On 22 October 2026, Parliament adopted Law No. 108/2026 amending Law No. 55/2020 “On payment services” (the “Amending Law“), which enters into force on 1 January 2027 and fully aligns Albanian law with PSD2, EMD2, the DORA amending directive and the Instant Payments Regulation. It affects banks, payment and e-money institutions, fintechs and any business that collects or transfers funds for others.
Scope and licensing
E-money institutions are now licensed and supervised under the Payment Services Law, and the list of payment service providers is expanded to include third-country branches. The core exclusions (cash payments, commercial agents acting for only one party, cash transport) are unchanged; telecom payments are excluded up to EUR 50 per transaction and EUR 300 per month. Licenses are available only to companies established in Albania with their head office there, and application files must now cover ICT governance, outsourcing, incident management, business continuity and AML controls.
Qualifying holdings
The existing regime (prior notification to the Bank of Albania when crossing 20%, 30% or 50%, and a three-month right to object) is retained but tightened. The law now defines a qualifying holding itself (10% or more of capital or voting rights, or significant influence). Instead of only objecting, the Bank of Albania may issue orders, sanction managers or suspend voting rights, including where the acquirer failed to notify, and any holding acquired in breach of the law is absolutely null. The same rules now apply to e-money institutions.
Capital, own funds and safeguarding
Initial capital is set by the Bank of Albania until EU accession, after which the EU amounts apply (EUR 20,000 to EUR 125,000; EUR 350,000 for e-money institutions). Own funds are calculated under Methods A, B or C (Method D for e-money), with a ±20% supervisory adjustment. Client funds must be safeguarded in a separate account with an Albanian credit institution or the Bank of Albania, in safe liquid assets, or by insurance or guarantee, and are protected from creditors and insolvency.
E-money
E-money must be issued and redeemed at par, may not be issued through agents, may not bear interest, and the corresponding funds must be safeguarded within five business days. A small e-money institution regime applies to e-money with an average outstanding balance of up to EUR 5 million.
Passporting and third-country branches
A full EU passporting regime is introduced, but it applies only from Albania’s EU accession; until then, an EU licence does not allow services in Albania. From 1 January 2027, however, foreign (including EU) payment and e-money institutions may open an Albanian branch, subject to full licensing requirements, an endowment capital equal to the initial capital, fit-and-proper managers and home-regulator approval. A small payment institution exemption is available for an average up to EUR 3 million per month, subject to an Albanian head office; it does not affect AML obligations.
Other changes
- Digital operational resilience. ICT risk management, the classification and reporting of ICT incidents and business continuity planning must follow the Bank of Albania’s digital operational resilience framework and, from accession, the EU DORA Regulation. For most providers, these DORA-aligned reporting rules replace the general incident-reporting regime under the Payment Services Law.
- Mergers and licence revocation. Mergers of payment or e-money institutions now require prior approval from the Bank of Albania, granted within three months of the submission of a complete file, and are permitted only between institutions of the same type. Where a licence is revoked, the institution may not enter into new contracts and must submit a plan to wind down client relationships and return client funds.
- Outsourcing and agents. The Bank of Albania could already object to outsourcing important functions within three months. The Amending Law makes clear that this covers ICT systems and adds that outsourcing may not remove or modify any licensing condition. Not only agents but also branches must now tell users on whose behalf they act.
- Consumer protection. Framework contracts and pre-contractual information may be drafted in Albanian or another language agreed by the parties. Limits previously expressed in lek are converted to euro: simplified rules for low-value instruments apply to payments up to EUR 30 with a EUR 150 spending or stored-value limit (up to EUR 500 for prepaid instruments), and a payer’s liability for a lost or stolen instrument is capped at EUR 50 (previously ALL 5,000). Unauthorised or incorrectly executed transactions must be reported within 13 months of the debit date. Payees may not surcharge card payments covered by interchange fee rules, or credit transfers and direct debits covered by Bank of Albania rules. The Bank of Albania becomes the alternative dispute resolution body for payment services and e-money, and will publish a consumer rights leaflet that providers must make available free of charge.
- Maximum fines on institutions increase fourfold, from ALL 250,000 to ALL 1,000,000. Responsible employees face fines of up to ALL 200,000, and administrators who fail to provide information will face fines up to ALL 400,000. New offences include breaching the legal form rules, using safeguarded funds for other purposes, and failures in ICT risk management, incident reporting, strong customer authentication and interchange fee rules.
What should businesses do now?
Licensed institutions should review capital, safeguarding, ICT, outsourcing and agent arrangements before 1 January 2027. Although the exclusions are unchanged, platforms that collect funds for others should double-check that they genuinely fall within one of them, given the higher fines. Foreign providers should note that serving Albania still requires a local license, a branch or a licensed partner. All participants should monitor the Bank of Albania’s implementing regulations.
Frequently asked questions – FAQ
1. What has changed in Albanian payment services law?
On 22 October 2026, the Albanian Parliament adopted Law No. 108/2026, amending the Law on Payment Services. The amendments enter into force on 1 January 2027 and align Albanian law with PSD2, EMD2, the DORA amending directive and the Instant Payments Regulation.
2. Can a provider licensed in the EU offer payment services in Albania?
Not yet. EU passporting will apply only from the date of Albania’s EU accession. Until then, a foreign provider needs a local license, an Albanian branch (possible as of 1 January 2027), or a licensed local partner.
3. What changes for e-money institutions?
They are now licensed and supervised under the Payment Services Law. E-money must be issued and redeemed at par, and the corresponding funds must be safeguarded within five business days. A simplified regime applies to small e-money institutions with an average outstanding balance of up to EUR 5 million.
4. How are customers’ funds protected?
Client funds must be safeguarded in a separate account with an Albanian credit institution or the Bank of Albania, in safe liquid assets, or by insurance or a guarantee. They are protected from creditors and insolvency.
5. How have the sanctions changed?
Maximum fines on institutions increase fourfold, to ALL 1,000,000. Responsible employees and administrators may also be fined, and new offences cover, among other things, the misuse of safeguarded funds and failures in ICT risk management and incident reporting.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
