Italy (IT)

Licensing, Authorisation & Market Access

Banca d'Italia supervises Italy's dual bank-PSP and non-bank payment-institution licensing regime under the TUB and D.Lgs. 11/2010, with capital requirements tiered by service scope: EUR125,000 for full-scope payment institutions offering services 1-5 under Art.1(2)(h-septies.1) TUB, EUR20,000 for money-remittance-only payment institutions, and EUR50,000 for payment-initiation-service providers. These thresholds set the capital-entry cost for any operator seeking an Italian PI or e-money institution licence and directly shape market-access economics for new entrants and PIS-only fintechs.

From 2 March 2026, a new MiCAR/PSD2 dual-authorisation regime requires crypto-asset service providers offering e-money-token transfer or custody services that qualify as payment services to hold both a MiCAR CASP authorisation and a PSD2 payment/e-money institution authorisation, or to partner with an already-authorised payment service provider, with cumulative capital requirements applying across both regimes. The requirement materially raises the compliance and capital bar for crypto-native firms wanting to offer payment-like e-money-token services in Italy, favouring bank-partnership or dual-licence structuring over stand-alone crypto entry.

Outlook

With the capital-threshold architecture and the new crypto dual-authorisation regime both now in force, the near-term licensing question for Italy is less about further rule-making and more about how quickly crypto-native applicants absorb the cumulative capital burden, and whether bank-partnership models displace independent CASP-only entry into payment-like e-money-token services.

Conduct, Safeguarding & Financial Promotions

Hybrid-commercial payment and e-money institutions that combine payment services with other, non-payment business lines must constitute a single ring-fenced asset pool -- the patrimonio destinato under Art.114-terdecies TUB -- dedicated exclusively to payment services and e-money issuance. The regime governs customer-fund protection design for any non-bank PI or IMEL diversifying beyond pure payment services, a recurring structuring question for fintech and telco hybrids operating in the Italian market.

Outlook

The ring-fencing regime is a single-T1-anchor finding this cycle and remains a standing structural feature of Italian conduct regulation rather than a live rule-change; watch for a second corroborating anchor before the confidence rating is upgraded, and for any read-across from the D.Lgs. 208/2025 enforcement reform into safeguarding-breach penalties.

Stablecoins & Digital Money

Italy's national transitional regime for pre-existing virtual-asset service providers under MiCA closed on 30 June 2026, having been extended from an original 30 December 2025 deadline via the Omnibus Decree 95/2025; eight firms held full CASP authorisation as of 1 July 2026, formally closing the transitional-entry window and crystallising the competitive set of regulated Italian crypto-asset service providers. Separately, Banca Sella completed its MiCA Article 60 credit-institution notification to Banca d'Italia on 27 May 2026, becoming Italy's first bank cleared for crypto custody and transfer services, a lighter-touch notification pathway distinct from the full CASP licence pure-play crypto firms require.

Outlook

With the transitional regime now closed, expect the competitive field to consolidate around the eight authorised CASPs and an expanding cohort of bank-notification entrants following Banca Sella's lead; the closed transitional window forecloses further transitional-regime entry, making full CASP authorisation or bank-partnership the only remaining routes to market.

Operational Resilience & Critical Infrastructure

Banca d'Italia's 3 February 2026 update to its Disposizioni di vigilanza per gli IP e IMEL transposes DORA, its delegated acts, and Directive (EU) 2022/2556, and bans outsourcing of operational functions or critical components tied to payment services and e-money issuance. The critical-outsourcing ban forces payment and e-money institutions relying on group or third-party technology or banking-as-a-service providers to re-architect vendor arrangements ahead of DORA supervisory review.

Outlook

Expect Banca d'Italia's DORA supervisory review to test the practical boundaries of the critical-outsourcing ban over the coming cycles, particularly for institutions built on group-provided or white-label technology stacks that may now fall within the banned category of critical components.

