Ferrer-Bonsoms · 14 October 2026
The question always arrives late. The app works, users top up, the product grows, and then somebody — an investor, a bank, a corporate client — asks whether this requires a licence.
By that stage it is no longer a legal query: it is architecture. And rebuilding the architecture of a live product costs ten times what thinking about it beforehand would have.
Here is the check worth running on day one.
The four elements
Spain’s Law 21/2011 on electronic money defines it through four features which must all be present at the same time:
First, monetary value stored by electronic or magnetic means. A balance in a database is exactly that.
Second, representing a claim on the issuer. That is, the user can demand something from you in respect of that balance.
Third, issued on receipt of funds for the purpose of making payment transactions. If the balance is given away, there are no funds received. If it is bought, there are.
And fourth, accepted by a person other than the issuer.
That fourth feature is the hinge of the whole analysis, and it is where almost every project believes itself safe without being so.
What usually is not electronic money
A balance the user can only spend with you, on your own goods or services, fails the fourth element. It is a prepayment, not electronic money.
Loyalty points earned through spending rather than purchased fail the third: no funds were received in exchange.
A voucher or gift card redeemable only at your own premises, likewise.
So far, so reassuring. Now the three things that break it.
If the user can spend the balance outside your company, with unrelated merchants or suppliers, the fourth element is satisfied.
If the user can convert it back into money — refund, withdrawal to an account — you are returning funds you received.
And if the user can transfer it to another user, that is a payment transaction, however entirely it occurs inside your app.
Any one of the three is enough.
The limited network exclusion, and the change most people have missed
An exclusion exists, and it is what saves many legitimate businesses. Article 4 of Royal Decree-Law 19/2018 on payment services excludes from the regime instruments that allow the acquisition of goods or services only on the issuer’s premises, or within a limited network of providers linked by direct commercial agreement with a professional issuer, or else a very limited range of goods or services.
It is the basis of shopping-centre cards, meal vouchers and closed systems within a campus or a chain.
But three things are worth knowing about it.
First, it is not a permanent harbour. It is assessed by actual use rather than by what the contract says, and the European Banking Authority has read it narrowly in its guidelines on the subject, which the Banco de España has adopted. A network that grows stops being limited even though nobody changed anything.
Second, it carries a notification duty. Above the threshold, the Banco de España must be notified, and will assess whether the activity genuinely falls within the exclusion.
And third, the part almost nobody has updated. The threshold changed. Until 2023 it was calculated on an average monthly value above one million euros across the previous calendar year, with notification in the first quarter. Law 11/2023 amended Article 6.1 of Royal Decree-Law 19/2018 to align it with the European directive and the EBA guidelines, and since 10 May 2023 the test is different: notification is required where, in the preceding twelve months, payment transactions have been executed with a total value exceeding one million euros.
No averaging, and no waiting for the first quarter. In practice the bar dropped considerably, and many companies are still calculating under the old rule.
And if I put it on a blockchain?
That is the next question, and the answer surprises those who ask it expecting the opposite.
Where the balance is represented by a token referencing a single official currency and purporting to maintain a stable value against it, we are dealing with an e-money token within the meaning of the MiCA Regulation. And its Article 48 is categorical: no person may offer an e-money token to the public, or seek its admission to trading, unless that person is the issuer and is authorised as a credit institution or an electronic money institution. A white paper must also be drawn up, notified to the competent authority and published, with at least forty working days’ prior notice.
Put another way: tokenising does not release you, it stacks. The electronic money regime remains and the MiCA regime is added on top.
The three questions that reveal the problem
If you want the thirty-second version, it is these:
-
Can the user spend the balance outside your company?
-
Can the user convert it back into money?
-
Can the user transfer it to another user?
A single yes and it is worth sitting down with it properly before building any further.
What happens if you get it wrong
The institutional answer is the predictable one: issuing electronic money or providing payment services without authorisation infringes the supervisory regime, with the corresponding penalties, and compromises the validity of what has been agreed with users.
But in our experience the blow does not land there first. It lands through the bank. Your payment service provider or account-holding institution has compliance obligations of its own, and the moment it detects that you are moving third-party funds without being authorised to do so, it closes. With no useful notice, no negotiation, and your users’ money inside.
That is the practical reason to resolve this early: not the fine, but losing your payment rail on a Tuesday morning.
At Ferrer-Bonsoms we assess whether a product requires an electronic money or payment services licence, whether it fits the limited network exclusion, and what would have to change for it to fit. If you are designing a product with a balance, or already running one, get in touch and we will review it.