PI · Buy-side acquisition

Buy a Payment Institution in France

Payment Institution · Jurisdiction: France
Supervisor: Autorité de contrôle prudentiel et de résolution (ACPR)

Buy-side PI acquisition · France

Buy a Payment Institution in France

An ACPR-supervised payment institution sits at the centre of the euro area, with full PSD2 passporting, the SEPA clearing rails operated out of the Banque de France, and a supervisory file that institutional counterparties recognise on sight. Cadena Brokers represents acquirers only. Every French PI we surface has been pre-vetted on banking continuity, qualifying-holding history, and ACPR supervisory file before it reaches your desk.

Request the French PI shortlist All coverage

Why France

ACPR discipline, EU 27 passporting, euro-area clearing at the source

The supervisor is the Autorité de contrôle prudentiel et de résolution, an independent administrative authority of the Banque de France. ACPR runs prudential and conduct supervision of credit institutions, payment institutions, electronic money institutions, investment firms, and the insurance sector under a single roof, with the General Secretariat (Secrétariat général) executing day-to-day supervision. The Direction des autorisations sits inside the General Secretariat and is the desk an acquirer’s qualifying-holding file actually lands on. Sitting next to ACPR in the same building, the Banque de France itself runs CORE(FR) and the French node of TARGET2, which makes the Paris supervisory cluster one of the few in the EU 27 where the prudential authority and the euro-clearing operator share a corridor. The acquirer’s downstream banking and SEPA-participation conversations sit closer to the regulator than they do in most peer jurisdictions.

The French PI population is sizeable for the EU 27 and skewed toward bank-adjacent platforms and BaaS operators. ACPR publishes the public register on its REGAFI database. Active charters cluster around three patterns: bank-adjacent PIs and BaaS operators (Treezor under Société Générale, Lemonway, Spendesk on its own ACPR licence as of 2024) running marketplace-payments, expense-management, and embedded-finance books across France and into the EU 27; founder-led fintechs that secured ACPR authorisation in the 2024-2025 cohort (Hero in March 2025, Fipto, plus the wider tail of payment-initiation and AISP licensees) where the post-grant cap-table is now clarifying; and smaller domestic French PIs that scaled inside the merchant-acquiring or remittance corridor and are now consolidating. The banking cluster around the licensed entities is concentrated (BNP Paribas, Société Générale, Crédit Agricole, BPCE, La Banque Postale, plus the cooperative networks), with the wider EU 27 one passport notification away.

Three reasons acquirers shortlist France. First, structural cross-border reach: an ACPR-authorised PI passports under PSD2 by notification to every EU 27 host competent authority, with cross-border services and the establishment of branches, agents, and distributors all available across the EEA. Second, the euro-clearing position. Banque de France operates the French half of the Eurosystem’s payment infrastructure; Paris-anchored PIs and their safeguarding banks sit inside that infrastructure rather than passporting back into it. Third, the regulatory file’s reputational weight. ACPR is one of three NCAs in the EU 27 (alongside BaFin and the Banca d’Italia) whose prudential reading is treated as a benchmark by sponsor banks, card schemes, and institutional counterparties. For an acquirer whose post-close thesis depends on a recognised supervisory file and a euro-area banking corridor that institutional counterparties accept without negotiation, France is structurally the right shortlist entry.

What an ACPR PI authorisation permits

Scope, capital, and the obligations a buyer inherits

The activities ACPR authorises follow PSD2 directly. Directive (EU) 2015/2366 was transposed into French law through the Code monétaire et financier (CMF), with the payment-institution regime carried by Articles L.522-1 et seq. (definition, authorisation, prudential perimeter) and accompanying decrees in the regulatory part of the CMF. The licence covers the full PSD2 Annex I services menu: money remittance; payment-initiation services; execution of direct debits, credit transfers, and card-based payment transactions; acquiring of payment transactions; issuance of payment instruments; account-information services; and the ancillary services tied to payment provision (foreign-exchange, safekeeping, data storage). A French PI cannot take deposits, cannot grant credit beyond the narrow ancillary-credit window in PSD2, and cannot issue electronic money. Those activities sit under the separate ACPR-issued electronic money institution authorisation, which is the EUR 350,000 minimum-capital régime under Article L.526-7 CMF.

