# Licensing Strategy

# Licensing Strategy

## Unified Platform Model

One PI (Payment Institution) licence covers three products under one regulatory umbrella.

```
AISP/PISP Licence
Finanstilsynet (Norwegian FSA)
Entity: ALAI Holding AS (org.nr 932 516 136)
    │
    ├── AISP scope
    │   ├── Tok Platform — Open Banking API (B2B)
    │   └── Bilko — automatic bank feed (AISP consumer)
    │
    └── PISP scope
        ├── Drop Balkan — payment initiation
        └── Bilko — pay-from-app (invoice payment)
```

**Key insight:** The PI licence already required for Drop Norway covers Tok and Bilko at zero marginal regulatory cost. Regulatory overhead shared across three revenue streams.

---

## Licence Types

| Type | Full Name | Scope | Capital Requirement |
|------|-----------|-------|---------------------|
| **AISP** | Account Information Service Provider | Read bank accounts and transactions | €0 (PII insurance only) |
| **PISP** | Payment Initiation Service Provider | Initiate payments on behalf of users | €50,000 (Serbia NBS) |

Tok Phase 1 requires AISP only. PISP follows in Phase 2 (Q3 2026+).

---

## Professional Indemnity Insurance (PII)

PII is mandatory for AISP registration — it replaces capital requirements.

**Legal basis:** PSD2 Article 5(3), EBA/GL/2017/08
**Minimum:** €50,000 annual aggregate (EBA floor for new entities without 12 months operating data)

### Two Policies Required

| Territory | Policy | Why | Estimated Annual Cost |
|-----------|--------|-----|-----------------------|
| Norway + Croatia (EEA) | Norwegian policy with explicit EEA scope | HNB accepts home-country PII for passported entities | €800 – €2,500 |
| Serbia | Separate Serbian policy from NBS-licensed insurer | Serbia is not EEA — no passporting for insurance | €2,000 – €8,000 |

**Critical:** The Norwegian/EEA policy does NOT cover Serbia. Two separate policies are required.

### Recommended Providers

**Norway/EEA:**
- **Howden Norway** (primary) — created the first PSD2 policy, Lloyd's backing
- **Nordic Guarantee** (alternative) — faster, PSD2 guarantee specialist
- **Superscript EU** / **Marsh Norway** (backup)

**Serbia:**
- **Dunav Osiguranje** — state-owned, largest in RS
- **DDOR Osiguranje** — Unipol group, has professional liability
- **Generali Srbija** — international

No Serbian insurer has a ready-made fintech PII product — policy will be bespoke.

---

## Countries Covered

| Country | Framework | Entity | Mechanism |
|---------|-----------|--------|-----------|
| 🇳🇴 Norway | Finanstilsynet AISP | ALAI Holding AS | Direct registration |
| 🇭🇷 Croatia | PSD2 / Berlin Group | — | EEA passporting from Norway |
| 🇷🇸 Serbia | NBS bilateral (PSD2-equivalent, Sl. glasnik RS 64/2024) | ALAI Tech d.o.o. | Direct NBS registration |
| 🇧🇦 BiH | No PSD2 mandate | — | Bilateral bank agreements |

---

## Veza sa Drop

Drop Norway (ZTL Payment Solution AS candidacy) requires a PI licence from Finanstilsynet. The AISP/PISP licence is the same instrument — Tok benefits from Drop's regulatory investment at no additional cost.

**Shared regulatory infrastructure:**
- Same Finanstilsynet application
- Same EEA passporting mechanism
- Same PII insurance (Norway/EEA policy)
- Same QWAC/QSEAL certificates (DigiCert or GlobalSign)

---

## Registration Timeline

| Phase | Country | Entity | Target | Capital |
|-------|---------|--------|--------|---------|
| 1 | Norway | ALAI Holding AS | Q2 2026 | €0 |
| 1b | Croatia | — (via passporting) | Q2–Q3 2026 | €0 |
| 2 | Serbia | ALAI Tech d.o.o. | Q3–Q4 2026 | €0 |
| 3 | BiH | — (bilateral) | Q1 2027 | €0 |
| 4 | Serbia PISP | ALAI Tech d.o.o. | Q2 2027+ | €50,000 |

---

## Key Regulatory Contacts

| Institution | Contact | Status |
|-------------|---------|--------|
| Finanstilsynet (NO) | fintech@finanstilsynet.no | Email sent 24.02.2026 ✓ |
| HNB (HR) | moneterra@hnb.hr | Pending |
| NBS (RS) | platni.sistem@nbs.rs | Pending |

---

## QWAC Certificates

Required for PSD2 mTLS (Croatia, and Serbia if Berlin Group adopted).

- **Provider:** DigiCert (via QuoVadis) or GlobalSign
- **Note:** Buypass AS discontinued PSD2 certificates from 01.10.2025 — do NOT use
- **Cost:** ~€200–800/year
- **Lead time:** 5–15 business days after receiving NCA authorisation number
- **Storage:** GCP Cloud KMS HSM (private key never leaves HSM)

Reference: [eIDAS Trusted List Dashboard](https://eidas.ec.europa.eu/efts/browser) for full list of qualified TSPs.