment service users in their interests against the claims of the applicant’s other creditors, particularly in the event of insolvency; c. a copy of the draft contract with the credit institution; and d. a solemn declaration by the applicant concerning compliance with Article 10 of Law 4537/2018. In case the applicant safeguards the funds of payment service users pursuant to Article 10(1)(b) of Law 4537/2018 by means of an insurance contract or comparable guarantee from an insurance company or credit institution, which must be established in Greece or with a branch operating Greece and which is not a related party of the applicant within the meaning of the Related Party of Annex A to Law 4308/2014, the applicant must provide a description of the safeguarding measures, which must include the following: a. an attestation that the insurance contract or comparable guarantee issued by an insurance company or credit institution originates from an entity that does not belong to the same group of companies as the applicant; b. details of the agreement verification process to ensure that the contract or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at any time; c. the duration and renewal of the insurance coverage; and d. a copy of the insurance contract or comparable guarantee, or a draft thereof.

Document submitted under requirements: No

No 7475

8 Governance framework and internal audit mechanisms Other Document

Governance framework and internal audit mechanisms

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The applicant must provide a description of the governance framework and internal audit mechanisms, which must include: a. a mapping of the risks identified by the applicant, including the type of risks and the relevant assessment and prevention procedures the applicant will implement; b. the procedures for conducting periodic and routine audits, including their frequency and the human resources required to conduct them; c. the accounting procedures with which the applicant will record and report its financial information; d. a description of how the operational activities outsourced to third parties will be monitored and audited, so as to avoid any potential deterioration in the quality of the applicant’s internal audit mechanisms; e. the identity of any auditor who is not a certified auditor or audit firm as defined in Law 4449/2017; f. a description of the method used to monitor and audit agents, within the meaning of Article 4(38) of Law 4537/2018, and branches, including those operating abroad, within the framework of the applicant’s internal audit mechanisms; g. if the applicant is an affiliated undertaking of a supervised entity in another EEA Member State, a description of the group’s governance structure.

Document submitted under requirements: No

No 7475

9 Process for monitoring, managing and controlling security incidents and security-related customer complaints Other Document

Process for monitoring, managing and controlling security incidents and security-related customer complaints

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The applicant shall provide a description of the procedure in place for the control, management and monitoring of safety incidents and safety-related customer complaints, which shall include the following: a. organisational measures and tools for fraud prevention; b. details of the person or persons and bodies responsible for assisting customers in cases of fraud, technical problems and/or claims management; c. fraud reporting hotline; d. point of contact for customers, including name and email address; e. incident reporting procedures, including the notification of such reports to internal or external bodies, as well as the notification of major incidents to the Bank of Greece pursuant to Article 95 of Law 4537/2018 and pursuant to Executive Committee Act 157/3/2.4.2019 “Adoption of the guidelines of the European Banking Authority on major incident reporting under Directive (EU) 2015/2366” (Government Gazette, Series II, No 1597); f. the monitoring tools, measures and procedures implemented to mitigate security risks.

Document submitted under requirements: No

No 7475

10 Procedure for archiving, monitoring, tracing and restricting access to sensitive payment data Other Document

Procedure for archiving, monitoring, tracing and restricting access to sensitive payment data

Submission by: Submitted by the applicant (in person or by post)

Notes: The applicant shall provide a description of the procedure for archiving, monitoring, tracing and restricting access to sensitive payment data, which shall include: a. a description of the data flows classified as sensitive payment data within the context of the applicant’s business model; b. the procedures for granting access to sensitive payment data; c. description of the monitoring tool; d. the policy on right of access, with a detailed description of access to all relevant individual infrastructure components and systems, including databases and backup infrastructure; e. a description of how the data collected will be archived, unless the applicant intends to provide exclusively payment initiation services; f. intended internal and/or external uses of collected data, including by counterparties, unless the applicant intends to provide exclusively payment initiation services; g. the IT system and the technical safety measures that have been implemented, including encryption and/or tokenisation technology; h. identification of individuals, bodies and/or committees with access to sensitive payment data; i. an elaboration of how breaches are identified and addressed; j. plan for annual internal auditing of information systems security.

