Every payment institution and electronic money institution (EMI) authorised in the EU must show its national regulator that it meets the third Payment Services Directive (PSD3) to keep its authorisation. It is not a new application from a blank page, but it is a full review of the authorisation file against the new rules, completed within a transition of up to 27 months after PSD3 enters into force. The Council adopted its first reading position on 29 October 2026, so the content of the rules is settled; the clock starts when the text is published in the Official Journal.
This article looks at re-authorisation from the compliance side: what the regulator will read, where existing files usually fall short of the new standard, and how to plan the work so the file is ready well before the deadline. Our guide to the EMI changes under PSD3 covers the e-money side in detail.
Where the legislation stands
The European Parliament and the Council reached a provisional agreement on the payments package on 27 November 2025, and the final compromise texts were published on 23 April 2026. On 29 October 2026 the Council published statements confirming that it had adopted PSD3 and the Payment Services Regulation (PSR) at first reading. The next step is approval by Parliament in plenary, then signature and publication.
| Milestone | Date |
|---|---|
| Provisional political agreement | 27 November 2025 |
| Final compromise texts published | 23 April 2026 |
| Council adopts first reading position | 29 October 2026 |
| Parliament plenary approval | Expected next |
| Entry into force | 20 days after publication in the Official Journal |
| PSD3 applies, PSR applies, PSD2 and EMD2 repealed | 21 months after entry into force |
| End of transition for existing institutions | 27 months after entry into force |
PSD3 is a directive, so each member state transposes it into national law within the 21 months. The PSR is a regulation and applies directly. A firm's re-authorisation therefore runs under its home state's implementing law and its regulator's process, within a common EU framework.
Who is in scope
Every institution authorised under national laws implementing PSD2 or the Second E-Money Directive (EMD2) is in scope, in every EU and EEA member state. That covers authorised payment institutions, EMIs, payment initiation and account information providers, and institutions operating under national waivers, for which the agreed texts provide a longer transition.
UK firms are affected only through their EU subsidiaries. A UK group with an EMI in Ireland, Lithuania or the Netherlands needs that subsidiary to complete the process. The UK is reforming its own payments rules separately; HM Treasury's consultation on modernising payment services regulation closed on 6 October 2026 and does not propose re-authorising existing UK firms. Our pages on the Ireland EMI licence and the Lithuania payment institution licence set out how those regulators assess files today.
What the regulator will review
Re-authorisation uses the authorisation contents in Article 3 of PSD3. For an established firm the regulator is not asking whether the business model is viable in theory; it is asking whether the institution, as it operates today, meets each requirement and can evidence it.
| Area | What the regulator will look for |
|---|---|
| Programme of operations | Every service actually provided, mapped to the PSD3 Annex I list |
| Business plan | Current forecasts that reconcile to audited accounts |
| Capital and own funds | The Article 5 minimum and the ongoing own funds calculation, documented |
| Safeguarding | Method, timing, banks used, reconciliations and audit findings |
| Governance and internal control | Board oversight, three lines of defence, outsourcing, agents and distributors |
| ICT and security | Compliance with DORA, the EU Digital Operational Resilience Act |
| Winding-up plan | A plan adapted to size and business model, new under Article 3(3)(r) |
| People | Fitness and propriety of directors, managers and qualifying shareholders |
A regulator may treat an institution as authorised without a full submission where it already holds clear evidence of compliance. It is a discretion, not a right, and no compliance team should plan on it.
The compliance gaps to close first
Re-authorisation will expose the distance between the file the firm was licensed on and the firm it is now. Five gaps appear most often when established institutions are reviewed against a new standard.
The service list. Firms add products after authorisation: a card programme, merchant acquiring, a remittance corridor. Under PSD3 each Annex I service must be in the authorisation, and a service missing from the file will not be permitted after the transition.
Safeguarding. PSD3 requires funds still held at the end of the business day after receipt to be safeguarded, against up to five business days for e-money under EMD2. Institutions must try not to hold all customer funds with one credit institution and must notify material changes in advance. Reconciliation records and the last safeguarding audit will be read closely.
The winding-up plan. Few institutions licensed before 2024 hold one in the form PSD3 requires: how customers are repaid and how critical activities carried out by outsourced providers, agents or distributors continue during an orderly exit.
Outsourcing and agents. Governance sections written at authorisation rarely describe today's outsourcing chain. The regulator will expect a current register, oversight evidence and exit plans for critical providers, consistent with DORA.
