Buy-side acquisition · Luxembourg
Buy a Payment Institution in Luxembourg
CSSF-supervised payment institutions, sourced and brokered for acquirers. Pre-vetted carve-outs, EU passporting, and a regulator that staffs your file individually.
Buy-side acquisition
Acquirers buy a Luxembourg PI for stable supervision, not speed
You are not looking for the cheapest payment licence in Europe. You are looking for the one that an institutional shareholder, a correspondent bank, or a euro-clearing counterparty will look at without flinching. The Luxembourg payment-institution licence has carried that quality signal for a decade — supervised by the Commission de Surveillance du Secteur Financier (CSSF), seated in a AAA-rated jurisdiction, and held by a small population of operators that the CSSF knows by name. For buyers, that means clean diligence files, predictable change-of-control timelines, and a banking sector that opens accounts on the strength of the licence rather than despite it.
Cadena Brokers is buy-side only. We source Luxembourg PI targets, structure the acquisition, and stand alongside you through CSSF non-opposition. We never represent sellers and never represent both sides. Brief us on your mandate
Why Luxembourg
The licence behind a triple-A financial centre
The CSSF authorises and supervises payment institutions under the Law of 10 November 2009 on Payment Services (the PSL), specifically Articles 6 and 24-2. Luxembourg transposed PSD2 by the Law of 20 July 2018, and the PSL has been amended in step with each subsequent European technical standard. The result is a licensing regime that is recognisably the EU baseline but applied by a regulator that staffs files individually, expects English-language correspondence, and publishes its expectations in the form of circulars (notably CSSF 19/713 on security measures and CSSF 22/806 on outsourcing).
For an acquirer, three things matter. First, the licence passports across the EEA under PSD2 — a Luxembourg PI you buy today can serve customers in Germany, France or the Netherlands on a freedom-of-services notification, no fresh authorisation required. Second, Luxembourg’s banking sector is unusually receptive to licensed payment institutions; the correspondent-banking conversation that drags out the value-capture window in other jurisdictions is normally shorter here. Third, the CSSF’s change-of-control machinery is well-trodden, transparent and conducted in English, which means the deal-team can plan against published assessment criteria rather than guess at the regulator’s mood.
Scope and capital
What a Luxembourg PI actually permits
Annex I of the PSL lists eight payment services and a Luxembourg PI is authorised against a specific subset. Standard authorised PIs cover account services, execution of credit transfers and direct debits, card-issuing or merchant acquiring, and (where the licence extends to it) money remittance and the two newer PSD2 categories — payment initiation services and account information services. The combination on a target’s authorisation is more important to the deal than the headline number of services: a card-acquiring PI is a different business and a different capital profile from a remittance-only PI, and a buyer needs to read the carve-out precisely.
Statutory minimum initial capital depends on the service mix authorised by the CSSF. Money-remittance-only PIs require EUR 20,000 (PSL Annex I point 6). PIs authorised for payment-initiation services only require EUR 50,000 (Annex I point 7). PIs authorised for account services, execution of payment transactions, card-issuing or acquiring need EUR 125,000 (Annex I points 1 to 5). Beyond initial capital, a PI must maintain own funds on an ongoing basis under one of three calculation methods (A, B or C) prescribed by the PSL, and CSSF supervises the choice each year. Account-information service providers (AISPs) sit outside the PI capital regime and are subject to a separate, lighter registration.
Client-money safeguarding is mandatory for every PI that holds funds for users. Safeguarding is either via segregation on accounts at a credit institution or by an insurance policy or comparable guarantee; the CSSF expects evidence of both the chosen method and its operational discipline at authorisation, and re-tests it during inspections. For an acquirer, this is the file you read first in diligence.
The book
What we broker — and what we will not
Our Luxembourg PI book is small by construction. Each target on it has passed three internal screens before reaching your desk: regulatory standing (no open CSSF remedial measure, no qualifying-holding objection in the prior three years, clean ML/TF supervisory history), banking continuity (at least one correspondent or transactional bank willing to continue the relationship through change-of-control), and an AML/CFT programme that survives a CSSF onsite. We do not list shells with dormant authorisations awaiting a buyer-led restart; the CSSF reads those filings unfavourably and the change-of-control assessment becomes harder, not easier.
What we look for in the buyer is parallel: a defensible source-of-funds story, a credible business plan for the licence (the CSSF requires updated three-year financial projections at the qualifying-holding stage), and a management team the regulator can fit-and-proper-test without surprises. We turn down mandates where the buyer’s narrative is thin, because the time-to-non-opposition lengthens dramatically when the file invites supplementary questions.
The diligence gates that matter on a Luxembourg PI carve-out, in order: change-of-control approval scope and timing, banking continuity (specifically, whether the correspondent relationships transfer or need re-onboarding), FTE retention for the two-person rule and senior management, IT outsourcing under CSSF 22/806 (contracts often need novation), and AML programme continuity through legal-entity change.
