Every EU and UK licensed fintech requires named responsible persons. The Money Laundering Reporting Officer (MLRO) is mandatory under FCA authorisation. An equivalent compliance officer role is standard across EU jurisdictions under PSD2. These are not roles that can be covered by a part-time contractor and left unsupervised without regulatory consequences.

The practical consequence is a fixed compliance headcount cost that doesn't scale down with company size. A licensed EMI with €2 million annual revenue and a licensed EMI with €20 million annual revenue both require an MLRO and a compliance function that the regulator considers credible. Companies must appoint qualified compliance officers (MLROs) and ensure segregation of client assets — ignoring compliance early can lead to fines in the hundreds of millions.

For a small licensed entity, MLRO salary or outsourced MLRO retainer typically runs €60,000 to €120,000 annually depending on seniority and jurisdiction. That figure is the floor, not the average, and it doesn't include the broader compliance team that large transaction volumes or multi-jurisdiction operations require.

Transaction monitoring, KYC platforms, AML screening tools, audit trail software, and incident logging are not optional for a licensed entity — they're the operational infrastructure that regulators inspect. Penetration testing from certified agencies runs $15,000 to $25,000 per annual deep audit — required before launch and annually thereafter for licensed fintechs maintaining institutional counterparty relationships.

PCI DSS Level 1 QSA-led assessments cluster between $50,000 and $200,000 depending on scope. For a multi-jurisdiction EU operator, the cumulative technology compliance cost — transaction monitoring platform, KYC vendor fees, annual penetration testing, SOC 2 recertification, PCI DSS assessment — commonly runs €150,000 to €300,000 annually before any custom development is included.

Lithuania's Bank of Lithuania inspection posture means the compliance cost now sits in operational evidence, not just policy — controls need to be inspection-ready from day one. That "inspection-ready" standard requires technology infrastructure that produces the audit trails, monitoring logs, and escalation records that an examiner expects to see. Maintaining that standard continuously is a materially different cost than producing it at the point of an examination.

Minimum capital requirements don't disappear after authorisation — they must be maintained continuously, with the regulator able to request evidence at any time. An EU EMI requires minimum initial capital of €350,000. A payment institution requires €125,000. For a growing company deploying capital into product, sales, and market expansion, the portion locked in regulatory minimums generates no return.

Obtaining a payment institution license in 2026 is more complex, more expensive, and more demanding than at any point in the past decade — the EU EMI licence requires €350,000 capital with 30-country passporting, while the Singapore MPI requires SGD $250,000 capital with ASEAN access. Those capital requirements are locked for the life of the licence. At a cost of capital of 15%, €350,000 in locked regulatory capital has an annual opportunity cost of approximately €52,500 — a number that rarely appears in licence cost analyses but compounds over time.

The maintenance cost of a fintech licence does not stay constant — it rises as the regulatory environment evolves and new obligations apply to existing licensees without a choice to opt out.

DORA, effective January 2025, applies to EU-regulated financial entities and requires ICT risk management frameworks, major incident reporting within defined timeframes, regular resilience testing, and third-party ICT provider oversight. PSD3 implementation becomes mandatory by 2026–2027 with 18-month transition periods — small fintechs face €20,000–€50,000 additional compliance investment, while larger organisations require €200,000–€500,000 for full implementation.

These are not optional upgrades. Every EU-licensed EMI and PI must comply with both frameworks. The DORA implementation cost — ICT risk management documentation, incident response procedures, penetration testing programme, third-party oversight framework — is a one-time investment followed by ongoing maintenance that adds materially to the annual compliance run-rate.

The cumulative EU regulatory spread on a fintech that already operates in the US commonly adds 25–50% to the compliance run-rate when measured fully. Multi-jurisdiction operation multiplies reporting obligations, supervisory relationships, and jurisdiction-specific feature requirements simultaneously.

The economics of licence maintenance produce a specific seller population that creates buyer opportunity. When a licensed entity's ongoing compliance overhead — staffing, technology, capital, regulatory evolution — outgrows the revenue base the licence supports, the founder's rational choice is to sell. The licence has value to a buyer whose scale makes the fixed compliance cost proportionate — but the original holder's revenue doesn't justify the overhead.

For buyers, this creates an acquisition opportunity at pricing that reflects the seller's cost pressure rather than the licence's strategic value to a larger operator. The maintenance cost that makes the licence uneconomical for a €3 million ARR company is proportionately trivial for a €30 million ARR operator who absorbs the same fixed compliance base across a much larger revenue base. For sellers mapping the gap between their compliance overhead and their revenue trajectory, N5Deal provides the market context and buyer pool that allows exit decisions to be made before the overhead becomes a crisis rather than after.

This page is for informational purposes only. It does not constitute legal, financial, or regulatory advice. Readers should consult qualified professionals before making any decisions.