Licensing Strategy

Licensing Strategy 
 Unified Platform Model 
 One PI (Payment Institution) licence covers three products under one regulatory umbrella. 
 AISP/PISP Licence
Finanstilsynet (Norwegian FSA)
Entity: ALAI Holding AS (org.nr 932 516 136)
 │
 ├── AISP scope
 │ ├── Tok Platform — Open Banking API (B2B)
 │ └── Bilko — automatic bank feed (AISP consumer)
 │
 └── PISP scope
 ├── Drop Balkan — payment initiation
 └── Bilko — pay-from-app (invoice payment)
 
 Key insight: The PI licence already required for Drop Norway covers Tok and Bilko at zero marginal regulatory cost. Regulatory overhead shared across three revenue streams. 
 
 Licence Types 
 
 
 
 Type 
 Full Name 
 Scope 
 Capital Requirement 
 
 
 
 
 AISP 
 Account Information Service Provider 
 Read bank accounts and transactions 
 €0 (PII insurance only) 
 
 
 PISP 
 Payment Initiation Service Provider 
 Initiate payments on behalf of users 
 €50,000 (Serbia NBS) 
 
 
 
 Tok Phase 1 requires AISP only. PISP follows in Phase 2 (Q3 2026+). 
 
 Professional Indemnity Insurance (PII) 
 PII is mandatory for AISP registration — it replaces capital requirements. 
 Legal basis: PSD2 Article 5(3), EBA/GL/2017/08
 Minimum: €50,000 annual aggregate (EBA floor for new entities without 12 months operating data) 
 Two Policies Required 
 
 
 
 Territory 
 Policy 
 Why 
 Estimated Annual Cost 
 
 
 
 
 Norway + Croatia (EEA) 
 Norwegian policy with explicit EEA scope 
 HNB accepts home-country PII for passported entities 
 €800 – €2,500 
 
 
 Serbia 
 Separate Serbian policy from NBS-licensed insurer 
 Serbia is not EEA — no passporting for insurance 
 €2,000 – €8,000 
 
 
 
 Critical: The Norwegian/EEA policy does NOT cover Serbia. Two separate policies are required. 
 Recommended Providers 
 Norway/EEA: 
 
 Howden Norway (primary) — created the first PSD2 policy, Lloyd's backing 
 Nordic Guarantee (alternative) — faster, PSD2 guarantee specialist 
 Superscript EU / Marsh Norway (backup) 
 
 Serbia: 
 
 Dunav Osiguranje — state-owned, largest in RS 
 DDOR Osiguranje — Unipol group, has professional liability 
 Generali Srbija — international 
 
 No Serbian insurer has a ready-made fintech PII product — policy will be bespoke. 
 
 Countries Covered 
 
 
 
 Country 
 Framework 
 Entity 
 Mechanism 
 
 
 
 
 🇳🇴 Norway 
 Finanstilsynet AISP 
 ALAI Holding AS 
 Direct registration 
 
 
 🇭🇷 Croatia 
 PSD2 / Berlin Group 
 — 
 EEA passporting from Norway 
 
 
 🇷🇸 Serbia 
 NBS bilateral (PSD2-equivalent, Sl. glasnik RS 64/2024) 
 ALAI Tech d.o.o. 
 Direct NBS registration 
 
 
 🇧🇦 BiH 
 No PSD2 mandate 
 — 
 Bilateral bank agreements 
 
 
 
 
 Veza sa Drop 
 Drop Norway (ZTL Payment Solution AS candidacy) requires a PI licence from Finanstilsynet. The AISP/PISP licence is the same instrument — Tok benefits from Drop's regulatory investment at no additional cost. 
 Shared regulatory infrastructure: 
 
 Same Finanstilsynet application 
 Same EEA passporting mechanism 
 Same PII insurance (Norway/EEA policy) 
 Same QWAC/QSEAL certificates (DigiCert or GlobalSign) 
 
 
 Registration Timeline 
 
 
 
 Phase 
 Country 
 Entity 
 Target 
 Capital 
 
 
 
 
 1 
 Norway 
 ALAI Holding AS 
 Q2 2026 
 €0 
 
 
 1b 
 Croatia 
 — (via passporting) 
 Q2–Q3 2026 
 €0 
 
 
 2 
 Serbia 
 ALAI Tech d.o.o. 
 Q3–Q4 2026 
 €0 
 
 
 3 
 BiH 
 — (bilateral) 
 Q1 2027 
 €0 
 
 
 4 
 Serbia PISP 
 ALAI Tech d.o.o. 
 Q2 2027+ 
 €50,000 
 
 
 
 
 Key Regulatory Contacts 
 
 
 
 Institution 
 Contact 
 Status 
 
 
 
 
 Finanstilsynet (NO) 
 fintech@finanstilsynet.no 
 Email sent 24.02.2026 ✓ 
 
 
 HNB (HR) 
 moneterra@hnb.hr 
 Pending 
 
 
 NBS (RS) 
 platni.sistem@nbs.rs 
 Pending 
 
 
 
 
 QWAC Certificates 
 Required for PSD2 mTLS (Croatia, and Serbia if Berlin Group adopted). 
 
 Provider: DigiCert (via QuoVadis) or GlobalSign 
 Note: Buypass AS discontinued PSD2 certificates from 01.10.2025 — do NOT use 
 Cost: ~€200–800/year 
 Lead time: 5–15 business days after receiving NCA authorisation number 
 Storage: GCP Cloud KMS HSM (private key never leaves HSM) 
 
 Reference: eIDAS Trusted List Dashboard for full list of qualified TSPs.