Banca d'Italia (Bank of Italy) has a statutory 90-day review period for payment institution license applications. In practice, the authorization process takes 9–18 months — because information requests from Bank of Italy suspend the 90-day clock entirely, and DORA (EU Regulation 2022/2554 — Digital Operational Resilience Act) compliance became a hard application gate from January 17, 2025.
Fintech founders evaluating Italy as a payment institution base often compare the nominal statutory timeline against competing jurisdictions without accounting for what Bank of Italy actually enforces on substance: operational headquarters physically in Italy, an Italy-resident majority on the board, a full DORA ICT risk management framework documented before formal submission, and minimum capital of €20,000–€125,000 that must remain as own funds permanently throughout authorization and post-authorization operation.
This guide provides the honest 9–18 month authorization roadmap, the total all-in project cost from €50,000 to €150,000+, the specific DORA requirements embedded in Bank of Italy's authorization process since January 2025, and the MiCA (Markets in Crypto-Assets Regulation, EU Regulation 2023/1114) transition path for crypto operators currently registered under OAM (Organismo Agenti e Mediatori — Italian agents and mediators registration body). Our regulatory lawyers in Milan advise fintech founders and compliance directors on Bank of Italy PI (Payment Institution / Istituto di Pagamento) and IMEL (Istituto di Moneta Elettronica — Electronic Money Institution) authorization, OAM-to-CASP transitions, and DORA compliance documentation.
License Types — PI, IMEL, Small PI, and CASP Compared
Selecting the correct license type before beginning the authorization process is essential. Applying for the wrong license wastes months and carries the risk of rejection on eligibility grounds.
| License Type | Italian Name | Regulator | Minimum Capital | Scope | EU Passport |
|---|---|---|---|---|---|
| Payment Institution (PI) | Istituto di Pagamento | Bank of Italy | €20k (remittance only) / €50k (payment initiation or AIS) / €125k (full incl. card issuing) | All PSD2 payment services | Yes — all 30 EU/EEA states via notification |
| Electronic Money Institution (IMEL) | Istituto di Moneta Elettronica | Bank of Italy | €350,000 | Issue e-money + all PI services | Yes — all 30 EU/EEA states |
| Small Payment Institution (SPI) | Istituto di Pagamento Minore | Bank of Italy | None specified | Limited payment services (max €3M/month) | No EU passport |
| CASP (Crypto Asset Service Provider) | PSAN / CASP | CONSOB + Bank of Italy (shared) | To be confirmed under MiCA implementing rules | Crypto asset services under EU MiCA | Yes — from December 2024 under MiCA |
Choose the PI license when your business model covers standard payment services under PSD2 — money remittance, account information services, payment initiation services, acquiring, card issuing — and EU passporting is strategically important for expanding beyond Italy.
Choose the Small Payment Institution when you are testing the Italian market, transaction volumes will remain below €3 million per month, and EU passporting is not required for the initial business phase. The SPI regime has significantly lighter governance requirements, making it a viable launch vehicle that can be upgraded to full PI authorization when volumes grow.
Choose the IMEL when your core business is issuing electronic money — prepaid cards, stored-value instruments, digital wallets with stored e-money. IMEL authorization is more complex and capital-intensive than PI but provides a broader scope of permitted activities.
Choose CASP/MiCA when your primary business involves crypto asset services: exchange, custody, brokerage, advisory, or portfolio management for crypto assets. Full MiCA CASP authorization has been available in Italy from December 30, 2024. The regulatory lead is split between CONSOB (Commissione Nazionale per le Società e la Borsa — Italian securities regulator) and Bank of Italy depending on the specific service.
Who Can Apply — Eligibility and Entity Structure
The most frequent eligibility blocker for non-EU companies: Bank of Italy does not authorize foreign companies directly. Every PI or IMEL license attaches to an Italian legal entity.
Entity structure requirement: Non-EU companies — and EU companies seeking an Italian PI as their regulatory base — must establish an Italian subsidiary as the licensed entity. The licensed entity must be an Italian SRL (Società a Responsabilità Limitata) or SpA (Società per Azioni — joint-stock company). The foreign parent company cannot hold the Italian PI license directly; only the Italian subsidiary can be authorized.
