Buy a Payment Company vs BaaS vs Starting a Payment Business (2026)

1. Acquiring a Swiss SRO-supervised payment intermediary

Under the Swiss Anti-Money Laundering Act (AMLA), financial intermediaries outside the banking sector — for example businesses providing payment-transaction services or certain crypto services — must meet AML due-diligence duties. Those not otherwise supervised by FINMA must join a self-regulatory organisation recognised and supervised by FINMA. FINMA describes SROs as the bodies that monitor their members' compliance with AML duties (FINMA: SROs).

Buying such a company is a share deal: you acquire the legal entity, its SRO membership, its existing governance and any contracts that survive the change of control. That is different from licensing software. A software licence gives you technology; it does not give you a legal entity, an AML framework or a regulatory status.

2. Partnering with a regulated PI, EMI or bank (BaaS)

In a BaaS model, a licensed institution provides accounts, payment execution, card issuing or e-money under its own authorisation, and you build the customer-facing product on top. In the EEA, payment institutions are authorised under PSD2 (Directive (EU) 2015/2366) and e-money institutions under EMD2 (Directive 2009/110/EC). Your partner remains the regulated party and keeps final say on onboarding, risk appetite and termination.

3. Founding a new PSP

You incorporate, build governance and an AML/compliance function, apply for the authorisation your model needs — SRO affiliation in Switzerland, PI or EMI authorisation in an EEA member state, or a FINMA banking or fintech licence for deposit-taking — and then onboard banking and scheme partners. You own everything, and you carry every step.

The most common misunderstanding in this market is treating different statuses as equivalent. They are not.

• Swiss SRO affiliation is AML supervision. It does not authorise accepting public deposits; in Switzerland that generally requires a banking licence or the fintech licence described by FINMA (banks, fintech licence). Swiss banking law contains specific exceptions — such as for certain settlement accounts — whose conditions must be verified by counsel for your exact flow of funds.
• EEA payment institution authorisation under PSD2 covers the payment services listed in Annex I of the Directive, with initial capital tiers set out in Article 7 and safeguarding duties in Article 10. Authorised institutions can passport across the EEA under the Directive's notification procedure.
• EEA e-money institution authorisation under EMD2 additionally permits issuing electronic money, with an initial capital requirement set in the Directive and its own safeguarding rules.
• Crypto-asset services in the EU fall under MiCA (Regulation (EU) 2023/1114), which has its own authorisation for crypto-asset service providers. A Swiss approval of a VASP business model under AML rules is not a MiCA authorisation.

You can check whether an EEA firm is authorised on the EBA register of payment and e-money institutions; the EBA's payment services and e-money hub collects its guidelines and technical standards. Swiss SRO status, by contrast, is generally verified with the relevant SRO itself.

Practical consequence: Swiss SRO status does not passport into the EU, and it does not automatically permit regulated custody, exchange or deposit-like services in every jurisdiction. If your customers are in the EEA, you will likely need either an EEA-authorised partner or your own EEA authorisation for in-scope activities.

Access to accounts and payment rails is usually the real bottleneck, not technology. An existing company with onboarded bank or EMI relationships can save negotiation effort, but those relationships are not assets you simply inherit: most providers reserve rights to review, re-onboard or exit on a change of ownership.

In the EU, access is slowly widening. The Instant Payments Regulation (EU) 2024/886 amended the settlement-finality framework so that payment institutions and e-money institutions can participate in designated payment systems, subject to conditions. That benefits EEA-authorised firms; it does not extend to a Swiss SRO-affiliated intermediary.

A BaaS partner gives you rail access on day one of the contract, but on its terms. A new PSP has to win banking relationships while still unproven, which many founders find the hardest step.

Whatever route you choose, AML is not outsourced away. In an acquisition you inherit a framework — policies, risk assessment, an AML officer, audit history — and must keep it effective under new ownership. Ask for the most recent SRO audit reports and any findings. In a BaaS arrangement your partner's policies apply and it will audit you. In a new PSP, regulators will expect complete documentation before authorisation.

