The activities the FMA authorises follow PSD2 directly. Under § 14 ZaDiG 2018 (transposing Article 7 PSD2), statutory minimum initial capital scales with service scope. EUR 20,000 applies where the institution provides only money remittance. EUR 50,000 applies where the institution provides only payment-initiation services. EUR 125,000 applies where the institution operates payment accounts, executes payment transactions, or issues and acquires payment instruments — the tier that covers the bulk of acquirer use cases. Own funds are maintained on a continuous basis under one of the three PSD2 calculation methods, with active issuers commonly running on the volume-linked Method B, which scales required own funds to the average monthly payment volume executed.

Customer payment funds must be safeguarded under § 17 ZaDiG 2018: held in a segregated account at an authorised credit institution, or covered by an insurance policy or comparable financial guarantee from an institution that is not part of the same group. The acquirer inherits the named safeguarding-bank relationship at signing, which is why we screen banking continuity before the targets reach the brief. ICT and operational-resilience expectations follow DORA (Regulation EU 2022/2554), which has applied to Austrian PIs since 17 January 2025; the FMA has been explicit on its conduct-and-IT-risk pages that incident-reporting readiness and third-party ICT-provider registers are now part of the live supervisory file. AML/CFT supervision runs in parallel under the Finanzmarkt-Geldwäschegesetz, with FMA on-site reviews testing transaction-monitoring rules, sanctions screening cadence, and MLRO seniority.

One nuance worth flagging early. The PSD3 and PSR package reached provisional political agreement at EU level on 27 November 2025, with formal adoption expected in the first half of 2026 and consolidating PI and EMI authorisations under a single supervisory framework. An Austrian PI authorised today under ZaDiG 2018 keeps that authorisation through whatever transitional grandfathering ZaDiG’s PSD3 amendment ultimately provides; past EU payment-services revisions have grandfathered existing authorisations rather than retesting them. Acquirers buying now lock in the existing fit-and-proper assessment under the current rulebook.

Acquisition runs through a share purchase of the entity holding the FMA authorisation, with prior FMA non-objection under § 8 ZaDiG 2018 (transposing Article 6 PSD2). The notification thresholds are the standard EU set: 10%, 20%, 30%, and 50%, plus any move that hands the buyer control. The fit-and-proper assessment covers beneficial owners, the proposed members of the management body, group structure transparency, the source and provenance of funds, and the strategic plan for the PI post-acquisition. FMA consults the home supervisor of any EU-regulated acquirer. The assessment clock under the EBA/ESMA/EIOPA Joint Guidelines runs sixty working days from a complete file, extendable by thirty working days in defined cases. The bottleneck for unprepared acquirers is the completeness gate, not the substantive review.

One procedural note worth flagging early. FMA filings are conducted in German, and translations of foreign-language source documents are commonly requested even where English drafts exist. That is a genuine difference from peer regulators that nominally accept English filings; planning for sworn translation early in the file removes the most common cause of clock pauses. See the four-step acquisition process on the homepage for the standing checklist that runs in parallel.