🇪🇺PSD3 and PSR: EU Payment Services Reform

Why the EU Is Rebuilding Its Payments Rulebook

Europe's payments market still runs on two texts from another era: PSD2 has applied since January 2018, the E-Money Directive (EMD2) since 2011. Since then embedded finance has become an industry, instant transfers the norm, and fraud has moved from stolen passwords to social engineering. On 28 June 2023 the European Commission proposed a full rebuild — the Commission's payment services page and the European Parliament's Legislative Train file describe a package of the PSD3 directive (access to the profession: licensing, supervision, safeguarding — transposed by member states) and the PSR regulation (conduct-of-business rules that apply directly and identically across the EU). The third element of the same package is FIDA, the open finance regulation, covered at the end.

The split answers PSD2's main lesson: national transposition diluted the "single" rulebook into 27 versions, so the behavioural layer — SCA, open banking, refunds, transparency — moves into a regulation applied as written.

The package matters twice over: more and more money sits not in a bank but in an EMI — a fintech account, a card wallet, a multi-currency service — and anyone launching a payment product has so far had to open with the question "EMI or PI", which PSD3 abolishes.

The regime's key parameters, as the package texts fix them:

Where the Package Stands: Status and Calendar

Parliament adopted its first-reading position on 23 April 2024, the Council and Parliament reached a political agreement on 27 November 2025, the Council's General Secretariat put the final compromise texts to the Permanent Representatives Committee on 17 April 2026 (documents 8221/26 for the PSR and 8222/26 for PSD3), and the ECON committee endorsed the agreed text on 5 May 2026. The OEIL procedure file shows the file awaiting the Council's formal first-reading position, with an indicative Parliament plenary vote on 14 December 2026.

From here it is arithmetic, not politics. Both acts enter into force on the twentieth day after publication in the Official Journal; with a December vote, publication lands around the turn of 2026–2027. Two markers count from that date: at 21 months the PSR applies and the PSD3 transposition deadline expires; at 27 months the PSR's verification-of-payee (VoP) articles switch on and the transition window for existing institutions closes. In parallel, a whole layer of the Instant Payments Regulation (IPR) is already live.

One PI Licence: What Happens to EMIs

The headline structural change: EMD2 is repealed, e-money issuance becomes one of the payment services, and the EMI turns into a sub-category of a single payment institution — a "PI authorised to issue e-money", per Morrison Foerster's review. Existing institutions get a transition window: they may keep operating on their current authorisation for up to 27 months after PSD3 enters into force, and where the regulator already holds evidence of compliance, authorisation is automatic, without a fresh application — details in the PwC Legal client alert.

Capital. The 2023 proposal raised the initial thresholds — one for each category of service:

Thresholds are indexed periodically for inflation, and the definitive figures sit in the 17 April 2026 compromise text — check thresholds for a specific application against it; KPMG Law has a summary.

Safeguarding moves into PSD3 with a tightening: client funds may not be concentrated in a single bank, and one of the options is placing them with a central bank — where the central bank is willing to open such accounts.

What Already Applies Without Waiting for PSD3

The Instant Payments Regulation, adopted on 13 March 2024, made instant euro transfers mandatory: euro-area banks must receive them since 9 January 2025 and send them since 9 October 2025 — from the same date checking the payee's name against the IBAN before execution and warning the payer of any mismatch. Non-euro member states follow in 2027. The payee check applies to every euro-area payment service provider, PIs and EMIs included, from 9 October 2025 (IPR Art. 5c(9)); what was deferred for euro-area PIs and EMIs is only the duty to send and receive instant transfers, to 9 April 2027 (Art. 5a(8)).

Access to Payment Systems

The second shift runs deeper. The IPR amended the Settlement Finality Directive, letting PIs and EMIs into designated payment systems (transposition by 9 April 2025); the Eurosystem set its access policy for non-bank PSPs on 19 July 2024 and formalised it in an ECB decision of 27 January 2025; since October 2025 a non-bank PSP that meets the TARGET Guideline requirements can open a settlement account in TARGET and TIPS.