The horizon worth pricing in
PSD3 changes the file you’ll be re-opening in 2028
The Commission’s PSD3 / Payment Services Regulation package is expected in the Official Journal in mid-2026, with the PSR applying around 18 months later and Luxembourg’s PSL re-amendment landing on a similar timetable. Every existing Luxembourg PI and EMI will need to re-authorise under a unified payment-institution shell with new mandatory deliverables: winding-up plans, DORA alignment documentation, and revised passporting disclosures. The CSSF has not yet issued PSD3-specific guidance; incumbents are still operating to the 2018 PSD2 regime as amended.
For acquirers, this is information your seller may not have priced. A Luxembourg PI bought today inherits the re-authorisation workload — legal, compliance, governance, and operational-resilience filings on a tight calendar. Well-prepared buyers raise this in the LOI and recover value against it. We brief every Cadena-client on the PSD3 timeline as part of the mandate workstream, because we would rather you walk in with the right reserves than discover the obligation in month nine of integration.
Process
From mandate to closing
Acquisition runs in three legs: mandate intake and target identification, exclusivity and diligence over the qualifying-holding notification, and CSSF non-opposition leading to closing. Cadena drives the buy-side workstream end-to-end and coordinates with Luxembourg counsel and your existing tax adviser. For the full sequence, see our process.
We do not commit to fixed closing dates because Luxembourg PI deals are paced by CSSF response cycles, not by the deal lawyers. We commit to expedited closings — files prepared so that the regulator has no reason to extend the assessment clock.
Why Cadena
Three things that distinguish a Luxembourg PI mandate with us
- Single-side discipline. Every page on this site is written for the acquirer. We never run dual mandates, never broker for the seller in parallel, and never optimise the deal price against our own roster.
- Pre-vetted carve-outs. Our Luxembourg PI book is curated against regulatory standing, banking continuity, and AML programme survivability before you see the teaser. Targets that fail any of the three are not shown.
- PSD3 in the pricing. We brief every buyer on the re-authorisation file due in 2027 / 2028 so the offer accounts for it. Most sell-side processes still don’t.
FAQ
Questions acquirers ask before a Luxembourg PI mandate
How is a payment institution licence in Luxembourg structured?
The Luxembourg payment institution licence is granted by the CSSF under Articles 6 and 24-2 of the Law of 10 November 2009 on Payment Services. The licence is service-specific: the CSSF authorises the institution against the Annex I services it actually performs, sets the corresponding statutory minimum initial capital (EUR 20,000, EUR 50,000 or EUR 125,000), and sets the own-funds calculation method to apply on an ongoing basis. An acquirer reads the authorisation, the ongoing-supervisory letter and the most recent CSSF inspection report together to understand what the licence really permits.
What’s the difference between an authorised PI and a Luxembourg small payment institution?
Luxembourg has implemented the small-PI regime under the PSL — institutions whose monthly payment-transaction volume averages below the threshold set in the PSL can apply for the lighter regime instead of full PI authorisation. Capital, governance and reporting are reduced, but the licence does not passport and the volume cap is binding. For an acquirer building a cross-border euro-payments business, the full PI is normally the only credible target. We can also broker small-PI carve-outs where the use-case justifies it — see our sibling page on Luxembourg small payment institutions.
How does CSSF change-of-control approval work for the buyer?
The PSL transposes the qualifying-holding regime of Article 6 of PSD2: a direct or indirect acquisition that crosses 20%, 30% or 50% of capital or voting rights, or that results in the target becoming a subsidiary, must be notified to the CSSF in advance and is subject to non-opposition. The CSSF assesses the proposed acquirer’s reputation, financial soundness, the management of the target after the transaction, and the operational soundness of the post-deal entity. The clock can be paused for missing information, which is why a well-prepared filing matters more than a fast one.
Can a Luxembourg PI passport into other EU member states?
Yes — under PSD2 a Luxembourg payment institution can passport into the EEA either through freedom of services (cross-border activity without local presence) or freedom of establishment (a branch). Both routes go through the CSSF as home regulator: the institution notifies the CSSF, the CSSF transmits the file to the host competent authority, and the host has a defined window to react. Card-acquiring PIs and remittance-heavy operators commonly run an EU-wide footprint from a single Luxembourg authorisation.
What does PSD3 mean for someone buying a Luxembourg PI today?
PSD3 and the Payment Services Regulation are expected in the EU Official Journal in mid-2026, with application around 18 months later. Every existing Luxembourg PI will need to re-authorise under the new unified payment-institution framework with additional deliverables — winding-up plans, DORA alignment documentation, revised passporting disclosures. A Luxembourg PI you buy in 2026 inherits that re-authorisation workload. Buyers should raise this in the term sheet and reserve for the legal-and-compliance workstream; well-advised sellers will already have started the prep.
Brief us
Ready to open a Luxembourg PI mandate?
Send us the acquirer profile, the target service-mix you are aiming for (Annex I points), and any banking constraints. We will come back with a shortlist of carve-out candidates and a workplan that prices in the PSD3 horizon.
