Do I need a written security policy when making an application to become authorised as a payment institution?

Yes, the application requires a written security policy document.