EMI for High-Risk Business in 2026: Lithuania, Malta, Cyprus

Yes, EU-licensed EMIs still onboard high-risk businesses in 2026. Fewer of them do it than three years ago, they ask for more on day one, and they exit faster when something doesn't match. The ones that do take high-risk files mostly hold licences in Lithuania, Malta or Cyprus and passport into the rest of the EEA. Whichever one you pick, your money depends on that firm's safeguarding, not on deposit insurance.

For a nutra, gaming, forex affiliate, adult, crypto-adjacent or subscription business, the realistic play is a specialist EMI that has your vertical on its accepted list, with a file that answers its questions before it asks them, and a second account somewhere else from the start.

This guide is for businesses choosing an EMI as a client. It covers where those EMIs are licensed and what each regulator is doing as of October 2026, what they ask high-risk applicants for, what safeguarding protects you from and what it doesn't, why accounts get closed, and the setup that holds up. If you're still deciding between an EMI and a bank in general, start with our EMI vs bank comparison.

If you're on the other side, a newly licensed EMI looking for the bank that will hold your customers' money, that's a different problem with a different shortlist. Our guide to safeguarding account providers for EMIs covers which banks offer them in the EU and UK, what a new licensee pays and has to prove, and why applications get refused.

Why Lithuania, Malta and Cyprus

An EMI licensed in any EU member state can passport its services across the EEA. So the question isn't where your customers are; it's which regulator supervises the firm holding your money, and how hard that regulator is pushing.

Lithuania: the biggest pool, and the busiest regulator

Lithuania built the largest EMI sector in the EU, and the Bank of Lithuania has spent the last few years cutting it back. At the end of 2024 there were 119 licensed EMIs and payment institutions (76 EMIs, 43 PIs), down from 125 a year earlier. The regulator revoked 9 licences in 2024, after 13 in 2023, most of those for AML and counter-terrorist financing failures. In 2024 the ten largest firms earned over 60% of the sector's licensed income; the small and mid-sized ones, almost half of all firms, handled about 0.5% of turnover.

Enforcement has kept its pace in 2026, and safeguarding is now in almost every decision:

• Paytend Europe lost its EMI licence with effect from 3 March 2026. The regulator cited monitoring that couldn't identify suspicious activity, unreported suspicious transactions, false information about a high-risk customer, and breaches of capital and safeguarding rules.
• Walletto was fined €290,000 in April for AML, governance and safeguarding breaches and for giving the regulator incomplete or inaccurate information.
• AlphaPay, a payment institution, had its licence suspended in April and its clients' accounts frozen after the regulator found their money hadn't been properly safeguarded. The licence was revoked in July, and the central bank said it would seek bankruptcy proceedings.
• Smaller fines with a safeguarding component followed in June and July at Nuvei's Lithuanian EMI (€90,000), TransferGo Lithuania (€42,000) and Nayax Europe (€90,000).

What that means for you: Lithuanian EMIs that take high-risk clients are under direct pressure to prove their monitoring and safeguarding work. They'll ask for more, review more often, and offboard quickly when a client's activity drifts from what was declared. The upside is that the survivors tend to have better controls than the ones that were shut.

Malta: smaller, with safeguarding in focus

Malta's MFSA licenses EMIs as "financial institutions". In its 2025 enforcement summary it reported 91 enforcement actions and penalties totalling €570,673, most of them for late or missing filings. It also flagged client fund problems at certain payment and e-money institutions, naming inadequate segregation, irregular reconciliations and weak governance, and cancelled one financial institution's licence partly over safeguarding breaches. In February 2025 it cancelled MTACC Ltd's licence, citing inadequate safeguarding of clients' funds, weak governance and a lack of cooperation, and ordered a winding-up application. The financial institution notices published between July and September 2026 were small settlements, under €2,200 each, for late audited accounts.

Maltese EMIs have historically served gaming, given Malta's gaming licensing industry, and some still do. Expect a full look at your gaming licence and the jurisdictions you take players from.