For the market this ends the era when the whole fintech stack hung off client accounts at two or three commercial banks: sponsor-bank de-risking stops being an existential threat — see the effect on BaaS chains.

Money in an EMI: Safeguarding, VoP and Refunds

Money on an EMI or PI account is not a bank deposit: deposit guarantee schemes do not cover it, and protection rests on safeguarding — segregation of client funds. The reform adds three things. First, a re-licensing filter: in 2027–2029 every institution holding your money will re-prove its capital, governance and safeguarding to the regulator; weak ones will leave the market. The practical question for anyone holding money in an EMI: has the institution passed re-authorisation, and in which jurisdiction will it sit afterwards.

Second, VoP: name-and-IBAN matching already runs in the euro area and will extend under the PSR to all credit transfers, with only a narrow opt-out for corporate payers.

Third, spoofing refunds: where a fraudster impersonates your bank or EMI using its channels and you authorise a payment under that deception, the PSP must refund the full amount — provided you report to the police and notify the PSP without undue delay; it has 15 business days to refund or justify a refusal. The receiving bank, meanwhile, must freeze suspicious incoming transactions — a first-ever window to claw back a stolen payment. Who bears a fraud loss under the rules in force today is set out in payment fraud liability.

File Now or Wait for PSD3: Agents and Infrastructure Access

Filing under PSD2 now versus waiting for PSD3 is a question of launch horizon. A 2026 application delivers a licence in 2027 under current rules, plus re-authorisation within the 27-month window under the new ones. If the product must be live before H2 2028, there is nothing to wait for: file now, but design compliance against the compromise text from day one — a wind-down plan, ICT resilience under DORA, diversified safeguarding. Entry without your own licence — the agent model — survives, but under tighter discipline.

Agents and the Licence Perimeter

Two perimeter squeezes. The commercial agent exclusion, on which marketplaces kept payments outside the licence for years, will remain only where the agent acts under a genuine mandate from one side — payer or payee, not both. For acquiring structures that is the decisive fork: which party in the chain actually receives the funds and therefore carries the risk is worked through in PayFac, ISO and merchant of record. E-money distributors are pulled into the agent regime with registration through the principal. Open banking is rebuilt: a dedicated interface becomes the default, although the competent authority may exempt a bank and let it offer its customer interface or, where justified, no interface at all (Art. 39 of the agreed PSR text); access without proper identification (screen scraping) is ruled out; the customer gets a consent dashboard and providers get data parity. The licences and access rules are covered in open banking: AISP and PISP.

The strategic shift is settlement infrastructure: a PI with its own TARGET account settles in central bank money instead of renting access from a sponsor bank. That changes the economics of licence renting as a whole.

SCA: Authentication Under the New Rules

The skeleton stays — two independent elements from the categories knowledge, possession and inherence — but the PSR allows SCA built on two factors from the same category where the PSP can demonstrate their independence. Accessibility rules are added: authentication may not depend on a single method, nor on mandatory smartphone ownership, and must be free of charge. Enrolling a payment instrument on a new device gets a default four-hour delay — a window in which the customer can spot a rogue activation. The liability perimeter widens to technical service providers and wallets: those failing to support SCA share the fraud losses.

FIDA: Open Finance in the Pipeline

The package's third element is FIDA, the regulation on access to financial data beyond payment accounts: investments, insurance, pensions, credit — with a new FISP licence for financial information service providers. The file has had a rough ride: the Commission's 2025 work programme listed it as a candidate for withdrawal, but after pushback from the market and co-legislators it came back to life; the Council and Parliament mandates date from 4 and 18 December 2024, followed by trilogues still running, as the Legislative Train file shows.

As of April 2026 there was no agreement; the Commission is steering the parties towards a political deal in 2026, and phased application pushes working open finance towards the end of the decade. It promises portability of investment, insurance and pension data across providers, and the FISP licence opens a new licensing niche — worth a place in the roadmap, too early for the 2027 budget.