PSD3 and the Payment Services Regulation are the largest change to EU payments law since PSD2 took effect in 2018. They reshape authorisation, capital, e-money, safeguarding, fraud liability, open banking and customer protection, and they move many rules from national law into one directly applicable EU regulation.
| Area | PSD2 and EMD2 today | PSD3 and PSR (agreed text) |
|---|---|---|
| Legal form | Two directives, each written into national law | PSD3 directive for authorisation and supervision; PSR regulation for conduct, applying directly |
| E-money | Separate EMI licence | Issuing e-money becomes a payment service within one payment institution licence |
| Money remittance capital | €20,000 | €40,000 |
| Payment initiation capital | €50,000 | €50,000 |
| Core payment services capital | €125,000 | €150,000 |
| E-money capital | €350,000 | €250,000 |
| Several services | Highest figure applies | Figures for payment initiation, core services and e-money added together |
| Fraud | Strong customer authentication | Name and IBAN checks, fraud data sharing, wider liability and refunds |
| Open banking | Access rights under PSD2 | Listed prohibited obstacles, permission dashboards |
| Safeguarding | National implementation | Harmonised rules, central bank option, EBA standards on concentration |
| Existing licences | National authorisations | Transitional assessment into the new framework |
The figures come from the final compromise texts confirmed by the Council's Permanent Representatives Committee in April 2026. They remain subject to formal adoption, and PSD2 and the Electronic Money Directive govern until the new framework applies.
The two files run as separate procedures: 2023/0209(COD) for PSD3 and 2023/0210(COD) for the PSR. They are being concluded as an early second reading agreement, in which the Council adopts a first reading position matching the agreed text and the Parliament then approves it.
| Date | Step |
|---|---|
| 28 June 2023 | Commission publishes the proposals (COM(2023) 366 and 367) |
| 23 April 2024 | Parliament adopts its first reading position |
| 18 June 2025 | Council agrees its negotiating position |
| 27 November 2025 | Council and Parliament reach provisional political agreement |
| April 2026 | Permanent Representatives Committee confirms the final compromise texts |
| 5 May 2026 | Parliament's ECON committee approves the agreed texts |
| Pending | Council first reading position; Parliament plenary, indicative date 14 December 2026 |
| Pending | Signature, publication in the Official Journal, entry into force 20 days later |
As at 17 October 2026, EUR-Lex lists both files only as Commission proposals, and the Parliament's Legislative Observatory shows each as awaiting the Council's first reading position. Neither text has a final act number. The application dates run from entry into force, so they will be fixed only on publication.
Entry into force follows 20 days after publication. The PSR's rules then apply, and Member States must have written PSD3 into national law, after a transition period that the final texts set from that date. On any realistic publication date the new rules will not apply before 2028, and the final texts give some technical obligations a longer lead time. Plan the large technology projects to finish well inside that window rather than at its end.
PSD2 was a directive, so each Member State wrote it into national law in its own words. The result was differences in how customer rules, open banking and fraud liability operate from one country to the next.
The reform splits the subject in two. PSD3, a directive, keeps the matters that sit in national law: authorisation, prudential supervision, capital and the institutional framework for payment institutions. The PSR, a regulation, places conduct rules (customer information, rights and obligations, fraud, open banking and strong customer authentication) directly in EU law with no national transposition.
A payment institution authorised in Lithuania, Ireland or Malta will therefore face the same core customer rules wherever it operates. Treat the two texts as one package: the licence sits in PSD3 and the day-to-day obligations in the PSR.
The package reaches well beyond licensed payment firms. Each type of business has a different main task.
| Business | Main impact |
|---|---|
| Payment institutions | New capital levels, transition assessment, harmonised safeguarding, fraud liability, wind-down plan |
| EMIs | Move into the payment institution framework; e-money capital of €250,000 plus any payment services |
| Banks | Name and IBAN checks, fraud liability, open banking obligations, non-discriminatory account access for payment institutions |
| Payment initiation and account information providers | More reliable bank interfaces, permission dashboards, listed prohibited obstacles |
| Card acquirers | Clear fee disclosure to merchants |
| Merchants and retailers | Trading name on statements; option to offer cash withdrawals up to €150 without a purchase |
| Online platforms and search engines | Checks on financial services advertisers; liability for fraudulent content left online after notice |
| Device makers and electronic service providers | Fair, reasonable and non-discriminatory access for payment apps |
| Crypto-asset service providers | Streamlined payment authorisation where already authorised under MiCA |
Political agreement does not change the rules that apply today. Firms applying in 2026 must meet PSD2, the Electronic Money Directive and the home state's law, as assessed by regulators such as the Bank of Lithuania, the Central Bank of Ireland, the MFSA and DNB.
