Payment institutions (établissements de paiement) and e-money institutions (établissements de monnaie électronique) authorised by the ACPR will have to evidence PSD3 compliance within 27 months of entry into force. The ACPR has not yet described its process, but at its market meeting for these institutions in November 2025 it set out detailed expectations on safeguarding, governance, outsourcing, agents and DORA. This checklist builds on them. The EU-wide process is in our PSD3 re-authorisation guide.
The French market
At 30 October 2026 the EBA Central Register listed 83 authorised payment institutions, 24 EMIs and 10 registered account information firms with a French home licence or registration, 69 of them passporting.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
France will transpose PSD3 by amending the Monetary and Financial Code. The PSR applies directly.
Checklist 1: safeguarding, with the ACPR authorisation step
The ACPR requires prior authorisation for changes to the safeguarding arrangement, other than guarantee adjustments driven by volume, and has two months from a complete file to respond. Plan PSD3 changes so the filing is made well before the transition ends.
| ACPR expectation | PSD3 change | Action |
|---|---|---|
| Next business day for payment services | Same | Confirm cut-offs and evidence |
| E-money within five business days, or next day for cash and EMIs also providing payment services | Next business day for all funds | Redesign e-money flows and file the change |
| Seven day safeguarding for instant transfers | Instant transfers around the clock | Confirm weekend and holiday processes |
| No set-off, no pledges, no fees on segregated accounts | Funds insulated in insolvency | Review bank account agreements |
| Segregation exact to the euro | Amount equal to users' claims | Daily reconciliation with breaks resolved |
- Assess concentration and add a second safeguarding bank where needed.
- Prepare user information on the method and insolvency law.
Our PSD3 safeguarding checklist has the full control set, and our safeguarding team supports French institutions.
Checklist 2: governance
- Confirm at least two effective managers.
- Separate the chair of the supervisory body from the chief executive, or document the derogation.
- Involve control functions in the supervisory body and consider an independent member, as the ACPR recommends.
- Formalise information flows to the supervisory body.
- For group subsidiaries, show local decision-making capacity.
Checklist 3: outsourcing
- Confirm the ACPR was told before each operational function was outsourced.
- Keep a complete register of providers.
- Ensure contracts allow ACPR on-site access.
- Fix formalisation and monitoring weaknesses the ACPR has highlighted.
Checklist 4: agents and distributors
- Define each agent's and distributor's status clearly.
- Integrate them into internal control: selection, training, monitoring and audit.
- Confirm registrations and passport notifications.
- Cover them in the winding-up plan.
Checklist 5: DORA and the internal control report
- File and maintain the DORA register of information.
- Meet incident notification deadlines and record classification decisions.
- Use the 2026 internal control report template as the base for the PSD3 gap analysis.
Checklist 6: payment security and fraud
- Prepare for the Banque de France's review of payment security.
- Implement PSR verification of payee, fraud data sharing and impersonation fraud refunds.
Checklist 7: capital and the winding-up plan
- Recalculate capital by service under PSD3; see our own funds calculation guide.
- Draft a winding-up plan covering return of safeguarded funds and customers served through agents; see our winding-up plan guide.
Timing the safeguarding authorisation
Because the ACPR must authorise changes to safeguarding arrangements and has two months from a complete file, work backwards from the end of the PSD3 transition. Allow time to design the new arrangement, open and document any new bank account, file a complete request, answer questions and implement the change. For an EMI moving e-money to next business day timing, the operational change may also need system work on cut-offs and transfers. Filing early has a further benefit: it shows the ACPR that the institution is acting on PSD3 rather than waiting.
Remitters and agent networks
French money remitters often rely on large agent networks. Under PSD3, the institution remains fully responsible for its agents, and the ACPR has already said agent status and integration into internal control are often weak. For each agent, hold the registration, the fit and proper check, the contract, training records, monitoring results and audit findings. Show how cash collected by agents reaches safeguarded accounts and by when. In the winding-up plan, explain how customers who deal only through agents would be told what to do and repaid.
Account information and payment initiation providers
France's 10 registered account information firms and its payment initiation providers face direct changes under the PSR, including dedicated interfaces, limits on obstacles to access and a user permission dashboard. Account information providers keep professional indemnity insurance instead of capital, and payment initiation carries EUR 50,000 of initial capital. Check insurance cover against new liabilities and plan for interface changes at the banks you connect to.
What a good French gap analysis looks like
A good gap analysis lists every PSD3 requirement that applies, the current arrangement with a document reference, a rating and an action with owner and date. It should cover the ACPR's stated expectations as well as the directive, since the ACPR will read the file through both.
Questions for the board
A French supervisory board should be able to answer: when will we file the change to our safeguarding arrangement with the ACPR; do we meet the ACPR's expectations on effective managers and board composition; are outsourcing and agent oversight formalised to the ACPR's standard; what is our PSD3 capital requirement over three years; and who owns the file and timetable. The answers can be recorded in the next internal control report.
Using the internal control report
The annual internal control report already covers governance, internal control, outsourcing, AML and safeguarding. Add a PSD3 section to the next report summarising the gap analysis and plan. It gives the ACPR early sight of the work and creates a record the PSD3 file can rely on. Our compliance support team prepares PSD3 gap analyses for French institutions. See also our France payment institutions and France EMI pages.