Statutory minimum initial capital follows the PSD2 Article 7 schedule, transposed without national variation. EUR 20,000 covers only money-remittance activity. EUR 50,000 covers only payment-initiation services. EUR 125,000 covers the full account-based payment-services menu (direct debits, credit transfers, card payments, acquiring, payment-instrument issuing), and that is the threshold most acquirers are working against, because the post-close service mix almost always reaches into card acquiring, card issuing, or PSD2 Annex I (3) execution. An AISP-only entity carries no initial capital floor but must hold professional indemnity insurance sized to the EBA Guidelines under PSD2 Article 5(4). Own funds are then maintained on a continuous basis under one of the three PSD2 calculation methods (Methods A, B, or C); ACPR sizes the operating buffer to the post-acquisition business plan, and credible cross-border passport ambition typically calls for an operating capital base above the statutory floor.

Customer payment funds are safeguarded under the regime in CMF Article L.522-17: held in a segregated account at a credit institution authorised in the EEA and ring-fenced from the PI’s own resources, or invested in low-risk liquid assets, or covered by an insurance policy or comparable financial guarantee from an institution outside the same group. ACPR verifies the chosen mechanism at authorisation and audits it on an ongoing basis. AML/CFT obligations sit alongside the prudential test as a parallel gate, with French AMLD5/AMLD6 transpositions running through the CMF and Tracfin (the French Financial Intelligence Unit, attached to the Ministry of the Economy) acting as the reporting counterparty. The institution must maintain real office space and staff in France, with the management body, the dirigeants effectifs (the two senior managers required under PSD2 Article 5(1)(d)), and the heads of compliance, AML, and risk on the payroll of the licensed entity rather than on a service-agreement basis from a foreign parent. ICT and operational-resilience requirements follow DORA (Regulation EU 2022/2554), which has applied to French PIs since 17 January 2025; ACPR has been running its first DORA inspections through 2025, so the ICT third-party register, the operational-resilience self-assessment, and the incident-reporting plumbing are now part of the live supervisory file.

What we broker here

The French PI profiles in our book

Specific entities are not disclosed outside an executed NDA. The general profile of what reaches an acquirer’s brief from the French shelf falls into three patterns. Bank-adjacent and BaaS-pattern PIs: small-to-mid-cap French institutions running marketplace-payments, embedded-finance, or expense-management books, often with a sponsor-bank relationship that has survived multiple growth phases and a passport stack already filed across the EU 27. Founder-led fintech PIs from the 2022-2024 authorisation cohort: institutions that secured the licence on the back of a clear vertical thesis (treasury, payroll, niche acquiring, B2B payment-initiation) where the founders are stepping back without unwinding the customer franchise. Niche-acquired charters: PIs held by groups that parked the charter alongside an EMI, a credit business, or a brokerage operation and are now consolidating away from payments to focus on a different vertical.

The diligence gates we work through with every French file are four. Banking continuity: which French credit institution holds the safeguarded balances (BNP Paribas, Société Générale, Crédit Agricole, BPCE, La Banque Postale, plus the cooperative networks are the recurring counterparties, with onboarding posture varying by acquirer profile and the post-close service mix), what the timeline looks like for re-papering on change-of-control, and whether SEPA participation, card-scheme memberships, and any acquiring sponsorship survive the new controlling group. AML programme integrity: ACPR’s expectations on transaction monitoring, sanctions screening cadence, and the seniority of the responsable de la conformité, with any recent ACPR or Tracfin correspondence treated as a deal item rather than a footnote. Substance test in France: real headcount in country, the dirigeants effectifs requirement enforced at change-of-control, real office, the management body and committee structure standing up to ACPR’s secondary-test review, and the local compliance and AML officers staying through closing or replaceable on a pre-agreed timetable. IT and DORA readiness: the ICT third-party register, the operational-resilience self-assessment, and the incident-reporting plumbing ACPR has been examining since 17 January 2025.