Scheme & Network Compliance

Italy's own submission to the OECD competition committee shows the merged Nexi/SIA processing entity holding roughly 70-75% of Italian card-processing share and 90-95% of non-SEPA clearing share, following the 2021 Nexi/SIA merger; the AGCM has flagged an exclusivity arrangement between Nexi and equensWorldline as a live competition-policy concern. The near-monopoly processing and clearing concentration is a standing scheme-access risk factor for competing acquirers.

Outlook

Watch the AGCM's handling of the flagged Nexi/equensWorldline exclusivity arrangement for signs of a formal competition inquiry, which would be the first material test of Italy's post-merger processing concentration since the 2021 Nexi/SIA combination.

Payment Corridor Dynamics

Banca d'Italia is the sole developer and operator of TIPS, the TARGET Instant Payment Settlement service, on the Eurosystem's behalf as one of the four providing central banks; payment service providers reachable for SCT Inst within T2 must also be reachable in TIPS. This structural infrastructure role and the associated reachability obligations shape instant-payment corridor design for all Italian payment service providers.

Outlook

TIPS reachability mandates remain a stable, mandated feature of Italy's instant-payment architecture; no material change to Banca d'Italia's 4CB role or the SCT Inst/TIPS reachability linkage was identified this cycle.

Industry Structure & Commercial Dynamics

CVC Capital Partners is reported to be nearing agreement with Nexi Group shareholders on a take-private transaction, reportedly conditional on first spinning out Nexi's politically sensitive digital-banking/interbank-network unit. A successful take-private would be the single largest market-structure event in Italian payments this cycle, reshaping scheme and processing ownership and raising the possibility of a separate re-listing of the interbank-network unit.

Separately, Poste Italiane finalised acquisition of a 49% stake in PagoPA in late 2025 for a disclosed EUR400m upfront plus EUR100m contingent on performance, with state entity IPZS retaining the remaining 51%. The state-linked consolidation of public-sector payments infrastructure, which processed EUR97bn in 2025, under a commercial postal operator is a significant market-structure shift with implications for competitive neutrality.

Outlook

Watch for confirmation or collapse of the reported CVC take-private structure and execution of the required digital-banking-unit spin-out; the Poste/PagoPA integration will be a useful marker of how state-linked consolidation interacts with competitive-neutrality expectations for public-sector payments infrastructure.

Legal & Litigation

D.Lgs. 208/2025 introduces periodic penalty payments -- penalita di mora, under new Art.144-ter.1 TUB -- leviable daily, weekly or monthly until non-compliance ceases, alongside classic pecuniary sanctions. The reform materially raises enforcement exposure for payment and e-money institutions with unresolved supervisory findings, changing the cost calculus of prolonged non-compliance.

Separately, Banca d'Italia has clarified that most buy-now-pay-later agreements qualify as regulated consumer-credit financing under national banking law when the lender is not the merchant, ahead of the EU Consumer Credit Directive II entering into force from November 2026. The reclassification pulls independent BNPL providers into licensing, AML and disclosure regimes, favouring bank-backed BNPL models as CCD II compliance thresholds tighten.

Outlook

Watch for the first periodic-penalty-payment enforcement actions under D.Lgs. 208/2025 and for how independent BNPL providers adapt their licensing posture ahead of the November 2026 Consumer Credit Directive II deadline.

Merchant Acquiring & Risk

On Nexi's XPay e-commerce gateway, PCI DSS compliance burden scales by integration model: a hosted payment page requires no merchant certification, an SAQ-A-compliant iFrame integration carries a lighter self-assessment burden, and a full server-to-server integration requires SAQ-D certification. The choice of integration model directly determines PCI DSS compliance cost and audit burden for Italian e-commerce merchants on the country's leading payment gateway.

Outlook

This is a dated, vendor-documentation-sourced finding rather than a live rule change; no regulatory shift to Italy's merchant-acquiring PCI DSS framework was identified this cycle.