Registered office and operational substance: The licensed entity must maintain a registered office in Italy. More significantly, Bank of Italy verifies that the operational headquarters — the actual place where management decisions are made, where compliance and risk functions operate, and where ICT systems are managed — is genuinely in Italy. A letterbox registered office at a law firm address, without demonstrable substance, will result in rejection or significant delays during the authorization review.
Board composition minimum requirements:
- Minimum of 2 directors on the board
- At least one director must be resident in Italy and demonstrably present in the Italian operational entity
- All directors must meet Bank of Italy's fit-and-proper requirements: no relevant criminal convictions, adequate and verifiable financial services experience, and personal integrity assessments. Bank of Italy submits individual fit-and-proper questionnaires and assesses each director separately
10%+ shareholder fit-and-proper: All shareholders holding 10% or more of the licensed entity's capital must submit separate fit-and-proper documentation to Bank of Italy alongside the corporate application. This applies to corporate shareholders as well as individuals — the assessment looks through corporate layers to the ultimate beneficial owners.
Operational substance requirements Bank of Italy actually enforces:
- Italian bank account for regulatory capital deposit at application
- Compliance and risk management functions actually located in Italy — not outsourced entirely to a foreign parent
- AML/CFT officer (Responsabile Antiriciclaggio) physically based in Italy
- Internal audit function — can be partially outsourced but must have Italian-based oversight
The prerequisite step before any of the above: incorporating the Italian SRL or SpA that will be the licensed entity.
The Realistic Authorization Timeline — 9–18 Months Explained
The most important service this guide provides is an honest account of what "90-day statutory review period" means in practice. No experienced regulatory advisor in Italy quotes the statutory timeline to a new PI applicant.
Phase 1 — Pre-Application Preparation (3–6 Months)
Pre-application preparation is where the 9–18 month total timeline is largely determined. Bank of Italy applications that are submitted prematurely — before all documentation is complete and all substance requirements are met — face rejection or protracted RFI (Request for Information) cycles that extend the overall timeline.
Required pre-application deliverables:
- Entity incorporation (SRL or SpA): 3–5 weeks
- Regulatory capital paid-up and deposited into Italian bank account: 2–4 weeks
- Bank of Italy-format business plan and 3-year financial projections: 4–8 weeks (Bank of Italy has specific format requirements; a generic business plan will trigger RFI)
- AML/CFT program documentation: 4–8 weeks
- DORA ICT risk management framework (see H2 #4 — mandatory from January 2025): 4–12 weeks
- Governance and organizational structure documentation: 4–6 weeks
- Pre-filing meeting with Bank of Italy: strongly recommended but not formally required; Bank of Italy staff informally review the application structure and flag deficiencies before formal submission, significantly reducing rejection risk
Phase 2 — Formal Bank of Italy Review (3–8 Months)
The statutory 90-day review period begins from the date Bank of Italy acknowledges receipt of a complete application. Any missing document, deficient section, or inadequate explanation triggers an RFI — and each RFI suspends the 90-day clock entirely until a satisfactory response is received and assessed.
Bank of Italy almost always issues at least one RFI during the formal review phase. Common RFI triggers: business plan too vague on revenue projections or market analysis; AML documentation insufficient for the intended transaction volumes; director fit-and-proper gaps or experience not clearly documented; DORA ICT framework missing or inadequate (hard gate from January 2025); capital adequacy calculation methodology errors; anti-fraud controls inadequately documented.
Practical average: 4–6 months of Bank of Italy formal review after submission of a complete application.
Phase 3 — Post-Authorization Setup (1–2 Months)
Authorization is granted via Bank of Italy formal decree. Post-authorization operational steps: activate banking relationships and payment processing agreements; configure live compliance monitoring; register for EU passporting notifications for each target EEA state (Bank of Italy notifies the host country regulator; operational in target states from 1–3 months after notification).
Total realistic timeline: 9–18 months from project start to first authorized payment transaction.
