For most of the past decade, European payment firms have built their businesses around PSD2 and the second E-Money Directive. That framework is set to be replaced. The EU institutions reached a provisional political agreement on a third Payment Services Directive (PSD3) and a new Payment Services Regulation (PSR) in late November 2025, and the agreed texts were endorsed by member state representatives in April 2026. As of 23 October 2026, final adoption and publication remain pending. The details will matter for years, but the direction is already clear enough to plan around.
That matters as much for firms still deciding where to apply as for those already licensed. Anyone currently comparing EU jurisdictions for an e-money licence is effectively choosing a home supervisor for the PSD3 era, not just for the next twelve months. Here is what changes, and what sensible firms are doing about it now.
Two instruments, two timelines
The package splits the rules in two. The PSR is a regulation, so it applies directly across the EU without national transposition. It carries most of the conduct rules: fraud liability, payee verification, transparency and open banking access. PSD3 is a directive and covers licensing and supervision, which member states must write into national law.
The agreed texts provide for most provisions to apply 21 months after entry into force, with certain payee-verification requirements following later. Exact calendar dates depend on formal adoption and publication in the Official Journal; 2028 remains indicative rather than a confirmed start date, and some obligations may apply later. Twenty-one months sounds generous. For a firm that needs to update its authorisation documentation, rebuild fraud controls and renegotiate banking arrangements, it is not.
E-money institutions fold into the payment institution regime
The most visible structural change is the end of the separate e-money framework. The package repeals the second E-Money Directive and brings e-money institutions into the payment institution regime as a sub-category, while keeping specific rules on issuing and redeeming e-money.
For existing EMIs this is less dramatic than it sounds. The business model does not disappear. But licensing, governance and outsourcing expectations converge with those of payment institutions, and firms will need to show their national regulator that they meet the new standards within the transition window. The agreed text provides transitional compliance assessments for existing payment and e-money institutions, including automatic authorisation where supervisors already have evidence of compliance. This does not mean every firm must make a full new licence application. Firms should nevertheless prepare the information their supervisor needs to assess compliance.
Fraud liability moves towards the provider
The PSR would extend providers' liability for certain fraud losses. Its headline provisions cover impersonation fraud, where a fraudster poses as the consumer's payment provider and persuades them to authorise a transfer. Refund protection would apply under specified conditions, including reporting the fraud to the police and informing the provider, and would be subject to the applicable exclusions. Providers that fail to implement required fraud-prevention measures would also face liability under the relevant provisions.
The name-and-IBAN check that the Instant Payments Regulation introduced for euro credit transfers is also extended more broadly under the PSR. Providers would have to perform payee-verification checks and inform customers of discrepancies in accordance with the applicable rules. In parallel, very large online platforms and search engines would need to check that financial-services advertisers are authorised, officially exempt or acting on behalf of an eligible provider, which is a modest but useful step against investment and payment scams.
For smaller payment firms, the practical consequence is potentially greater fraud reimbursement exposure. Fraud monitoring and liability already exist under PSD2; the new provisions would expand responsibilities in defined circumstances. Boards should assess the implications for pricing, customer onboarding and transaction monitoring budgets.
Safeguarding gets more prescriptive
Client-fund protection has been a recurring weak spot in European payment supervision, and the new texts tighten it. Expect clearer rules on how funds are segregated, which accounts are acceptable for safeguarding, how insurance or guarantee alternatives work, and how firms manage concentration risk with the banks that hold their customers' money. Wind-down planning also features more prominently.
Firms that currently rely on a single safeguarding bank should start reviewing concentration risk and the case for diversification now. The agreed text requires firms using segregation to avoid concentration risk where appropriate and endeavour not to hold all safeguarded funds with one credit institution, with further standards to reflect proportionality. This should not be read as an unconditional requirement for every firm to open a second account. Where diversification is appropriate, planning early gives firms more time to establish suitable arrangements.
Bank account access and open banking
Access to bank accounts has been a long-running complaint from non-bank payment firms, many of which have struggled to open or keep the accounts they need. The new framework strengthens their position by requiring credit institutions to justify refusals more clearly, though it does not guarantee any individual firm an account.
On open banking, account-holding providers must offer reliable data-access interfaces, remove obstacles to third-party access and give users a dashboard to manage the permissions they have granted. Broader open finance rules sit in a separate proposal that is still under negotiation.
What to do in the next twelve months
Run a gap analysis against the agreed texts. Final wording may shift slightly, but the structure is settled.
Plan the authorisation compliance assessment early. Programme of operations, governance, outsourcing and ICT arrangements should be ready for the applicable national process, taking account of any simplified or automatic authorisation route.
Model fraud liability. Estimate refund exposure under the impersonation rules using your own historical fraud data.
Review safeguarding. Check concentration, account terms and wind-down planning.
Align with DORA. Many governance and outsourcing expectations overlap with operational resilience rules already in force since 17 January 2025.
For firms not yet licensed, the decision is simpler but no less important. A licence obtained now will need to be carried across into the new regime, so the quality of the original application, and the relationship with the home regulator, will matter more than the speed of the first approval.
PSD3 and the PSR are not a revolution. They are a correction of the parts of PSD2 that did not work well enough, particularly fraud, safeguarding and access to banking. Firms that use the transition period to fix those weaknesses on their own terms will find the new regime easier to live with than those who wait for the regulator to point them out. The work is not glamorous, but it is the kind that supervisors notice, and it tends to pay for itself the first time a regulator or a partner bank asks difficult questions.