Cyprus: a regulator rebuilding its EMI supervision

The Central Bank of Cyprus supervised 26 EMIs and 11 payment institutions when it published a new strategy for the sector in December 2024, with a dedicated supervision directorate and a focus on licensing and risk-based supervision. On 3 August 2026 it changed the licensing process: applicants now go through a pre-application exploratory stage (€5,000, non-refundable) before a formal application (fee raised to €10,000), the bank can demand an enhanced due diligence report on the applicant, and files that go quiet are treated as withdrawn.

For you as a client, that means new Cypriot EMIs will arrive more slowly and with more vetting behind them. Cyprus has deep experience with forex/CFD brokers, and some Cypriot EMIs reflect that client base.

The regulator doesn't change the core question

The EBA's December 2025 follow-up peer review found authorisation practice converging but still uneven across member states, including in governance, internal controls and local substance. And from 1 January 2028 the new EU anti-money laundering authority, AMLA, will directly supervise 40 high-risk financial groups that operate in at least six member states; e-money and payment institutions are among the likely candidates, with selection running from July 2027.

For an operator, the licence country is a signal, not a guarantee. What matters more is whether the specific firm has your vertical in its risk appetite, how its safeguarding is set up, and how many partner banks it depends on.

What a high-risk EMI application looks like

Expect the onboarding to feel closer to an acquirer's underwriting than a fintech sign-up. The pack that gets approved without three rounds of questions usually includes:

Company and ownership

• Certificate of incorporation, articles, registers of directors and shareholders, certificate of good standing
• Org chart through to every individual with 25% or more, plus controllers
• Passports, proof of address and source-of-wealth documents for each UBO and director

The business itself

• A live website with real products, prices, terms, refund and cancellation policy, and a company name that matches the application
• Licences where your vertical needs them (gaming, forex/CFD, crypto), with the list of countries you serve
• A clear description of the business model and how customers pay

Money flows

• Expected monthly volume and transaction count, by currency
• Who pays into the account (PSPs, acquirers, customers, affiliates) and who you pay out to (suppliers, affiliates, payroll)
• A flow-of-funds diagram from customer to final payout
• Three to six months of statements from your current accounts and processing statements, if you have them

Compliance

• Your own AML/KYC policy if you're regulated, or your customer-vetting process if you're not
• Contracts with your main PSPs and top counterparties

The two questions every high-risk application gets, in one form or another: where does the money come from, and does the activity on the account match what you told us? A file that answers both clearly gets through. One that leaves gaps gets a questionnaire, then a call, then often a decline.

Safeguarding: what protects your balance at an EMI

Your balance at an EMI isn't a deposit, and EU deposit guarantee schemes don't cover it. The protection is safeguarding: the EMI must keep client funds separate from its own, either in a segregated account at a credit institution, invested in secure, liquid, low-risk assets, or covered by an insurance policy or bank guarantee. If the EMI fails, safeguarded funds are ring-fenced from its general creditors.

That's real protection against the EMI's creditors. It's not protection against:

• A shortfall in the safeguarded pool. Regulators keep finding firms that held client money in the wrong place. The Bank of Lithuania revoked PayrNet's licence in 2023 partly because client funds were held at another EMI instead of a dedicated account at a credit institution or central bank.
• Delay. When a licence is revoked, clients typically have to claim their funds back from the institution or its administrator. In Paytend's case the firm had five business days to tell clients how settlement would work, and funds go back only to an account the client names at another institution. At AlphaPay, clients lost access to their accounts in April, three months before the licence was revoked. Even when the money is all there, that's weeks to months without it.
• A partner bank exit. Most EMIs safeguard and settle through a small number of partner banks. If one exits the relationship, currencies or corridors can disappear overnight.

The rules are tightening. The agreed texts of the new Payment Services Directive (PSD3) and Regulation (PSR) were published in April 2026; publication in the Official Journal is expected around the end of 2026, with most provisions applying about 21 months later, so realistically in 2028. Under them, EMIs will have to safeguard funds by the end of the business day after receipt, should avoid holding all client funds at a single bank, and must use a bank authorised in an EU member state, which rules out UK banks for EU firms. The separate EMI licence disappears: existing EMIs become a category of payment institution and have 27 months to show the regulator they comply or face suspension. Expect some smaller EMIs to merge, sell or exit rather than go through it. Separately, under the Instant Payments Regulation, euro-area EMIs and payment institutions must be able to send and receive SEPA Instant payments by 9 April 2027.

