Swiss SRO-Affiliated Fintech vs EU EMI vs Starting a New Fintech Company (2026)

1. Decision matrix: compare responsibilities, not labels

Write a one-page service specification: who your customers are, where they are located, what they can do, who receives their money and who owes repayment. Include cards, payment accounts, foreign exchange, crypto custody and any credit separately. The same interface can conceal very different issuer and intermediary relationships.

Read the matrix as a screening tool. A Swiss entity may have additional permissions, and an EU institution may have restricted services or an exemption rather than full authorisation. Incorporation in either region does not establish the category. Verify the exact legal entity and documentary scope before assigning value to the label.

2. Swiss SRO affiliation: AMLA supervision, not a bank

FINMA’s SRO guidance explains that relevant professional financial intermediaries under Article 2 paragraph 3 AMLA must affiliate with a recognised SRO. The intermediary is supervised by the SRO where it is affiliated, not directly by FINMA under that affiliation. FINMA recognises and supervises the SROs; their regulations define due diligence, controls and sanctions.

This distinction matters in sales documents. ‘FINMA-recognised SRO’ describes the organisation, not a banking authorisation granted to every member. An AML-supervised intermediary still needs to assess whether its specific activities trigger another authorisation. Customer identification, beneficial ownership checks, monitoring and suspicious-activity reporting remain operational obligations, not a badge supplied by software.

A FINMA banking licence is separate. So is the Article 1b FinTech licence: FINMA describes permission to accept public deposits up to CHF 100 million or cryptobased assets under specified restrictions, including no investment and no interest. FINMA also warns that assets under that licence are not protected by deposit protection in insolvency. These conditions must not be attributed to a company merely because it is SRO-affiliated.

Use the member search linked by FINMA and request current affiliation evidence, the member’s business description, applicable SRO regulations and audit correspondence. FINMA’s supervision explanation concerns its oversight of SROs. It is not evidence that a particular company’s cards, accounts or crypto services are approved everywhere. Cross-border customer access requires a separate market-by-market analysis; Swiss affiliation does not create an EU passport.

3. EU EMI authorisation: e-money, safeguards and scope

An electronic money institution is a defined legal category, not simply a payment-oriented fintech. Directive 2009/110/EC (EMD2) defines electronic money and establishes the EMI framework. Article 6 lists permitted activities, including payment services, while prohibiting deposit-taking as such. Article 11 addresses issuance and redemption at par value. The entity’s national authorisation and conditions determine what the buyer actually acquires.

Safeguarding deserves its own diligence workstream. Article 7 of EMD2 requires safeguarding of relevant funds received in exchange for issued e-money. PSD2, Directive (EU) 2015/2366, Article 10, sets out safeguarding methods for payment-service funds, including segregation and protection against other creditors or qualifying insurance or a comparable guarantee. Review the method applicable to the actual money flow and national implementation, rather than assuming one account structure fits every service.

Safeguarding is not the same thing as a bank deposit guarantee. Ask who is the issuer, what claim customers have, how balances reconcile to safeguarded funds and what happens in insolvency. An IBAN, card or bank partner logo does not answer those questions. Obtain agreements, reconciliation evidence, exception reports and the treatment of fees and unsettled payments.

EU cross-border rights operate within the permission and required procedures, not worldwide. PSD2 Article 28 addresses services and branches in another Member State. EMD2 distinguishes distributing and redeeming e-money through persons acting for the issuer from issuing e-money through agents; payment-service agents are separately governed. Check notified territories and roles. The EBA central register is useful for discovery, but EBA states that it has no legal significance and national registers remain authoritative. Check the national authority’s record and restrictions.

4. Starting a new software-led fintech

A new company can design its governance, customer proposition and technology without inheriting an acquired entity’s history. It also starts without evidence of operating continuity. Incorporation, a working demonstration and a signed software licence are different milestones from permission to serve customers or a provider accepting the business.

Specify whether the company will seek its own authorisation, act in a permitted agent or distributor role, or supply technical services to a regulated provider. Name the entity issuing e-money or accounts and contracting with customers. Avoid describing a partner-led model as your own EMI licence. A provider’s permission does not automatically cover every activity performed by your company.

An optional platform such as SAMFCore can supply software workflows; its licensing materials describe contractual technology options. Neither the software nor the vendor example in this guide is a regulated company acquisition or financial authorisation. Check deployment, modification, data export, support and third-party rights in the signed agreement.

The new-company route is credible when the team can build the surrounding operation: accountable management, compliance, finance, customer support, security and provider oversight. It is not automatically cheaper or quicker. For the separate legal object being purchased—shares, assets or software rights—read our existing acquisition-versus-licensing guide rather than treating a regulatory comparison as a vendor selection exercise.

5. Acquisition and change of control

A share acquisition generally leaves the legal entity in place, but the buyer changes its ownership and potentially its risk profile. An asset purchase is different: the seller’s authorisation cannot simply be assigned with a repository or customer list. Price operating continuity only after identifying the consents and conditions that preserve it.

For an EU EMI, EMD2 Article 3 addresses prior information and assessment of qualifying holdings, including specified increases, reductions and subsidiary changes. Do not treat a proposed acquisition as completed regulatory clearance. Verify the applicable national procedure, ownership chain, source-of-funds evidence and any management assessment. Put required clearance or non-opposition and critical contractual consents into the transaction conditions.