A firm authorised in 2026 or 2027 will operate under PSD3 early in its life. The practical approach is twin-track: comply fully with the current framework and design capital, safeguarding, fraud controls and governance so they move across without rebuilding. Our guide to the EU payment institution licence covers the current requirements.
The agreed PSD3 text repeals the Second Electronic Money Directive and removes the separate EMI category. Payment services and e-money issuance sit within one payment institution authorisation, with issuing e-money listed as a payment service in its own right.
E-money concepts remain: issuance on receipt of funds, redemption at par value, safeguarding, outstanding e-money and the own funds calculated on it. A payment institution may hold permission for payment services, for e-money issuance, or for both.
Existing EMIs do not lose their licences. The agreed text gives them a transition period to continue operating and to supply the information their regulator needs to confirm they meet the new requirements, with a longer period for EMIs that used the small EMI waiver. Where the evidence already shows compliance, the regulator can treat the firm as authorised under PSD3 without a new application. Where there are gaps, the firm remediates within the transition.
| Area | Evidence to hold |
|---|---|
| Permissions | Current services mapped to the new payment services list, including e-money |
| Capital | Initial capital and own funds under the new levels and the cumulative rule |
| Governance | Board composition, responsibilities, fitness of directors and key function holders |
| Safeguarding | Method, banks used, concentration, reconciliation records and audit findings |
| Fraud and authentication | Monitoring, payee verification plan, fraud data and loss reporting |
| Wind-down | Updated plan with the resources to carry it out |
| ICT | DORA framework, register of information and incident records |
Existing payment institutions go through a similar validation. The exact months for each step run from entry into force and will be confirmed on publication. Prepare an evidence pack now covering governance, safeguarding, financial resources, the business plan and the control framework, so the regulator can confirm the transition from documents already on file.
Article 5 of the agreed PSD3 text sets new initial capital levels. They are future figures: current rules apply to 2026 applicants.
| Service | PSD2 and EMD2 today | PSD3 agreed text |
|---|---|---|
| Money remittance only | €20,000 | €40,000 |
| Payment initiation | €50,000 | €50,000 |
| Core payment services (accounts, execution, issuing, acquiring) | €125,000 | €150,000 |
| Issuing e-money | €350,000 | €250,000 |
Under PSD2 the highest relevant figure applies. Under the agreed PSD3 text, where an institution provides more than one of payment initiation, the core payment services and e-money issuance, the minimum amounts are added together. An e-money issuer that also offers core payment services and payment initiation would need €450,000 (€250,000 plus €150,000 plus €50,000), more than the €350,000 it needs today.
| Firm | Capital today | Capital under the agreed text |
|---|---|---|
| Money remittance only | €20,000 | €40,000 |
| Merchant acquirer | €125,000 | €150,000 |
| Acquirer that also offers payment initiation | €125,000 | €200,000 |
| E-money wallet issuer only | €350,000 | €250,000 |
| E-money issuer with payment accounts and card issuing | €350,000 | €400,000 |
| E-money issuer with core services and payment initiation | €350,000 | €450,000 |
Initial capital is a floor. For an established firm the own funds calculation is usually higher, so the change in initial capital matters most for start-ups and small firms.
The institution must hold the higher of its initial capital and its ongoing own funds requirement. Payment services continue to use methods based on fixed overheads, payment volume or income, and e-money issuance keeps a method of at least 2% of average outstanding e-money. Multi-activity firms calculate each activity separately. Model capital against the permission mix you will hold under PSD3, and identify where any extra shareholder funding would come from.
The agreed texts harmonise how customer funds are protected across Member States. The two methods remain: segregation, with funds placed in a separate account at a credit institution or in secure, liquid, low-risk assets, or an insurance policy or comparable guarantee.
Two changes stand out. Payment institutions may hold safeguarded funds in a separate account at a central bank, where the central bank agrees to open one. And the agreed text treats concentration with a single bank as a significant risk: the EBA will develop technical standards on when funds should be spread across institutions. Review whether your safeguarding is resilient, not only segregated.
Practical steps now:
Customers are to receive clearer information on how their funds are protected and what happens on insolvency. Review customer terms so that they describe the legal entity providing the service, the safeguarding method and the bank or central bank holding the funds, especially in groups with several licensed entities.