Document submitted under requirements: No

No 7475

11 Business continuity planning Other Document

Business continuity planning

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: The applicant shall provide a description of its business continuity arrangements, clearly identifying critical functions, effective contingency plans and the procedure for regularly testing and reviewing the adequacy and effectiveness of said plans, which shall include the following: a. business impact analysis, including business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; b. identification of back-up site, access to IT infrastructure, and essential software and basic data that must be recovered in the event of failure or disruption; c. an elaboration of how the applicant will address major business continuity incidents and disruptions, such as the failure of key systems, the loss of basic data, inability to access premises, loss of key staff essential to the unhindered operation of the organisation; d. the frequency of testing of the applicants business continuity and disaster recovery plans, including how the results of the tests will be recorded; e. a description of the risk reduction measures applied by the applicant in the event of termination of the provision of payment services, with a view to ensuring the execution of pending payment transactions and the termination of ongoing contracts.

Document submitted under requirements: No

No 7475

12 Principles and definitions for the collection of statistical data on performance, transactions and fraud Other Document

Principles and definitions for the collection of statistical data on performance, transactions and fraud

Submission by: Submitted by the applicant (in person or by post)

Notes: The applicant shall provide a description of the principles and definitions applied for the collection of statistical data on performance, transactions and fraud, including the following: a. the type of data collected in relation to customers, the type of payment service, the channel, the medium, geographical areas and currencies; b. the scope of collection in terms of activities and entities, including branches and agents within the meaning of Article 4(38) of Law 4537/2018; c. the method of collection; d. the purpose of collection; e. the frequency of collection; f. supporting documents describing how the system functions, such as a manual.

Document submitted under requirements: No

No 7475

13 Security policy Document

Security policy

Submission by: Submitted by the applicant (in person or by post)

Notes: The applicant shall provide a document describing its security policy, which shall include the following: a. a detailed risk assessment of the payment service or services that the applicant intends to provide, which shall encompass fraud risks, security controls, and risk reduction measures to be taken to adequately protect payment service users against any risks identified; b. a description of the IT systems, including the following: i. the architecture of the systems and their network elements; ii. the main IT systems that support the business activities provided, such as the applicant’s website, wallets, payment system, risk and fraud management system, and customer accounting; iii. the IT support systems used in the organisation and administration of the applicant, such as accounting systems, reporting systems, human resources management systems, customer relationship management systems, email servers and internal file servers; iv. information on whether these systems have already been implemented by the applicant or by the group to which it belongs, and, where applicable, the estimated date of implementation; c. the form of authorised external connections, such as those with partners, service providers, group entities and employees working remotely, including justification for said connections; d. for each of the connections referred to in point (c), the logical security measures and mechanisms in place, specifying the control to be exercised by the applicant with regard to such access, as well as the nature and frequency of each control, e.g. technical controls versus organisational controls, preventative controls versus ex-post controls, real-time monitoring versus periodic checks, such as the use of an active directory separate from the group, the opening and closing of communication lines, the configuration of security equipment, the generation of client authentication keys or certificates, system monitoring, authentication, communication confidentiality, intrusion detection, anti-virus systems and virus logs; e. the logical security measures and mechanisms governing internal access to IT systems, which include: i. the technical and organisational nature and frequency of each measure, such as whether it is preventive or ex-post, implemented in real time or otherwise; ii. the means of addressing the matter of partitioning the customer environment in case of common use of the applicants IT resources; f. the physical security measures and mechanisms of the facilities and the applicant’s billing centre, such as access controls and environmental security controls; g. the security of payment procedures, which shall include: i. the customer authentication procedure used to grant access, both for information purposes and for the execution of transactions, as well as of all underlying payment means; ii. an elaboration of how secure delivery to legitimate users of the payment service and integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, both at initial registration and at renewal; iii. a description of the applicant’s systems and procedures for analysing transactions and identifying suspicious or unusual transactions; h. a detailed assessment of the risks associated with the provided payment services, including fraud, in relation to the measures to control and mitigate them, which are set out in the relevant sections of the application for authorisation to operate, demonstrating that said risks are addressed; i. a list of the main written procedures concerning the applicant’s IT systems, or the estimated completion date for any procedures that have not yet been finalised.

