On 8 June 2026 the Malta Financial Services Authority wrote to the boards and chief executives of authorised payment and e-money institutions about PSD3. The letter is short, but it is specific: it names the areas the MFSA will look at, sets eight minimum expectations, and tells boards that re-authorisation within 27 months is required to keep providing services. This article turns the letter into a compliance plan. The EU-wide process is in our PSD3 re-authorisation guide.
Who the letter applies to
The letter applies to institutions authorised under PSD2 and the Second E-Money Directive. At 30 October 2026, the EBA Central Register listed 38 authorised EMIs and 40 payment institutions with a Maltese home licence, 57 of them passporting. All will become payment institutions under PSD3, with e-money issuance as a listed service where relevant.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
The MFSA expected publication in the Official Journal towards the end of 2026 and is working with the Central Bank of Malta on transposition. It reminded boards that the EBA must submit a regulatory technical standard on authorisation within 12 months of publication.
The eight expectations as evidence
| Expectation | Evidence to hold | Owner |
|---|---|---|
| Board awareness | Board minute recording a PSD3 briefing and discussion | Company secretary |
| Alignment from publication | Implementation plan targeting compliance on publication | CEO |
| EBA standard on authorisation | Tracking log of EBA consultations and final standards | Compliance |
| 27 month deadline | Timetable with internal deadlines well before month 27 | CEO |
| Key function holders prepared | Area plans from compliance, MLRO, risk and finance | Each key function holder |
| Documented gap analysis | Gap analysis with evidence and ratings | Compliance |
| Board-approved implementation plan | Approved plan, communicated to staff | Board |
| External support where applicable | Scope and outputs of any external review | Board |
The letter sets no calendar deadline for the gap analysis or plan, but asks for work to begin without undue delay. Expect the evidence above to be requested in supervisory meetings.
Focus area 1: safeguarding
- Safeguard funds still held at the end of the business day after receipt, including e-money.
- Apply the rule correctly to multi-intermediary flows, where the MFSA notes safeguarding applies, and to acquiring through international card schemes.
- Safeguard the amount that corresponds to each user's claim.
- Tell users how funds are protected, which insolvency law applies and where to claim.
- Identify, monitor and manage concentration risk from the outset; avoid holding all funds with one credit institution.
Our PSD3 safeguarding checklist sets out the controls, and our safeguarding team reviews Maltese arrangements.
Focus area 2: governance
- Confirm the organisational structure, risk procedures and internal controls are proportionate and documented.
- Align ICT governance with DORA Articles 6 and 7.
- Review administration and accounting procedures.
Focus area 3: security incidents
- Document procedures to monitor, handle and follow up security incidents and security-related complaints.
- Align incident classification and reporting with DORA Chapter III.
Focus area 4: business continuity
- Identify critical operations.
- Maintain ICT business continuity, response and recovery plans.
- Test and review them in line with DORA and record results.
Focus area 5: the winding-up plan
- Draft a proportionate plan covering return of safeguarded funds in a disorderly wind-down.
- For gaming and merchant clients, address settlements, reserves and chargebacks.
- Cover agents and distributors and how customers reached through them would be repaid.
Our winding-up plan guide covers what regulators expect.
Beyond the letter
The letter does not cover every part of the PSD3 file. A complete plan should also include capital and own funds, recalculated by service under PSD3 (see our own funds calculation guide); the service list and passports; AML controls aligned with the EU AML Regulation from 10 July 2027; and, for groups with crypto-asset activity, alignment of MiCA and PSD3 authorisations. A crypto-asset service provider applying for payment institution authorisation may reuse its MiCA information where it is still current.
Writing a gap analysis the MFSA will accept
The MFSA asked for a comprehensive, documented gap analysis. In practice that means three things. First, coverage: every PSD3 requirement that applies to the institution, not only the five focus areas, listed with its source. Second, evidence: for each requirement, the current policy, procedure or record that addresses it, referenced by document and date. Third, a rating and an action: compliant, partly compliant or not compliant, with the action, owner and date needed to close any gap. A gap analysis that lists requirements without testing the institution's arrangements will not meet the expectation.
Keep the analysis as a living document. Update it when the EBA publishes standards, when Malta's transposing law is published and when actions close. Report progress to the board at each meeting, so the minutes show oversight over time rather than a single approval.
Briefing key function holders
The letter expects key function holders to understand PSD3 for their areas and take preparatory measures. A short written note for each role works well: what changes, what evidence the role must produce, and by when. The compliance officer owns the gap analysis and EBA tracking. The MLRO owns AML controls and alignment with the EU AML Regulation. The risk officer owns the winding-up plan scenarios and triggers. The finance lead owns capital and safeguarding reconciliation. Each note should be acknowledged and its actions added to the implementation plan.
Common gaps to look for
Several areas tend to surface in PSD3 gap analyses. Safeguarding procedures written for five day e-money timing; a single safeguarding bank; user terms that do not say which insolvency law applies; wind-down plans that assume a sale; DORA documents prepared separately from the governance framework; agents or distributors not fully reflected in internal control; and capital calculations that use out-of-date figures. Check each one early, because the fixes involve banks, systems or shareholders and take time.
A 90 day plan
- Days 1 to 30: board briefing and minute; appoint a PSD3 owner; start the EBA tracking log.
- Days 31 to 60: documented gap analysis across the five focus areas plus capital, services and AML.
- Days 61 to 90: board approval of the implementation plan with dates, budget and reporting; communicate to staff.
Our compliance support team runs this plan for Maltese institutions. See also our Malta EMI licence guide and our Malta payment institutions page.