Funds held in settlement accounts linked to designated payment systems receive clearer treatment, and the EBA will set standards on segregation and reconciliation. A payment institution seeking direct access to payment systems should plan treasury, safeguarding and liquidity controls together. The firm's safeguarding practice builds these frameworks for EU and UK institutions.
Payment institutions have long found bank accounts hard to obtain. The agreed text requires banks to give payment institutions access to payment accounts on a non-discriminatory basis, assessed proportionately and objectively.
Banks may still decline on financial crime, risk appetite or prudential grounds, but a refusal or closure must be justified and transparent. A well-documented financial crime framework and clear money flows remain the strongest basis for opening safeguarding and operating accounts.
The PSR targets social engineering, impersonation, account takeover and both authorised and unauthorised fraud. It gives roles to the payer's provider and the payee's provider, and expects controls to act before money leaves, which matters most for instant payments.
Before a transfer, the provider checks that the payee's name matches the IBAN, as already required for euro transfers under the Instant Payments Regulation (Regulation (EU) 2024/886). Where the name and IBAN do not match, the payer is told before the payment proceeds. Implementation needs beneficiary data, matching logic, customer warnings, exception handling and an audit trail, and is a substantial project for cross-border and multi-currency platforms.
| Component | What to build |
|---|---|
| Data | Account holder names held in a form that can be matched, including trading names |
| Matching | Rules for exact, close and no match, with tolerance for spelling and format |
| Customer warning | A clear message before the payment proceeds, and a record of the customer's choice |
| Responding to checks | A service that answers other providers' name checks quickly and reliably |
| Audit trail | Logs showing each check, the result and the action taken |
Where a fraudster poses as an employee of the customer's provider and persuades the customer to approve a payment, the provider must refund the full amount if the customer reports the fraud to the police and to the provider. Where a fraudster initiates or alters a transaction, it counts as unauthorised. Firms need a clear process to identify genuine impersonation claims and handle them separately from other disputes.
A provider that does not have the required fraud prevention measures in place is liable for losses those measures should have prevented. The firm must show that a control was operating at the relevant time and explain why it executed, delayed or stopped a payment. Logs and model decisions must be reproducible. Boards should treat fraud as both a conduct and a financial matter.
Large online platforms and search engines may show advertising for financial services only where the advertiser shows it is authorised or exempt. Platforms that do not remove fraudulent content after being told of it can be liable to providers that refunded customers.
Strong customer authentication, the two-factor check for payments and account access, remains. The PSR updates it for known weaknesses and new risks, and the EBA will develop technical standards on authentication and its exemptions, including accessible methods for customers who do not use a smartphone.
Avoid long-term architecture that depends only on current PSD2 interpretations. Authentication and fraud monitoring must work together, because an authenticated payment can still be fraudulent.
PSD2 created payment initiation and account information services, but bank interfaces vary widely across Member States. The PSR lists the obstacles a bank may not place in the way of an authorised provider and prohibits discrimination against these providers.
Banks should review their dedicated interfaces, consent journeys and how they treat third-party providers against the listed obstacles. Third-party providers should plan for more stable access and review their own consent records, which must match the bank's dashboard.
Customers get a dashboard showing which providers can access their data and what they have agreed to. Consent records, expiry, revocation and interface access must stay aligned between the bank and the third-party provider. Treat the dashboard as a data governance and systems project, not a screen.
Device makers and electronic service providers must let payment apps store and transfer the data they need on fair, reasonable and non-discriminatory terms. Wallet and payment app providers that rely on smartphone functions should follow the detailed rules as they develop.
Customers must see all charges before a payment starts, including currency conversion and fixed cash withdrawal fees, whoever operates the ATM. Card acquirers must disclose their fees to merchants clearly, and merchants must make sure their trading name matches the name on customers' statements.
Retailers may offer cash withdrawals without a purchase, up to €150, using chip and PIN. The measure supports access to cash in rural areas.
Automated support is permitted, but customers must be able to reach a person. Fraud, payment blocking, vulnerable customers and disputes need escalation routes with real human intervention, which affects staffing and outsourcing plans.
Every payment service provider must take part in alternative dispute resolution where a consumer chooses it, and tell customers about it in contracts and communications. Firms that passport should map the dispute resolution bodies in each country they serve.
Application requirements become more harmonised, with a complete application decided within three months as today. The EBA will develop standards on the information required and a common assessment approach. National regulators still grant the licence, so local differences in practice will remain, and the choice of jurisdiction should rest on substance and commercial fit, as set out in our guide to EU payment institution and EMI licensing by jurisdiction.
