# PSD3 and PSR: the EU Payments Overhaul — One PI Licence and the End of the EMI > One PI licence replaces the EMI regime: re-authorisation within 27 months, verification of payee, TARGET access and new capital floors — the EU payments reform calendar to 2029. Author: Maria Plotnikova — Lawyer, Family Office (https://wiki.private.law/en/authors/plotnikova) Last modified: 2026-08-14T13:14:00.000Z Canonical: https://wiki.private.law/en/psd3-psr Topics: banking Jurisdictions: eu Product tags: neobank, banking, compliance Semantic tags: neobank, banking, compliance --- ## Why the EU Is Rebuilding Its Payments Rulebook Europe's payments market still runs on two texts from another era: PSD2 has applied since January 2018, the E-Money Directive \(EMD2\) since 2011. Since then embedded finance has become an industry, instant transfers the norm, and fraud has moved from stolen passwords to social engineering. On 28 June 2023 the European Commission proposed a full rebuild — the [Commission's payment services page](https://finance.ec.europa.eu/consumer-finance-and-payments/payment-services/payment-services_en) and the [European Parliament's Legislative Train file](https://www.europarl.europa.eu/legislative-train/theme-an-economy-that-works-for-people/file-revision-of-eu-rules-on-payment-services) describe a package of the PSD3 directive \(access to the profession: licensing, supervision, safeguarding — transposed by member states\) and the PSR regulation \(conduct-of-business rules that apply directly and identically across the EU\). The third element of the same package is FIDA, the open finance regulation, covered at the end. The split answers PSD2's main lesson: national transposition diluted the "single" rulebook into 27 versions, so the behavioural layer — SCA, open banking, refunds, transparency — moves into a regulation applied as written. The package matters twice over: clients increasingly keep money not in a bank but in an EMI — a fintech account, a card wallet, a multi-currency service — while for builders "EMI or PI" was the first licensing question, and PSD3 abolishes it. ## Where the Package Stands: Status and Calendar Parliament adopted its first-reading position on 23 April 2024, the Council and Parliament reached a political agreement on 27 November 2025, the Council's General Secretariat published the final compromise texts on 23 April 2026, and the ECON committee endorsed the agreed text on 5 May 2026. The [OEIL procedure file](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2023%2F0209\(COD\)) shows the file awaiting the Council's formal first-reading position, with an indicative Parliament plenary vote on 14 December 2026. From here it is arithmetic, not politics. Both acts enter into force on the twentieth day after publication in the Official Journal; with a December vote, publication lands around the turn of 2026–2027. Two markers count from that date: at 21 months the PSR applies and the PSD3 transposition deadline expires; at 27 months the PSR's verification-of-payee \(VoP\) articles switch on and the transition window for existing institutions closes. In parallel, a whole layer of the Instant Payments Regulation \(IPR\) is already live. | **Date** | **Milestone** | | --- | --- | | 28 June 2023 | Commission proposes PSD3, PSR and FIDA | | 9 January 2025 | Euro area: obligation to receive instant transfers \(IPR\) | | 9 April 2025 | Settlement Finality Directive amendment transposed: PIs and EMIs admitted to payment systems | | 9 October 2025 | Euro area: obligation to send instant transfers, plus VoP \(IPR\) | | October 2025 | Eurosystem opens TARGET and TIPS to non-bank PSPs | | 27 November 2025 | Council–Parliament political agreement on PSD3/PSR | | 23 April 2026 | Council publishes the final compromise texts | | 14 December 2026 | Indicative Parliament plenary vote \(second reading\) | | Turn of 2026–2027 | Expected Official Journal publication; entry into force 20 days later | | 9 January / 9 July 2027 | Non-euro member states: receiving, then sending instant transfers + VoP \(IPR\) | | 9 April 2027 | IPR instant-payment deadline for PIs and EMIs themselves \(euro area\) | | Entry into force + 21 months \(≈ H2 2028\) | PSR applies; PSD3 transposition deadline | | Entry into force + 27 months \(≈ H1 2029\) | PSR VoP articles; end of the transition window for existing PIs and EMIs | ## One PI Licence: What Happens to EMIs The headline structural change: EMD2 is repealed, e-money issuance becomes one of the payment services, and the EMI turns into a sub-category of a single payment institution — a "PI authorised to issue e-money", per Morrison Foerster's review. Existing institutions get a transition window: they may keep operating on their current authorisation for up to 27 months after PSD3 enters into force, and where the regulator already holds evidence of compliance, authorisation is automatic, without a fresh application — details in the PwC Legal client alert. Capital. The 2023 proposal raised the initial thresholds: €25,000 for money remittance, €50,000 for payment initiation, €150,000 for the remaining payment services and €400,000 for e-money issuance, with periodic inflation indexation. The