DORA — What New Applicants Must Show from January 2025
From January 17, 2025, DORA (EU Regulation 2022/2554) fully applies to all EU financial entities, including newly authorizing payment institutions. Bank of Italy has embedded DORA compliance requirements as a hard gate in the PI authorization process — applications submitted without adequate DORA documentation will not progress through formal review.
DORA requirements now embedded in the PI authorization application:
1. ICT Risk Management Framework. A documented, board-approved policy for identifying, classifying, and managing all ICT risks affecting the business. Must cover the full ICT asset inventory, vulnerability management processes, access control procedures, and business continuity planning for ICT failures. Bank of Italy reviewers assess whether the framework is genuinely operational or merely a template copied from another entity.
2. ICT Incident Classification and Reporting Procedures. Written procedures for detecting, classifying, and reporting digital operational incidents. Under the January 2025 RTS (Regulatory Technical Standards), significant ICT incidents must be reported to Bank of Italy within 4 hours of detection. The procedures must define what constitutes a "significant incident" and who in the organization is responsible for each reporting step.
3. Digital Operational Resilience Testing. For larger and systemically important PIs, formal TLPT (Threat-Led Penetration Testing) is required annually. For smaller PIs, demonstrable basic resilience testing capability — vulnerability scanning, business continuity tests, disaster recovery exercise records — must be presented in the application.
4. Third-Party ICT Provider Management. A documented policy for managing cloud providers, payment processors, core banking technology providers, and other third-party ICT services. DORA specifies mandatory contractual clauses that must appear in all material third-party ICT contracts — including provisions on audit rights, data portability, exit strategies, and incident notification obligations. Bank of Italy will assess whether existing vendor contracts comply.
5. Information Sharing (Assessed Positively). Participation in cyber threat intelligence sharing arrangements is not mandatory for new PIs but is assessed positively by Bank of Italy as an indicator of mature cybersecurity culture.
Practical impact on timeline: DORA documentation adds 4–12 weeks to Phase 1 preparation for applicants without existing ICT governance frameworks. Fintech startups with no prior compliance infrastructure should budget a minimum of 3 months for DORA preparation alone — and engage a DORA specialist in parallel with the PI license legal team, as these are distinct and complementary expertise sets.
MiCA and the OAM-to-CASP Transition for Crypto Operators
Italy currently has approximately 140+ VASPs (Virtual Asset Service Providers) registered with OAM. This OAM registration is a compliance registration under Italy's AML law transposition — it is not a license, provides no EU passport, and imposes limited regulatory oversight. MiCA fundamentally changes this landscape.
Full MiCA CASP authorization has been available from December 30, 2024. OAM-registered VASPs must assess whether their services require CASP authorization under MiCA or whether transitional provisions allow continued operation under OAM registration while pursuing CASP status.
MiCA Transitional Provisions for Existing Italian VASPs:
- EU member states can grant an 18-month transition period for VASPs already providing services before December 30, 2024
- Italy has indicated intent to implement this transition — VASPs registered with OAM before December 30, 2024 can continue operating until June 30, 2026 while pursuing CASP authorization
- OAM registration does NOT automatically convert to CASP authorization; a separate, full CASP application is required to CONSOB (and Bank of Italy for certain services)
CONSOB vs. Bank of Italy jurisdiction split for crypto under MiCA:
| CASP Service | Regulator |
|---|---|
| Crypto exchange, portfolio management, advisory | CONSOB |
| Crypto custody and administration | Bank of Italy (potential overlap with CONSOB) |
| Crypto-to-fiat payment services | Bank of Italy (PI/IMEL jurisdiction) |
Action plan for OAM-registered VASPs: Assess your current service scope against the MiCA CASP service categories; determine whether CONSOB, Bank of Italy, or both are your regulatory lead; initiate CASP pre-application consultation by Q1 2025 to preserve the maximum runway before the June 2026 transitional deadline.
For Bank of Italy's substance requirement — specifically the Italy-resident director essential for PI authorization — see our nominee director Italy services.
