Advice for every part of how money moves.

From 10 July 2027 the AML Regulation (EU) 2024/1624 applies directly in every EU member state. If you are an EMI, payment institution, PSP, crypto-asset service provider or another obliged entity, your AML/CFT framework has to meet one EU rulebook instead of national rules. In practice that means appointing a compliance manager on the management body as well as a compliance officer, updating your business-wide risk assessment to cover targeted financial sanctions, refreshing customer files at least every year for higher-risk customers and every five years for others, applying the 25%-or-more beneficial ownership test alongside control by other means, and checking that you are not outsourcing decisions the regulation reserves to you. Buxten runs AMLR gap analyses and updates policies, procedures, risk assessments and customer files so you are ready before the deadline.

AMLR applies from 10 July 2027. The new EU Anti-Money Laundering Authority (AMLA) will directly supervise around 40 of the highest-risk groups operating in at least six member states from 2028, chosen through a selection process that starts in July 2027. Most payment and e-money firms will stay with their national supervisor, such as the Bulgarian National Bank, but that supervisor will apply the same AMLR rules and AMLA standards. Maximum fines for serious breaches rise to €10 million or 10% of annual turnover.

A payments consultant helps businesses that accept, move or process money choose the right payment model, partners and controls. At Buxten that covers payment strategy, acquirer and banking partners, PayFac and merchant-of-record structures, fraud and chargebacks, AML compliance, licensing and payments technology.

You need an EMI licence if you will issue e-money, for example stored-value wallets or prepaid cards that hold customer balances. If you only execute payments, acquire card transactions or transfer money without holding stored value, a payment institution licence is usually enough. Some models fit a small payment institution or an agent arrangement under someone else's licence. We map your product and flow of funds to the right option before you spend money on an application.

The EU minimum initial capital is €350,000 for an EMI and between €20,000 and €125,000 for a payment institution, depending on the services. Once a complete application is filed, approval typically takes three to six months in Bulgaria or Lithuania and longer in Ireland or the UK. The biggest cause of delay is an incomplete or generic application, so most of our work goes into getting the file right the first time.

There is no single best country. The right choice depends on your target markets, timeline, budget, where your team will be based, banking and safeguarding options, and how each regulator views your business model. With an EU licence you can passport your services to other EEA countries. We compare the realistic options for your case, including Bulgaria, Lithuania, Ireland and the Netherlands.

Yes. We write and review AML/CTF policies and procedures, carry out business-wide risk assessments, design CDD and EDD processes, run independent AML audits, prepare firms for AMLR, and provide ongoing compliance support to your team and MLRO.

Acquirers and PSPs hold reserves or pause payouts when they see risk: a high chargeback or fraud rate, a sudden jump in volume, a high-risk business category, or incomplete onboarding information. We help merchants prepare a strong underwriting file, bring chargebacks under card scheme thresholds and talk to providers about releasing or reducing reserves.

Buxten is based in Sofia, Bulgaria. We work with clients across the EU and EEA, the UK and the US.

Email info@buxten.com with a short description of your business and what you need. We reply and suggest a scope, either a defined project or ongoing support.