Member States must require undertakings not otherwise exempt and not natural or legal persons benefiting from Articles 32 or 33 to obtain authorisation as a payment institution before providing payment services; authorisation is only granted to legal persons established in a Member State. Competent authorities shall grant authorisation where the application meets Article 5 requirements and the authority's overall assessment is favourable; they may consult the national central bank or other relevant public authorities. Where national law requires a registered office, the payment institution must have its head office in the same Member State and carry out at least part of its payment services business there.

Authorisation is conditional on robust governance arrangements proportionate to the nature, scale and complexity of the services, including a clear organisational structure, risk management, monitoring and internal controls. Competent authorities may require separation of payment services into a distinct entity where other activities impair financial soundness or supervisory monitoring. Authorisation shall be refused if shareholders with qualifying holdings are unsuitable, and granted only where close links (per Regulation (EU) No 575/2013) or third‑country laws do not prevent effective supervision. An authorisation is valid in all Member States and permits provision of the authorised payment services across the Union under the freedom to provide services or freedom of establishment.