Product Innovation & Market Development

The ECB's digital euro pilot preparation phase opened its call for expression of interest on 5 March 2026, with payment service provider applications due 14 May 2026, selection notified end-June 2026, a development phase beginning Q3 2026, and a 12-month pilot exercise planned for H2 2027. The timeline determines the near-term participation window for Italian payment service providers in Eurosystem digital-euro infrastructure build-out, a strategically material product-development decision point.

Outlook

The end-June 2026 selection notification and the Q3 2026 development-phase start are the immediate markers to watch; the planned H2 2027 twelve-month pilot exercise is the next major milestone for Italian PSP participation in digital-euro infrastructure.

Consumer Protection & APP Fraud

Consumer liability for unauthorised payments under the PSD2-derived regime is capped at EUR50, but no automatic reimbursement scheme exists for authorised push-payment fraud in Italy; recovery instead depends on bank goodwill, fund recall, Arbitro Bancario Finanziario escalation, or criminal reporting. The absence of a mandatory APP-fraud reimbursement scheme, unlike the UK's PSR-style model, is a structural consumer-protection gap relevant to future PSD3 debate.

Outlook

This remains an under-indexed area: recovery-rate data for Italian APP-fraud victims was not surfaced this cycle, and the comparative gap with UK-style mandatory reimbursement is worth deeper sourcing of Polizia Postale recovery statistics next cycle.

AML/CFT & Financial Crime

This module is sourced from the Sentinel.gi feed. Italy's April 2026 FATF Mutual Evaluation Report found a mature whole-of-government AML/CFT framework with strong inter-agency coordination, but identified persistent beneficial-ownership transparency gaps and insufficiently dissuasive sanctions for non-disclosure; Italy was placed under regular follow-up with a three-year reform window. The beneficial-ownership transparency gap is a live supervisory-cooperation friction point for cross-border PSP onboarding and KYC in Italy; original illicit-finance analysis of this finding belongs to the Financial Intelligence Monitor, not this monitor.

Outlook

Track Italy's progress against the three-year FATF follow-up window via the Sentinel.gi feed and the Financial Intelligence Monitor rather than through original analysis in this brief.

Correspondent Banking, Settlement & Access

Italy's correspondent-banking access structure has historically run on a bank-versus-non-bank asymmetry: as of 6 October 2025, following amendment of the Settlement Finality Directive under ECB Guideline ECB/2025/28, Italian e-money and payment institutions gained the right to direct T2 participation, subject to operational parity with credit institutions, account-balance caps, and exclusion from Eurosystem credit; central-bank accounts may not be used for client-fund safeguarding. Direct TARGET access is a structural correspondent-banking upgrade for non-bank payment service providers, reducing settlement-bank dependency, though the safeguarding-account refusal preserves a residual client-fund protection gap.

Outlook

The bank-versus-non-bank access asymmetry persists in modified form: non-banks now reach TARGET directly but remain excluded from central-bank safeguarding, an unresolved structural gap worth tracking as non-bank PSP TARGET participation grows.

Commercial Intelligence (M&A, Investment & Product)

CVC Capital Partners is reported nearing agreement with Nexi Group shareholders on a take-private transaction, reportedly requiring prior spin-out of Nexi's digital-banking/interbank-network unit; the deal value has not been publicly disclosed. Poste Italiane finalised acquisition of a 49% stake in PagoPA in late 2025 for EUR400m upfront plus EUR100m contingent on performance. Bancomat announced an agreement in early 2025 to acquire a controlling stake in open-banking fintech FlowPay; the amount was not publicly disclosed. Banca Sella completed its MiCA Article 60 notification on 27 May 2026, launching a regulated crypto custody and transfer service targeting corporate and institutional clients before end-2026. Conio, backed by Poste Investimenti and Banca Generali, received MiCAR CASP authorisation from CONSOB and Banca d'Italia ahead of the 30 June 2026 transition deadline, covering custody, transfer and placement services.

Outlook

Watch for confirmation of the CVC/Nexi take-private structure and execution of the required spin-out, alongside further MiCAR CASP product launches as firms complete the post-transitional-regime shakeout.