Until then, ask any EMI you're considering:

1. Which method do you use to safeguard, and at which banks?
2. How often do you reconcile safeguarded funds?
3. Is my IBAN in my company's name, or a pooled account in yours?
4. Which partner banks handle each currency I need?
5. Has the regulator taken any action against you in the last three years, and what changed after it?

Since 9 October 2025, euro-area banks have had to check the payee name against the IBAN before a transfer and show the payer the result. If your IBAN is pooled or held in the EMI's name, your customers and PSPs may see a mismatch warning when they pay you. A named IBAN avoids that.

Why high-risk EMI accounts get closed

Account closures at EMIs are faster and blunter than at banks. The triggers we see most often:

1. The vertical drifts. You were approved as "digital marketing" and the account starts receiving settlements from a gaming PSP. Monitoring flags it, compliance asks, and if the answer isn't already in the file, the account closes.
2. Volume jumps without warning. Say you declared €200,000 a month and the account runs €1.5 million in month three: that's an alert, whatever the reason. Tell the EMI before the spike, not after.
3. Unexplained counterparties. Payments in from individuals in jurisdictions you didn't declare, or out to entities that aren't on your supplier list.
4. Partner-bank pressure. The EMI's own bank pushes back on a category, and the EMI exits a whole segment at once. This is the hardest to predict and the main reason to have a second account.
5. Unanswered RFIs. A request for information with a short deadline that sits in an unread inbox. Assign someone to answer compliance emails within 24 hours.
6. The EMI itself is in trouble. Restrictions on new clients, capital problems or regulator action can lead to offboarding of riskier segments first. After a fine for monitoring failures, expect a wave of periodic reviews.

If you're already dealing with a restriction, our guide on what to do when a business bank account is frozen covers the first steps, most of which apply to EMIs too.

EMI options by vertical, honestly

Appetite changes month to month, so treat this as a map of where to start, not a promise.

For subscription and nutra files, the EMI will often ask for your dispute ratios against the card schemes' monitoring programmes; our breakdown of VAMP and Mastercard chargeback thresholds shows the numbers they're comparing you to.

For crypto proceeds, the EMI wants to see a clean path from a licensed exchange or OTC desk to your account. We go through how that works in our crypto off-ramp guide. If part of your treasury sits in USDT, check how the EU's non-MiCA stablecoin deadline affects the exchanges feeding your EMI account.

The setup that holds up

1. Shortlist EMIs that list your vertical as accepted. Read the restricted and prohibited business lists before applying. Applying where you're on the prohibited list wastes weeks and leaves a decline on your record with a provider you might want later.
2. Describe the business exactly as it is. The vertical, the payment flows, the licences. Never relabel a high-risk activity to get through onboarding. It surfaces in transaction monitoring, and the account closes with funds held.
3. Build the pack before you apply. Everything in the checklist above, in one folder, with a one-page summary of the business and the flow of funds.
4. Open two EMIs at different licence holders, ideally in different countries and using different partner banks. Route real volume through both so the backup isn't dormant when you need it.
5. Keep balances lean. Sweep surplus funds to a bank account or a second provider on a fixed schedule. An EMI is an operating account, not a treasury. AlphaPay's clients found that out with their balances frozen for months.
6. Pre-clear changes. New product line, new PSP, new markets, a volume jump: tell the EMI first and get it in writing.
7. Watch your provider. Check the regulator's enforcement page for your EMI a few times a year; the Bank of Lithuania and the MFSA both publish theirs. When a provider you use gets fined, expect a periodic review soon after, and have your file current before it lands.

Where card processing is part of the picture, the EMI account usually sits behind your acquiring setup as the settlement account. How those pieces fit together is covered in our guide to high-risk merchant accounts and multi-MID routing. If you want an EMI and bank stack built and introduced for your specific vertical, that's what our offshore and corporate banking team does.