Irish payment and e-money firms will need to evidence PSD3 compliance to the Central Bank of Ireland within 27 months of entry into force. The Central Bank has not yet published its process, but its Regulatory and Supervisory Outlook for 2026 tells firms where it is looking, and almost every point maps to a section of the PSD3 file. This checklist organises the work around those priorities. The EU-wide process is in our PSD3 re-authorisation guide.
The Irish context
At 30 October 2026 the EBA Central Register listed 29 authorised EMIs, 26 payment institutions and 6 registered account information firms with an Irish home licence. 58 of these firms passport into other member states, many as the EU hub of an international group.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
Ireland is expected to transpose PSD3 by regulations replacing the European Union (Payment Services) Regulations 2018 and the European Communities (Electronic Money) Regulations 2011. When PSD2 arrived, the Central Bank sent existing firms amended application forms and gave itself until 13 July 2018, six months after the 13 January 2018 transposition date, to decide. A file that is ready before the forms arrive is the best protection against a short window.
The central bank's priorities and the PSD3 file
| Central Bank 2026 priority | PSD3 file section | Owner |
|---|---|---|
| Safeguarding, with no tolerance for shortcomings | Safeguarding description | Head of Safeguarding |
| Wind-down plans lacking clear triggers | Winding-up plan | CRO or CFO |
| AML risk assessments and fraud controls | Internal AML controls; PSR fraud rules | MLRO |
| Outages, DORA registers and incident reporting | Governance, ICT, incidents, continuity | CTO and CRO |
| Board composition, distributors and agents | Governance; agents and distributors | Company secretary and compliance |
Checklist 1: safeguarding
- Confirm the Head of Safeguarding has a documented mandate covering PSD3 changes.
- Close every finding from the latest safeguarding audit and record the evidence.
- Move e-money safeguarding to the end of the business day after receipt.
- Assess concentration: if all funds sit with one bank, open a second account and set limits.
- Draft user information on the safeguarding method and Irish insolvency position.
- Prepare the advance notification process for material changes to the arrangement.
Detailed controls are in our PSD3 safeguarding checklist, and our safeguarding team supports Irish firms with reviews and audits.
Checklist 2: wind-down and winding-up plan
The Central Bank found many wind-down plans poorly integrated with risk management and lacking clear triggers, and planned a thematic review of financial resilience.
- Link triggers to the risk appetite statement and to measurable indicators such as capital headroom, liquidity and loss of a key bank.
- Model severe scenarios, including the collapse of the parent group and loss of shared services.
- Map group dependencies and document how each continues during a wind-down.
- Show step by step how customers are repaid from safeguarded funds and how long it takes.
- Cost the plan and fund it from own resources.
Our winding-up plan guide sets out regulator expectations across the EU.
Checklist 3: AML and fraud
- Refresh the business risk assessment in light of the Central Bank's concerns about risk assessment quality.
- Prepare for the enhanced Risk Evaluation Questionnaire and AML inspections.
- Implement PSR verification of payee, fraud data sharing and impersonation fraud refunds.
- Review treatment of fraud victims against the Central Bank's planned cross-sectoral review.
- Align with the EU AML Regulation from 10 July 2027; see our EU AML Regulation readiness plan.
Checklist 4: operational resilience and DORA
- Keep the DORA register of information complete and current.
- Test major incident classification and reporting timelines.
- Act on the Central Bank's IT outsourcing thematic feedback.
- Test business continuity and ICT recovery plans and document results.
Checklist 5: governance, agents and distributors
- Review board composition and the balance of skills and independence.
- Document how the Irish board oversees group policies, systems and outsourced functions.
- List every agent and distributor, confirm registration and monitoring, and include them in the winding-up plan.
- Check activities still outside the perimeter, since the agreed texts tighten the commercial agent exclusion.
Checklist 6: services, capital and passports
- Map each activity to the PSD3 service list, including e-money issuance.
- Recalculate initial capital: EUR 150,000 for core payment services and EUR 250,000 for e-money, added together where both apply.
- Recalculate ongoing own funds and project three years ahead; see our own funds calculation guide.
- Align passport notifications with the PSD3 service list.
Lessons from 2018
The Central Bank's PSD2 process suggests a few lessons. Its amended forms reflected that firms were already authorised but otherwise resembled a new application, so firms whose business had changed since authorisation had more to rebuild. The decision had to be made within six months of transposition, so the time between receiving the forms and the decision was short. And any assessment of an existing firm naturally draws on what the supervisor already knows, including open findings. For PSD3 the practical lesson is simple: keep a living authorisation file, close findings early, and treat the PSD3 gap analysis as the start of the file rather than a separate document.
Evidence index for an Irish file
| File section | Core documents |
|---|---|
| Programme of operations | Service list mapped to PSD3, passport list, agents and distributors |
| Business plan | Three-year projection, capital plan, board approval |
| Safeguarding | Account letters, procedures, reconciliations, latest audit and closure evidence |
| Governance | Board composition, terms of reference, PCF holders, group oversight |
| AML | Business risk assessment, policies, monitoring, inspection actions |
| ICT and continuity | DORA register, incident procedure, continuity and recovery tests |
| Winding-up plan | Triggers, scenarios, dependencies, repayment process, costs |
Questions for the board
An Irish board should be able to answer, at short notice: which PSD3 services will we list and do they match the business; is every safeguarding audit finding closed; what are the triggers in our wind-down plan and when were they tested; which group services are critical and how would they continue in a wind-down; and who owns the PSD3 file, with what deadline. Recording the answers in a board paper creates useful evidence for the file and for supervisory meetings. Where an answer is unclear, the gap analysis should assign an owner and a date.
Putting the file together
The file should be assembled as if the Central Bank's forms arrived next month: programme of operations, three-year business plan, capital, safeguarding, governance and internal controls, incident and continuity arrangements, AML controls, and the winding-up plan. Our compliance support team prepares PSD3 files for Irish firms. See also our Ireland EMI licence and Ireland payment institution licence guides.