Article 3 of the agreed PSD3 text requires a winding-up plan adapted to the size and business model of the applicant. The plan shows how the firm would close in an orderly way: returning customer funds, ending contracts, keeping critical staff and systems, and communicating with customers. It needs the financial resources to carry it out. Existing firms should update plans written for PSD2.
Crypto-asset service providers already authorised under the Markets in Crypto-Assets Regulation (MiCA) receive a streamlined authorisation procedure, supplying a reduced set of information that includes their own winding-up plan.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 and covers ICT risk, incident reporting, resilience testing and third-party risk. PSD3 authorisation information draws on the DORA framework rather than duplicating it. Build one integrated framework for governance, outsourcing, cyber security, incidents and continuity. Our article on DORA and digital operational resilience covers the requirements in full.
An e-money token, a stablecoin referencing one official currency, is a crypto-asset under MiCA and can be issued only by a credit institution or an EMI. Some services involving e-money tokens may also be payment services. A crypto-asset licence does not replace payment authorisation where payment services are provided, and each activity needs its own analysis. See our guide to the MiCA stablecoin licence.
Apply under the current PSD2 and Electronic Money Directive framework; there is no need to wait. Make the application ready for PSD3: model the future capital, design safeguarding with concentration risk in mind, and include a wind-down plan and a DORA-compliant ICT framework.
A new EMI should expect to move into the payment institution framework during its first years. As national rules converge under the PSR, the commercial reasons for choosing a jurisdiction (team, customers, banking) carry more weight than differences in local rules.
No. PSD3 and the PSR do not apply to FCA-authorised firms. The UK Payment Services Regulations 2017, the Electronic Money Regulations 2011 and the FCA Handbook continue to govern UK firms, including the CASS 15 safeguarding rules in force since 7 May 2026.
The UK has required reimbursement of authorised push payment fraud since 7 October 2024, so UK groups already run much of the fraud handling the PSR introduces in the EU, although the EU rules differ in scope. HM Treasury is reviewing the UK payments framework separately. Groups operating in both markets should run the two regimes as separate programmes with a shared control framework. Our article on the UK payment services reforms covers the UK position.
| Workstream | What it covers | Start |
|---|---|---|
| 1. Mapping | Current activities against the future permissions, including passporting, agents and distributors | Now |
| 2. Prudential | Initial capital, own funds, growth and cumulative scenarios | Now |
| 3. Operations | Safeguarding, fraud, payee verification, authentication, open banking, disclosures, complaints and technology | Large projects now; detail once EBA standards are final |
| 4. Transition evidence | Governance records, policies and compliance evidence for the home regulator | From publication |
Clear answers to these six questions give the board a costed plan and give the home regulator the evidence it will ask for in the transition.
No. The rules are not in force, and much of the detail will come from the final texts and the EBA's technical standards. Implementing provisions that may change in detail adds cost.
Decisions with long lead times can be taken now: capital planning, legal entity strategy, product design and major technology choices. Forms, reporting templates and detailed authentication settings can wait for the final standards. The aim in 2026 is readiness: a costed plan, clear ownership and the large projects started.
PSD3 is not yet adopted. It was agreed politically on 27 November 2025 and approved by the ECON committee on 5 May 2026; as at 17 October 2026 it awaits the Council's first reading position, with a Parliament plenary vote indicated for 14 December 2026.
No. As at 17 October 2026 EUR-Lex lists PSD3 and the PSR only as Commission proposals, with no final act number.
The EMI category is folded into the payment institution framework, but existing EMIs keep operating through a transition and can be treated as authorised once their regulator confirms they meet the new requirements.
In the agreed text: €40,000 for money remittance only, €50,000 for payment initiation, €150,000 for core payment services and €250,000 for issuing e-money, added together for combined services.
One licence for payments and e-money, revised capital, harmonised safeguarding, name and IBAN checks, wider fraud liability and refunds, refined authentication, stronger open banking access and non-discriminatory bank account access.
No. Applications in 2026 are assessed under PSD2 and the Electronic Money Directive, and a firm can design its capital, safeguarding and controls for PSD3 from the start.
No. FCA-authorised firms remain under the UK Payment Services Regulations 2017 and Electronic Money Regulations 2011.
Buckingham Capital Consulting has obtained payment and e-money licences in the UK and the EU since 2013, including a Central Bank of Ireland EMI licence for Own Solutions. The firm runs PSD3 readiness assessments for existing payment institutions and EMIs, covering permissions, capital, safeguarding, fraud and the transition evidence their home regulator will ask for.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.