Document submitted under requirements: No

No 4084

14 Internal audit mechanisms to ensure compliance with obligations relating to the prevention of money laundering and terrorist financing Other Document

Internal audit mechanisms to ensure compliance with obligations relating to the prevention of money laundering and terrorist financing

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: A description of the applicant’s internal audit mechanisms designed to ensure compliance, where applicable, with the obligations arising from the legal framework for anti-money laundering and terrorist financing, pursuant to the relevant provisions of Law 4557/2018 and Banking and Credit Matters Committee Act 281/5/17.3.2009, taking into account the nature of its business activities and the degree of risk involved in those activities, which shall include the following: a. the applicant’s assessment of the money laundering and terrorist financing risks associated with their business, including the risks associated with their customer base, products and services provided, distribution channels used, and geographical areas of operation. This risk assessment shall take into account the National Risk Assessment Report, the corresponding report of the European Commission and the opinion of the European Supervisory Authorities on the risk associated with the financial market; b. the measures the applicant has or intends to put in place to mitigate risks and ensure compliance with obligations relating to the prevention of money laundering and terrorist financing, the policies and procedures for complying with customer due diligence requirements, as well as the policies and procedures for identifying and reporting suspicious transactions or activities; c. the systems and controls it has or will put in place to ensure that its branches and agents within the meaning of Article 4(38) of Law 4537/2018 comply with the applicable anti-money laundering and terrorist financing requirements, including cases in which the agent or branch is located in another EEA Member State; d. the arrangements it has or will put in place to ensure that its staff and agents, within the meaning of Article 4(38) of Law 4537/2018, have received appropriate training on matters relating to the prevention of money laundering and terrorist financing; e. the identity of the competent management executive responsible for anti-money laundering and terrorist financing (hereinafter the competent executive under Article 38 of Law 4557/2018) and proof that they possess sufficient experience and knowledge in this field to perform their duties effectively; f. the systems and controls it has or will put in place to ensure that its policies and procedures for combating money laundering and terrorist financing remain up to date, effective and relevant; g. the systems and controls it has or will put in place to ensure that its agents, within the meaning of Article 4(38) of Law 4537/2018 do not expose it to increased risks of money laundering and terrorist financing; h. the anti-money laundering and terrorist financing manual of the applicant for employees and agents within the meaning of Article 4(38) of Law 4537/2018.

Document submitted under requirements: No

No 7475

15 Identification and evaluation of the suitability of persons with qualifying holdings in payment institutions within the meaning of Article 4(1)(36) of Regulation (EU) No 575/2013. Other Document

Identification and evaluation of the suitability of persons with qualifying holdings in payment institutions within the meaning of Article 4(1)(36) of Regulation (EU) No 575/2013.