Total Project Cost — Capital + Legal + Setup
All-in cost transparency is essential for a project of this investment level. Budget planning that underestimates regulatory capital requirements or DORA preparation costs creates cash flow crises mid-authorization.
| Cost Category | Amount |
|---|---|
| Minimum regulatory capital (must remain as own funds permanently) | €20,000–€125,000 |
| Bank of Italy application fee | €2,500–€5,000 |
| Legal / regulatory advisory (full application preparation) | €15,000–€60,000+ |
| DORA compliance documentation | €5,000–€20,000 |
| AML/CFT program preparation | €5,000–€15,000 |
| Business plan and financial projections | €3,000–€8,000 |
| Entity incorporation (SRL/SpA) + registered office | €3,000–€8,000 |
| Ongoing compliance (post-authorization per month) | €2,000–€5,000/month |
| Total all-in (Year 1, including regulatory capital) | €50,000–€150,000+ |
Cost varies primarily with: the scope of payment services applied for (broader scope = more complex business plan, AML, and DORA documentation); whether DORA documentation must be built from scratch or adapted from an existing framework; the number of Bank of Italy RFI rounds and response costs; and the number of EU/EEA passporting states requiring individual notification and local compliance review.
Ongoing compliance after authorization: monthly Bank of Italy regulatory reporting; annual DORA digital resilience testing; quarterly AML/CFT monitoring reviews; annual financial statements and capital adequacy filings. Budget €24,000–€60,000 per year in ongoing compliance costs after authorization.
Italy's authorized PI market is well-regulated and relatively concentrated — approximately 50–70 authorized Italian Payment Institutions appear in the Bank of Italy public register (2024). Entry into this market means operating alongside established competitors with mature compliance frameworks.
FAQ
Q: What is the minimum capital required for a Payment Institution license in Italy?
Minimum capital depends on the payment services scope: €20,000 for money remittance only; €50,000 for payment initiation services or account information services; €125,000 for the full range of PSD2 payment services including card issuing and acquiring. This capital must be fully paid-up at the time of application and must be maintained as own funds throughout authorization and post-authorization operation — it cannot be deployed for operational expenses.
Q: How long does it take to get a Payment Institution license in Italy?
Bank of Italy has a statutory 90-day review period, but in practice the authorization process takes 9–18 months from project start to the first authorized payment transaction. Bank of Italy's requests for additional information suspend the statutory clock each time they are issued. Pre-application preparation — DORA documentation, business plan, AML framework, entity incorporation, capital deposit — takes 3–6 months before formal submission.
Q: Can a foreign (non-EU) company apply for a payment institution license in Italy?
Not directly. Non-EU companies must establish an Italian subsidiary — SRL or SpA — as the licensed entity, with a registered office and genuine operational headquarters in Italy. At least one director must be Italy-resident and operationally present. All shareholders holding 10% or more must submit individual fit-and-proper documentation to Bank of Italy.
Q: Does a crypto company in Italy need a payment institution license?
It depends on the specific crypto services. Crypto-to-fiat payment processing may require a PI license from Bank of Italy. Pure crypto exchange, custody, and advisory services fall under MiCA CASP authorization supervised by CONSOB and/or Bank of Italy. Existing OAM-registered VASPs have a transitional period until June 2026 to obtain CASP authorization. Crypto companies providing both payment and crypto services may require both a PI license and CASP authorization.
Q: What does DORA mean for Italian Payment Institutions?
DORA (EU Regulation 2022/2554) has been fully applicable since January 17, 2025. For new PI applicants, DORA compliance is a hard gate in Bank of Italy's authorization process: applicants must present a documented ICT risk management framework, incident reporting and classification procedures, resilience testing capability, and third-party ICT provider management policy as part of the authorization package. Applications without adequate DORA documentation will not complete Bank of Italy's formal review.
Q: What is a Small Payment Institution (SPI) and how does it differ from a full PI license?
A Small Payment Institution (Istituto di Pagamento Minore) is a lighter-regime authorization for payment service providers with total monthly transaction volumes below €3 million. It has significantly reduced governance requirements compared to a full PI license — no mandatory DORA documentation at the same depth, simplified business plan, and faster Bank of Italy registration. The critical limitation: SPIs cannot EU passport their services. An SPI is ideal for market testing before committing to full PI authorization, but any business plan requiring cross-border EU operations must target a full PI license from the outset.
