Skip to main content

Licensing Strategy

Licensing Strategy

Unified Platform Model

One PI (Payment Institution) licence covers three products under one regulatory umbrella.

AISP/PISP Licence
Finanstilsynet (Norwegian FSA)
Entity: ALAI Holding AS (org.nr 932 516 136)
    │
    ├── AISP scope
    │   ├── Tok Platform — Open Banking API (B2B)
    │   └── Bilko — automatic bank feed (AISP consumer)
    │
    └── PISP scope
        ├── Drop Balkan — payment initiation
        └── Bilko — pay-from-app (invoice payment)

Key insight: The PI licence already required for Drop Norway covers Tok and Bilko at zero marginal regulatory cost. Regulatory overhead shared across three revenue streams.

Licence Types

Type Full Name Scope Capital Requirement
AISP Account Information Service Provider Read bank accounts and transactions €0 (PII insurance only)
PISP Payment Initiation Service Provider Initiate payments on behalf of users €50,000 (Serbia NBS)

Tok Phase 1 requires AISP only. PISP follows in Phase 2 (Q3 2026+).

Professional Indemnity Insurance (PII)

PII is mandatory for AISP registration — it replaces capital requirements.

Two Policies Required

Territory Policy Why Estimated Annual Cost
Norway + Croatia (EEA) Norwegian policy with explicit EEA scope HNB accepts home-country PII for passported entities €800 – €2,500
Serbia Separate Serbian policy from NBS-licensed insurer Serbia is not EEA — no passporting for insurance €2,000 – €8,000

Critical: The Norwegian/EEA policy does NOT cover Serbia. Two separate policies are required.

Norway/EEA:

  • Howden Norway (primary) — created the first PSD2 policy, Lloyd's backing
  • Nordic Guarantee (alternative) — faster, PSD2 guarantee specialist
  • Superscript EU / Marsh Norway (backup)

Serbia:

  • Dunav Osiguranje — state-owned, largest in RS
  • DDOR Osiguranje — Unipol group, has professional liability
  • Generali Srbija — international

No Serbian insurer has a ready-made fintech PII product — policy will be bespoke.

Countries Covered

Country Framework Entity Mechanism
🇳🇴 Norway Finanstilsynet AISP ALAI Holding AS Direct registration
🇭🇷 Croatia PSD2 / Berlin Group — EEA passporting from Norway
🇷🇸 Serbia NBS bilateral (PSD2-equivalent, Sl. glasnik RS 64/2024) ALAI Tech d.o.o. Direct NBS registration
🇧🇦 BiH No PSD2 mandate — Bilateral bank agreements

Veza sa Drop

Drop Norway (ZTL Payment Solution AS candidacy) requires a PI licence from Finanstilsynet. The AISP/PISP licence is the same instrument — Tok benefits from Drop's regulatory investment at no additional cost.

Shared regulatory infrastructure:

  • Same Finanstilsynet application
  • Same EEA passporting mechanism
  • Same PII insurance (Norway/EEA policy)
  • Same QWAC/QSEAL certificates (DigiCert or GlobalSign)

Registration Timeline

Phase Country Entity Target Capital
1 Norway ALAI Holding AS Q2 2026 €0
1b Croatia — (via passporting) Q2–Q3 2026 €0
2 Serbia ALAI Tech d.o.o. Q3–Q4 2026 €0
3 BiH — (bilateral) Q1 2027 €0
4 Serbia PISP ALAI Tech d.o.o. Q2 2027+ €50,000

Key Regulatory Contacts

Institution Contact Status
Finanstilsynet (NO) [email protected] Email sent 24.02.2026 ✓
HNB (HR) [email protected] Pending
NBS (RS) [email protected] Pending

QWAC Certificates

Required for PSD2 mTLS (Croatia, and Serbia if Berlin Group adopted).

  • Provider: DigiCert (via QuoVadis) or GlobalSign
  • Note: Buypass AS discontinued PSD2 certificates from 01.10.2025 — do NOT use
  • Cost: ~€200–800/year
  • Lead time: 5–15 business days after receiving NCA authorisation number
  • Storage: GCP Cloud KMS HSM (private key never leaves HSM)

Reference: eIDAS Trusted List Dashboard for full list of qualified TSPs.

No comments to display

Back to top