Capital documentation. Most institutions hold well above the minimum, but the calculation must be redone under the new Article 5 levels, which are added together where the institution provides services in more than one band.
New capital levels
| Service | PSD2 or EMD2 | PSD3 |
|---|---|---|
| Money remittance only | EUR 20,000 | EUR 40,000 |
| Payment initiation | EUR 50,000 | EUR 50,000 |
| Core payment services (cash, transfers, cards, acquiring) | EUR 125,000 | EUR 150,000 |
| Issuing e-money | EUR 350,000 | EUR 250,000 |
An institution offering the core payment services and e-money holds EUR 400,000. Ongoing own funds for e-money remain at least 2% of average outstanding e-money.
A two year plan
The practical filing window is 2027 and 2028. The EBA's technical standards on authorisation are due about 12 months after entry into force, and regulators will publish national notices on format and timing. The plan below assumes entry into force in early 2027.
| Quarter | Work |
|---|---|
| Q4 2026 to Q1 2027 | Map services to Annex I; recalculate capital; appoint a director to own the project |
| Q2 2027 | Gap analysis of the existing file against Article 3; safeguarding review |
| Q3 2027 | Draft the winding-up plan; update the outsourcing register and DORA evidence |
| Q4 2027 | Refresh governance documents and fitness and propriety information |
| Q1 2028 | Align with the EBA standards and the regulator's national notice |
| Q2 to Q3 2028 | Board approval and submission, leaving time for regulator questions |
Firms with a safeguarding audit, a compliance monitoring review or a DORA assessment already scheduled in 2027 should scope them to cover the PSD3 requirements, so the evidence serves both purposes. Our compliance support team runs re-authorisation as a fixed-scope project alongside the firm's compliance lead.
How the process will differ by member state
The framework is common, but each regulator will run its own process, and the national implementing law decides details such as the format of the submission, whether it is staged, and how the regulator confirms the outcome. Four points are worth watching in the main EU licensing hubs.
Ireland. The Central Bank of Ireland supervises a large number of payment and e-money institutions, many owned by UK and US groups. It already expects detailed safeguarding audits and has a strong focus on governance and outsourcing, so firms there should expect close review of those sections.
Lithuania. The Bank of Lithuania licenses one of the largest populations of EMIs and payment institutions in the EU, and has tightened supervision of anti-money laundering and safeguarding in recent years. A large number of files will reach it within the same window, which argues for filing early.
The Netherlands and Malta. De Nederlandsche Bank and the Malta Financial Services Authority supervise fewer institutions but have established expectations on business models and controls. Groups with institutions in several member states should plan one programme with a local workstream for each regulator rather than separate projects.
In every case, the regulator's national notice, once published, is the document that sets the timetable. Our page on the Malta EMI licence and our comparison of Lithuania and Ireland payment institution licences set out how those regulators approach files today.
Agents, distributors and passporting
Institutions that operate through agents or distributors, or that passport services into other member states, have more to evidence. The regulator will want to see the current list of agents and distributors, how they are selected and monitored, and how the institution keeps oversight of activity in host states. Passporting notifications made under PSD2 continue under the new framework, but the services they cover must match the services in the new authorisation. A passport for a service the institution no longer lists will lapse with it.
Firms should also check their branch and agent registrations on the home and host state registers against their internal records. Differences are common, and they are much easier to fix before the file is submitted than in response to a regulator's question.
Who should own the project
Re-authorisation touches finance, operations, technology, legal and compliance, and it ends with a board approval. The most reliable model is a named director as sponsor, the head of compliance as project lead, and a working group that meets fortnightly with a single tracker of requirements and evidence. External support is most useful for the gap analysis, the winding-up plan and a pre-submission review of the full file.
If the deadline is missed
If the institution has not shown compliance by the end of the transition, its payment services can be suspended until the regulator has received and verified the outstanding information, and the regulator can withdraw the authorisation. Banking partners and card schemes monitor the public registers, so a suspension has commercial consequences well before any formal withdrawal.
For groups considering buying or selling an EU institution, re-authorisation status becomes a key point of due diligence. A buyer will want to know whether the target's file has been submitted and accepted, and the regulator's approval of the new owner runs alongside it. Our guide to change of control at FCA-regulated firms covers the UK equivalent of that process.