A weak or stalled application: repair it, reset the scope, or stop

This guide is for a firm whose application has stalled, is drawing repeated questions, or is being run against a plan nobody in the room now believes.

It is not a prediction of what any authority will do. Nothing here says an application would be granted, refused or decided by a date, and this site holds no evidence that would support such a statement.

It is not for a firm that has not yet applied. Choosing a route and building the evidence in the right order is a different problem, and it starts with the perimeter: an activity excluded from the framework entirely is not made into a payment service by an application.1213

Whether the perimeter is settled. PSD2 excludes a list of activities from its scope entirely and the E-Money Directive excludes certain monetary value from the definition of electronic money, so a file can be complete and still be for the wrong thing.1213

Whether the entity can hold the permission at all. A payment institution authorisation is granted only to a legal person established in a Member State, and the Union frameworks generally require the authorised entity to be established in a Member State and to have its head office or effective management there.131015

Whether the capital position still matches the model. Several frameworks measure own funds against a proportion of fixed overheads, so a requirement met at the start of a programme rises with the cost base rather than staying at the headline figure.24

Whether funds received from users are safeguarded as the framework requires, since those arrangements are supervised on an ongoing basis rather than evidenced once.914

Whether the operational and security evidence exists in the form the application asks for. A payment institution application must include a security policy document containing a risk assessment and a description of the security control and mitigation measures.8

Whether obligations the firm treated as future have already attached. An applicant that already holds another authorisation may already be a listed financial entity in that other capacity, in which case DORA already binds it.5

Repair is the right answer when the activity list is stable, the entity can hold the permission, and what is missing is evidence that can actually be produced: governance records, control descriptions, the security policy document and the reconciliation behind safeguarding.8914

Reset the scope when the activity list itself is the problem, because the exclusions are checked before the authorisation question rather than after it, and a file that names the wrong activity cannot be corrected by adding pages to it.1213

Reset the entity when the applicant cannot satisfy the establishment condition, since the authorisation is granted only to a legal person established in a Member State and no quantity of evidence changes that.10

Where an applicant is not otherwise a listed financial entity, what an authority examines on operational resilience at this stage is the evidence the sectoral framework requires in the application itself, so a resilience gap and an application gap are not always the same gap.58

Consider stopping when repair and reset both require the business model to change so far that what is left is a different firm. That is a commercial decision rather than a regulatory one, and it costs less taken deliberately than discovered.

A payment institution may provide payment services through agents that it registers with its home competent authority, and it remains responsible for their acts. An agency arrangement gives the agent no permission of its own.11

Whether DORA binds a given firm is a conclusion rather than an assumption. It applies to the financial entities listed in Article 2(1), which is a closed list, excludes certain entities entirely and applies a simplified ICT risk management framework to others.56

Where it does bind, it requires ICT third-party risk to be managed and a register of information on contractual arrangements to be maintained, and it establishes an oversight framework for critical ICT third-party service providers.7

Answering questions one at a time. A file that answers twelve questions in twelve voices reads as twelve positions, and the next round is then about the inconsistencies rather than about the business.

Nobody owning the answer. When each question goes to whoever is free, the file loses the one thing an assessor is looking for, which is a firm that knows what it is.

Treating an evidence gap as a drafting task. If the control does not exist, describing it produces a document that the first operational question will contradict.

Leaving the scope question open because it is uncomfortable. It does not get cheaper later; it becomes the reason the rest of the work has to be done again.

Moving the file to another Member State to escape the questions. The framework travels with the activity, so the same questions arrive again against a new file and a later start.

Before writing another response, write the activity list: one line per activity the firm performs, in the words the framework uses, with the entity that performs it and the customer funds it touches. If that page is clean you have a repair. If it is not, you have a scope decision, and it is the only one worth taking this week.