One contrarian observation worth airing early. France looks expensive on initial capital next to Lithuania for the same activity scope, and the headline three-month ACPR processing window reads competitively until you trace where the clock actually starts. The clock is the three months from a complete file, and “complete” is judged by the Direction des autorisations after a pre-filing dialogue that is itself unbounded by statute. Acquirers who arrive without a coherent group-structure chart, a board-ready strategic plan, and a Banque de France opinion already lined up on payment-instrument security routinely run a longer pre-clock window than they expect. The capital floor is not the binding constraint; the file-completeness gate is. The good news is that on the change-of-control track, the gate is shaped differently and runs to the EBA/ESMA/EIOPA Joint Guidelines clock, which is structurally tighter than the greenfield window.

Acquisition path

Change-of-control under ACPR’s qualifying-holdings regime

Acquisition runs through a share purchase of the French entity holding the ACPR authorisation, with prior ACPR non-objection under the qualifying-holdings regime transposed from PSD2 Article 6 into the CMF. The notification thresholds are the standard EU set: 10%, 20%, 30%, and 50%, plus any move that hands the buyer control of the licensed entity. The fit-and-proper assessment covers beneficial owners, the proposed dirigeants effectifs and members of the management body, group structure transparency, the source and provenance of funds, and the strategic plan for the PI post-acquisition. ACPR consults the home supervisor of any EU-regulated acquirer through the EBA’s standing colleges and bilateral channels, and works with Tracfin where the acquirer profile triggers a direct AML-side review.

The assessment clock under the EBA/ESMA/EIOPA Joint Guidelines on Prudential Assessment of Acquisitions runs sixty working days from a complete file, extendable by thirty working days where the supervisor seeks supplementary information. The bottleneck for unprepared acquirers is the completeness gate, not the substantive review. Acquirers who arrive with a coherent group-structure chart, audited accounts, source-of-funds dossier, and a board-ready strategic plan typically clear the file without iteration. See the four-step acquisition process on the homepage for the standing checklist that runs in parallel with target negotiations.

Why Cadena

Buy-side only, transactional, fast

The mandate is buy-side only. We work for the acquirer. ACPR notices when the same broker name turns up on both sides of a transaction, and the qualifying-holding file lands cleaner when the buyer arrives with independent representation. We do not run listing brokerage, we do not split fees with sellers, and we do not present targets whose seller is paying a placement bonus.

Engagement is transactional. We take the acquirer’s brief, map it to a small shortlist of pre-vetted French profiles, run side-by-side regulatory and banking diligence, then file the qualifying-holding notification with ACPR while target negotiations close in parallel. Each French PI we present has a live, named safeguarding-bank relationship that has been personally confirmed. Our diligence checklist is mapped to the CMF, the EBA Guidelines on authorisation information, the ACPR’s published supervisory expectations on PSPs, and the DORA implementation expectations ACPR has been issuing through 2024 and 2025. If the acquisition thesis depends on a particular service mix — card acquiring, payment initiation, marketplace acquiring — we can tell you in the first meeting which targets in the French book are board-ready for it and which need a service-scope amendment first.

FAQ

France PI: questions buyers ask us

What is a payment institution licence in France?

A payment institution (établissement de paiement) is the PSD2-derived authorisation issued by the ACPR under Articles L.522-1 et seq. of the Code monétaire et financier. It permits the institution to provide the PSD2 Annex I payment services — money remittance, payment-initiation services, execution of direct debits and credit transfers, card-based payment transactions, acquiring, issuance of payment instruments, account-information services, and the ancillary services tied to payment provision. A French PI does not take deposits and does not issue electronic money; e-money issuance sits under the separate electronic money institution authorisation under Article L.526-7 CMF. Standard PI authorisation carries the EU/EEA passport on a notification basis. The simplified PI track under L.522-11-1 is a different, smaller regime with no passport.

What is the minimum capital for a French payment institution?