definitive figures sit in the 23 April 2026 compromise text — check thresholds for a specific application against it; KPMG Law has a summary. Safeguarding moves into PSD3 with a tightening: client funds may not be concentrated in a single bank, and one of the options is placing them with a central bank — where the central bank is willing to open such accounts. ## What Already Applies Without Waiting for PSD3 The [Instant Payments Regulation](https://www.ecb.europa.eu/paym/retail/instant_payments/html/instant_payments_regulation.en.html), adopted on 13 March 2024, made instant euro transfers mandatory: euro-area banks must receive them since 9 January 2025 and send them since 9 October 2025 — from the same date checking the payee's name against the IBAN before execution and warning the payer of any mismatch. Non-euro member states follow in 2027; PIs and EMIs themselves have until 9 April 2027. The second shift runs deeper. The IPR amended the Settlement Finality Directive, letting PIs and EMIs into designated payment systems \(transposition by 9 April 2025\); the Eurosystem set its [access policy for non-bank PSPs on 19 July 2024](https://www.ecb.europa.eu/press/intro/news/html/ecb.mipnews20240719.en.html) and formalised it in an [ECB decision of 27 January 2025](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AL_202500222); since October 2025 a non-bank PSP that meets the TARGET Guideline requirements can open a settlement account in TARGET and TIPS. For the market this ends the era when the whole fintech stack hung off client accounts at two or three commercial banks: sponsor-bank de-risking stops being an existential threat — see the effect on [BaaS chains](https://wiki.private.law/en/baas-sponsor-bank). ## Money in an EMI: Safeguarding, VoP and Refunds Money on an EMI or PI account is not a bank deposit: deposit guarantee schemes do not cover it, and protection rests on [safeguarding — segregation of client funds](https://wiki.private.law/en/correspondent-banking-safeguarding). The reform adds three things. First, a re-licensing filter: in 2027–2029 every institution holding your money will re-prove its capital, governance and safeguarding to the regulator; weak ones will leave the market. The practical question for a client: has your EMI passed re-authorisation, and in which jurisdiction will it sit afterwards. Second, VoP: name-and-IBAN matching already runs in the euro area and will extend under the PSR to all credit transfers, with only a narrow opt-out for corporate payers. Third, spoofing refunds: where a fraudster impersonates your bank or EMI using its channels and you authorise a payment under that deception, the PSP must refund the full amount — provided you report to the police and notify the PSP without undue delay; it has 15 business days to refund or justify a refusal. The receiving bank, meanwhile, must freeze suspicious incoming transactions — a first-ever window to claw back a stolen payment. ## File Now or Wait for PSD3: Agents and Infrastructure Access Filing under PSD2 now versus waiting for PSD3 is a question of launch horizon. A 2026 application delivers a licence in 2027 under current rules, plus re-authorisation within the 27-month window under the new ones. If the product must be live before H2 2028, there is nothing to wait for: file now, but design compliance against the compromise text from day one — a wind-down plan, ICT resilience under DORA, diversified safeguarding. Entry without your own licence — the [agent model](https://wiki.private.law/en/payment-agents-eu) — survives, but under tighter discipline. Two perimeter squeezes. The commercial agent exclusion, on which marketplaces kept payments outside the licence for years, will remain only where the agent acts under a genuine mandate from one side — payer or payee, not both. For acquiring structures that is the decisive fork: which party in the chain actually receives the funds and therefore carries the risk is worked through in [PayFac, ISO and merchant of record](https://wiki.private.law/en/payfac-vs-iso). E-money distributors are pulled into the agent regime with registration through the principal. Open banking is rebuilt: a mandatory dedicated API, a ban on screen scraping, a consent dashboard for the customer and data parity for providers. The strategic shift is settlement infrastructure: a PI with its own TARGET account settles in central bank money instead of renting access from a sponsor bank. That changes the economics of licence renting as a whole — where the perimeter is heading is mapped in the [trends overview](https://wiki.private.law/en/regulatory-perimeter-trends). ## SCA: Authentication Under the New Rules The skeleton stays — two independent elements from the categories knowledge, possession and inherence — but the PSR allows SCA built on two factors from the same category where the PSP can demonstrate their independence. Accessibility rules are added: authentication may not depend on a single method, nor on mandatory smartphone ownership, and must be free of charge. Enrolling a payment instrument on a new device gets a default four-hour delay — a window in which the customer can spot a rogue activation. The liability