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: For the purposes of verifying the identity and suitability of persons with a direct or indirect qualifying holding in the applicant within the meaning of Article 4(1)(36) of Regulation (EU) No 575/2013 (OJ L 176/1, 27.6.2013), the procedure and criteria, as applicable, laid down in Articles 23 to 28 of Law 4261/2014 (Government Gazette, Series I, No 107) and in Chapter B of Executive Committee Act 142/11.6.2018, shall apply to the applicant, in respect of the following persons who are required to submit the following data and information to the Bank of Greece, as follows: a. natural persons who will directly or indirectly possess a qualifying holding in the applicant in accordance with the criteria set out in Chapter B, paragraphs 10 to 12 of Executive Committee Act 142/11.6.2018, individually or acting jointly with other persons within the meaning of Article 23(5) of Law 4261/2014, as well as natural persons who, although not covered by this case, will exercise, through written or other agreements or by acting jointly with other persons, the control of the applicant within the meaning of Article 3(1)(34) of Law 4261/2014, shall submit: i. the ‘Evaluation questionnaire for proposed acquisitions of holdings by natural persons’ set out in Annex II to Executive Committee Act 142/11.6.2018, filled out, signed and accompanied by the relevant supporting documents; ii. a description of any affiliations to politically exposed persons, as defined in Article 3(9) of Law 4557/2018; and iii. an analysis of whether the natural person’s qualifying holding in the applicant will affect in any way, including as a result of close ties within the meaning of Article 3(1)(35) of Law 4261/2014, the latter’s ability to provide accurate and timely information to the Bank of Greece. b. Legal persons which fulfil the conditions set out in point (a) above, including entities without legal personality such as collective investment schemes, sovereign wealth funds or trusts, shall submit: i. the ‘Evaluation questionnaire for proposed acquisitions of holdings by legal persons’ set out in Annex II to Executive Committee Act 142/11.6.2018, filled out, signed and accompanied by the relevant supporting documents; ii. legal persons that have not been active for a sufficiently long period of time to have been required to prepare financial statements for the three financial years preceding the date of submission of the application shall submit any existing financial statements, if any; and iii. if the head office (and/or registered office) of the legal person or entity are located in a third country, general information on the regulatory status of that third country applicable to the legal person or entity, including information on the consistency between said third country’s framework for combating money laundering and terrorist financing and the recommendations of the Financial Action Task Force; and iv. an analysis of whether the legal person’s or entity’s qualifying holding in the applicant will affect in any way, including as a result of close ties within the meaning of Article 3(1)(35) of Law 4261/2014, the latter’s ability to provide accurate and timely information to the Bank of Greece. In addition to the above, the following must be submitted: a. a description of the structure of the group to which the applicant belongs or will belong, with reference to the parent undertaking. if applicable, the financial statements of the group in question for the last 3 years, audited by a certified auditor or an audit firm in accordance with the applicable legislation, as well as any report(s) from external credit assessment institutions concerning the applicant and/or the group in question, are also required; b. a diagram setting out the applicant’s shareholder structure, including the name and percentage of share capital or voting rights held by each person with a direct or indirect stake in said share capital or voting rights, specifying the persons with a qualifying holding and the reasons for said qualifying holding; c. a list of the names of all persons and other entities with direct or indirect qualifying holdings in the applicant, providing the following for each such person or entity: i. the number and type of shares or other stakeholding issued or to be issued; ii. the nominal value of said shares or stakeholding; d. a list of all natural or legal persons with close ties to the applicant, within the meaning of Article 3(1)(35) of Law 4261/2014, with reference to the identity details of said persons and the nature of their ties. The Bank of Greece may authorise the parent company or the beneficial owner within the meaning of Article 3(17) of Law 4557/2018 to make notifications and submit questionnaires in the name and on behalf of legal persons that acquire an indirect holding, pursuant to the provisions hereof. The Bank of Greece may request data on the identity and percentage of participation, as well as the submission of the relevant questionnaires, as appropriate, from natural or legal persons not belonging to the above categories, but who will directly or indirectly (according to the criteria of Chapter B paragraph 10 of Executive Committee Act 142/11.6.2018) possess a holding or voting rights above 1% of the applicant’s share capital.

Document submitted under requirements: No

No 7475

16 Identity and suitability assessment of board members and management executives Document

Identity and suitability assessment of board members and management executives

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: For the purposes of verifying the identity and assessing the suitability of the persons referred to in Article 5(1)(n) of Law 4537/2018, the ‘Assessment Questionnaire for Members of the Board of Directors and Heads of Critical Functions’ set out in Annex II to Executive Committee Act 142/11.6.2018, must be filled out, signed and submitted, accompanied by the relevant supporting documentation as specified. For the purposes of the above paragraph, questionnaires must be submitted by at least the following persons: a. members of the Board of Directors; b. the head of the internal audit sector; c. the head of the risk management sector; d. the head of the regulatory compliance sector; e. the Chief Financial Officer; f. the members of the audit committee or any other supervisory body/committee, if applicable; g. the competent management executive under Article 38 of Law 4557/2018. Information must also be submitted regarding the suitability assessment of the above persons carried out by the applicant, specifically the details of the results of said assessment, such as relevant committee minutes or appropriate assessment reports or other corresponding documents.