Customer-fund treatment deserves its own legal analysis. EEA PIs and EMIs must safeguard funds under PSD2 Article 10 and the equivalent EMD2 provisions. In Switzerland, holding customer money can bring you close to the deposit-taking rules; the structure — which provider holds funds, for how long, and in whose name — determines whether a banking or fintech licence would be required. Do not assume an SRO membership answers that question.

Three separate approvals or notifications can apply when you buy a payment company:

• Regulator or SRO. EEA PIs and EMIs are subject to qualifying-holding rules, so buying one generally requires prior assessment by the competent authority. For a Swiss SRO member, the SRO's regulations govern what must be notified and when, typically including fit-and-proper information on new owners and managers.
• Providers. Banks, EMIs, card programme managers and KYC vendors run their own reviews.
• Counterparties and staff. Office leases, outsourced officers and key individuals may need new agreements.

For the company listed on this site, the seller states that ownership transfers on completion of the transaction documents, that no regulatory approval is required for the ownership change, and that the SRO is notified after completion. Treat this as a seller statement to confirm during diligence.

Published "average costs" for launching a PSP vary so widely that they are rarely useful. Instead of inventing numbers, use this matrix to collect real quotes. Fill each cell from term sheets, provider quotes and your own payroll.

Two data points from the listing on this site, stated by the seller and subject to confirmation: the Swiss resident director and AML officer together have a base cost of CHF 4,500–5,000 per month, and banking costs are approximately CHF 5,000 per month, with SRO, office, accounting, tax and AML-audit costs additional. See the listing FAQ. Other routes have different cost structures and should be quoted on equal terms.

Speed claims are where this market is least reliable. The honest comparison is about which steps each route removes, not a number of weeks:

• Acquisition removes incorporation and initial SRO affiliation; it still requires diligence, closing, provider reviews, platform deployment and integrations.
• BaaS removes your own licensing; it still requires partner due diligence, contract negotiation, integration and partner sign-off on your programme.
• A new PSP requires every step, and the authorisation timeline is controlled by the regulator and the completeness of your file.

The company on this site makes no fixed launch-date commitment; commercial launch depends on deployment scope, configuration, integrations and provider onboarding.

• Acquisition suits investors or operators who want their own Swiss legal entity with AML supervision, plan to serve customers where that status is adequate (or partner where it is not), and have the people to run compliance. Compare it with building from scratch.
• BaaS suits product teams validating demand, brands adding embedded finance, or companies whose customers are mostly in the partner's licensed markets.
• New PSP suits well-capitalised teams with a long horizon, a specific regulatory need (for example EEA passporting or e-money issuance) and appetite for running the authorisation process.

Many businesses combine routes: an owned Swiss entity for some activities plus regulated partners for accounts, cards or EEA customers. The technology question that follows — gateway, orchestration or core fintech software — is covered in our companion guide on payment gateway vs orchestration vs core fintech software.

1. Obtain written confirmation of SRO membership status, approved business model and any conditions directly from the SRO.
2. Review the last SRO/AML audit reports, findings and remediation.
3. Map every intended activity and customer country to the permission it needs (Swiss, EEA, MiCA, local).
4. Ask each bank, EMI and vendor in writing whether the relationship survives a change of control, and on what conditions.
5. Confirm how customer funds will be held and whether any structure approaches Swiss deposit-taking rules.
6. Check corporate records, share capital, tax filings and litigation; negotiate warranties and indemnities.
7. Confirm who the director and AML officer are, their contract terms and their availability after closing.
8. Separate the share purchase from any software licence; read each licence for scope, IP ownership and source-code rights.
9. Build the five-year cost matrix above from real quotes for at least two routes.
10. Plan your own compliance resourcing; acquisition does not replace it.

For a longer due-diligence list, see the payment company acquisition checklist.