For a Swiss SRO member, obtain the actual SRO’s rules and a written response about the proposed owners, beneficial owners, directors, AML officer and business changes. Do not copy FINMA banking control rules onto an SRO member, or assume every SRO transaction needs only a post-closing notice. A particular seller’s handover description must be tested against the target’s actual affiliation and planned operating model.

Review past audits, unresolved findings, sanctions, complaints, tax records and customer liabilities. Separate corporate title transfer from commercial launch: deployment, revised customer terms, provider reviews and compliance readiness can remain outstanding after shares change hands. Warranties allocate risk but are no substitute for verified records. Our due-diligence guide provides a broader workstream to organise these checks.

6. Provider contracts, KYB and money-flow evidence

Build a dependency map for banks, EMIs, card issuers, payment processors, custody and liquidity providers, identity vendors and hosting. Record the contracting entity, customer countries, allowed activity, currencies, limits, termination rights and control-change clauses. ‘Integrated’ may mean code exists; it does not demonstrate a live commercial entitlement for your proposed business.

Ask each critical provider to confirm continuity in writing. Renewed know-your-business checks may examine owners, source of wealth or funds, directors, compliance staff, sanctions exposure, customer segments and transaction flows. Distinguish a contact, an application, an approved contract, a tested integration and a live service. Budget dependencies using written evidence, not the number of logos in a presentation.

For in-scope EU financial entities, DORA, Regulation (EU) 2022/2554, Articles 28 and 30, addresses ICT third-party risk and contractual provisions. Outsourcing does not remove the entity’s responsibility. Identify applicable audit access, incident cooperation, subcontracting, continuity and exit requirements. Applicability and additional requirements depend on the entity and function.

Trace sample payments through customer terms, ledger entries, provider records and reconciliations. Test failed transfers, reversals, disputed cards and provider suspension. Assess crypto activities separately: an EMI permission is not blanket permission for custody, exchange or every stablecoin arrangement. Get activity-specific legal advice instead of inferring rights from the word VASP or a multi-asset interface.

7. Capital and costs: compare funding needs without guesses

EMD2 Article 4 sets minimum initial capital of EUR 350,000 for full EMI authorisation; Article 5 imposes ongoing own-funds requirements that may be higher. This is a legal funding requirement, not an acquisition price or total budget. Small or exempt categories require separate examination and must not be marketed as full passportable EMIs.

Swiss corporate share capital is not identical to prudential capital, provider collateral or spendable operating cash. SRO affiliation alone does not establish that no activity-specific capital or permission requirement can arise. Identify the proposed activities before comparing funding. Keep required own funds, safeguarded customer funds, reserves and the working-capital runway on separate lines.

For all three routes, request dated written inputs for transaction advisers, implementation, software, hosting, security, staff, compliance, audits, providers and exit. For acquisitions, include identified remediation and retained expertise. For a new entity, include application or provider-onboarding work where relevant. A perpetual software licence does not eliminate maintenance, hosting or provider charges.

Use the same service scope and customer countries in each model. Show upfront expenditure, recurring operating costs, capital tied up and downside funding separately. Stress a provider refusal, delayed readiness, remediation and replacement of a key partner. This guide gives no guessed cost range, return percentage or guaranteed timetable; a smaller purchase price can conceal a larger unresolved operating obligation.

8. Buyer checklist: turn claims into closing evidence

• Service perimeter: Identify each activity, customer jurisdiction, issuer, contracting entity and holder of customer funds.
• Status: Obtain current SRO membership evidence or the national EMI register entry, permission conditions and any restrictions. Separate applications and exemptions from full authorisation.
• Control: Document the owners and beneficial owners, required notifications or assessment, management changes and written SRO or authority guidance.
• Customer money: Review segregation or safeguarding documents, daily reconciliation procedures, exceptions, redemption terms and insolvency analysis.
• Providers: Obtain signed agreements and control-change consents; verify KYB, permitted markets, production access and termination exposure.
• History and governance: Examine AML audits, incidents, complaints, liabilities, staffing and unresolved remediation, with accountable owners.
• Technology: Check IP or licence rights, security findings, ledger integrity, backup restoration, data portability and independent maintenance options.
• Funding: Separate purchase expenditure, regulatory or corporate capital, safeguarding, reserves and operating cash; use documented quotes.
• Readiness: Define launch acceptance tests, responsibility for remaining work, critical dependencies and the right to stop or renegotiate if evidence fails.

Use a findings register with a source document, owner and consequence for each open item. Classify gaps as closing conditions, launch conditions, priced remediation or reasons not to proceed. Do not leave an unsupported permission assumption as a task for the engineers after signing.

9. Match the route to your service

A Swiss SRO-affiliated non-bank may fit a documented intermediary model with appropriate provider arrangements. A fully authorised EU EMI may fit a plan requiring e-money issuance and properly notified cross-border services. Starting a new company may fit a provider-led or independently authorised model when the team can assemble the operation. None is an inherent winner.

For the offer on this website, review the fintech company for sale and request target-specific evidence; this general guide is not verification of that company. Continue with fintech due diligence, build versus buy and the 2026 acquisition-versus-licensing guide. The blog groups these separate buyer questions. Decide only once the permissions, contracts, money flows and funding fit the same operating plan.

Frequently asked questions