perimeter widens to technical service providers and wallets: those failing to support SCA share the fraud losses. ## FIDA: Open Finance in the Pipeline The package's third element is FIDA, the regulation on access to financial data beyond payment accounts: investments, insurance, pensions, credit — with a new FISP licence for financial information service providers. The file has had a rough ride: the Commission's 2025 work programme listed it as a candidate for withdrawal, but after pushback from the market and co-legislators it came back to life; the Council and Parliament mandates date from 4 and 18 December 2024, followed by trilogues still running, as the [Legislative Train file](https://www.europarl.europa.eu/legislative-train/theme-an-economy-that-works-for-people/file-open-finance-framework?sid=9901) shows. As of April 2026 there was no agreement; the Commission is steering the parties towards a political deal in 2026, and phased application pushes working open finance towards the end of the decade. For clients it promises portability of whole-portfolio data; for builders, a new licensing niche — worth a place in the roadmap, too early for the 2027 budget. > 🍓 Payments Europe is moving from two regimes to one: a PI licence with an e-money option, directly applicable PSR rules, and a settlement account at the central bank instead of full dependence on a sponsor. Every date counts from Official Journal publication: application at 21 months, VoP and the end of the transition window at 27. Money in an EMI stays non-bank money: its protection is safeguarding plus the discipline of the specific institution, and the 2027–2029 re-licensing will show who holds that discipline. Builders gain nothing by waiting: license under the current rules while engineering compliance for the new ones. ## Q/A ### **File for an EMI/PI now or wait for PSD3** If you need to launch before H2 2028, file now: a PSD2 licence keeps working, the re-authorisation window runs up to 27 months after PSD3 enters into force, and where compliance is already evidenced it happens automatically. Design the application against the 23 April 2026 text from the start: wind-down plan, diversified safeguarding, DORA resilience. ### **What the regime merger means for money on an EMI account** By itself, little: e-money remains redeemable at par, and safeguarding survives and tightens \(no concentration in a single bank, a central-bank account option\). The real effect is the re-licensing filter: in 2027–2029, check whether your institution obtained its new authorisation and whether it moved to another jurisdiction. ### **Does PSD3/PSR touch UK EMIs** Not directly: the package applies in the EU/EEA, the UK runs its own reform, and the VoP analogue — Confirmation of Payee — has operated there since 2020. But UK groups with EU subsidiaries will live the reform through those subsidiaries: re-authorisation, PSR rules and the new SCA apply to them in full. ### **When does the reform actually bite** Count from Official Journal publication; with a plenary vote on 14 December 2026, publication lands around the turn of 2026–2027. That puts PSR application and the PSD3 transposition deadline in H2 2028, and the VoP articles plus the end of the transition window in H1 2029. The IPR layer — instant transfers, euro-area VoP, PI/EMI access to TARGET — is already in force. --- ## FAQ ### What the regime merger means for money on an EMI account By itself, little: e-money remains redeemable at par, and safeguarding survives and tightens (no concentration in a single bank, a central-bank account option). The real effect is the re-licensing filter: in 2027–2029, check whether your institution obtained its new authorisation and whether it moved to another jurisdiction. ### Does PSD3/PSR touch UK EMIs Not directly: the package applies in the EU/EEA, the UK runs its own reform, and the VoP analogue — Confirmation of Payee — has operated there since 2020. But UK groups with EU subsidiaries will live the reform through those subsidiaries: re-authorisation, PSR rules and the new SCA apply to them in full. ### When does the reform actually bite Count from Official Journal publication; with a plenary vote on 14 December 2026, publication lands around the turn of 2026–2027. That puts PSR application and the PSD3 transposition deadline in H2 2028, and the VoP articles plus the end of the transition window in H1 2029. The IPR layer — instant transfers, euro-area VoP, PI/EMI access to TARGET — is already in force. --- ## Factual claims - Europe's payments market still runs on two texts from another era: PSD2 has applied since January 2018, the E-Money Directive (EMD2) since 2011. - The split answers PSD2's main lesson: national transposition diluted the "single" rulebook into 27 versions, so the behavioural layer — SCA, open banking, refunds, transparency — moves into a regulation applied as written. - Filing under PSD2 now versus waiting for PSD3 is a question of launch horizon. - The package's third element is FIDA, the regulation on access to financial data beyond payment accounts: investments, insurance, pensions, credit — with a new FISP licence for financial information service providers.