Q: Does a payment institution in Italy need a separate office and Italian-resident employees?
Bank of Italy requires genuine operational substance — not a letterbox registered address. The actual management decision-making, compliance and risk functions, and AML/CFT officer must be physically present in Italy. At least one director must be Italy-resident and operationally active. The AML/CFT officer (Responsabile Antiriciclaggio) must be physically based in Italy. A fintech startup that proposes to manage its Italian PI entirely from abroad with one local legal address will face Bank of Italy rejection during the substance assessment phase of the formal review.
Q: What Bank of Italy documents are required for a payment institution application?
A PI application to Bank of Italy requires: Bank of Italy-format business plan with 3-year financial projections; AML/CFT program documentation; DORA ICT risk management framework (mandatory from January 2025); governance and organizational structure documentation; fit-and-proper questionnaires for all directors and 10%+ shareholders; capital adequacy calculation; anti-fraud controls documentation; entity incorporation documents (SRL/SpA visura camerale, atto costitutivo); proof of regulatory capital deposit in an Italian bank account. Bank of Italy has specific format requirements — generic templates from other jurisdictions will trigger RFI delays.
Q: Can an Electronic Money Institution (IMEL) in Italy issue prepaid cards and e-wallets?
Yes. An IMEL (Istituto di Moneta Elettronica) is authorized to issue electronic money — including prepaid cards, digital wallets with stored e-money, and stored-value instruments — and to provide all PSD2 payment services (the same scope as a full PI plus e-money issuance). Minimum capital for IMEL is €350,000 — significantly higher than the €20,000–€125,000 range for PI licenses. IMEL authorization takes 9–18 months through Bank of Italy and also provides EU passporting rights for both e-money issuance and payment services.
Q: What are the ongoing compliance costs after receiving a Bank of Italy PI license?
Annual ongoing compliance costs after authorization range from approximately €24,000–€60,000 per year. This covers: monthly Bank of Italy regulatory reporting; annual DORA digital operational resilience testing; quarterly AML/CFT monitoring reviews; annual financial statements and capital adequacy filings; ongoing legal and compliance advisory. Add payroll for the Italy-resident director and AML/CFT officer. Total annual operating cost of the Italian PI entity — before any transaction processing revenue — typically ranges from €100,000–€250,000 per year depending on business complexity.
Q: How does EU passporting work for an Italian Payment Institution?
An Italian PI authorized by Bank of Italy can passport its PSD2 payment services to all 30 EU/EEA member states. The process: the Italian PI notifies Bank of Italy of the target member states; Bank of Italy notifies each host country regulator; the PI can begin offering services in each host state from 1–3 months after notification. The passport covers all services for which the Italian entity is authorized. No separate licensing, local capital, or local entity is required in host states — only the notification procedure. This makes Italy-based PI authorization a cost-efficient EU-wide payment services strategy.
Ready to Get Started?
A Bank of Italy Payment Institution license provides EU-wide passporting for the full range of PSD2 payment services, but it requires an Italian corporate subsidiary, at least one Italy-resident director, €20,000–€125,000 in regulatory capital that remains permanently reserved, and a fully documented DORA ICT framework — with a realistic 9–18 month authorization timeline that reflects how the process actually works, not how the statute describes it.
The pre-application preparation phase — 3–6 months of DORA framework development, AML program documentation, Bank of Italy-format business planning, and entity setup — is where the race is won or lost. Our regulatory team in Milan handles the full pre-application process, application preparation, and Bank of Italy correspondence. Contact us for a payment institution license roadmap consultation, or download our Italy PI License Application Checklist.
Milan: Via Monte Napoleone 8, 20121 Milano — +39 02 8088 1240 Rome: Via del Corso 184, 00186 Roma — +39 06 4520 7330 Florence: Via de' Tornabuoni 17, 50123 Firenze — +39 055 264 8120 Email: info@company-italy.com
This page provides general information about financial services licensing in Italy and does not constitute legal or regulatory advice. Engage qualified Italian regulatory counsel before initiating any Bank of Italy authorization application.