The PSD2 Article 7 schedule, transposed into French law without national variation. EUR 20,000 covers only money-remittance activity. EUR 50,000 covers only payment-initiation services. EUR 125,000 covers the full account-based payment-services menu including card acquiring and card issuing. An AISP-only entity carries no initial capital floor but must hold professional indemnity insurance sized to the EBA Guidelines under PSD2 Article 5(4). Most acquirers are working against the EUR 125,000 threshold because the post-close service mix typically reaches into card or account-execution services. Ongoing own funds are calculated on a continuous basis under one of the three PSD2 methods (A, B, or C). ACPR sizes the operating buffer to the business plan; credible cross-border passport ambition typically calls for an operating capital base above the statutory floor.

Does a French PI passport across the EU?

Yes. An ACPR-authorised standard PI passports under PSD2 by notification through ACPR to the host competent authority. Both cross-border services and the establishment of branches, agents, and distributors are available across the EU 27 and the wider EEA. Common host markets for French PIs are Belgium, Luxembourg, Germany, Spain, Italy, the Netherlands, and the wider Romance-language European corridor. The passporting notification is administrative; it is not a second authorisation file in the host country. The simplified PI track under L.522-11-1, by contrast, does not carry the passport — that is the structural reason most acquirer briefs target standard PI authorisations rather than simplified ones.

What is a simplified payment institution under L.522-11-1?

The simplified PI regime under Article L.522-11-1 CMF is the French transposition of the PSD2 small-PI option (Member-State derogation under PSD2 Article 32). Eligibility is limited to institutions whose monthly average of payment transactions, calculated over the preceding twelve months, does not exceed EUR 3 million, and whose service scope does not include money remittance. Prudential requirements are adjusted (lighter own-funds calculation, simplified governance). The trade-off: the simplified track does not carry the EU/EEA passport, and the activity scope cap is structurally binding on growth. For acquirers whose post-close thesis is single-country French operation under a narrow service scope, the simplified track is workable; for any cross-border or scale ambition, only the standard PI fits.

What does ACPR check on a change of control?

A qualifying-holding notification under the regime transposed from PSD2 Article 6 into the CMF. Thresholds are 10%, 20%, 30%, and 50%, plus any move that hands the buyer control of the licensed entity. ACPR assesses fit-and-proper standing of beneficial owners and the proposed dirigeants effectifs, financial soundness and source of funds, group structure transparency, the strategic plan for the PI post-acquisition, and AML/CFT integration. The assessment clock under the EBA/ESMA/EIOPA Joint Guidelines on Prudential Assessment of Acquisitions is sixty working days from a complete file, extendable by thirty working days where supplementary information is sought. ACPR consults the home supervisor of any EU-regulated acquirer through the EBA channels and bilateral colleges, and works with Tracfin where the acquirer profile triggers a direct AML-side review. Closing on the SPA is conditional on ACPR non-objection.

How does PSD3 and the Payment Services Regulation affect a 2026 PI acquisition?

The European Parliament and the Council of the EU reached provisional political agreement on PSD3 and the directly-applicable Payment Services Regulation on 27 November 2025. Publication in the Official Journal is expected in H1 2026; the PSR will apply 20 days after publication, while PSD3 requires national transposition over an 18-month window with applicability targeted for Q2/Q3 2028. The reform tightens fraud-liability rules, expands strong-customer-authentication scope, and consolidates supervisory expectations on outsourcing and ICT risk. For an acquirer evaluating an ACPR-supervised PI today, the practical implication is that the entity acquired in 2026 is being acquired into the tail-end of the PSD2 regime; the integration plan must already account for PSR direct-effect obligations applying within months of completion, and the change-of-control file should anticipate ACPR’s reading of the target’s PSR-readiness as part of the substantive review. We screen targets on PSD3/PSR readiness as part of standing diligence.

Next step

Open a buy-side mandate on French PIs

Send a one-paragraph profile of the acquirer, the post-close service scope, banking-stack constraints if any, and any preference on substance footprint. We respond inside one business day with the matching set from the current French book, plus the banking-stack readout and substance-posture score for each. Buy-side only: no listing brokerage, no double-ended deals.

Start the buy-side conversation Request the French shortlist