Document submitted under requirements: No

No 4084

17 Professional liability insurance or a comparable guarantee for payment initiation and account information services Other Document

Professional liability insurance or a comparable guarantee for payment initiation and account information services

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: In case the applicant intends to provide payment initiation and/or account information services, it shall provide the following information to the Bank of Greece to demonstrate that it holds professional liability insurance or a comparable guarantee, pursuant to Article 5(4) and (5) of Law 4537/2018: a. an insurance contract or other equivalent document confirming active professional liability insurance or a comparable guarantee, with a coverage amount consistent with those referred to in Chapter V of Executive Committee Act 164/2019 and covering the relevant liabilities; b. documentation demonstrating how the applicant shall calculate the minimum amount in a manner compliant with Chapter V of Executive Committee Act 164/2019.

Document submitted under requirements: No

No 7475

18 Attachments Document

Attachments

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: A reference to the corresponding paragraph must be added to the submitted information or documents, which must be appended as numbered attachments, as per the predefined serial numbering set out herein. The numbering of the attachments must remain unchanged, even when there is no information / documentation to be submitted. Where there are no competent authorities to issue the required certificates, equivalent documents issued by a reliable independent source will be submitted.

Document submitted under requirements: No

No 4084

19 Declaration Declaration

Declaration

Submission by: Submitted by the applicant (in person or by post)

Submitted by: Legal entities

Notes: A solemn declaration accompanying the application to the Bank of Greece for an authorisation to operate as a payment institution, in which the signatories declare that the information submitted is true and complete and that all legal and regulatory requirements have been met, undertake to notify the Bank of Greece immediately of any changes, consent to the Bank of Greece verifying the information, acknowledge the penal provisions for making false statements, and confirm that they possess the necessary authorisation to sign on behalf of the applicant.

Document submitted under requirements: No

No 9429

Law 167 5193 2025 56 Α

Description This procedure concerns the granting of an authorisation to operate a payment institution in the form of a public limited company or a European company (SE) under Regulation (EC) No 2157/2001 (OJ L 294)

Legal references https://api.et.gr/apiLAW/1/2025/5193/pdf

Law 5 4537 2018 84 Α

Description This law concerns applications for authorisation to operate as payment institutions, in accordance with Article 5 of Directive 2015/2366/EU, which it transposes

Legal references https://api.et.gr/apiFEK/1/2018/84/pdf

1 Submission of dossier with application and required supporting documentation

Responsible for Implementation Competent Directorate

Μethod of Implementation Manual Action

Description The Directorate for the Inspection of Supervised Companies receives the application and the required supporting documents in hard copy within a dossier. The dossier may be either submitted in person or sent by mail to the following address: Bank of Greece, Directorate for the Inspection of Supervised Companies, 21 Eleftheriou Venizelou Street, 102 50 Athens Tel.: +30 210 3205322 Fax:+30 210 3205405 Email: Dep.supinspection@bankofgreece.gr

No No

2 Dossier completeness check, conducted by the competent Directorate for the Inspection of Supervised Companies

Responsible for Implementation Competent Directorate

Μethod of Implementation Manual Action

Description Dossier completeness check, conducted by the competent Directorate for the Inspection of Supervised Companies.

No No

3 Evaluation of application and drafting of recommendation.

Responsible for Implementation Competent Directorate

Μethod of Implementation Manual Action

Description Evaluation of application and drafting of recommendation.

No No

4 Adoption of decision by the Credit and Insurance Committee of the Bank of Greece

Responsible for Implementation Competent Directorate

Μethod of Implementation Manual Action

Description Adoption of decision by the Credit and Insurance Committee of the Bank of Greece.

No No

5 Notification of the decision to the applicant

Responsible for Implementation Competent Directorate

Μethod of Implementation Manual Action

Description The decision is notified to the applicant by mail (registered post) or email.

No No

Bank of Greece, Payment institutions – authorisation

https://www.bankofgreece.gr/kiries-leitourgies/epopteia/xrhmatodotika-idrymata/adeiodothsh?tab=tabContent5 Bank of Greece, Payment institutions – authorisation

The Bank of Greece has established an optional pre-application procedure to facilitate applicants interested in setting up a Payment Institution.

https://www.bankofgreece.gr/kiries-leitourgies/epopteia/epikoinwnia-prin-thn-ypovolh-aithshs-adeiodothshs The Bank of Greece has established an optional pre-application procedure to facilitate applicants interested in setting up a Payment Institution.