Бесплатный фрагмент - EU KYC Survival Guide

EU KYC Survival Guide: Don’t Get Blocked

From EMI License to First Customer Without Blocks

PSD2, 6AMLD & GDPR Compliance for Payment Institutions & Neobanks

By Andrei Traderson

* * *

Disclaimer

This book is a practical, educational playbook written for fintech founders, Chief Compliance Officers (CCOs), MLROs, and compliance managers. It is not legal advice. Regulations evolve, supervisory expectations differ by jurisdiction, and your specific situation may require tailored counsel. The templates, scripts, and examples in this book are realistic illustrations built from publicly available regulatory guidance, enforcement actions, and common industry practice. Where this book references onboarding questions from specific Electronic Money Institutions (EMIs) or audit questions from regulators, these are representative

reconstructions based on how such processes typically work in

practice — not verbatim copies of any company’s confidential internal documents. Always validate against the current text of PSD2 (Directive (EU) 2015/2366), the 6th Anti-Money Laundering Directive (Directive (EU) 2018/1673 and the broader AMLD framework), the GDPR (Regulation (EU) 2016/679), and the rules of your competent authority before relying on anything here in production.

Use it to ship faster. Verify before you sign.

* * *

How To Use This Book

You did not buy this book to learn the theory of money laundering. You bought it because an EMI partner, a sponsor bank, or a regulator is standing between you and your launch — and they keep asking you for documents you do not have, in a format you do not understand, with a deadline that is already too tight.

So this book is built like a field manual, not a textbook.

If you are 2 weeks from a bank onboarding call, jump straight to Chapter 3 (Real Onboarding Questions) and Chapter 2 (Bank-Ready Documents). Bring the answers. Bring the templates.

If you are choosing a license, start with Chapter 1.

The KYC/AML burden of a PI, an EMI, and a banking license are radically different, and picking the wrong one costs you a year.

If you are building the tech, Chapter 4 (Transaction Monitoring) has the rule logic and code you can adapt.

If you are scared of the GDPR/AML conflict, Chapter 5 resolves the paradox that paralyzes most founders.

If your audit is scheduled, Chapter 6 is your rehearsal script.

If you want to know what actually kills companies, Chapter 7 is the graveyard tour: Wirecard, N26, and 15 founder mistakes.

Read it in order once. Then keep it open on the second monitor while you build.

* * *

Introduction: The Product Was Never the Hard Part

Here is the uncomfortable truth that every fintech founder eventually learns, usually too late and too expensively: the product is the easy part.

You can build a beautiful app. You can integrate a card issuer. You can wire up a ledger, a KYC vendor, an IBAN provider, and a slick onboarding flow in a quarter. Engineers are abundant, APIs are mature, and the technical path from idea to a working payment app is more paved than it has ever been.

And then you go to open the account that makes the whole thing real — the safeguarding account, the sponsor relationship, the EMI partnership — and you hit the wall.

The wall is compliance. And the wall does not care how good your app is.

Roughly three out of four EU fintechs that attempt bank or EMI onboarding stumble or fail on the first pass — not because they are fraudulent, not because their idea is bad, but because their AML policy is a Google Doc with three bullet points, their KYC flow has no documented risk tiers, and their transaction monitoring is “we’ll add that later.” The partner asks three questions — Show me your AML policy. Show me your KYC flow.

Show me your transaction monitoring rules. — and the founder

freezes.

Get one answer wrong and you do not get a “try again next week.” You get a six-month delay while you rebuild documentation you should have had on day one. You get €200k–

€500k in legal and consulting fees as you scramble to retrofit a compliance program. Or you get the worst answer of all: a flat, unexplained “No,” with no appeal and no feedback, because the partner has a hundred other applicants and zero obligation to coach you.

This book exists to make sure that does not happen to you.

I have written it as the manual I wish I’d had — the one that skips the academic history of the Financial Action Task Force and gets straight to: here is exactly what they will ask, here is the document that answers it, here is the rule that satisfies the regulator, and here is the mistake that will get you blocked.

Compliance done right is not a tax on your business. It is the moat. The founders who treat AML/KYC as a product feature — designed, documented, and demonstrable — are the ones who onboard in weeks instead of quarters, who survive audits without panic, and who turn “we’re compliant” into a sales advantage when they court enterprise clients.

Let’s get you onboarded.

* * *

Chapter 1 — License Breakdown: PI vs EMI vs Banking License

Before you write a single line of an AML policy, you need to know which regime you are actually in. The single most expensive mistake founders make is choosing a license without understanding the compliance weight attached to it. The KYC/AML obligations of a Payment Institution, an Electronic Money Institution, and a credit institution (bank) are not the same

— and the gap between them is measured in millions of euros and years of runway.

The Three Doors

Under the EU framework, three principal authorizations let you move other people’s money:

— Payment Institution (PI) — Authorized under PSD2

(Directive (EU) 2015/2366). A PI can execute payment services: money remittance, payment initiation, acquiring, account information services, and execution of payment transactions. A PI cannot hold customer funds as a stored balance the way an e-money institution can; funds it receives must generally be for the purpose of executing a payment and must be safeguarded.

— Electronic Money Institution (EMI) — Authorized under

the E-Money Directive 2 (Directive 2009/110/EC), read together with PSD2. An EMI can do everything a PI can do, plus issue electronic money — i.e., hold a stored monetary value on behalf of customers (think of a prepaid balance, a wallet, the float in a neobank-style account). This is why most “neobanks” that are not actually banks are, legally, EMIs.

— Credit Institution (Banking License) — Authorized under

the Capital Requirements Directive/Regulation (CRD IV / CRR) framework and supervised within the Single Supervisory Mechanism for significant institutions. A bank can take deposits,

lend against them, and is covered by deposit guarantee schemes. It carries the heaviest capital, governance, and AML obligations of the three.

The Compliance Weight You Are Actually Signing Up For

Here is the part nobody tells you in the pitch meeting: all three are “obliged entities” under the AML framework. A PI is not “AML-lite.” From the day you are authorized, you carry the full set of obligations:

A documented, board-approved AML/CFT policy.

A business-wide risk assessment (BWRA) and customer risk assessment methodology.

Customer Due Diligence (CDD) at onboarding, Enhanced Due Diligence (EDD) for high-risk relationships, and Simplified Due Diligence (SDD) only where genuinely permitted.

Ongoing monitoring of transactions and of the business relationship.

A nominated officer — the MLRO (Money Laundering Reporting Officer) — responsible for receiving internal disclosures and filing Suspicious Activity Reports (SARs) with the national Financial Intelligence Unit (FIU).

Record-keeping (generally five years).

Training for relevant staff.

Independent audit of the AML function.

The difference between the licenses is not whether you do AML — it is how much scrutiny you face and how sophisticated your controls must be. An EMI holding customer float is inherently a juicier target for money launderers than an Account Information Service Provider, so supervisors expect more from it. A bank,

sitting at the center of the financial system, gets the heaviest expectations of all.

The “Agent vs. Principal” Shortcut (And Its Trap)

Many founders launch faster by operating as an agent or distributor of an existing EMI (sometimes called “EMI-as-a-service” or a BaaS arrangement) rather than getting their own license. This is legitimate and often smart for a first product. But understand the trade-off:

The principal (the licensed EMI) owns the regulatory relationship. Their risk appetite becomes your ceiling. If their compliance team decides your customer segment is too risky, you are deplatformed overnight — and you have no license to fall back on.

You still have to do real KYC/AML. The principal will push obligations down to you contractually and will

audit you. You do not escape the work; you escape the

authorization, not the operation.

Your exit (getting your own license) requires you to already have a mature compliance program. So you cannot defer the work forever — you just choose when to pay for it.

The strategic rule of thumb: start as an agent to validate the market, but build your compliance program from day one as if you were the principal. That way, when you apply for your own EMI or PI license, the regulator sees an operation that already runs like an obliged entity. The single biggest accelerant to authorization is showing up with a program that already works.

How To Choose — A Decision Framework

Ask yourself four questions, in order:

— Do I need to hold customer balances? If yes, you need EMI or bank — a PI will not do. If you are purely initiating payments or aggregating account data, a PI (or even just PIS/AIS registration) may be enough.

Do I need to lend my customers’ deposits? If yes,

you are in banking-license territory. Almost no early-stage fintech should start here.

How risky is my customer base? High-risk

segments (crypto, gambling, money services, high-cash, cross-border to high-risk jurisdictions) will dramatically raise the AML bar and may make agent arrangements impossible — partners will refuse you. Know this before you build.

— How much runway do I have? A banking license

can take three years and burn millions before first revenue. An EMI is faster. An agent arrangement is fastest. Match the license to the runway, not the ambition.

The founders who get blocked are almost always the ones who picked the license for the story (“we’re a bank!”) instead of the operation. Pick the lightest license that legally supports your actual product, build the compliance program to the standard of the heaviest, and you will move faster than 90% of your competitors.

In the next chapter, we turn theory into paper: the exact, bank-ready documents every partner will demand — AML Policy, KYC Policy, and Risk Assessment — written so you can adapt and ship them.

Chapter 2 — Bank-Ready Documents: The Templates That Pass Audits

When an EMI partner, sponsor bank, or competent authority says “send us your compliance pack,” they expect three core documents and a cluster of supporting ones. This chapter gives you adaptable, copy-paste templates for the three that matter most: the AML/CFT Policy, the KYC/CDD Policy, and the Business-Wide Risk Assessment. Adapt the bracketed fields, delete what does not apply, and have a qualified person review before submission.